Function at 0x1401a6790
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
movzx ebx, r8b
movzx ebp, dl
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
xor eax, eax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov byte [rcx + 0x48], al
mov qword [rcx + 0x50], rax
mov qword [rcx + 0x58], rax
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
mov rcx, qword [0x1407e6a20]
test rcx, rcx
jne 0x1401a680f
mov ecx, 0x110
call fcn.14036fce4
mov qword [rsp + 0x70], rax
mov rcx, rax
call fcn.140088470
mov rcx, rax
mov qword [0x1407e6a20], rax
mov rax, qword [rcx]
mov rdx, qword [rax + 0x68]
lea rax, [method.xmrig::HwlocCpuInfo.virtual_104]
cmp rdx, rax
jne 0x1401a6bb1
movzx eax, byte [rcx + 0xc]
mov byte [rdi + 0x48], al
test rcx, rcx
jne 0x1401a6853
mov ecx, 0x110
call fcn.14036fce4
mov qword [rsp + 0x70], rax
mov rcx, rax
call fcn.140088470
mov rcx, rax
mov qword [0x1407e6a20], rax
mov rax, qword [rcx]
mov rdx, qword [rax + 0x30]
lea r8, [method.xmrig::HwlocCpuInfo.virtual_48]
lea r14, [method.xmrig::HwlocCpuInfo.virtual_24]
cmp rdx, r8
jne 0x1401a6bcc
mov r8, qword [rax + 0x18]
cmp r8, r14
jne 0x1401a6bbf
mov eax, dword [rcx + 0x94]
shr eax, 2
and al, 1
jmp 0x1401a6892
mov rcx, qword [0x1407e6a20]
mov byte [rdi + 0x49], al
test rcx, rcx
jne 0x1401a68bb
mov ecx, 0x110
call fcn.14036fce4
mov qword [rsp + 0x70], rax
mov rcx, rax
call fcn.140088470
mov rcx, rax
mov qword [0x1407e6a20], rax
mov rax, qword [rcx]
mov rdx, qword [rax + 0x38]
lea r8, [method.xmrig::HwlocCpuInfo.virtual_56]
cmp rdx, r8
jne 0x1401a6be0
mov r8, qword [rax + 0x18]
cmp r8, r14
jne 0x1401a6bd3
mov eax, dword [rcx + 0x94]
shr eax, 3
and al, 1
jmp 0x1401a68f3
mov rcx, qword [0x1407e6a20]
mov byte [rdi + 0x4a], al
mov byte [rdi + 0x4b], 0
test bl, bl
je 0x1401a69af
mov eax, dword [0x14054746c]
test eax, eax
jle 0x1401a6915
mov byte [rdi + 0x4b], 1
jmp 0x1401a69af
jns 0x1401a69af
call fcn.1400773c0
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0xd0]
lea rax, [method.xmrig::HwlocCpuInfo.virtual_208]
cmp rdx, rax
jne 0x1401a6be7
mov ebx, dword [rcx + 0x78]
call fcn.1400773c0
mov rcx, qword [rax]
mov rdx, qword [rcx + 8]
lea rcx, [fcn.140062260]
cmp rdx, rcx
jne 0x1401a6bf0
mov eax, dword [rax + 8]
cmp ebx, 1
jne 0x1401a6ad9
call fcn.1400773c0
mov rsi, rax
call fcn.1400773c0
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x88]
lea rcx, [fcn.1400883b0]
cmp rdx, rcx
jne 0x1401a6bfa
mov rbx, qword [rax + 0x58]
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0xa8]
cmp rax, rbx
sete al
mov byte [rdi + 0x4b], al
mov rcx, qword [0x1407e6a20]
cmp byte [rdi + 0x4a], 0
jne 0x1401a69b9
mov byte [rdi + 0x4b], 0
test rcx, rcx
jne 0x1401a69df
mov ecx, 0x110
call fcn.14036fce4
mov qword [rsp + 0x70], rax
mov rcx, rax
call fcn.140088470
mov rcx, rax
mov qword [0x1407e6a20], rax
mov rax, qword [rcx]
mov rdx, qword [rax + 0x58]
lea r8, [method.xmrig::HwlocCpuInfo.virtual_88]
cmp rdx, r8
jne 0x1401a6c14
mov r8, qword [rax + 0x18]
cmp r8, r14
jne 0x1401a6c07
mov eax, dword [rcx + 0x94]
shr eax, 0xb
and al, 1
mov byte [rdi + 0x4c], al
mov ebx, 0x20000
mov eax, 0x40000
cmp byte [rdi + 0x4b], 0
cmovne ebx, eax
mov qword [rdi + 0x58], rbx
cmp byte [0x1407e6cf8], 0
je 0x1401a6a50
test bpl, bpl
je 0x1401a6a50
mov edx, 0x200000
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x20003000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1401a6a70
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1401a6b8e
mov qword [rdi + 0x50], rax
mov eax, 0xec0
lock xadd qword [0x1407e6cf0], rax
movzx ecx, ax
add rcx, qword [rdi + 0x50]
mov qword [rdi + 0x20], rcx
lea r15, [0x140817280]
mov r8, r15
lea r14, [0x140817040]
sub r8, r14
mov rdx, r14
call fcn.14038e7d0
mov rcx, qword [rdi + 0x20]
lea r12, [0x140817281]
lea rbp, [0x140817371]
lea rsi, [0x140817301]
sub rcx, r14
add rcx, r15
cmp byte [rdi + 0x4c], 0
je 0x1401a6b04
mov r8, rbp
sub r8, rsi
mov rdx, rsi
jmp 0x1401a6b0d
cmp ebx, 2
jne 0x1401a69a8
sub eax, 3
je 0x1401a6968
mov rcx, qword [0x1407e6a20]
cmp eax, 1
je 0x1401a690c
mov byte [rdi + 0x4b], 0
jmp 0x1401a69af
mov r8, rsi
sub r8, r12
mov rdx, r12
call fcn.14038e7d0
lea rdx, [0x140817a70]
mov rbx, rdx
lea r8, [0x140817b40]
sub rbx, r8
add rbx, 0x10000
and rbx, 0xffffffffffffffc0
sub r8, rdx
mov rcx, qword [rdi + 0x20]
add rcx, rbx
call fcn.14038e7d0
mov rax, rsi
sub eax, r12d
sub ebp, esi
cmp byte [rdi + 0x4c], 0
cmove ebp, eax
sub ebp, r14d
add ebp, r15d
mov dword [rdi + 0x2c], ebp
mov rcx, qword [rdi + 0x20]
mov rax, rcx
sub rax, r14
add rax, r15
mov qword [rdi + 0x38], rax
lea rax, [rbx + rcx]
mov qword [rdi + 0x40], rax
mov rax, rdi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rdx, str.Failed_to_allocate_executable_memory
lea rcx, [rsp + 0x20]
call fcn.140004cf0
lea rdx, [0x14053df60]
lea rcx, [rsp + 0x20]
call fcn.14038f340
int3
call rdx
mov rcx, qword [0x1407e6a20]
jmp 0x1401a682a
mov edx, 2
call r8
jmp 0x1401a688b
call rdx
jmp 0x1401a688b
mov edx, 3
call r8
jmp 0x1401a68ec
call rdx
jmp 0x1401a68ec
call rdx
mov ebx, eax
jmp 0x1401a6940
mov rcx, rax
call rdx
jmp 0x1401a695f
mov rcx, rax
call rdx
mov rbx, rax
jmp 0x1401a6993
mov edx, 0xb
call r8
jmp 0x1401a6a0e
call rdx
jmp 0x1401a6a0e