Function at 0x140040a00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rax - 0x88], xmm14
movaps xmmword [rax - 0x98], xmm15
mov rax, qword [0x14006d040]
xor rax, rsp
mov qword [rbp - 0x18], rax
xor esi, esi
mov dword [rsp + 0x30], esi
mov rbx, qword [0x14006e100]
test rbx, rbx
je 0x1400411f7
cmp byte [0x14006e0ee], sil
je 0x140040aa6
lea rcx, [rbx + 0x2e0]
call fcn.14004bc00
movaps xmm6, xmm0
lea rcx, [rbx + 0x2e8]
call fcn.14004bc00
addss xmm0, dword [0x140061aa4]
comiss xmm0, xmm6
jb 0x1400411f7
mov r8d, dword [0x14006d150]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14003c190
movups xmm14, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x60], xmm14
movsd xmm15, qword [rsp + 0x50]
movsd qword [rsp + 0x70], xmm15
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.14003bd60
mov eax, dword [0x14006e198]
cdq
sub eax, edx
sar eax, 1
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mov eax, dword [0x14006e164]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd xmm12, qword [rsp + 0x30]
subsd xmm0, xmm12
movsd xmm1, qword [0x140061b28]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm9, xmm0
movsd xmm8, qword [rsp + 0x38]
subsd xmm7, xmm8
movsd xmm1, qword [0x140061b28]
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm9, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm9
ja 0x140040b5b
xorps xmm0, xmm0
sqrtsd xmm0, xmm9
jmp 0x140040b64
movaps xmm0, xmm9
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
movss xmm1, dword [0x14006d148]
cvtps2pd xmm1, xmm1
xorps xmm11, xmm11
comisd xmm0, xmm1
ja 0x140040b8b
ucomisd xmm12, xmm11
jp 0x140040b82
je 0x140040b8b
ucomisd xmm8, xmm11
jp 0x140040b9c
jne 0x140040b9c
mov dword [0x14006e120], 0x7f7fffff
mov qword [0x14006e100], rsi
xorps xmm10, xmm10
xorps xmm9, xmm9
cmp byte [0x14006e0e1], sil
je 0x140040f9c
lea rcx, [rbp - 0x40]
call fcn.14003c300
nop
mov ebx, 1
mov dword [rsp + 0x30], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x140040bce
mov rax, qword [rax]
lea rcx, str.Hunting_Rifle
cmp rax, rcx
je 0x140040c83
lea rcx, [rbp - 0x60]
call fcn.14003c300
nop
mov ebx, 3
mov dword [rsp + 0x30], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x140040bfb
mov rax, qword [rax]
lea rcx, str.Reaper_Sniper_Rifle
cmp rax, rcx
je 0x140040c83
lea rcx, [rbp - 0x80]
call fcn.14003c300
nop
mov ebx, 7
mov dword [rsp + 0x30], ebx
cmp qword [rax + 0x18], 0xf
jbe 0x140040c24
mov rax, qword [rax]
lea rcx, str.Heavy_Sniper_Rifle
cmp rax, rcx
je 0x140040c83
lea rcx, [rsp + 0x40]
call fcn.14003c300
nop
mov ebx, 0xf
mov dword [rsp + 0x30], ebx
cmp qword [rax + 0x18], rbx
jbe 0x140040c4d
mov rax, qword [rax]
lea rcx, str.Heavy_Impact_Sniper_Rifle
cmp rax, rcx
je 0x140040c83
lea rcx, [rsp + 0x60]
call fcn.14003c300
mov ebx, 0x1f
cmp qword [rax + 0x18], 0xf
jbe 0x140040c72
mov rax, qword [rax]
lea rcx, str.Bolt_Action_Sniper_Rifle
cmp rax, rcx
je 0x140040c83
xor dil, dil
jmp 0x140040c86
mov dil, 1
movdqa xmm6, xmmword [0x140061cb0]
test bl, 0x10
je 0x140040ce1
and ebx, 0xffffffef
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140040cd6
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040cd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040cd1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400560bc
movdqu xmmword [rsp + 0x70], xmm6
mov byte [rsp + 0x60], 0
test bl, 8
je 0x140040d3c
and ebx, 0xfffffff7
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140040d31
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040d24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040d24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400560bc
movdqa xmm6, xmmword [0x140061cb0]
movdqu xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x40], 0
test bl, 4
je 0x140040d93
and ebx, 0xfffffffb
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140040d8a
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040d7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040d7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400560bc
movdqa xmm6, xmmword [0x140061cb0]
movdqu xmmword [rbp - 0x70], xmm6
mov byte [rbp - 0x80], 0
test bl, 2
je 0x140040dea
and ebx, 0xfffffffd
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140040de1
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040dd4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040dd4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400560bc
movdqa xmm6, xmmword [0x140061cb0]
movdqu xmmword [rbp - 0x50], xmm6
mov byte [rbp - 0x60], 0
test bl, 1
je 0x140040e2d
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140040e2d
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040e28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040e28
