Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x410], rax
movzx eax, word [0x1400032ec]
movsd xmm0, qword [0x1400032c0]
mov ebx, dword [0x1400032c8]
movzx edi, word [0x1400032cc]
mov r14d, dword [0x1400032d8]
movzx r15d, word [0x1400032dc]
mov r13d, dword [str.JJM1]
mov word [rsp + 0x44], ax
mov eax, dword [0x1400032f8]
mov dword [rbp - 0x74], eax
movzx eax, word [0x1400032fc]
mov word [rsp + 0x46], ax
mov eax, dword [0x140003308]
mov dword [rbp - 0x70], eax
movzx eax, word [0x14000330c]
mov word [rsp + 0x48], ax
mov eax, dword [0x140003318]
mov dword [rbp - 0x6c], eax
movzx eax, word [0x14000331c]
mov word [rsp + 0x4a], ax
mov eax, dword [0x140003328]
mov dword [rbp - 0x68], eax
movzx eax, word [0x14000332c]
movsd qword [rbp + 0x18], xmm0
movsd xmm0, qword [str.RQVH1]
mov word [rsp + 0x4c], ax
mov eax, dword [0x140003338]
movsd qword [rbp + 0x20], xmm0
movsd xmm0, qword [0x1400032e0]
mov dword [rbp - 0x64], eax
movzx eax, word [0x14000333c]
movsd qword [rbp + 0x28], xmm0
movsd xmm0, qword [0x1400032f0]
mov word [rsp + 0x4e], ax
mov eax, dword [0x140003348]
movsd qword [rbp + 0x30], xmm0
movsd xmm0, qword [0x140003300]
mov dword [rbp - 0x60], eax
movzx eax, word [0x14000334c]
movsd qword [rbp + 0x38], xmm0
movsd xmm0, qword [0x140003310]
mov word [rsp + 0x50], ax
mov eax, dword [0x140003358]
movsd qword [rbp + 0x40], xmm0
movsd xmm0, qword [0x140003320]
mov dword [rbp - 0x5c], eax
movzx eax, word [0x14000335c]
movsd qword [rbp + 0x48], xmm0
movsd xmm0, qword [0x140003330]
mov word [rsp + 0x52], ax
mov eax, dword [0x140003368]
movsd qword [rbp + 0x50], xmm0
movsd xmm0, qword [0x140003340]
mov dword [rbp - 0x58], eax
movzx eax, word [0x14000336c]
movsd qword [rbp + 0x58], xmm0
movsd xmm0, qword [0x140003350]
mov word [rsp + 0x54], ax
mov eax, dword [0x140003378]
movsd qword [rbp + 0x60], xmm0
movsd xmm0, qword [0x140003360]
mov dword [rbp - 0x54], eax
movzx eax, word [0x14000337c]
movsd qword [rbp + 0x68], xmm0
movsd xmm0, qword [0x140003370]
mov word [rsp + 0x56], ax
mov eax, dword [0x140003388]
movsd qword [rbp + 0x70], xmm0
movsd xmm0, qword [0x140003380]
mov dword [rbp - 0x50], eax
movzx eax, word [0x14000338c]
movsd qword [rbp + 0x78], xmm0
movsd xmm0, qword [str.XAXYZAXAYAZH]
mov word [rsp + 0x58], ax
mov eax, dword [0x140003398]
mov dword [rbp - 0x4c], eax
movzx eax, word [0x14000339c]
movsd qword [rbp + 0x80], xmm0
movsd xmm0, qword [0x1400033a0]
mov word [rsp + 0x5a], ax
movsd qword [rbp + 0x88], xmm0
mov eax, dword [0x1400033a8]
movsd xmm0, qword [0x1400033b0]
mov dword [rbp - 0x48], eax
movzx eax, word [0x1400033ac]
mov word [rsp + 0x5c], ax
mov eax, dword [0x1400033b8]
mov dword [rbp - 0x44], eax
movzx eax, word [0x1400033bc]
