Function at 0x140011c30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov edi, r8d
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0xf0], rax
test r8d, r8d
jne 0x140011c66
mov edi, dword [rsi + 0x10]
test edi, edi
je 0x140011fc0
test r9b, r9b
jne 0x140011fcb
xor ebx, ebx
mov ebp, edi
add rbx, qword [rsi + 8]
mov rax, qword [rsi]
lea r14, [rsp + 0x88]
mov qword [r14 - 0x38], rax
mov qword [r14 - 0x30], rbx
mov qword [r14 - 0x28], rbp
xor ecx, ecx
mov qword [r14 - 0x20], rcx
mov qword [r14 - 0x10], rcx
mov qword [r14 - 8], 0x20
mov qword [r14 - 0x18], r14
mov byte [r14 + 0x20], 1
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x38], rcx
mov qword [r14 + 0x40], 2
lea rax, [rsp + 0xd0]
mov qword [rax - 0x18], rax
mov eax, dword [0x14005fd2c]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140011eef
mov edi, dword [0x14005fd28]
lea rax, [rbx + rbp]
dec rax
xor edx, edx
div rdi
mov rsi, rax
mov rax, rbx
xor edx, edx
div rdi
sub rsi, rax
inc rsi
je 0x140011d85
mov rbx, rax
imul rbx, rdi
xor r13d, r13d
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbx
mov rdx, rdi
mov r8d, 0x40
lea r9, [rsp + 0x20]
call r12
test eax, eax
je 0x14001205d
mov ebp, dword [rsp + 0x20]
mov rax, qword [rsp + 0xc0]
cmp rax, qword [rsp + 0xc8]
je 0x1400120db
mov rcx, qword [rsp + 0xb8]
shl rax, 4
mov dword [rcx + rax], ebp
mov qword [rcx + rax + 8], rbx
inc qword [rsp + 0xc0]
inc r13
add rbx, rdi
cmp r13, rsi
jne 0x140011d28
mov rax, qword [rsp + 0x50]
mov qword [r15], rax
mov rax, qword [rsp + 0x58]
mov qword [r15 + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [r15 + 0x10], rax
mov eax, dword [rsp + 0x68]
mov dword [r15 + 0x18], eax
mov eax, dword [rsp + 0x6c]
mov dword [r15 + 0x1c], eax
mov rax, qword [rsp + 0x78]
mov qword [r15 + 0x28], rax
mov rcx, qword [rsp + 0x80]
mov qword [r15 + 0x30], rcx
mov rcx, qword [rsp + 0x70]
cmp rcx, r14
jne 0x140012077
lea rcx, [r15 + 0x38]
mov qword [r15 + 0x20], rcx
test rax, rax
lea rdi, [rsp + 0xd0]
jg 0x140012102
mov al, byte [rsp + 0xa8]
mov byte [r15 + 0x58], al
mov rax, qword [rsp + 0xb0]
mov qword [r15 + 0x60], rax
mov rax, qword [rsp + 0xc0]
mov qword [r15 + 0x70], rax
mov rcx, qword [rsp + 0xc8]
mov qword [r15 + 0x78], rcx
mov rbx, qword [rsp + 0xb8]
cmp rbx, rdi
jne 0x1400120a2
lea rcx, [r15 + 0x80]
mov qword [r15 + 0x68], rcx
test rax, rax
jle 0x140011e6c
shl rax, 4
add rax, rbx
xor ecx, ecx
lea rdx, [rbx + rcx]
add rdx, 0x10
mov ebp, dword [rdx - 0x10]
mov dword [r15 + rcx + 0x80], ebp
mov rbp, qword [rdx - 8]
mov qword [r15 + rcx + 0x88], rbp
add rcx, 0x10
cmp rdx, rax
jb 0x140011e44
mov qword [rsp + 0xc0], 0
mov byte [rsp + 0xa8], 0
mov eax, dword [0x14005fd2c]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140011f30
mov qword [rsp + 0xc0], 0
cmp rbx, rdi
jne 0x1400120c2
mov rcx, qword [rsp + 0x70]
cmp rcx, r14
jne 0x1400120d0
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140027a90
mov rax, r15
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x14005fd2c]
call fcn.14002687c
cmp dword [0x14005fd2c], 0xffffffff
jne 0x140011cf2
lea rsi, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov dword [0x14005fd28], eax
lea rcx, [0x14005fd2c]
call fcn.14002681c
jmp 0x140011cf2
lea rcx, [0x14005fd2c]
call fcn.14002687c
cmp dword [0x14005fd2c], 0xffffffff
jne 0x140011f68
lea rsi, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov dword [0x14005fd28], eax
lea rcx, [0x14005fd2c]
call fcn.14002681c
mov rbx, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xc0]
test rbp, rbp
je 0x140011ea5
shl rbp, 4
add rbp, rbx
mov esi, dword [0x14005fd28]
lea r12, [rsp + 0x20]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rbx]
mov rcx, qword [rbx + 8]
mov rdx, rsi
mov r9, r12
call r13
add rbx, 0x10
cmp rbx, rbp
jne 0x140011f9a
mov rbx, qword [rsp + 0xb8]
jmp 0x140011ea5
int3
mov rcx, qword [rsi]
mov rbp, qword [rsi + 8]
movsx rbx, r9b
lea r14, [rbx + rbp]
inc rcx
call fcn.140020d40
mov ecx, eax
mov rax, rbp
xor edx, edx
div rcx
mov rbp, rax
mov rax, r14
xor edx, edx
div rcx
cmp rbp, rax
je 0x140011c79
mov rcx, r14
call fcn.14004f0d0
test al, al
jne 0x140011c79
mov rax, qword [rsi]
mov qword [r15], rax
xor ecx, ecx
mov qword [r15 + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [r15 + 8], xmm0
mov qword [r15 + 0x18], rcx
mov qword [r15 + 0x30], 0x20
lea rdx, [r15 + 0x38]
mov qword [r15 + 0x20], rdx
mov byte [r15 + 0x58], 0
mov qword [r15 + 0x60], rax
mov qword [r15 + 0x70], rcx
mov qword [r15 + 0x78], 2
lea rax, [r15 + 0x80]
mov qword [r15 + 0x68], rax
jmp 0x140011ec8
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0xb0]
call fcn.14004fa40
jmp 0x140011d85
mov qword [r15 + 0x20], rcx
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x80], 0x20
mov qword [rsp + 0x78], 0
lea rdi, [rsp + 0xd0]
jmp 0x140011deb
mov qword [r15 + 0x68], rbx
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc8], 2
mov rbx, rdi
jmp 0x140011e6c
mov rcx, rbx
call qword [sym.imp.mozglue.dll_free]
jmp 0x140011eba
call qword [sym.imp.mozglue.dll_free]
jmp 0x140011ec8
mov edx, 1
lea rcx, [rsp + 0xb8]
call fcn.140030dc0
test al, al
je 0x140012065
mov rax, qword [rsp + 0xc0]
jmp 0x140011d5e
lea rdx, [rsp + 0x50]
add rax, rdx
add rax, 0x38
lea r8, [rsp + 0x89]
cmp rax, r8
cmova r8, rax
sub r8, rdx
add r8, 0xffffffffffffffc8
mov rdx, r14
call sub.ntdll.dll_memcpy
jmp 0x140011deb