Function at 0x14004f490
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x140159080]
xor rax, rsp
mov qword [rsp + 0x90], rax
call fcn.14005b430
movsxd rbx, eax
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1408b6318], rax
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14004b880
nop
mov r8d, 0xa
lea rdx, str.Game_Found
lea rcx, [0x1408b51b8]
call fcn.140059490
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rsp + 0x80]
sub rax, rcx
cmp rax, 6
jb 0x14004f72d
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 6
lea r9, str.PID_:
lea r8, [rsp + 0x70]
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14005aed0
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x14004f597
mov rcx, qword [0x1408b51b8]
inc rdx
cmp rdx, 0x1000
jb 0x14004f592
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004f700
mov rcx, r8
call fcn.1400bd5b8
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [0x1408b51b8], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [0x1408b51c8], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.Obtaining_base_addr...
lea rcx, [0x1408b51b8]
call fcn.140059490
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtSuspendProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x68]
mov edx, 0xe0c3b68
mov rcx, qword [0x1408b6318]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rsp + 0x68]
mov dword [0x1408b634c], eax
mov ecx, 8
call fcn.1400bd99c
mov rbx, rax
mov dword [rax], 0xe3a0005a
mov dword [rax + 4], 0xe12fff1e
mov rdi, qword [0x1408b6338]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov edx, 0x2ed6b6c
mov r9d, 0x40
lea r8d, [r9 - 0x3c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, 4
mov r8, rbx
mov edx, 0x2ed6b6c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, dword [rsp + 0x68]
test r9d, r9d
je 0x14004f6c2
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
mov edx, 0x2ed6b6c
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x14004f70c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f707
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f707
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400bd5b8
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400bd060
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
call fcn.14004a540
nop
int3