mov word [rsp + 0x5e], ax
mov eax, dword [0x1400033c8]
mov dword [rbp - 0x40], eax
movzx eax, word [0x1400033cc]
mov word [rsp + 0x60], ax
mov eax, dword [0x1400033d8]
mov dword [rbp - 0x3c], eax
movzx eax, word [0x1400033dc]
mov word [rsp + 0x62], ax
mov eax, dword [str.Lw_a]
mov dword [rbp - 0x38], eax
movzx eax, word [0x1400033ec]
mov word [rsp + 0x64], ax
mov eax, dword [0x1400033f8]
mov dword [rbp - 0x34], eax
movzx eax, word [0x1400033fc]
mov word [rsp + 0x66], ax
mov eax, dword [0x140003408]
mov dword [rbp - 0x30], eax
movzx eax, word [0x14000340c]
mov word [rsp + 0x68], ax
mov eax, dword [0x140003418]
mov dword [rbp - 0x2c], eax
movzx eax, word [0x14000341c]
movsd qword [rbp + 0x90], xmm0
movsd xmm0, qword [0x1400033c0]
mov word [rsp + 0x6a], ax
mov eax, dword [0x140003428]
movsd qword [rbp + 0x98], xmm0
movsd xmm0, qword [0x1400033d0]
mov dword [rbp - 0x28], eax
movzx eax, word [0x14000342c]
movsd qword [rbp + 0xa0], xmm0
movsd xmm0, qword [0x1400033e0]
mov word [rsp + 0x6c], ax
mov eax, dword [0x140003438]
movsd qword [rbp + 0xa8], xmm0
movsd xmm0, qword [0x1400033f0]
mov dword [rbp - 0x24], eax
movzx eax, word [0x14000343c]
movsd qword [rbp + 0xb0], xmm0
movsd xmm0, qword [0x140003400]
mov word [rsp + 0x6e], ax
mov eax, dword [0x140003448]
movsd qword [rbp + 0xb8], xmm0
movsd xmm0, qword [0x140003410]
mov dword [rbp - 0x20], eax
movzx eax, word [0x14000344c]
movsd qword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x140003420]
mov word [rsp + 0x70], ax
mov eax, dword [0x140003458]
movsd qword [rbp + 0xc8], xmm0
movsd xmm0, qword [0x140003430]
mov dword [rbp - 0x1c], eax
movzx eax, word [0x14000345c]
movsd qword [rbp + 0xd0], xmm0
movsd xmm0, qword [0x140003440]
mov word [rsp + 0x72], ax
mov eax, dword [0x140003468]
movsd qword [rbp + 0xd8], xmm0
movsd xmm0, qword [0x140003450]
mov dword [rbp - 0x18], eax
movzx eax, word [0x14000346c]
movsd qword [rbp + 0xe0], xmm0
movsd xmm0, qword [0x140003460]
mov word [rsp + 0x74], ax
mov eax, dword [0x140003478]
movsd qword [rbp + 0xe8], xmm0
movsd xmm0, qword [0x140003470]
mov dword [rbp - 0x14], eax
movzx eax, word [0x14000347c]
movsd qword [rbp + 0xf0], xmm0
movsd xmm0, qword [0x140003480]
lea rcx, [rbp + 0x141]
mov word [rsp + 0x76], ax
xor edx, edx
mov eax, dword [0x140003488]
mov r8d, 0x2cf
mov dword [rbp - 0x10], eax
movzx eax, word [0x14000348c]
mov word [rsp + 0x78], ax
mov eax, dword [0x140003498]
mov dword [rbp - 0xc], eax
movzx eax, word [0x14000349c]
mov word [rsp + 0x7a], ax
mov eax, dword [0x1400034a8]
mov dword [rbp - 8], eax
movzx eax, word [0x1400034ac]
mov word [rsp + 0x7c], ax
mov eax, dword [0x1400034b8]
mov dword [rbp - 4], eax
movzx eax, word [0x1400034bc]
mov word [rsp + 0x7e], ax
