Function at 0x14008df10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push r14
sub rsp, 0x50
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.1400989f0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.140098a90
nop
mov rcx, qword [rsp + 0x20]
call fcn.140098c70
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.140098c70
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14008dfed
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14008dfed
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.140098d80
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.140098d80
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14008e090
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14008e090
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.140098e90
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.140098e90
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14008e133
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14008e133
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.140098fa0
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.140098fa0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14008e1d6
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14008e1d6
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.1400990b0
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.1400990b0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14008e279
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14008e279
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.1400991c0
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.1400991c0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14008e31c
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14008e31c
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.1400992d0
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.1400992d0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14008e3bf
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14008e3bf
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.1400993e0
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.1400993e0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14008e462
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14008e462
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.1400994f0
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.1400994f0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14008e505
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14008e505
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.140099600
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.140099600
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14008e5a8
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14008e5a8
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.140099710
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.140099710
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14008e64b
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14008e64b
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.140099820
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.140099820
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14008e6ee
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14008e6ee
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.140099930
mov rbx, rax
cmp byte [rax], 0xe9
jne 0x14008e70e
movsxd rcx, dword [rax + 1]
add rbx, 5
add rbx, rcx
mov rcx, qword [rsp + 0x28]
call fcn.140099930
mov rsi, rax
cmp byte [rax], 0xe9
jne 0x14008e72b
movsxd rcx, dword [rax + 1]
add rsi, 5
add rsi, rcx
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ecx, dword [rax + 4]
sub ecx, dword [rax]
mov r14d, ecx
mov r8d, ecx
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, r14
je 0x14008e7b6
mov byte [0x1406c9eb8], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, r14d
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, r14d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, r14
jne 0x14008e7b6
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rsp + 0x38]
call rbx
nop
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402376c0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop r14
ret