Function at 0x140020310
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov rdi, qword [rdx]
movzx eax, word [rdi]
cmp eax, 0x5a4d
jne 0x1400203ca
mov r14d, r8d
mov rbx, rdx
mov r13, rcx
movsxd rax, dword [rdi + 0x3c]
mov r8d, dword [rdi + rax + 0x50]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x1400203c2
mov r12, rax
lea rsi, [rbp + 0x18]
mov qword [rsp + 0x20], rsi
mov r9d, 0x1000
mov rcx, r13
mov rdx, rax
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400203e2
cmp qword [rbp + 0x18], 0x1000
jne 0x1400203e2
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r13
mov byte [rbp - 0x28], 0
mov rdi, qword [rbx]
movzx eax, word [rdi]
cmp eax, 0x5a4d
jne 0x140020403
movsxd rax, dword [rdi + 0x3c]
add rax, rdi
jmp 0x140020405
mov qword [rbp - 0x38], 0
xor ebx, ebx
mov eax, ebx
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor ebx, ebx
mov rcx, r13
mov rdx, r12
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov qword [rbp - 0x38], 0
jmp 0x1400203cc
xor eax, eax
movzx ebx, word [rax + 6]
test ebx, ebx
je 0x1400204a5
mov byte [rbp + 0x38], r14b
mov qword [rbp + 0x40], r12
movzx ecx, word [rax + 0x14]
mov esi, ebx
neg esi
lea r12, [rax + rcx]
add r12, 0x2c
mov r15b, 1
mov r14d, 1
jmp 0x14002045e
cmp r14d, ebx
setb r15b
lea eax, [rsi + r14]
inc eax
mov ecx, r14d
inc ecx
add r12, 0x28
mov r14d, ecx
cmp eax, 1
je 0x14002048e
mov r9d, dword [r12 - 4]
test r9, r9
je 0x140020440
mov edx, dword [r12 - 8]
mov r8d, dword [r12]
add r8, rdi
add rdx, qword [rbp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140020440
test r15b, 1
mov r12, qword [rbp + 0x40]
movzx r14d, byte [rbp + 0x38]
lea rsi, [rbp + 0x18]
jne 0x140020795
test r14b, r14b
je 0x140020620
mov dword [rsp + 0x20], 0x40
mov r8d, 0x640
mov rcx, r13
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140020795
mov rdi, rax
mov qword [rsp + 0x20], rsi
lea r8, [0x1400585e0]
mov r9d, 0x640
mov rcx, r13
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140020780
cmp qword [rbp + 0x18], 0x640
jne 0x140020780
mov rsi, rdi
mov qword [rbp], rdi
mov qword [rbp + 8], r13
mov byte [rbp + 0x10], 0
lea rdx, str.kernel32.dll
mov rcx, r13
xor r8d, r8d
call fcn.140024260
mov rdi, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
sub rdi, rax
lea rdx, str.LoadLibraryA
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call r15
add rax, rdi
mov qword [rbp + 0x20], rax
lea rdx, [0x14004e988]
mov rcx, rbx
call r15
add rax, rdi
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x18], r12
mov dword [rbp + 0x4c], 0
lea rdx, str.ntdll.dll
lea r8, [rbp + 0x4c]
mov rcx, r13
call fcn.140024260
mov rdi, rax
mov r8d, dword [rbp + 0x4c]
lea r9, str.48_89_5C_24____48_89_74_24____48_89_7C_24____41_54_41_56_41_57_48_81_EC_00
mov rcx, r13
mov rdx, rax
call fcn.140024850
test eax, eax
je 0x1400207ba
mov eax, eax
add rax, rdi
mov qword [rbp + 0x30], rax
mov dword [rsp + 0x20], 4
xor r15d, r15d
mov r8d, 0x20
mov rcx, r13
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x14002084f
mov rbx, rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x18]
mov r9d, 0x20
mov rcx, r13
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140020761
cmp qword [rbp - 0x20], 0x20
je 0x140020778
jmp 0x140020761
mov dword [rsp + 0x20], 0x40
mov r8d, 0x410
mov rcx, r13
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140020795
mov rdi, rax
mov qword [rsp + 0x20], rsi
lea r8, [0x140058c20]
mov r9d, 0x410
mov rcx, r13
