Function at 0x140001eb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor r14d, r14d
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rcx
mov r15, rdx
mov rbx, rcx
test rdx, rdx
jne 0x140001ef1
mov eax, 0x57
jmp 0x1400023dd
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x14000d9cc], eax
je 0x140001f09
mov eax, 0x10dd
jmp 0x1400023dd
mov eax, dword [0x14000d9c8]
test eax, eax
jne 0x1400023dd
test rbx, rbx
jne 0x140001f26
mov eax, 6
jmp 0x1400023dd
mov qword [rsp + 0xf0], rdi
mov rdi, qword [rbx]
test rdi, rdi
jne 0x140001f51
mov dword [0x14000d9c8], 6
mov eax, 6
mov qword [0x14000d9d8], rbx
jmp 0x1400023d5
cmp byte [rdi], 0xff
mov qword [rsp + 0x130], rbp
mov rbp, r14
mov qword [rsp + 0xe8], r12
mov r12, r14
jne 0x140001f8e
cmp byte [rdi + 1], 0x25
jne 0x140001f8e
movsxd rbx, dword [rdi + 2]
lea rdx, [rdi + 6]
add rdx, rbx
mov rcx, rdi
call fcn.140001010
test al, al
je 0x140001f8e
mov rdi, qword [rbx + rdi + 6]
cmp byte [rdi], 0xeb
jne 0x140001fdb
movsx rax, byte [rdi + 1]
add rdi, 2
add rdi, rax
movzx ecx, byte [rdi]
cmp cl, 0xff
jne 0x140001fcb
cmp byte [rdi + 1], 0x25
jne 0x140001fcb
movsxd rbx, dword [rdi + 2]
mov rcx, rdi
lea rdx, [rbx + 6]
add rdx, rdi
call fcn.140001010
test al, al
je 0x140001fdb
mov rdi, qword [rbx + rdi + 6]
jmp 0x140001fdb
cmp cl, 0xe9
jne 0x140001fdb
movsxd rax, dword [rdi + 1]
add rdi, 5
add rdi, rax
cmp byte [r15], 0xff
jne 0x140002009
cmp byte [r15 + 1], 0x25
jne 0x140002009
movsxd rbx, dword [r15 + 2]
lea rdx, [r15 + 6]
add rdx, rbx
mov rcx, r15
call fcn.140001010
test al, al
je 0x140002009
mov r15, qword [rbx + r15 + 6]
mov qword [rsp + 0x28], r15
cmp byte [r15], 0xeb
jne 0x140002063
movsx rax, byte [r15 + 1]
add r15, 2
add r15, rax
mov qword [rsp + 0x28], r15
movzx ecx, byte [r15]
cmp cl, 0xff
jne 0x14000204e
cmp byte [r15 + 1], 0x25
jne 0x14000204e
movsxd rbx, dword [r15 + 2]
mov rcx, r15
lea rdx, [rbx + 6]
add rdx, r15
call fcn.140001010
test al, al
je 0x140002063
mov r15, qword [rbx + r15 + 6]
jmp 0x14000205e
cmp cl, 0xe9
jne 0x140002063
movsxd rax, dword [r15 + 1]
add r15, 5
add r15, rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0xe0], r13
cmp r15, rdi
jne 0x14000208a
cmp dword [0x14000d958], r14d
jne 0x1400023a6
jmp 0x140002357
mov ecx, 0x30
call fcn.1400078b0
mov rcx, rdi
mov qword [rsp + 0x30], rax
mov r12, rax
call fcn.1400014b0
mov rbp, rax
test rax, rax
jne 0x1400020b7
mov r14d, 8
jmp 0x140002357
xor eax, eax
mov dword [rsp + 0x20], r14d
mov qword [rbp + 0x40], rax
lea r15, [0x14000f140]
mov r8, rdi
mov r13, rbp
movabs r12, 0x8040000403
nop dword [rax]
xorps xmm0, xmm0
mov dword [rsp + 0x40], r14d
lea rax, [rsp + 0x88]
test r13, r13
movups xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x40]
cmovne rcx, r13
mov qword [rsp + 0x78], rax
mov rbx, r8
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x88], r14
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
test r8, r8
jne 0x140002165
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, r14
jmp 0x140002184
movzx eax, byte [r8]
mov r9, r8
shl rax, 4
mov r8, rcx
