Function at 0x140014ae0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400643c8]
xor rax, rsp
mov qword [rbp + 0x88], rax
mov qword [rsp + 0x58], r8
mov rsi, rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x60], rdx
xor r12d, r12d
movsxd rcx, dword [0x1400643a8]
call fcn.140028534
mov r14, rax
movsxd r8, dword [0x1400643a8]
xor edx, edx
mov rcx, rax
call fcn.140020860
lea rax, [0x140064250]
movups xmm0, xmmword [rax]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r14 + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r14 + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r14 + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [r14 + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [r14 + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [r14 + 0x60], xmm0
lea rcx, [r14 + 0x80]
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rax]
movups xmmword [rcx], xmm1
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm1
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm0
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm1
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm0
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm1
mov rax, qword [rax + 0x70]
mov qword [rcx + 0x70], rax
mov ebx, r12d
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rsi
movabs rdi, 0x7fffffffffffffff
movabs rcx, 0x8000000000000027
mov r15d, 4
lea r8d, [r12 + 0x16]
lea r13d, [r12 + 0xf]
cmp qword [rsi + 0x10], r15
jae 0x140014c39
mov edx, r13d
mov qword [rbp - 0x80], rdx
mov qword [rsp + 0x78], 8
mov ecx, r12d
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], cl
lea r8, [rsp + 0x68]
jmp 0x140014d87
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x60], r13
mov rax, qword [rsi + 0x10]
mov rsi, r15
cmp rax, r15
cmovb rsi, rax
mov rdx, qword [rsp + 0x50]
mov rax, rdx
mov qword [rsp + 0x40], rdx
cmp qword [rdx + 0x18], 0x10
jb 0x140014c6b
mov rax, qword [rdx]
mov qword [rsp + 0x40], rax
cmp rsi, r13
ja 0x140014c90
mov qword [rbp - 0x68], rsi
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14001ff70
mov byte [rbp + rsi - 0x78], bl
mov r12, qword [rbp - 0x78]
jmp 0x140014d1b
cmp rsi, rdi
ja 0x140015424
mov rbx, rsi
or rbx, r13
cmp rbx, rdi
jbe 0x140014cca
mov rbx, rdi
mov rax, rcx
mov rcx, rax
call fcn.14001df20
test rax, rax
je 0x14001542a
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140014cfa
cmp rbx, r8
cmovb rbx, r8
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140014ced
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140015418
jmp 0x140014caa
test rcx, rcx
je 0x140014cfa
call fcn.14001df20
mov r12, rax
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rbx
mov r8, rsi
mov rdx, qword [rsp + 0x40]
mov rcx, r12
call fcn.14001ff70
mov byte [r12 + rsi], 0
mov qword [rbp - 0x78], r12
mov ebx, r15d
mov dword [rsp + 0x38], ebx
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rcx, r12
mov rdx, qword [rbp - 0x68]
add rdx, rcx
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rcx, r12
call fcn.14001cf40
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rbp - 0x68]
movups xmmword [rsp + 0x78], xmm1
lea r8, [rsp + 0x68]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0x10
cmovae r8, rcx
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x68]
xor r12d, r12d
mov rsi, qword [rsp + 0x50]
mov eax, dword [r8]
mov dword [rsp + 0x40], eax
cmp rdx, 0x10
jb 0x140014dc1
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014dbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015430
call fcn.14001df5c
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], r13
mov byte [rbp + 0x48], 0
lea eax, [rbx + 4]
mov dword [rsp + 0x48], eax
cdqe
cmp rax, qword [rsi + 0x10]
jbe 0x140014dfb
mov qword [rsp + 0x78], 8
mov rcx, r12
mov byte [rsp + 0x70], 0
lea rax, [rsp + 0x68]
jmp 0x140014f5a
movsxd rcx, ebx
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x60], r13
mov rax, qword [rsi + 0x10]
cmp rax, rcx
jb 0x140015436
sub rax, rcx
cmp rax, 4
cmovb r15, rax
mov rax, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140014e2b
mov rax, qword [rsi]
lea rsi, [rcx + rax]
cmp r15, 0xf
ja 0x140014e57
mov qword [rbp - 0x68], r15
mov r8, r15
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.14001ff70
mov byte [rbp + r15 - 0x78], 0
mov rbx, qword [rbp - 0x78]
jmp 0x140014ef2
cmp r15, rdi
ja 0x14001543c
mov rax, r15
or rax, 0xf
cmp rax, rdi
jbe 0x140014e95
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.14001df20
test rax, rax
je 0x140015412
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140014ed3
mov rdi, rax
cmp rax, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140014ec1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001541e
jmp 0x140014e76
test rcx, rcx
je 0x140014ed0
call fcn.14001df20
mov rbx, rax
jmp 0x140014ed3
mov rbx, r12
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], rdi
mov r8, r15
mov rdx, rsi
mov rcx, rbx
call fcn.14001ff70
mov byte [rbx + r15], 0
mov qword [rbp - 0x78], rbx
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x38], eax
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rcx, rbx
mov rdx, qword [rbp - 0x68]
add rdx, rcx
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rcx, rbx
call fcn.14001cf40
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rbp - 0x68]
movups xmmword [rsp + 0x78], xmm1
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r13
mov byte [rbp - 0x78], 0
lea rax, [rsp + 0x68]
movq rcx, xmm0
psrldq xmm1, 8
movq r13, xmm1
cmp r13, 0x10
cmovae rax, rcx
