Function at 0x140189f80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x110
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor edi, edi
mov qword [rsp + 0x48], rcx
mov rbx, rdx
mov r12, rcx
test rdx, rdx
jne 0x140189fba
mov eax, 0xc000000d
jmp 0x14018a3a3
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
cmp dword [0x1402c82dc], ecx
je 0x140189fd8
mov eax, 0xc0000476
jmp 0x14018a3a3
mov eax, dword [0x1402c82d8]
nop
test eax, eax
jne 0x14018a3a3
test r12, r12
je 0x14018a007
mov rcx, qword [r12]
test rcx, rcx
jne 0x14018a011
mov dword [0x1402c82d8], 0xc0000008
mov qword [0x1402c9040], r12
mov eax, 0xc0000008
jmp 0x14018a3a3
mov qword ss:[rsp + 0x140], rbp
mov qword [rsp + 0x108], rsi
mov rsi, rdi
mov qword [rsp + 0x100], r13
mov qword [rsp + 0xf8], r14
mov r14, rdi
mov qword [rsp + 0xf0], r15
call fcn.140189aa0
mov rcx, rbx
mov r15, rax
call fcn.140189aa0
mov qword [rsp + 0x38], rax
cmp rax, r15
jne 0x14018a06b
cmp dword [0x1402c4fe8], edi
jne 0x14018a372
jmp 0x14018a323
mov ecx, 0x30
call fcn.1401e03c8
mov rcx, r15
mov qword [rsp + 0x40], rax
mov r14, rax
call fcn.1401898a0
mov rsi, rax
test rax, rax
jne 0x14018a097
mov edi, 0xc0000017
jmp 0x14018a323
xor eax, eax
lea r14, [0x1402e1170]
mov qword [rsi + 0x40], rax
mov r8, r15
mov rbp, rsi
mov r13d, edi
movabs r12, 0x8040000403
nop word [rax + rax]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x70], rdi
test rbp, rbp
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x78], edi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x98], rdi
cmovne rcx, rbp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov rbx, r8
test r8, r8
jne 0x14018a122
lea ecx, [r8 + 0xd]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, rdi
jmp 0x14018a149
movzx eax, byte ds:[r8]
mov r9, r8
shl rax, 4
mov r8, rcx
add rax, r14
lea rcx, [rsp + 0x60]
mov rdx, rax
mov rax, qword [rax + 8]
call qword [case.0x14013b5a0.0]
mov r8, rax
movsxd rax, dword ds:[rsp + 0x30]
mov edx, r8d
sub rax, rbx
sub edx, r15d
add rax, r8
add rbp, rax
movzx eax, bpl
sub al, sil
shl al, 3
movzx ecx, al
xor cl, dl
and cl, 7
xor cl, al
mov eax, r13d
inc r13d
mov byte [rax + rsi + 0x40], cl
cmp r13d, 8
jae 0x14018a1e9
movzx ecx, byte [rbx]
cmp cl, 0xeb
je 0x14018a1e9
lea eax, [rcx + 0x3e]
cmp al, 0x27
ja 0x14018a19b
bt r12, rax
jb 0x14018a1e9
nop dword [rax + rax]
cmp cl, 0xf3
jne 0x14018a25f
cmp byte [rbx + 1], 0xc3
je 0x14018a1e9
cmp cl, 0x26
je 0x14018a1cf
cmp cl, 0x2e
je 0x14018a1cf
cmp cl, 0x36
je 0x14018a1cf
nop
cmp cl, 0x3e
je 0x14018a1cf
cmp cl, 0x64
je 0x14018a1cf
cmp cl, 0x65
jne 0x14018a1db
cmp byte [rbx + 1], 0xff
jne 0x14018a1db
cmp byte [rbx + 2], 0x25
je 0x14018a1e9
nop dword [rax + rax]
cmp edx, 5
jb 0x14018a0c0
mov r14, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
cmp edx, 5
jae 0x14018a21d
mov rcx, r8
call fcn.140189280
test eax, eax
je 0x14018a315
cdqe
add r8, rax
mov rdx, r8
sub edx, r15d
cmp edx, 5
jb 0x14018a1f8
nop dword [rax]
cmp r13d, 8
ja 0x14018a315
lea r13, [rsi + 0x1e]
cmp rbp, r13
jbe 0x14018a234
int3
mov byte [rsi + 0x3e], dl
lea rcx, [rsi + 0x20]
mov ebx, edx
sub bpl, sil
mov r8d, edx
mov rdx, r15
mov byte [rsi + 0x1e], bpl
call fcn.1402074d0
cmp rbx, 0x19
jbe 0x14018a272
mov edi, 0xc0000008
jmp 0x14018a323
nop
cmp cl, 0xff
jne 0x14018a1af
cmp byte [rbx + 1], 0x25
jmp 0x14018a1d9
movzx edx, byte [rsi + 0x1e]
lea rax, [rbx + r15]
mov qword [rsi + 0x48], rax
add rdx, rsi
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x50], rax
mov eax, esi
lea rcx, [rdx + 6]
mov word [rdx], 0x25ff
sub eax, ecx
lea rcx, [rdx + 6]
add eax, 0x48
mov dword [rdx + 2], eax
mov rdx, r13
call fcn.140189220
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], edi
mov r9d, 0x40
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x50]
mov qword [rsp + 0x58], r15
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x50], rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
nop
test eax, eax
jns 0x14018a2e8
mov edi, eax
jmp 0x14018a323
mov dword [r14 + 8], edi
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x20], rsi
mov qword [r14 + 0x18], r15
mov eax, dword [rsp + 0x34]
mov dword [r14 + 0x28], eax
mov rax, qword [0x1402c9058]
mov qword [r14], rax
xor eax, eax
mov qword [0x1402c9058], r14
jmp 0x14018a37b
cmp dword [0x1402c4fe8], 0
mov edi, 0xc0000141
jne 0x14018a32e
mov dword [0x1402c82d8], edi
test rsi, rsi
je 0x14018a35e
xorps xmm0, xmm0
mov r9, rsi
movups xmmword [rsi], xmm0
and r9, 0xffffffffffff0000
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmmword [rsi + 0x40], xmm0
movups xmmword [rsi + 0x50], xmm0
mov r8, qword [r9 + 0x10]
mov qword [rsi + 0x48], r8
mov qword [r9 + 0x10], rsi
nop
test r14, r14
je 0x14018a372
mov edx, 0x30
mov rcx, r14
call fcn.1401e0404
mov qword [0x1402c9040], r12
mov eax, edi
mov r14, qword [rsp + 0xf8]
mov r13, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x108]
mov rbp, qword [rsp + 0x140]
mov r15, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0x110
pop r12
pop rdi
pop rbx
ret