Function at 0x40e4b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rax, [rcx - 1]
mov rbx, rcx
mov rsi, rdx
mov qword [rsp + 0xd0], r8
test rax, rcx
jne 0x40e630
lea rax, [rdx - 1]
test rax, rdx
jne 0x40e654
lea rcx, [rsp + 0x40]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x68]
mov r9d, 4
mov r8d, 0x3000
mov rdi, qword [sym.imp.kernel32.dll_VirtualAlloc]
cmp rsi, rdx
cmovb rsi, rdx
xor ecx, ecx
mov rdx, rbx
call rdi
test rax, rax
je 0x40e5f0
lea r12, [rsi - 1]
test r12, rax
jne 0x40e540
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
mov qword [rsp + 0x38], rax
mov r13, qword [sym.imp.kernel32.dll_VirtualFree]
call r13
mov r9, qword [rsp + 0x38]
test eax, eax
je 0x40e678
test rsi, r12
jne 0x40e610
lea r14, [rsi + rbx]
neg rsi
xor ebp, ebp
mov r15, rsi
nop dword [rax]
test r9, r9
je 0x40e58a
test r9, r12
je 0x40e5e3
xor ecx, ecx
mov r9d, 1
mov r8d, 0x2000
mov rdx, r14
call rdi
test rax, rax
je 0x40e5f0
lea rsi, [rax + r12]
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
and rsi, r15
call r13
test eax, eax
je 0x40e678
add ebp, 1
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbx
mov rcx, rsi
call rdi
cmp ebp, 0xa
mov r9, rax
jne 0x40e580
test rax, rax
je 0x40e5f0
mov rax, r9
jmp 0x40e52a
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 8
jne 0x40e6a0
xor eax, eax
jmp 0x40e52a
xor ecx, ecx
mov r9d, 1
mov r8d, 0x2000
lea rdx, [rsi + rbx]
call rdi
test rax, rax
je 0x40e5f0
call fcn.0040b4c0
nop
lea r8, str.__IsPowerOfTwo_size_______0_
xor r9d, r9d
mov edx, 0x2343
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
call fcn.00406990
lea r8, str.__IsPowerOfTwo_alignment_______0_
xor r9d, r9d
mov edx, 0x2344
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
call fcn.00406990
call qword [sym.imp.kernel32.dll_GetLastError]
mov rdx, qword [rsp + 0xd0]
mov dword [rsp + 0x20], 0
mov rcx, rbx
lea r8, str.deallocate
mov r9d, eax
call fcn.0040d4f0
mov rdx, qword [rsp + 0xd0]
mov r9d, eax
mov rcx, rbx
mov dword [rsp + 0x20], 0
lea r8, str.allocate_aligned
call fcn.0040d4f0
nop
nop word cs:[rax + rax]
push rsi
push rbx
sub rsp, 0x38
mov r9d, 4
mov r8d, 0x3000
mov rbx, rcx
mov rsi, rdx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
test rax, rax
je 0x40e6ff
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rsp + 0x20], 0
mov rdx, rsi
mov rcx, rbx
lea r8, str.allocate
mov r9d, eax
call fcn.0040d4f0
nop
nop
nop word cs:[rax + rax]
push rbx
sub rsp, 0x30
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x410a50
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
test rax, rax
je 0x40e7c4
mov byte [rax + 8], 0
movzx edx, byte [rbx]
lea rcx, [0x00599010]
mov qword [rax], rcx
lea rcx, [rax + 0x208630]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov byte [rax + 0x410a48], dl
lea rdx, [rax + 0x630]
mov qword [rax + 0x220], 0
nop word cs:[rax + rax]
mov qword [rdx], 0
add rdx, 0x208
cmp rcx, rdx
jne 0x40e7a0
mov qword [rax + 0x410a40], 0
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rsp + 0x20], 0
mov ecx, 0x410a50
lea r8, str.allocate
mov r9d, eax
lea rdx, str.deadlock_detector
call fcn.0040d4f0
nop
nop