Function at 0x14000b2c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
movaps xmmword [rsp + 0x230], xmm6
mov rax, qword [0x140044028]
xor rax, rsp
mov qword [rsp + 0x228], rax
cmp qword [rcx + 0x10], 0
je 0x14000b9b2
mov r15, rcx
mov qword [rsp + 0x98], 0
mov ecx, 0x40
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x90], rax
mov rdi, qword [r15 + 8]
mov r14, qword [rdi]
cmp r14, rdi
mov qword [rsp + 0x50], r15
je 0x14000b8f5
xor ebx, ebx
lea rcx, [r14 + 0x10]
call fcn.14000c160
test al, al
jne 0x14000b90c
mov r14, qword [r14]
cmp r14, rdi
jne 0x14000b341
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
test rbx, rbx
je 0x14000b8f5
add rbx, 0xc
lea rsi, [rsp + 0x90]
mov rcx, rsi
mov rdx, rsi
mov r8, rax
call fcn.14000c3b0
mov rcx, qword [rsi]
mov edx, 0x40
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov rcx, rbx
call sub.mozglue.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov r14, rax
test rbx, rbx
jne 0x14000b9b9
mov rax, qword [r15]
mov rcx, qword [rax]
lea r9, [rsp + 0x80]
mov rdx, r14
mov r8, rbx
call fcn.14000c400
test al, al
je 0x14000bcd0
cmp qword [r15 + 0x10], 0
je 0x14000b892
mov rax, qword [r15]
mov r12, qword [rax]
mov dword [rsp + 0x20], 1
mov r8d, 0x10000
mov rcx, r12
xor edx, edx
mov r9d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
mov rdi, qword [r15 + 0x10]
shl rdi, 6
lea rax, [rdi + 0x60]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x60], rax
cmp rax, 0x10001
jae 0x14000bcda
lea rbx, [rsp + 0xf0]
mov rcx, rbx
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
movzx ecx, word [rsp + 0xf0]
mov dword [rsp + 0xf0], ecx
mov rax, qword [rsp + 0x90]
mov edx, 0x10000
sub rdx, rax
cmp rdx, rcx
jb 0x14000b42b
mov ebx, ecx
mov edx, 0x800
mov r9d, 0x1000
mov r8d, 0x800
mov rcx, r9
shr r8, 1
mov r9, rdx
cmp rdx, rax
mov rdx, r8
jae 0x14000b46f
mov qword [rsp + 0x68], r14
neg ecx
and ebx, ecx
mov eax, ebx
and eax, 0xf000
add rsi, rax
add rdi, 0x105f
and rdi, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, r12
mov rdx, rsi
mov r8, rdi
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000bd2b
mov qword [rsp + 0x70], r12
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0xa8], 0
mov qword [rsp + 0x98], 0x20
lea rcx, [sym.plugin_container.exe_g_originals]
xor r14d, r14d
mov r8d, 0x150
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x14003b5f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14000bd5c
and ebx, 0xfff
add qword [rsp + 0x58], rbx
mov rax, qword [r15]
mov rsi, qword [rax + 0x48]
mov rcx, qword [rax + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
mov ecx, 0x30
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbx, rax
mov al, byte [r15 + 0x19]
mov rcx, qword [r15]
mov rcx, qword [rcx]
lea rdx, [0x14003b610]
mov qword [rbx], rdx
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], rcx
mov byte [rbx + 0x28], al
mov dword [rbx + 0x2c], 0
mov r12, qword [r15 + 8]
mov ebp, 0x20
mov rdi, r12
mov rdi, qword [rdi]
cmp rdi, r12
je 0x14000b7c7
lea rdx, [rdi + 0x10]
lea rcx, [rsp + 0xf0]
call fcn.140006d60
xor r15d, r15d
mov qword [rsp + 0x208], r15
mov qword [rsp + 0x218], r15
mov qword [rsp + 0x220], 7
mov word [rsp + 0x208], 0
mov edx, 9
lea rcx, [rsp + 0x208]
lea r9, [0x14003b5f0]
call fcn.14001d500
mov rax, qword [rsp + 0x218]
cmp qword [rsp + 0x108], rax
jne 0x14000b8ff
test rax, rax
je 0x14000b654
cmp qword [rsp + 0x220], 8
lea rcx, [rsp + 0x208]
jb 0x14000b61e
mov rcx, qword [rsp + 0x208]
cmp qword [rsp + 0x110], 8
lea rdx, [rsp + 0xf8]
jb 0x14000b639
mov rdx, qword [rsp + 0xf8]
xor r8d, r8d
movzx r9d, word [rdx + r8*2]
cmp r9w, word [rcx + r8*2]
jne 0x14000b8fc
inc r8
cmp rax, r8
jne 0x14000b63c
cmp dword [rsp + 0xf0], 1
jne 0x14000b8fc
mov rcx, qword [rsp + 0x158]
test rcx, rcx
jne 0x14000b6c3
cmp qword [rsp + 0x150], 0x10
lea r8, [rsp + 0x138]
jb 0x14000b68a
mov r8, qword [rsp + 0x138]
mov rax, qword [rbx]
mov rax, qword [rax + 0x10]
mov rcx, rbx
mov rdx, r13
lea r9, [rsp + 0x88]
call qword [0x14004a010]
test eax, eax
js 0x14000b970
mov rcx, qword [rsp + 0x88]
sub rcx, r13
add rcx, rsi
mov qword [rsp + 0x158], rcx
cmp qword [rsp + 0x150], 0x10
lea rdx, [rsp + 0x138]
jb 0x14000b6de
mov rdx, qword [rsp + 0x138]
movsxd rax, r14d
shl rax, 6
mov r8, qword [rsp + 0x60]
sub r8, rbp
cmp qword [rsp + 0x130], 0x10
lea r9, [rsp + 0x118]
jb 0x14000b708
mov r9, qword [rsp + 0x118]
mov r10, qword [rsp + 0x58]
lea r15, [r10 + rax]
add r15, 0x20
mov rax, qword [rbx]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x40], 0
mov rcx, rbx
mov rdx, qword [rsp + 0x78]
mov r8, rsi
call qword [0x14004a010]
test eax, eax
js 0x14000b989
movsxd rax, dword [rsp + 0xf4]
lea rcx, [sym.plugin_container.exe_g_originals]
mov qword [rcx + rax*8], r15
inc r14d
mov dword [rsp + 0xa8], r14d
add rbp, 0x40
mov qword [rsp + 0x98], rbp
mov r15b, 1
mov rax, qword [rsp + 0x220]
cmp rax, 8
jb 0x14000b7af
mov rcx, qword [rsp + 0x208]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14000b949
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
lea rcx, [rsp + 0xf0]
call fcn.1400066a0
test r15b, r15b
jne 0x14000b589
jmp 0x14000b7cf
mov dword [rsp + 0x4c], 0
mov rax, qword [rbx]
mov rax, qword [rax]
mov rcx, rbx
mov edx, 1
call qword [0x14004a010]
test r13, r13
je 0x14000b7f1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [rsp + 0x4c]
test esi, esi
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x68]
jne 0x14000b8bf
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x90]
mov r9d, 0x20
mov rsi, qword [rsp + 0x70]
mov rcx, rsi
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000b9a8
cmp qword [rsp + 0xf0], 0x20
jne 0x14000b9a8
lea rax, [rsp + 0x208]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [r15]
lea rdx, str.g_originals
lea r8, [sym.plugin_container.exe_g_originals]
mov r9d, 0x150
call fcn.14000c7d0
test eax, eax
jne 0x14000b8bd
mov rax, qword [rsp + 0x80]
mov qword [sym.plugin_container.exe_g_interceptions], rax
lea r8, [sym.plugin_container.exe_g_interceptions]
mov rcx, qword [r15]
lea rdx, str.g_interceptions
mov r9d, 8
call fcn.14000c7d0
mov esi, eax
mov rcx, r14
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.14001cdf0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x230]
add rsp, 0x248
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x14000b373
xor r15d, r15d
mov dword [rsp + 0x4c], 2
jmp 0x14000b77f
lea rsi, [r14 + 0x18]
lea rcx, [rsp + 0x90]
mov rdx, rsi
call fcn.14002a730
test rax, rax
je 0x14000be0f
mov rax, qword [r14 + 0x48]
mov rcx, qword [r14 + 0x68]
add rax, rcx
add rax, 0x21
and rax, 0xfffffffffffffff8
add rbx, rax
mov r15, qword [rsp + 0x50]
jmp 0x14000b352
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000bcca
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
jmp 0x14000b7aa
mov ecx, eax
call fcn.140038f10
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x4c], 0x29
jmp 0x14000b9a0
mov ecx, eax
call fcn.140038f10
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x4c], 0x28
xor r15d, r15d
jmp 0x14000b77f
mov esi, 0x2a
jmp 0x14000b8bf
xor esi, esi
jmp 0x14000b8c7
mov r13, r14
add r14, 0xc
xor eax, eax
mov qword [rsp + 0x58], rax
cmp byte [r15 + 0x18], 0
je 0x14000be3e
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [r13 + 4], rax
lea rax, [rbx - 0xc]
lea rcx, [rsp + 0x90]
mov qword [rcx], rax
lea rax, [rsp + 0x208]
mov qword [rax], r14
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
mov rbp, qword [rax]
xorps xmm6, xmm6
mov rax, qword [rsp + 0x50]
cmp rbp, qword [rax + 8]
je 0x14000bd6b
lea rcx, [rbp + 0x10]
call fcn.14000c160
test al, al
jne 0x14000ba2d
mov rbp, qword [rbp]
jmp 0x14000ba0b
lea rsi, [rbp + 0x18]
movups xmmword [rsp + 0x100], xmm6
cmp qword [rbp + 0x30], 8
mov rdi, rsi
jb 0x14000ba47
mov rdi, qword [rbp + 0x18]
mov r15, qword [rbp + 0x28]
cmp r15, 7
ja 0x14000ba67
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0xf0], xmm0
mov r12d, 7
mov rax, r15
jmp 0x14000bade
mov r12, r15
or r12, 7
movabs rax, 0x7ffffffffffffffe
cmp r12, rax
cmovae r12, rax
lea rcx, [r12 + r12]
cmp r12, 0x7ff
jb 0x14000bab6
movabs rax, 0x7fffffffffffffec
cmp r12, rax
jae 0x14000be52
add rcx, 0x29
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14000bac2
add rcx, 2
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rcx, rax
mov qword [rsp + 0xf0], rcx
lea r8, [r15 + r15]
add r8, 2
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x108], r12
add rax, rax
add rax, 0x1f
and rax, 0xfffffffffffffff8
mov rcx, qword [rsp + 0x90]
sub rcx, rax
jae 0x14000bb64
xor esi, esi
mov rax, qword [rsp + 0x108]
cmp rax, 8
jb 0x14000bb56
mov rcx, qword [rsp + 0xf0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14000bb51
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000bcca
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
test sil, sil
jne 0x14000ba0b
jmp 0x14000be45
mov r15, qword [rsp + 0x208]
mov qword [rsp + 0x90], rcx
lea rdi, [r15 + rax]
mov qword [rsp + 0x208], rdi
cmp dword [rbp + 0x10], 5
sete byte [r15 + 0x14]
mov qword [r15], rax
mov qword [r15 + 8], rax
mov dword [r15 + 0x10], 0
lea rcx, [r15 + 0x16]
cmp qword [rbp + 0x30], 8
jb 0x14000bba7
mov rsi, qword [rbp + 0x18]
mov r8, qword [rbp + 0x28]
add r8, r8
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp + 0x28]
mov word [r15 + rax*2 + 0x16], 0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
cmp rbp, rax
je 0x14000bcb3
mov rsi, rbp
mov rcx, qword [rsp + 0x100]
cmp qword [rsi + 0x28], rcx
jne 0x14000bc9f
test rcx, rcx
je 0x14000bc31
cmp qword [rsp + 0x108], 8
lea rdx, [rsp + 0xf0]
jb 0x14000bc09
mov rdx, qword [rsp + 0xf0]
cmp qword [rsi + 0x30], 8
jb 0x14000bc16
mov r8, qword [rsi + 0x18]
jmp 0x14000bc1a
lea r8, [rsi + 0x18]
xor r9d, r9d
movzx r10d, word [r8 + r9*2]
cmp r10w, word [rdx + r9*2]
jne 0x14000bc9f
inc r9
cmp rcx, r9
jne 0x14000bc1d
lea rdi, [rsi + 0x10]
mov rcx, rdi
lea rdx, [rsp + 0x208]
lea r8, [rsp + 0x90]
mov r9, r14
call fcn.14002b480
test al, al
je 0x14000bb06
cmp rbp, rsi
jne 0x14000bc61
mov rbp, qword [rbp]
mov r15, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rax], r15
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov qword [rax + 8], rcx
mov r12, qword [rsp + 0x50]
dec qword [r12 + 0x10]
mov rcx, rdi
call fcn.1400066a0
mov edx, 0x80
mov rcx, rsi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov rax, qword [r12 + 8]
mov rsi, r15
jmp 0x14000bca2
mov rsi, qword [rsi]
cmp rsi, rax
jne 0x14000bbd7
mov rdi, qword [rsp + 0x208]
mov rax, qword [rsp + 0x58]
inc eax
mov qword [rsp + 0x58], rax
mov sil, 1
mov r14, rdi
jmp 0x14000bb08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov esi, 0x27
jmp 0x14000b8bf
lea rdx, [0x14003b5e8]
lea r8, str.size___kAllocGranularity
lea rcx, [rsp + 0x90]
call fcn.140022030
test rax, rax
je 0x14000b423
lea rdx, str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
lea rbx, [rsp + 0xf0]
mov rcx, rbx
mov r8d, 0x2b
mov r9, rax
call fcn.1400206c0
mov rcx, rbx
call int.140020760
jmp 0x14000b423
lea rdx, str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
lea r9, str.thunk_base
lea rsi, [rsp + 0xf0]
mov rcx, rsi
mov r8d, 0x188
call fcn.140020670
mov rcx, rsi
call int.140020760
jmp 0x14000b4cc
mov esi, 7
mov r14, qword [rsp + 0x68]
jmp 0x14000b8bf
mov rdx, r13
mov rax, qword [rsp + 0x58]
mov dword [r13], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, qword [rax]
lea r9, [rsp + 0x80]
mov r8, rbx
call fcn.14000c400
test al, al
je 0x14000be57
test rbx, rbx
mov r15, qword [rsp + 0x50]
mov r14, r13
je 0x14000b3cb
lea rax, str.TargetNtMapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rsi, [0x14003b5f0]
lea r8, str.NtMapViewOfSection
mov rcx, r15
mov rdx, rsi
mov r9d, 1
call fcn.140006990
lea rax, str.TargetNtUnmapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, str.NtUnmapViewOfSection
mov rcx, r15
mov rdx, rsi
mov r9d, 1
call fcn.140006990
jmp 0x14000b3d6
mov rax, qword [r14 + 0x28]
add rax, rax
add rax, 0x1f
and rax, 0xfffffffffffffff8
add rbx, rax
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xf0]
mov r8, rsi
call fcn.140029a00
jmp 0x14000b929
xor eax, eax
jmp 0x14000b9de
mov esi, 0x26
mov r14, r13
jmp 0x14000b8bf
call fcn.1400202d0
mov esi, 0x27
jmp 0x14000be4a