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x68], rcx
mov ebx, dword [rax]
cmp r13, 0x10
jb 0x140014f99
lea rdx, [r13 + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014f94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015412
call fcn.14001df5c
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.14000ace0
nop
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140018ed0
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8d, eax
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.14000ace0
nop
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140018ed0
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8d, eax
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x30]
call fcn.14000ace0
nop
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140018ed0
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8d, eax
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.14000ace0
nop
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140018ed0
mov r13d, eax
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8d, eax
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x30]
call fcn.14000ace0
nop
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x140015081
lea r12d, [rax + 1]
mov rcx, r14
call fcn.140024b7c
jmp 0x1400153a8
lea rax, [rbp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], r12d
mov rdi, qword [rbp - 0x80]
mov rsi, qword [rsp + 0x68]
nop dword [rax + rax]
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [r9 + 0xc]
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x30]
call fcn.14000ace0
nop
lea rbx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rbx, qword [rbp - 0x58]
movsx rax, word [rbx + 2]
mov ecx, 0x404
cmp ax, cx
je 0x140015311
mov ecx, 0x400
cmp ax, cx
jne 0x140015126
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 0x10
cmovae rdx, qword [rbp + 0x28]
lea r8, [rsp + 0x68]
cmp rdi, 0x10
cmovae r8, rsi
movsx rcx, word [rbx]
cmp ecx, 9
jg 0x1400152de
movsxd rax, dword [rbx + 4]
add rcx, rax
add rcx, r15
sub edx, ecx
add edx, dword [rbx + 8]
add dword [rax + r8], edx
jmp 0x1400152d5
mov ecx, 0x401
cmp ax, cx
jne 0x140015140
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rdx, qword [rbp + 8]
jmp 0x1400150f4
mov ecx, 0x402
cmp ax, cx
jne 0x140015180
lea r8, [rsp + 0x68]
cmp rdi, 0x10
cmovae r8, rsi
movsx rax, word [rbx]
cmp eax, 9
jg 0x1400152de
movsxd rcx, dword [rbx + 4]
lea rdx, [rcx + rax]
add rdx, r15
mov eax, r15d
sub eax, edx
add eax, dword [rbx + 8]
add dword [rcx + r8], eax
jmp 0x1400152d5
mov ecx, 0x403
cmp ax, cx
jne 0x1400152aa
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140018ed0
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8d, eax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x30]
call fcn.14000ace0
nop
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.140018ed0
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8d, eax
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x30]
call fcn.14000ace0
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140015206
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
test rax, rax
je 0x1400152ec
mov ecx, r12d
mov rdx, r12
movsxd r8, dword [0x1400643a8]
shr r8, 3
test r8, r8
je 0x14001525b
nop
mov rax, qword [r14 + rdx*8]
test rax, rax
je 0x14001525b
cmp rax, r9
je 0x14001525f
inc ecx
inc rdx
movsxd rax, ecx
cmp rax, r8
jb 0x140015240
mov qword [r14 + rdx*8], r9
movsxd rax, ecx
lea rdx, [r14 + rax*8]
lea r8, [rsp + 0x68]
cmp rdi, 0x10
cmovae r8, rsi
movsx rcx, word [rbx]
cmp ecx, 9
jg 0x140015295
movsxd rax, dword [rbx + 4]
add rcx, rax
add rcx, r15
sub edx, ecx
add dword [rax + r8], edx
mov rdi, qword [rbp - 0x80]
mov rsi, qword [rsp + 0x68]
lea rcx, [rbp - 0x38]
call fcn.140002c80
nop
lea rcx, [rbp - 0x78]
call fcn.140002c80
jmp 0x1400152de
lea r8, [r14 + rax*8]
lea rdx, [rsp + 0x68]
cmp rdi, 0x10
cmovae rdx, rsi
movsx rcx, word [rbx]
cmp ecx, 9
jg 0x1400152de
movsxd rax, dword [rbx + 4]
add rcx, rax
add rcx, r15
sub r8d, ecx
add dword [rax + rdx], r8d
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.140002c80
jmp 0x1400150a0
mov r12d, 1
lea rcx, [rbp - 0x38]
call fcn.140002c80
nop
lea rcx, [rbp - 0x78]
call fcn.140002c80
nop
lea rcx, [rbp - 0x58]
call fcn.140002c80
jmp 0x14001538e
lea rcx, [rbp - 0x58]
call fcn.140002c80
lea rdx, [rsp + 0x68]
cmp rdi, 0x10
cmovae rdx, rsi
mov r8, qword [rsp + 0x78]
mov rcx, r15
call fcn.14001ff70
lea rcx, [rsp + 0x68]
cmp rdi, 0x10
cmovae rcx, rsi
mov r8, qword [rsp + 0x78]
xor edx, edx
call fcn.140020860
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rcx, qword [rbp - 0x18]
movsxd rax, dword [rsp + 0x40]
add rax, r15
mov edx, r13d
call rax
lea rcx, [rsp + 0x4c]
call fcn.14000b3a0
test rax, rax
je 0x140015389
movsxd r8, dword [rsp + 0x4c]
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call fcn.140005480
call fcn.14000b360
mov rcx, r14
call fcn.140024b7c
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp - 0x18]
call fcn.140002c80
nop
lea rcx, [rbp + 0x68]
call fcn.140002c80
nop
lea rcx, [rbp + 8]
call fcn.140002c80
nop
lea rcx, [rbp + 0x28]
call fcn.140002c80
nop
lea rcx, [rsp + 0x68]
call fcn.140002c80
nop
mov rcx, qword [rsp + 0x50]
call fcn.140002c80
mov eax, r12d
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.14001df00
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140024798
nop
call fcn.140002d50
nop
call fcn.140002d50
nop
call fcn.140002d70
int3
call fcn.140024798
int3
call fcn.140024798
nop
call fcn.140007920
int3
call fcn.140002d70
int3