mov eax, dword [0x1400034c8]
mov dword [rbp], eax
movzx eax, word [0x1400034cc]
mov word [rbp - 0x80], ax
mov eax, dword [0x1400034d8]
mov dword [rbp + 4], eax
movzx eax, word [0x1400034dc]
movsd qword [rbp + 0xf8], xmm0
movsd xmm0, qword [0x140003490]
mov word [rbp - 0x7e], ax
mov eax, dword [0x1400034e8]
movsd qword [rbp + 0x100], xmm0
movsd xmm0, qword [0x1400034a0]
mov dword [rbp + 8], eax
movzx eax, word [0x1400034ec]
movsd qword [rbp + 0x108], xmm0
movsd xmm0, qword [0x1400034b0]
mov word [rbp - 0x7c], ax
mov eax, dword [0x1400034f8]
movsd qword [rbp + 0x110], xmm0
movsd xmm0, qword [0x1400034c0]
mov dword [rbp + 0xc], eax
movzx eax, word [0x1400034fc]
movsd qword [rbp + 0x118], xmm0
movsd xmm0, qword [0x1400034d0]
mov word [rbp - 0x7a], ax
mov eax, dword [0x140003500]
mov dword [rbp + 0x10], eax
movzx eax, word [0x140003504]
movsd qword [rbp + 0x120], xmm0
movsd xmm0, qword [0x1400034e0]
mov word [rbp - 0x78], ax
movzx eax, byte [0x140003506]
movsd qword [rbp + 0x128], xmm0
movsd xmm0, qword [0x1400034f0]
mov byte [rsp + 0x42], al
movsd qword [rbp + 0x130], xmm0
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140001577
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001b80
mov rcx, rax
lea rdx, [0x140001d30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movzx eax, word [rsp + 0x44]
movsd xmm0, qword [rbp + 0x18]
mov word [rbp + 0x168], ax
mov eax, dword [rbp - 0x74]
mov dword [rbp + 0x172], eax
movzx eax, word [rsp + 0x46]
mov word [rbp + 0x176], ax
mov eax, dword [rbp - 0x70]
mov dword [rbp + 0x180], eax
movzx eax, word [rsp + 0x48]
mov word [rbp + 0x184], ax
mov eax, dword [rbp - 0x6c]
mov dword [rbp + 0x18e], eax
movzx eax, word [rsp + 0x4a]
mov word [rbp + 0x192], ax
mov eax, dword [rbp - 0x68]
mov dword [rbp + 0x19c], eax
movzx eax, word [rsp + 0x4c]
movsd qword [rbp + 0x140], xmm0
movsd xmm0, qword [rbp + 0x20]
mov word [rbp + 0x1a0], ax
mov eax, dword [rbp - 0x64]
movsd qword [rbp + 0x14e], xmm0
movsd xmm0, qword [rbp + 0x28]
mov dword [rbp + 0x1aa], eax
movzx eax, word [rsp + 0x4e]
movsd qword [rbp + 0x15c], xmm0
movsd xmm0, qword [rbp + 0x30]
mov word [rbp + 0x1ae], ax
mov eax, dword [rbp - 0x60]
movsd qword [rbp + 0x16a], xmm0
movsd xmm0, qword [rbp + 0x38]
mov dword [rbp + 0x1b8], eax
movzx eax, word [rsp + 0x50]
movsd qword [rbp + 0x178], xmm0
movsd xmm0, qword [rbp + 0x40]
mov word [rbp + 0x1bc], ax
mov eax, dword [rbp - 0x5c]
movsd qword [rbp + 0x186], xmm0
movsd xmm0, qword [rbp + 0x48]
mov dword [rbp + 0x1c6], eax
movzx eax, word [rsp + 0x52]
movsd qword [rbp + 0x194], xmm0
movsd xmm0, qword [rbp + 0x50]
mov word [rbp + 0x1ca], ax
mov eax, dword [rbp - 0x58]
movsd qword [rbp + 0x1a2], xmm0
