Function at 0x140001ba0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get number of processors

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, 0x1000
xor r14d, r14d
xor edi, edi
xor ecx, ecx
mov r8d, edx
mov dword [rsp + 0x24], edi
lea r9d, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140001bf0
lea rcx, str.Bad_init_shell__n
call fcn.140001030
xor al, al
jmp 0x140002028
lea rax, [rsp + 0x30]
cmp rbx, rax
jbe 0x140001c20
lea rax, [rsp + 0x3b]
cmp rbx, rax
jae 0x140001c20
mov dword [rbx + 7], 0xc3050fd1
mov dword [rbx + 3], 0x8b4c0000
mov word [rbx + 1], di
mov byte [rbx], 0xb8
jmp 0x140001c37
mov dword [rbx], 0xb8
mov dword [rbx + 4], 0xd18b4c00
mov word [rbx + 8], 0x50f
mov byte [rbx + 0xa], 0xc3
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140001c73
cmp al, 5
je 0x140001c6c
cmp al, 6
jne 0x140001c68
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140001c6c
sub ecx, 1
je 0x140001c61
cmp ecx, 1
jne 0x140001c73
mov ecx, 0x35
jmp 0x140001c78
xor ecx, ecx
jmp 0x140001c78
mov ecx, 0x34
jmp 0x140001c78
mov ecx, 0x36
lea rdx, [rbx + 1]
mov dword [rsp + 0x20], ecx
lea rax, [rsp + 0x28]
cmp rdx, rax
jbe 0x140001cb0
lea rax, [rsp + 0x2c]
cmp rdx, rax
jae 0x140001cb0
movzx eax, byte [rsp + 0x23]
mov byte [rdx + 3], al
movzx eax, byte [rsp + 0x22]
mov byte [rdx + 2], al
movzx eax, byte [rsp + 0x21]
mov byte [rdx + 1], al
jmp 0x140001cc8
movzx eax, byte [rsp + 0x21]
mov byte [rdx + 1], al
movzx eax, byte [rsp + 0x22]
mov byte [rdx + 2], al
movzx eax, byte [rsp + 0x23]
mov byte [rdx + 3], al
mov byte [rdx], cl
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
xor edx, edx
lea ecx, [rdx + 0x16]
call rbx
cmp eax, 0xc0000004
jne 0x140001d3f
test r14, r14
je 0x140001d03
mov rax, qword gs:[0x30]
mov r8, r14
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword gs:[0x30]
xor edx, edx
mov r8d, dword [rsp + 0x24]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, dword [rsp + 0x24]
lea r9, [rsp + 0x24]
mov rdx, rax
mov ecx, socket
mov r14, rax
call rbx
cmp eax, 0xc0000004
je 0x140001ce2
test eax, eax
jns 0x140001d7c
test r14, r14
je 0x140001d64
mov rax, qword gs:[0x30]
mov r8, r14
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
jmp 0x140002028
mov eax, dword [r14]
mov qword [rsp + 0x70], rbp
lea rbp, [r14 + 8]
test eax, eax
je 0x140001fef
mov qword [rsp + 0x78], rsi
mov rsi, rbp
mov qword [rsp + 0x80], r12
neg rsi
mov qword [rsp + 0x88], r15
lea r12, [0x140000000]
mov r15d, eax
nop word [rax + rax]
lea r9, [r12 + 0x4480]
mov ecx, 4
add r9, rsi
mov rax, rbp
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [r9 + rax]
movzx edx, byte [rax]
lea rax, [rax + 1]
cmp dl, r8b
jne 0x140001df9
sub rcx, 1
jne 0x140001de0
jmp 0x140001dfe
mov ecx, edx
sub ecx, r8d
test ecx, ecx
lea r10, [rdi + 1]
lea r9, [r12 + 0x4488]
mov ecx, 4
cmovne r10, rdi
mov rax, rbp
add r9, rsi
nop dword [rax + rax]
movzx r8d, byte [r9 + rax]
movzx edx, byte [rax]
lea rax, [rax + 1]
cmp dl, r8b
jne 0x140001e39
sub rcx, 1
jne 0x140001e20
jmp 0x140001e3e
mov ecx, edx
sub ecx, r8d
test ecx, ecx
lea r11, [r10 + 1]
lea r9, [r12 + 0x4490]
mov ecx, 4
cmovne r11, r10
mov rax, rbp
add r9, rsi
nop dword [rax + rax]
movzx r8d, byte [r9 + rax]
movzx edx, byte [rax]
lea rax, [rax + 1]
cmp dl, r8b
jne 0x140001e79
sub rcx, 1
jne 0x140001e60
jmp 0x140001e7e
mov ecx, edx
sub ecx, r8d
test ecx, ecx
lea r10, [r11 + 1]
lea r9, [r12 + 0x4498]
mov ecx, 4
cmovne r10, r11
mov rax, rbp
add r9, rsi
nop dword [rax + rax]
movzx r8d, byte [r9 + rax]
movzx edx, byte [rax]
lea rax, [rax + 1]
cmp dl, r8b
jne 0x140001eb9
sub rcx, 1
jne 0x140001ea0
jmp 0x140001ebe
mov ecx, edx
sub ecx, r8d
test ecx, ecx
lea r11, [r10 + 1]
lea r9, [r12 + 0x44a0]
mov ecx, 4
cmovne r11, r10
mov rax, rbp
add r9, rsi
nop dword [rax + rax]
movzx r8d, byte [r9 + rax]
movzx edx, byte [rax]
lea rax, [rax + 1]
cmp dl, r8b
jne 0x140001ef9
sub rcx, 1
jne 0x140001ee0
jmp 0x140001efe
mov ecx, edx
sub ecx, r8d
test ecx, ecx
lea r10, [r11 + 1]
lea r9, [r12 + 0x44a8]
mov ecx, 4
cmovne r10, r11
mov rax, rbp
add r9, rsi
nop dword [rax + rax]
movzx r8d, byte [r9 + rax]
movzx edx, byte [rax]
lea rax, [rax + 1]
cmp dl, r8b
jne 0x140001f39
sub rcx, 1
jne 0x140001f20
jmp 0x140001f3e
mov ecx, edx
sub ecx, r8d
test ecx, ecx
lea r11, [r10 + 1]
lea r9, [r12 + 0x44b0]
mov ecx, 4
cmovne r11, r10
mov rax, rbp
add r9, rsi
nop dword [rax + rax]
movzx r8d, byte [r9 + rax]
movzx edx, byte [rax]
lea rax, [rax + 1]
cmp dl, r8b
jne 0x140001f79
sub rcx, 1
jne 0x140001f60
jmp 0x140001f7e
mov ecx, edx
sub ecx, r8d
test ecx, ecx
lea r10, [r11 + 1]
lea r9, [r12 + 0x44b8]
mov ecx, 4
cmovne r10, r11
mov rax, rbp
add r9, rsi
nop dword [rax + rax]
movzx r8d, byte [r9 + rax]
movzx edx, byte [rax]
lea rax, [rax + 1]
cmp dl, r8b
jne 0x140001fb9
sub rcx, 1
jne 0x140001fa0
jmp 0x140001fbe
mov ecx, edx
sub ecx, r8d
test ecx, ecx
lea rdi, [r10 + 1]
cmovne rdi, r10
add rbp, 0x28
sub rsi, 0x28
sub r15, 1
jne 0x140001dc0
mov r15, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rax, qword gs:[0x30]
mov r8, r14
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbp, qword [rsp + 0x70]
cmp rdi, 2
setae al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140002330
add rsp, 0x50
pop r14
pop rdi
pop rbx
ret