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140020780
cmp qword [rbp + 0x18], 0x410
jne 0x140020780
mov rsi, rdi
mov qword [rbp], rdi
mov qword [rbp + 8], r13
mov byte [rbp + 0x10], 0
lea rdx, str.kernel32.dll
mov rcx, r13
xor r8d, r8d
call fcn.1400243d0
mov rdi, rax
lea r8, str.LoadLibraryA
mov rcx, r13
mov rdx, rax
call fcn.140024580
mov dword [rbp + 0x1c], eax
lea r8, [0x14004e988]
mov rcx, r13
mov rdx, rdi
call fcn.140024580
mov dword [rbp + 0x20], eax
mov dword [rbp + 0x18], r12d
mov dword [rbp + 0x4c], 0
lea rdx, str.ntdll.dll
lea r8, [rbp + 0x4c]
mov rcx, r13
call fcn.1400243d0
mov rdi, rax
mov r8d, dword [rbp + 0x4c]
lea r9, str.6A_70_68_____________E8_____________89_4D
mov rcx, r13
mov rdx, rax
call fcn.140024850
add eax, edi
mov dword [rbp + 0x24], eax
mov dword [rsp + 0x20], 4
xor r15d, r15d
mov r8d, 0x10
mov rcx, r13
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x14002084f
mov rbx, rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x18]
mov r9d, 0x10
mov rcx, r13
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140020761
cmp qword [rbp - 0x20], 0x10
je 0x140020778
mov rcx, r13
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor ebx, ebx
mov r15, rbx
jmp 0x14002084f
mov rcx, r13
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor ebx, ebx
test r13, r13
je 0x1400203cc
mov rcx, r13
mov rdx, r12
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x1400203cc
mov qword [rbp - 0x18], 0
mov ecx, 0x30
call fcn.140029c54
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [0x14002f510]
movups xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [0x14004ece5]
movups xmmword [rax + 0x1c], xmm0
movups xmm0, xmmword [0x14004ecd9]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.Failed_to_find_pattern_for_LdrpHandleTlsData]
movups xmmword [rax], xmm0
mov byte [rax + 0x2c], 0
lea rcx, [rbp - 0x20]
mov edx, 2
call fcn.1400250c0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x14002084c
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140020847
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14002094b
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.140029c98
xor r15d, r15d
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r13
mov byte [rbp - 0x40], 0
test r15, r15
je 0x1400208c2
mov rcx, r13
mov edx, r14d
call fcn.140020c10
mov rcx, rax
inc rcx
mov qword [rbp + 0x40], rcx
cmp rcx, 1
mov qword [rbp + 0x38], rax
ja 0x1400208c8
lea rdx, str.Couldnt_find_thread__try_again.
lea rcx, [rbp + 0x18]
call fcn.140020aa0
lea rcx, [rbp + 0x18]
mov edx, 2
call fcn.1400250c0
lea rcx, [rbp + 0x18]
call fcn.140001770
xor edi, edi
xor ebx, ebx
cmp qword [rbp + 0x40], 2
jb 0x140020902
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
jne 0x140020907
jmp 0x14002091c
xor ebx, ebx
xor edi, edi
jmp 0x14002091c
mov byte [rsp + 0x20], r14b
mov rcx, r13
mov rdx, rax
mov r8, rsi
mov r9, r15
call fcn.140021260
xor edi, edi
mov ebx, 0
test al, al
je 0x1400208fb
mov byte [rbp - 0x28], 1
mov dil, 1
mov bl, 1
cmp qword [rbp + 0x40], 2
jb 0x140020902
jmp 0x1400208b1
cmp qword [rbp + 0x40], 2
jae 0x1400208b1
test r13, r13
je 0x14002091c
mov rcx, r13
mov rdx, r15
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp byte [rbp + 0x10], 0
jne 0x14002093d
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14002093d
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test dil, dil
jne 0x1400203cc
jmp 0x140020797
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3