movsd xmm0, qword [rbp + 0x58]
mov dword [rbp + 0x1d4], eax
movzx eax, word [rsp + 0x54]
movsd qword [rbp + 0x1b0], xmm0
movsd xmm0, qword [rbp + 0x60]
mov word [rbp + 0x1d8], ax
mov eax, dword [rbp - 0x54]
movsd qword [rbp + 0x1be], xmm0
movsd xmm0, qword [rbp + 0x68]
mov dword [rbp + 0x1e2], eax
movzx eax, word [rsp + 0x56]
movsd qword [rbp + 0x1cc], xmm0
movsd xmm0, qword [rbp + 0x70]
mov word [rbp + 0x1e6], ax
mov eax, dword [rbp - 0x50]
movsd qword [rbp + 0x1da], xmm0
movsd xmm0, qword [rbp + 0x78]
mov dword [rbp + 0x1f0], eax
movzx eax, word [rsp + 0x58]
movsd qword [rbp + 0x1e8], xmm0
movsd xmm0, qword [rbp + 0x80]
mov word [rbp + 0x1f4], ax
mov eax, dword [rbp - 0x4c]
mov dword [rbp + 0x148], ebx
mov word [rbp + 0x14c], di
mov dword [rbp + 0x156], r14d
mov word [rbp + 0x15a], r15w
mov dword [rbp + 0x164], r13d
movsd qword [rbp + 0x1f6], xmm0
movsd xmm0, qword [rbp + 0x88]
mov dword [rbp + 0x1fe], eax
movzx eax, word [rsp + 0x5a]
mov word [rbp + 0x202], ax
mov eax, dword [rbp - 0x48]
mov dword [rbp + 0x20c], eax
movzx eax, word [rsp + 0x5c]
mov word [rbp + 0x210], ax
mov eax, dword [rbp - 0x44]
mov dword [rbp + 0x21a], eax
movzx eax, word [rsp + 0x5e]
mov word [rbp + 0x21e], ax
mov eax, dword [rbp - 0x40]
mov dword [rbp + 0x228], eax
movzx eax, word [rsp + 0x60]
mov word [rbp + 0x22c], ax
mov eax, dword [rbp - 0x3c]
mov dword [rbp + 0x236], eax
movzx eax, word [rsp + 0x62]
mov word [rbp + 0x23a], ax
mov eax, dword [rbp - 0x38]
mov dword [rbp + 0x244], eax
movzx eax, word [rsp + 0x64]
mov word [rbp + 0x248], ax
mov eax, dword [rbp - 0x34]
mov dword [rbp + 0x252], eax
movzx eax, word [rsp + 0x66]
mov word [rbp + 0x256], ax
mov eax, dword [rbp - 0x30]
mov dword [rbp + 0x260], eax
movzx eax, word [rsp + 0x68]
movsd qword [rbp + 0x204], xmm0
movsd xmm0, qword [rbp + 0x90]
mov word [rbp + 0x264], ax
mov eax, dword [rbp - 0x2c]
movsd qword [rbp + 0x212], xmm0
movsd xmm0, qword [rbp + 0x98]
mov dword [rbp + 0x26e], eax
movzx eax, word [rsp + 0x6a]
movsd qword [rbp + 0x220], xmm0
movsd xmm0, qword [rbp + 0xa0]
mov word [rbp + 0x272], ax
mov eax, dword [rbp - 0x28]
movsd qword [rbp + 0x22e], xmm0
movsd xmm0, qword [rbp + 0xa8]
mov dword [rbp + 0x27c], eax
movzx eax, word [rsp + 0x6c]
movsd qword [rbp + 0x23c], xmm0
movsd xmm0, qword [rbp + 0xb0]
mov word [rbp + 0x280], ax
mov eax, dword [rbp - 0x24]
movsd qword [rbp + 0x24a], xmm0
movsd xmm0, qword [rbp + 0xb8]
mov dword [rbp + 0x28a], eax
movzx eax, word [rsp + 0x6e]
movsd qword [rbp + 0x258], xmm0
movsd xmm0, qword [rbp + 0xc0]
mov word [rbp + 0x28e], ax
mov eax, dword [rbp - 0x20]
movsd qword [rbp + 0x266], xmm0
movsd xmm0, qword [rbp + 0xc8]
mov dword [rbp + 0x298], eax
movzx eax, word [rsp + 0x70]