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400560bc
test dil, dil
je 0x140040f9c
movss xmm8, dword [0x140061c28]
andps xmm8, xmmword [0x1400621a0]
movaps xmm12, xmm14
unpckhpd xmm12, xmm14
movaps xmm0, xmm12
subsd xmm0, qword [0x14006d1b8]
cvtsd2ss xmm0, xmm0
movss xmm6, dword [0x140061b20]
movaps xmm1, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
movaps xmm7, xmm0
movaps xmm0, xmm14
subsd xmm0, qword [0x14006d1b0]
cvtsd2ss xmm0, xmm0
movaps xmm1, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm7, xmm0
movaps xmm2, xmm15
subsd xmm2, qword [0x14006d1c0]
cvtpd2ps xmm0, xmm2
movaps xmm1, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm7, xmm0
xorps xmm1, xmm1
ucomiss xmm1, xmm7
ja 0x140040ebc
xorps xmm0, xmm0
sqrtss xmm0, xmm7
jmp 0x140040ec4
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
cvtss2sd xmm0, xmm0
divsd xmm0, qword [0x140061b80]
xorps xmm3, xmm3
cvtsd2ss xmm3, xmm0
divss xmm3, xmm8
cvtps2pd xmm4, xmm3
movaps xmm8, xmm4
mulsd xmm8, qword [0x14006d160]
movsd xmm2, qword [0x140061b88]
mulsd xmm8, xmm2
addsd xmm8, xmm14
movaps xmm7, xmm4
mulsd xmm7, qword [0x14006d168]
mulsd xmm7, xmm2
addsd xmm7, xmm12
movss xmm1, dword [0x140061c50]
andps xmm1, xmmword [0x1400621a0]
mulss xmm1, dword [0x140061acc]
mulss xmm3, dword [0x140061be0]
mulss xmm1, xmm3
cvtps2pd xmm6, xmm1
mulsd xmm4, qword [0x14006d170]
mulsd xmm4, xmm2
addsd xmm4, xmm15
addsd xmm6, xmm4
movsd qword [rsp + 0x40], xmm8
movsd qword [rsp + 0x48], xmm7
movsd qword [rsp + 0x50], xmm6
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14003bd60
movsd xmm12, qword [rax]
movsd qword [rsp + 0x40], xmm8
movsd qword [rsp + 0x48], xmm7
movsd qword [rsp + 0x50], xmm6
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14003bd60
movsd xmm8, qword [rax + 8]
movss xmm3, dword [0x14006d140]
movsd xmm4, qword [0x1400621c0]
ucomisd xmm12, xmm11
jp 0x140040fb5
je 0x140041026
mov eax, dword [0x14006e158]
movd xmm2, eax
cvtdq2pd xmm2, xmm2
comisd xmm12, xmm2
jbe 0x140040ffb
movaps xmm10, xmm2
subsd xmm10, xmm12
xorps xmm10, xmm4
cvtps2pd xmm0, xmm3
divsd xmm10, xmm0
movaps xmm1, xmm10
addsd xmm1, xmm2
add eax, eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x140040ffb
xorps xmm10, xmm10
comisd xmm2, xmm12
jbe 0x140041026
movaps xmm10, xmm12
subsd xmm10, xmm2
cvtps2pd xmm0, xmm3
divsd xmm10, xmm0
movaps xmm0, xmm10
addsd xmm0, xmm2
comisd xmm11, xmm0
jbe 0x140041026
xorps xmm10, xmm10
ucomisd xmm8, xmm11
jp 0x14004102f
je 0x1400410a0
mov eax, dword [0x14006e178]
movd xmm2, eax
cvtdq2pd xmm2, xmm2
comisd xmm8, xmm2
jbe 0x140041075
movaps xmm9, xmm2
subsd xmm9, xmm8
xorps xmm9, xmm4
cvtps2pd xmm0, xmm3
divsd xmm9, xmm0
movaps xmm1, xmm9
addsd xmm1, xmm2
add eax, eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x140041075
xorps xmm9, xmm9
comisd xmm2, xmm8
jbe 0x1400410a0
movaps xmm9, xmm8
subsd xmm9, xmm2
cvtps2pd xmm0, xmm3
divsd xmm9, xmm0
movaps xmm0, xmm9
addsd xmm0, xmm2
comisd xmm11, xmm0
jbe 0x1400410a0
xorps xmm9, xmm9
cmp byte [0x14006e0de], 0
je 0x140041156
cmp byte [0x14006df79], 0
je 0x1400410d1
lea rcx, [rsp + 0x30]
call fcn.140038300
mov rcx, qword [rax]
mov qword [0x14006dfa8], rcx
mov byte [0x14006df79], 0
lea rcx, [rsp + 0x30]
call fcn.140038300
mov rcx, qword [rax]
mov qword [0x14006dfb8], rcx
sub rcx, qword [0x14006dfa8]
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x14006e040], edx
movd xmm0, edx
cvtdq2ps xmm0, xmm0
comiss xmm0, dword [0x140061bc4]
jb 0x140041156
mov qword [rsp + 0x20], rsi
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, r9d
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], rsi
mov r9d, 4
xor r8d, r8d
xor edx, edx
mov ecx, r9d
call qword [sym.imp.USER32.dll_mouse_event]
mov byte [0x14006df79], 1
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x24], rsi
mov dword [rbp - 0x1c], esi
mov dword [rbp - 0x30], esi
mov qword [rbp - 0x2c], 0x4001
cvttsd2si eax, xmm10
mov dword [rbp - 0x38], eax
cvttsd2si eax, xmm9
mov dword [rbp - 0x34], eax
mov edx, 0x1000
xor ecx, ecx
mov r9d, 0x40
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x1400411f7
movups xmm0, xmmword [0x14006e090]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x14006e0a0]
movsd qword [rax + 0x10], xmm1
mov edx, dword [0x14006e0a8]
mov dword [rax + 0x18], edx
movzx edx, word [0x14006e0ac]
mov word [rax + 0x1c], dx
mov r8d, 0x28
lea rdx, [rbp - 0x40]
mov ecx, 1
call rbx
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140055e50
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm14, xmmword [r11 - 0x80]
movaps xmm15, xmmword [r11 - 0x90]
mov rsp, r11
pop rbp
ret