add rax, r15
lea rcx, [rsp + 0x50]
mov rdx, rax
call qword [rax + 8]
mov r8, rax
mov r9d, dword [rsp + 0x20]
mov esi, r8d
movsxd rax, dword [rsp + 0x40]
sub esi, edi
sub rax, rbx
add rax, r8
add r13, rax
movzx eax, r13b
sub al, bpl
shl al, 3
movzx ecx, al
xor cl, sil
and cl, 7
xor cl, al
mov byte [r9 + rbp + 0x40], cl
inc r9d
mov dword [rsp + 0x20], r9d
cmp r9d, 8
jae 0x14000221b
movzx ecx, byte [rbx]
cmp cl, 0xeb
je 0x14000221b
lea eax, [rcx + 0x3e]
cmp al, 0x27
ja 0x1400021d9
bt r12, rax
jb 0x14000221b
cmp cl, 0xf3
jne 0x14000228d
cmp byte [rbx + 1], 0xc3
je 0x14000221b
cmp cl, 0x26
je 0x140002206
cmp cl, 0x2e
je 0x140002206
cmp cl, 0x36
je 0x140002206
cmp cl, 0x3e
je 0x140002206
cmp cl, 0x64
je 0x140002206
cmp cl, 0x65
jne 0x140002212
cmp byte [rbx + 1], 0xff
jne 0x140002212
cmp byte [rbx + 2], 0x25
je 0x14000221b
cmp esi, 5
jb 0x1400020e0
mov r15, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
cmp esi, 5
jae 0x14000224f
nop word [rax + rax]
mov rcx, r8
call fcn.1400010b0
test eax, eax
je 0x140002348
cdqe
add r8, rax
mov rsi, r8
sub esi, edi
cmp esi, 5
jb 0x140002230
cmp r9d, 8
ja 0x140002348
lea rax, [rbp + 0x1e]
cmp r13, rax
jbe 0x140002263
int3
sub r13b, bpl
mov r8d, esi
lea rcx, [rbp + 0x20]
mov byte [rbp + 0x1e], r13b
mov rdx, rdi
mov byte [rbp + 0x3e], sil
call sub.VCRUNTIME140.dll_memcpy
cmp esi, 0x19
jbe 0x14000229f
mov r14d, 6
jmp 0x140002357
cmp cl, 0xff
jne 0x1400021e8
cmp byte [rbx + 1], 0x25
jmp 0x140002210
movzx edx, byte [rbp + 0x1e]
lea rax, [rdi + rsi]
add rdx, rbp
mov qword [rbp + 0x48], rax
mov eax, ebp
mov qword [rbp + 0x50], r15
lea rcx, [rdx + 6]
mov word [rdx], 0x25ff
sub eax, ecx
lea rcx, [rdx + 6]
add eax, 0x48
mov dword [rdx + 2], eax
lea rax, [rbp + 0x1e]
mov r8, rax
sub r8, rcx
cmp rcx, rax
cmova r8, r14
test r8, r8
je 0x1400022e6
mov dl, 0xcc
call sub.VCRUNTIME140.dll_memset
mov edx, esi
lea r9, [rsp + 0x44]
mov r8d, 0x40
mov dword [rsp + 0x44], r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002310
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
jmp 0x140002357
mov rax, qword [rsp + 0x38]
mov qword [r12 + 0x10], rax
mov dword [r12 + 8], r14d
mov qword [r12 + 0x20], rbp
mov qword [r12 + 0x18], rdi
mov eax, dword [rsp + 0x44]
mov dword [r12 + 0x28], eax
mov rax, qword [0x14000d9f0]
mov qword [r12], rax
xor eax, eax
mov qword [0x14000d9f0], r12
jmp 0x1400023b5
cmp dword [0x14000d958], 0
mov r14d, 9
jne 0x140002363
mov dword [0x14000d9c8], r14d
test rbp, rbp
je 0x140002394
xorps xmm0, xmm0
mov r8, rbp
movups xmmword [rbp], xmm0
and r8, 0xffffffffffff0000
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
mov rax, qword [r8 + 0x10]
mov qword [rbp + 0x48], rax
mov qword [r8 + 0x10], rbp
test r12, r12
je 0x1400023a6
mov edx, 0x30
mov rcx, r12
call fcn.1400078ec
mov rax, qword [rsp + 0x38]
mov qword [0x14000d9d8], rax
mov eax, r14d
mov rsi, qword [rsp + 0xf8]
mov r13, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0x130]
mov r12, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140007890
add rsp, 0x100
pop r15
pop r14
pop rbx
ret