Function at 0x140002a40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd rsi, dword [rcx + 0x3c]
xor ebx, ebx
mov rbp, rcx
add rsi, rcx
cmp dword [rsi], 0x4550
je 0x140002a8e
movzx eax, word [rcx + 0xa]
mov ecx, 0x111
and ax, 0x11
cmp ax, cx
je 0x140002a8e
lea rdx, [0x140001760]
jmp 0x140002ca6
mov edx, dword [rsi + 0x50]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x140002acd
lea rdx, [0x140001770]
call fcn.140002834
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8d, [rdi + 0xa]
mov edx, eax
call fcn.140002790
jmp 0x140002ce9
mov r8d, dword [rsi + 0x54]
mov rdx, rbp
mov rcx, rax
call qword [0x140007040]
movzx ecx, word [rsi + 6]
movzx eax, word [rsi + 0x14]
test ecx, ecx
je 0x140002b2c
lea r15, [rsi + 0x24]
lea r14, [rsi + 0x2c]
add rsi, 0x28
add r15, rax
add r14, rax
add rsi, rax
mov r12d, ecx
cmp dword [r14], ebx
je 0x140002b1b
mov edx, dword [r14]
mov ecx, dword [r15]
mov r8d, dword [rsi]
add rdx, rbp
add rcx, rdi
call qword [0x140007040]
add rsi, 0x28
add r14, 0x28
add r15, 0x28
dec r12
jne 0x140002b01
movsxd rsi, dword [rdi + 0x3c]
add rsi, rdi
call fcn.140003c44
sub eax, dword [0x140007080]
cmp eax, 0x7fff
jbe 0x140002b4c
xor eax, eax
jmp 0x140002cec
mov edx, dword [rsi + 0xb4]
test edx, edx
je 0x140002bb8
mov ecx, dword [rsi + 0xb0]
mov r10, rdi
sub r10, qword [rsi + 0x30]
add rcx, rdi
test edx, edx
je 0x140002bb8
mov ebp, dword [rcx]
lea r11, [rcx + 4]
lea rcx, [rcx + 8]
mov r8d, dword [r11]
sub r8d, 8
je 0x140002ba7
movzx eax, word [rcx]
mov r9d, eax
shr r9d, 0xc
test r9d, r9d
je 0x140002b9d
cmp r9d, 0xa
jne 0x140002bac
and eax, 0xfff
add eax, ebp
add qword [rax + rdi], r10
add rcx, 2
add r8d, 0xfffffffe
jne 0x140002b7d
sub edx, dword [r11]
jmp 0x140002b68
lea rdx, [0x140001788]
jmp 0x140002ca6
cmp dword [rsi + 0x94], ebx
je 0x140002cb6
mov ebp, dword [rsi + 0x90]
add rbp, rdi
je 0x140002cb6
mov eax, dword [rbp + 0xc]
test eax, eax
je 0x140002cb6
mov r14d, eax
add r14, rdi
call fcn.140003c44
sub eax, dword [0x140007080]
cmp eax, 0x7fff
ja 0x140002b45
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r13, rax
test rax, rax
je 0x140002cad
mov r14d, dword [rbp]
mov r15d, dword [rbp + 0x10]
add r14, rdi
add r15, rdi
jmp 0x140002c8e
movabs r8, 0x8000000000000000
mov rax, rcx
mov rdx, rbx
and rax, r8
movzx r12d, bx
cmp rax, r8
je 0x140002c5e
add rcx, 2
add rcx, rdi
mov qword [rsp + 0x28], rcx
call qword [0x140007030]
lea rdx, [rsp + 0x20]
mov word [rsp + 0x20], ax
mov word [rsp + 0x22], ax
jmp 0x140002c62
movzx r12d, word [r14]
lea r9, [rsp + 0x60]
movzx r8d, r12w
mov rcx, r13
mov qword [rsp + 0x60], rbx
call qword [0x140007070]
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x140002c9f
mov qword [r15], rax
add r14, 8
add r15, 8
mov rcx, qword [r14]
test rcx, rcx
jne 0x140002c1f
add rbp, 0x14
jmp 0x140002bd3
lea rdx, [0x1400017a8]
call fcn.140002834
jmp 0x140002ce9
lea rdx, [0x140001798]
jmp 0x140002ca6
mov r8d, dword [rsi + 0xa0]
test r8d, r8d
je 0x140002ce6
mov ecx, dword [rsi + 0xa4]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
lea rcx, [rdi + r8]
mov r8, rdi
shr rdx, 3
call qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov rbx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret