Function at 0x40e430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rax, [rcx - 1]
mov rbx, rcx
mov rsi, rdx
mov qword [rsp + 0xd0], r8
test rax, rcx
jne 0x40e5b0
lea rax, [rdx - 1]
test rax, rdx
jne 0x40e5d4
lea rcx, [rsp + 0x40]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x68]
mov r9d, 4
mov r8d, 0x3000
mov rdi, qword [sym.imp.kernel32.dll_VirtualAlloc]
cmp rsi, rdx
cmovb rsi, rdx
xor ecx, ecx
mov rdx, rbx
call rdi
test rax, rax
je 0x40e570
lea r12, [rsi - 1]
test r12, rax
jne 0x40e4c0
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
mov qword [rsp + 0x38], rax
mov r13, qword [sym.imp.kernel32.dll_VirtualFree]
call r13
mov r9, qword [rsp + 0x38]
test eax, eax
je 0x40e5f8
test rsi, r12
jne 0x40e590
lea r14, [rsi + rbx]
neg rsi
xor ebp, ebp
mov r15, rsi
nop dword [rax]
test r9, r9
je 0x40e50a
test r9, r12
je 0x40e563
xor ecx, ecx
mov r9d, 1
mov r8d, 0x2000
mov rdx, r14
call rdi
test rax, rax
je 0x40e570
lea rsi, [rax + r12]
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
and rsi, r15
call r13
test eax, eax
je 0x40e5f8
add ebp, 1
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbx
mov rcx, rsi
call rdi
cmp ebp, 0xa
mov r9, rax
jne 0x40e500
test rax, rax
je 0x40e570
mov rax, r9
jmp 0x40e4aa
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 8
jne 0x40e620
xor eax, eax
jmp 0x40e4aa
xor ecx, ecx
mov r9d, 1
mov r8d, 0x2000
lea rdx, [rsi + rbx]
call rdi
test rax, rax
je 0x40e570
call fcn.0040b440
nop
lea r8, str.__IsPowerOfTwo_size_______0_
xor r9d, r9d
mov edx, 0x2343
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
call fcn.00406910
lea r8, str.__IsPowerOfTwo_alignment_______0_
xor r9d, r9d
mov edx, 0x2344
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
call fcn.00406910
call qword [sym.imp.kernel32.dll_GetLastError]
mov rdx, qword [rsp + 0xd0]
mov dword [rsp + 0x20], 0
mov rcx, rbx
lea r8, str.deallocate
mov r9d, eax
call fcn.0040d470
mov rdx, qword [rsp + 0xd0]
mov r9d, eax
mov rcx, rbx
mov dword [rsp + 0x20], 0
lea r8, str.allocate_aligned
call fcn.0040d470
nop
nop word cs:[rax + rax]
push rsi
push rbx
sub rsp, 0x38
mov r9d, 4
mov r8d, 0x3000
mov rbx, rcx
mov rsi, rdx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
test rax, rax
je 0x40e67f
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rsp + 0x20], 0
mov rdx, rsi
mov rcx, rbx
lea r8, str.allocate
mov r9d, eax
call fcn.0040d470
nop
nop
nop word cs:[rax + rax]
push rbx
sub rsp, 0x30
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x410a50
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
test rax, rax
je 0x40e744
mov byte [rax + 8], 0
movzx edx, byte [rbx]
lea rcx, [0x005c0210]
mov qword [rax], rcx
lea rcx, [rax + 0x208630]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov byte [rax + 0x410a48], dl
lea rdx, [rax + 0x630]
mov qword [rax + 0x220], 0
nop word cs:[rax + rax]
mov qword [rdx], 0
add rdx, 0x208
cmp rcx, rdx
jne 0x40e720
mov qword [rax + 0x410a40], 0
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rsp + 0x20], 0
mov ecx, 0x410a50
lea r8, str.allocate
mov r9d, eax
lea rdx, str.deadlock_detector
call fcn.0040d470
nop
nop