movsd qword [rbp + 0x274], xmm0
movsd xmm0, qword [rbp + 0xd0]
mov word [rbp + 0x29c], ax
mov eax, dword [rbp - 0x1c]
movsd qword [rbp + 0x282], xmm0
movsd xmm0, qword [rbp + 0xd8]
mov dword [rbp + 0x2a6], eax
movzx eax, word [rsp + 0x72]
movsd qword [rbp + 0x290], xmm0
movsd xmm0, qword [rbp + 0xe0]
mov word [rbp + 0x2aa], ax
mov eax, dword [rbp - 0x18]
mov dword [rbp + 0x2b4], eax
movzx eax, word [rsp + 0x74]
movsd qword [rbp + 0x29e], xmm0
movsd xmm0, qword [rbp + 0xe8]
mov word [rbp + 0x2b8], ax
movsd qword [rbp + 0x2ac], xmm0
mov eax, dword [rbp - 0x14]
xor ecx, ecx
movsd xmm0, qword [rbp + 0xf0]
mov edx, 0x2d0
mov dword [rbp + 0x2c2], eax
mov r8d, 0x1000
movzx eax, word [rsp + 0x76]
mov word [rbp + 0x2c6], ax
lea r9d, [rcx + 0x40]
mov eax, dword [rbp - 0x10]
mov dword [rbp + 0x2d0], eax
movzx eax, word [rsp + 0x78]
mov word [rbp + 0x2d4], ax
mov eax, dword [rbp - 0xc]
mov dword [rbp + 0x2de], eax
movzx eax, word [rsp + 0x7a]
mov word [rbp + 0x2e2], ax
mov eax, dword [rbp - 8]
mov dword [rbp + 0x2ec], eax
movzx eax, word [rsp + 0x7c]
mov word [rbp + 0x2f0], ax
mov eax, dword [rbp - 4]
mov dword [rbp + 0x2fa], eax
movzx eax, word [rsp + 0x7e]
mov word [rbp + 0x2fe], ax
mov eax, dword [rbp]
mov dword [rbp + 0x308], eax
movzx eax, word [rbp - 0x80]
mov word [rbp + 0x30c], ax
mov eax, dword [rbp + 4]
movsd qword [rbp + 0x2ba], xmm0
movsd xmm0, qword [rbp + 0xf8]
mov dword [rbp + 0x316], eax
movzx eax, word [rbp - 0x7e]
movsd qword [rbp + 0x2c8], xmm0
movsd xmm0, qword [rbp + 0x100]
mov word [rbp + 0x31a], ax
mov eax, dword [rbp + 8]
movsd qword [rbp + 0x2d6], xmm0
movsd xmm0, qword [rbp + 0x108]
mov dword [rbp + 0x324], eax
movzx eax, word [rbp - 0x7c]
movsd qword [rbp + 0x2e4], xmm0
movsd xmm0, qword [rbp + 0x110]
mov word [rbp + 0x328], ax
mov eax, dword [rbp + 0xc]
movsd qword [rbp + 0x2f2], xmm0
movsd xmm0, qword [rbp + 0x118]
mov dword [rbp + 0x332], eax
movzx eax, word [rbp - 0x7a]
movsd qword [rbp + 0x300], xmm0
movsd xmm0, qword [rbp + 0x120]
mov word [rbp + 0x336], ax
mov eax, dword [rbp + 0x10]
mov dword [rbp + 0x338], eax
movzx eax, word [rbp - 0x78]
movsd qword [rbp + 0x30e], xmm0
movsd xmm0, qword [rbp + 0x128]
mov word [rbp + 0x33c], ax
movzx eax, byte [rsp + 0x42]
movsd qword [rbp + 0x31c], xmm0
movsd xmm0, qword [rbp + 0x130]
mov byte [rbp + 0x33e], al
movsd qword [rbp + 0x32a], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rcx, [rbp + 0x140]
mov r8d, 5
mov rdx, rax
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub r8, 1
jne 0x140001ad2
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
call rax
xor eax, eax
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140001df0
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret