Function at 0x401b90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.msvcrt.dll___iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
lea r9, [rax + 0x60]
mov r8d, 0x1b
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
call sub.msvcrt.dll___iob_func
lea rcx, [rax + 0x60]
mov rdx, rbx
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
movsxd rbp, dword [0x00408684]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x401d70
mov rax, qword [0x00408688]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x401be0
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x401d21
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x401bc4
mov rcx, rbx
call fcn.00402880
test rax, rax
mov r12, rax
je 0x401d94
lea rbp, [rbp + rbp*2]
lea r14, [rsp + 0x30]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00408688]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.004029a0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov rdx, r14
mov qword [r13 + 8], rax
mov rax, qword [0x00408688]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rax + rbp + 8]
call r13
test rax, rax
je 0x401d77
mov eax, dword [rsp + 0x54]
cmp eax, 4
je 0x401c70
cmp eax, 0x40
jne 0x401d32
add dword [0x00408684], 1
mov r8d, 0x30
mov rdx, r14
mov rcx, rbx
call r13
test rax, rax
je 0x401da3
mov eax, dword [rsp + 0x54]
cmp eax, 4
je 0x401c9d
cmp eax, 0x40
jne 0x401cc0
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sub.msvcrt.dll_memcpy
lea r12, [rsp + 0x2c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9, r12
call rbp
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x54]
cmp eax, 0x40
je 0x401d12
cmp eax, 4
je 0x401d12
mov r9, r12
mov r8d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call rbp
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r14, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x401c77
mov r9, rbp
add r9, qword [0x00408688]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401c70
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401b20
nop
xor ebp, ebp
jmp 0x401bed
mov rax, qword [0x00408688]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call fcn.00401b20
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00401b20
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rbx
mov edx, 0x30
call fcn.00401b20
nop
nop dword [rax + rax]
push rbp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x60
mov ebx, dword [0x00408680]
test ebx, ebx
je 0x401df0
mov rsp, rbp
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
mov dword [0x00408680], 1
call fcn.004028d0
cdqe
lea rax, [rax + rax*2]
lea rax, [rax*8 + 0x1e]
and rax, 0xfffffffffffffff0
call fcn.00402af0
mov rsi, qword [0x004054c0]
mov rbx, qword [0x004054d0]
sub rsp, rax
mov dword [0x00408684], 0
lea rax, [rsp + 0x20]
mov qword [0x00408688], rax
mov rax, rsi
sub rax, rbx
cmp rax, 7
jle 0x401ddb
cmp rax, 0xb
jle 0x401e75
mov r11d, dword [rbx]
test r11d, r11d
jne 0x401fa0
mov r10d, dword [rbx + 4]
test r10d, r10d
jne 0x401fa0
mov r9d, dword [rbx + 8]
test r9d, r9d
jne 0x401e8c
add rbx, 0xc
mov r8d, dword [rbx]
test r8d, r8d
jne 0x401fa0
mov ecx, dword [rbx + 4]
test ecx, ecx
jne 0x401fa0
mov edx, dword [rbx + 8]
cmp edx, 1
jne 0x4020ac
add rbx, 0xc
cmp rbx, rsi
jae 0x401ddb
mov r12, qword [0x004054f0]
lea r13, [rbp - 0x30]
movabs r14, 0xffffffff00000000
mov ecx, dword [rbx + 4]
mov eax, dword [rbx]
movzx edx, byte [rbx + 8]
add rax, r12
add rcx, r12
cmp edx, 0x10
mov r8, qword [rax]
je 0x402016
jbe 0x401fdd
cmp edx, 0x20
je 0x40205f
cmp edx, 0x40
jne 0x40204b
sub r8, rax
mov rdx, r13
mov rdi, r13
mov rax, r8
add rax, qword [rcx]
mov r8d, 8
mov qword [rbp - 0x30], rax
call 0x401b90
add rbx, 0xc
cmp rbx, rsi
jb 0x401eba
mov eax, dword [0x00408684]
xor ebx, ebx
xor esi, esi
test eax, eax
jle 0x401ddb
mov r14, qword [sym.imp.KERNEL32.dll_VirtualQuery]
lea r13, [rbp - 0x34]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x401f53
add esi, 1
add rbx, 0x18
cmp esi, dword [0x00408684]
jge 0x401ddb
mov rax, rbx
add rax, qword [0x00408688]
mov edx, dword [rax]
test edx, edx
je 0x401f40
mov rcx, qword [rax + 8]
mov r8d, 0x30
mov rdx, rdi
call r14
test rax, rax
je 0x40208e
mov rax, qword [0x00408688]
mov r9, r13
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
mov r8d, dword [rax + rbx]
call r12
jmp 0x401f40
cmp rbx, rsi
jae 0x401ddb
mov r12, qword [0x004054f0]
lea rdi, [rbp - 0x30]
mov ecx, dword [rbx + 4]
mov eax, dword [rbx]
mov r8d, 4
mov rdx, rdi
add rbx, 8
add rcx, r12
add eax, dword [rcx]
mov dword [rbp - 0x30], eax
call 0x401b90
cmp rbx, rsi
jb 0x401fb4
jmp 0x401f14
cmp edx, 8
jne 0x40204b
movzx edx, byte [rcx]
mov rdi, r13
mov r10, rdx
or r10, 0xffffffffffffff00
test dl, dl
cmovs rdx, r10
sub rdx, rax
lea rax, [r8 + rdx]
mov r8d, 1
mov rdx, r13
mov qword [rbp - 0x30], rax
call 0x401b90
jmp 0x401f0b
movzx edx, word [rcx]
mov rdi, r13
mov r10, rdx
or r10, 0xffffffffffff0000
test dx, dx
cmovs rdx, r10
sub rdx, rax
lea rax, [r8 + rdx]
mov r8d, 2
mov rdx, r13
mov qword [rbp - 0x30], rax
call 0x401b90
jmp 0x401f0b
lea rcx, str.__Unknown_pseudo_relocation_bit_size__d._n
mov qword [rbp - 0x30], 0
call fcn.00401b20
mov edx, dword [rcx]
mov rdi, r13
mov r10, rdx
or r10, r14
test edx, edx
cmovs rdx, r10
sub rdx, rax
lea rax, [r8 + rdx]
mov r8d, 4
mov rdx, r13
mov qword [rbp - 0x30], rax
call 0x401b90
jmp 0x401f0b
add rbx, qword [0x00408688]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov rax, qword [rbx + 0x10]
mov r8, qword [rbx + 8]
mov edx, dword [rax + 8]
call fcn.00401b20
lea rcx, str.__Unknown_pseudo_relocation_protocol_version__d._n
call fcn.00401b20
nop
nop
nop
nop
nop
nop
nop
nop
sub rsp, 0x28
mov eax, dword [rcx]
cmp eax, 0xc0000091
ja 0x402130
cmp eax, 0xc000008d
jae 0x40214f
cmp eax, 0xc0000008
je 0x4021f0
ja 0x4021c0
cmp eax, 0x80000002
je 0x4021f0
cmp eax, 0xc0000005
jne 0x4021ce
xor edx, edx
mov ecx, 0xb
call sub.msvcrt.dll_signal
cmp rax, 1
je 0x402250
test rax, rax
je 0x402230
mov ecx, 0xb
call rax
xor eax, eax
add rsp, 0x28
ret
cmp eax, 0xc0000094
je 0x402200
ja 0x402180
cmp eax, 0xc0000092
je 0x4021f0
cmp eax, 0xc0000093
jne 0x4021ce
xor edx, edx
mov ecx, 8
call sub.msvcrt.dll_signal
cmp rax, 1
mov rdx, rax
je 0x4021d8
test rdx, rdx
mov eax, 1
je 0x402123
mov ecx, 8
call rdx
xor eax, eax
add rsp, 0x28
ret
cmp eax, 0xc0000095
je 0x4021f0
cmp eax, 0xc0000096
jne 0x4021ce
xor edx, edx
mov ecx, 4
call sub.msvcrt.dll_signal
cmp rax, 1
je 0x40223a
test rax, rax
je 0x402230
mov ecx, 4
call rax
xor eax, eax
jmp 0x402123
cmp eax, 0xc000001d
je 0x40218e
cmp eax, 0xc000008c
je 0x4021f0
mov eax, 1
add rsp, 0x28
ret
mov edx, 1
mov ecx, 8
call sub.msvcrt.dll_signal
call fcn.00401af0
nop dword [rax]
xor eax, eax
add rsp, 0x28
ret
xor edx, edx
mov ecx, 8
call sub.msvcrt.dll_signal
cmp rax, 1
mov rdx, rax
jne 0x402164
mov edx, 1
mov ecx, 8
call sub.msvcrt.dll_signal
xor eax, eax
jmp 0x402123
mov eax, 4
add rsp, 0x28
ret
mov edx, 1
mov ecx, 4
call sub.msvcrt.dll_signal
xor eax, eax
jmp 0x402123
mov edx, 1
mov ecx, 0xb
call sub.msvcrt.dll_signal
xor eax, eax
jmp 0x402123