Function at 0x180029620
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rsi, rcx
xor r14d, r14d
cmp qword [0x1800a43c0], r14
jne 0x1800298d1
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
lea ecx, [r14 + 0x20]
call fcn.1800506b0
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], reloc.WS2_32.dll_setsockopt
mov qword [rbp - 0x10], 0x1f
movups xmm0, xmmword [str.IDXGISwapChainPresent]
movups xmmword [rax], xmm0
mov ecx, dword [0x18008f6d8]
mov dword [rax + 0x10], ecx
movzx ecx, byte [reloc.WS2_32.dll_WSACleanup]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], r14b
lea rax, [rbp - 0x28]
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x38], r14d
lea r9, [rbp + 0x38]
lea edx, [r14 + 8]
lea r8d, [r14 + 0x40]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180029706
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x18002a104
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180029e25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002a146
call fcn.180050b2c
mov eax, 0x80004005
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rsi]
mov rbx, qword [rax + 0x40]
mov ecx, 0x40
call fcn.1800506b0
mov rdi, rax
mov qword [rbp + 0x48], rax
mov qword [rax], r14
lea rcx, [rax + 8]
lea rdx, [rbp - 0x28]
call fcn.180006410
mov qword [rdi + 0x28], rbx
lea rax, [0x180028ef0]
mov qword [rdi + 0x30], rax
mov byte [rdi + 0x38], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x18002977c
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180029777
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002a146
call fcn.180050b2c
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], setsockopt
mov byte [rbp - 0x28], 0
mov rbx, qword [0x1800a43c0]
mov qword [0x1800a43c0], rdi
test rbx, rbx
je 0x18002980a
cmp byte [rbx + 0x38], 0
je 0x1800297ae
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x1800297ed
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x1800297e8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002a14c
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
mov edx, 0x40
mov rcx, rbx
call fcn.180050b2c
cmp byte [rdi + 0x38], 0
jne 0x1800298c7
mov r8, rdi
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x28]
call fcn.18004f030
test eax, eax
jne 0x180029847
mov rcx, qword [rdi + 0x28]
call fcn.18004f540
test eax, eax
jne 0x18002983b
mov byte [rdi + 0x38], 1
jmp 0x180029847
mov rcx, qword [rdi + 0x28]
call fcn.18004f330
mov qword [rdi], r14
cmp byte [rdi + 0x38], 0
jne 0x1800298c7
mov rbx, qword [0x1800a43c0]
mov qword [0x1800a43c0], r14
test rbx, rbx
je 0x18002a104
cmp byte [rbx + 0x38], 0
je 0x180029873
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x1800298b2
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x1800298ad
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002a152
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
jmp 0x180029e1d
mov rax, qword [rdi]
mov qword [0x1800a40c0], rax
cmp qword [0x1800a43c8], 0
jne 0x180029b83
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
mov ecx, 0x20
call fcn.1800506b0
mov rdx, rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], 0x1b
mov qword [rbp - 0x10], 0x1f
movups xmm0, xmmword [str.IDXGISwapChainResizeBuffers]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x18008f6b8]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x18008f6c0]
mov word [rax + 0x18], cx
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rdx + 0x1a], al
mov byte [rdx + 0x1b], 0
lea rax, [rbp - 0x28]
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x38], r14d
lea r9, [rbp + 0x38]
mov edx, 8
lea r8d, [rdx + 0x38]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800299b8
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x18002a104
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180029e25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002a158
call fcn.180050b2c
mov eax, 0x80004005
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rsi]
mov rbx, qword [rax + 0x68]
mov ecx, 0x40
call fcn.1800506b0
mov rdi, rax
mov qword [rbp + 0x48], rax
mov qword [rax], r14
lea rcx, [rax + 8]
lea rdx, [rbp - 0x28]
call fcn.180006410
mov qword [rdi + 0x28], rbx
lea rax, [0x1800292b0]
mov qword [rdi + 0x30], rax
mov byte [rdi + 0x38], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x180029a2e
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180029a29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002a158
call fcn.180050b2c
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], setsockopt
mov byte [rbp - 0x28], 0
mov rbx, qword [0x1800a43c8]
mov qword [0x1800a43c8], rdi
test rbx, rbx
je 0x180029abc
cmp byte [rbx + 0x38], 0
je 0x180029a60
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x180029a9f
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x180029a9a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002a15e
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
mov edx, 0x40
mov rcx, rbx
call fcn.180050b2c
cmp byte [rdi + 0x38], 0
jne 0x180029b79
mov r8, rdi
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x28]
call fcn.18004f030
test eax, eax
jne 0x180029af9
mov rcx, qword [rdi + 0x28]
call fcn.18004f540
test eax, eax
jne 0x180029aed
mov byte [rdi + 0x38], 1
jmp 0x180029af9
mov rcx, qword [rdi + 0x28]
call fcn.18004f330
mov qword [rdi], r14
cmp byte [rdi + 0x38], 0
jne 0x180029b79
mov rbx, qword [0x1800a43c8]
mov qword [0x1800a43c8], r14
test rbx, rbx
je 0x18002a104
cmp byte [rbx + 0x38], 0
je 0x180029b25
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x180029b64
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x180029b5f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002a164
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
jmp 0x180029e1d
mov rax, qword [rdi]
mov qword [0x1800a40c8], rax
cmp qword [0x1800a43d0], 0
jne 0x180029e44
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
mov ecx, 0x20
call fcn.1800506b0
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], 0x1a
mov qword [rbp - 0x10], 0x1f
movups xmm0, xmmword [str.IDXGISwapChainResizeTarget]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x18008f708]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x18008f710]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
lea rax, [rbp - 0x28]
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x38], r14d
lea r9, [rbp + 0x38]
mov edx, 8
lea r8d, [rdx + 0x38]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180029c5d
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x18002a104
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180029e25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002a16a
call fcn.180050b2c
mov eax, 0x80004005
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rsi]
mov rbx, qword [rax + 0x70]
mov ecx, 0x40
call fcn.1800506b0
mov rdi, rax
mov qword [rbp + 0x48], rax
mov qword [rax], r14
lea rcx, [rax + 8]
lea rdx, [rbp - 0x28]
call fcn.180006410
mov qword [rdi + 0x28], rbx
lea rax, [0x180029430]
mov qword [rdi + 0x30], rax
mov byte [rdi + 0x38], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x180029cd3
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180029cce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002a16a
call fcn.180050b2c
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], setsockopt
mov byte [rbp - 0x28], 0
mov rbx, qword [0x1800a43d0]
mov qword [0x1800a43d0], rdi
test rbx, rbx
je 0x180029d61
cmp byte [rbx + 0x38], 0
je 0x180029d05
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x180029d44
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x180029d3f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002a170
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
mov edx, 0x40
mov rcx, rbx
call fcn.180050b2c
cmp byte [rdi + 0x38], 0
jne 0x180029e3a
mov r8, rdi
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x28]
call fcn.18004f030
test eax, eax
jne 0x180029d9e
mov rcx, qword [rdi + 0x28]
call fcn.18004f540
test eax, eax
jne 0x180029d92
mov byte [rdi + 0x38], 1
jmp 0x180029d9e
mov rcx, qword [rdi + 0x28]
call fcn.18004f330
mov qword [rdi], r14
cmp byte [rdi + 0x38], 0
jne 0x180029e3a
mov rbx, qword [0x1800a43d0]
mov qword [0x1800a43d0], r14
test rbx, rbx
je 0x18002a104
cmp byte [rbx + 0x38], 0
je 0x180029dce
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x180029e0d
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x180029e08
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002a176
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
mov edx, 0x40
mov rcx, rbx
call fcn.180050b2c
mov eax, 0x80004005
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rdi]
mov qword [0x1800a40b8], rax
cmp qword [0x1800a43d8], 0
jne 0x18002a12d
mov qword [rbp + 0x40], r14
mov rax, qword [rsi]
lea r8, [rbp + 0x40]
lea rdx, [0x18008f8b8]
mov rcx, rsi
call qword [rax]
test eax, eax
js 0x18002a12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
mov ecx, 0x20
call fcn.1800506b0
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], reloc.WS2_32.dll_shutdown
mov qword [rbp - 0x10], 0x1f
movups xmm0, xmmword [str.IDXGISwapChain1Present]
movups xmmword [rax], xmm0
mov ecx, dword [0x18008f6f0]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x18008f6f4]
mov word [rax + 0x14], cx
mov byte [rax + 0x16], 0
lea rax, [rbp - 0x28]
mov qword [rbp + 0x48], rax
mov rbx, qword [rbp + 0x40]
mov dword [rbp + 0x38], r14d
lea r9, [rbp + 0x38]
mov edx, 8
lea r8d, [rdx + 0x38]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180029f2d
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x18002a0f5
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002a0f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002a140
jmp 0x18002a0f0
mov rax, qword [rbx]
mov rbx, qword [rax + 0xb0]
mov ecx, 0x40
call fcn.1800506b0
mov rdi, rax
mov qword [rbp - 0x30], rax
mov qword [rax], r14
lea rcx, [rax + 8]
lea rdx, [rbp - 0x28]
call fcn.180006410
mov qword [rdi + 0x28], rbx
lea rax, [0x1800290c0]
mov qword [rdi + 0x30], rax
mov byte [rdi + 0x38], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x180029fa6
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180029fa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002a140
call fcn.180050b2c
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], setsockopt
mov byte [rbp - 0x28], 0
mov rbx, qword [0x1800a43d8]
mov qword [0x1800a43d8], rdi
test rbx, rbx
je 0x18002a034
cmp byte [rbx + 0x38], 0
je 0x180029fd8
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x18002a017
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x18002a012
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002a17c
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
mov edx, 0x40
mov rcx, rbx
call fcn.180050b2c
cmp byte [rdi + 0x38], 0
jne 0x18002a114
mov r8, rdi
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x28]
call fcn.18004f030
test eax, eax
jne 0x18002a071
mov rcx, qword [rdi + 0x28]
call fcn.18004f540
test eax, eax
jne 0x18002a065
mov byte [rdi + 0x38], 1
jmp 0x18002a071
mov rcx, qword [rdi + 0x28]
call fcn.18004f330
mov qword [rdi], r14
cmp byte [rdi + 0x38], 0
jne 0x18002a114
mov rbx, qword [0x1800a43d8]
mov qword [0x1800a43d8], r14
test rbx, rbx
je 0x18002a0f5
cmp byte [rbx + 0x38], 0
je 0x18002a09d
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x18002a0d8
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x18002a0d3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002a13a
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
mov edx, 0x40
mov rcx, rbx
call fcn.180050b2c
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x18002a104
mov rax, qword [rcx]
call qword [rax + select]
mov eax, 0x80004005
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rdi]
mov qword [0x1800a40d8], rax
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x18002a12d
mov rax, qword [rcx]
call qword [rax + select]
xor eax, eax
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18005c4f8
nop
call fcn.18005c4f8
int3
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
int3