Function at 0x140089900
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [0x140234112]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x140089945
lea rdx, str.NaClGetKiUserExceptionDispatcher:_Failed_to_open_ntdll.dll_n
mov ecx, 0xfffffffc
call fcn.1401f7e70
lea rdx, str.KiUserExceptionDispatcher
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x14008996e
lea rdx, str.NaClGetKiUserExceptionDispatcher:_GetProcAddress___failed_to_get_KiUserExceptionDispatcher_n
mov ecx, 0xfffffffc
call fcn.1401f7e70
mov dword [rsp + 0x2c], 0xaaaaaaaa
cmp byte [rsi], 0xfc
jne 0x140089a63
cmp byte [rsi + 1], 0x48
jne 0x140089a63
cmp byte [rsi + 2], 0x8b
jne 0x140089a63
cmp byte [rsi + 3], 5
jne 0x140089a63
lea rdx, str.NaClPatchWindowsExceptionDispatcherWithCheck:_Got_instructions_expected_for_Windows_Vista_and_Windows_7_n
mov ecx, 2
call fcn.1401f7e70
lea rbx, [rsi + 0x60000000]
lea rdi, [rsi - 0x60000000]
movaps xmm0, xmmword [0x140232ef0]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
and rdi, 0xffffffffffff0000
cmp rbx, rdi
jbe 0x140089ab7
lea r12, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ebp, 0xffff
lea r14, str.Fatal_error_in_file__s__line__d:____s__n
lea r15, str..._.._native_client_src_trusted_service_runtime_win_exception_patch_ntdll_patch.c
mov r8d, gethostbyname
mov rcx, rdi
mov rdx, r12
call r13
cmp rax, 0x30
je 0x140089a41
test rax, rax
je 0x140089ab7
lea rax, str.result__sizeof_info_
mov qword [rsp + 0x20], rax
mov ecx, 0xfffffffc
mov rdx, r14
mov r8, r15
mov r9d, 0x59
call fcn.1401f7e70
cmp dword [rsp + 0x50], 0x10000
je 0x140089a93
mov rax, qword [rsp + 0x48]
add rax, rbp
and rax, 0xffffffffffff0000
add rdi, rax
cmp rdi, rbx
jb 0x140089a01
jmp 0x140089ab7
lea rdx, str.NaClPatchWindowsExceptionDispatcherWithCheck:_Unexpected_start_instructions_n
xor esi, esi
xor ecx, ecx
call fcn.1401f7e70
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401a4270
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
jne 0x140089acb
lea rdx, str.NaClPatchWindowsExceptionDispatcherWithCheck:_AllocatePageInRange___failed_n
mov ecx, 0xfffffffc
call fcn.1401f7e70
xor r14d, r14d
mov edx, 0x10000
mov rcx, r14
call fcn.1401f3b60
lea rdi, [0x1400011e0]
lea rbx, [0x140001208]
sub rbx, rdi
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call fcn.1401a6090
lea rbp, [0x1400011e8]
sub rbp, rdi
cmp dword [rbp + r14 + 1], 0x12345678
je 0x140089b36
lea rax, str.reloc_addr__0x12345678
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_exception_patch_ntdll_patch.c
mov ecx, 0xfffffffc
mov r9d, 0xe8
call fcn.1401f7e70
mov eax, dword [0x14036bfd8]
mov dword [r14 + rbp + 1], eax
lea rdi, [r14 + rbx]
mov rax, qword [rsi]
mov qword [r14 + rbx], rax
mov rax, rsi
sub rax, rdi
movsxd rbp, dword [r14 + rbx + 4]
add rbp, rax
mov dword [r14 + rbx + 4], ebp
movsxd rax, ebp
add rax, rdi
add rax, 4
movsxd rcx, dword [rsi + 4]
add rcx, rsi
add rcx, 4
cmp rax, rcx
je 0x140089ba3
lea rax, str._uintptr_t__new_operand__new_operand___uintptr_t__old_operand__old_operand
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_exception_patch_ntdll_patch.c
mov ecx, 0xfffffffc
mov r9d, 0x7d
call fcn.1401f7e70
cmp rbp, 0x7ffffeff
jge 0x140089bdc
cmp rbp, 0xffffffff80000100
jg 0x140089c06
lea rax, str.new_displacement___INT32_MIN__0x100
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_exception_patch_ntdll_patch.c
mov ecx, 0xfffffffc
mov r9d, 0x84
jmp 0x140089c01
lea rax, str.new_displacement___INT32_MAX___0x100
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_exception_patch_ntdll_patch.c
mov ecx, 0xfffffffc
mov r9d, 0x83
call fcn.1401f7e70
lea rax, [rsi + 8]
lea rcx, [rbx + r14]
add rcx, 0xd
mov byte [rcx - 5], 0xe9
mov rdx, rax
sub rdx, rcx
mov dword [rcx - 4], edx
movsxd rcx, edx
add rcx, rdi
add rcx, 0xd
cmp rcx, rax
je 0x140089c58
lea rax, str.instruction_end___int32_t___code_1___jump_target
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_exception_patch_ntdll_patch.c
mov ecx, 0xfffffffc
mov r9d, 0x92
call fcn.1401f7e70
lea r9, [rsp + 0x2c]
mov edx, 0x10000
mov rcx, r14
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140089c86
lea rdx, str.NaClPatchWindowsExceptionDispatcherWithCheck:_VirtualProtect___failed_to_make_our_intercept_routine_executable_n
mov ecx, 0xfffffffc
call fcn.1401f7e70
lea r9, [rsp + 0x2c]
mov edx, 6
mov rcx, rsi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140089cb4
lea rdx, str.NaClPatchWindowsExceptionDispatcherWithCheck:_VirtualProtect___failed_to_make_the_routine_writable_n
mov ecx, 0xfffffffc
call fcn.1401f7e70
cmp byte [rsi], 0xfc
je 0x140089ce3
lea rax, str.ntdll_routine_0___0xfc
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_exception_patch_ntdll_patch.c
mov ecx, 0xfffffffc
mov r9d, 0x10c
call fcn.1401f7e70
lea rax, [rsi + 6]
mov byte [rsi + 1], 0xe9
mov rcx, r14
sub rcx, rax
mov dword [rsi + 2], ecx
movsxd rax, ecx
add rax, rsi
add rax, 6
cmp rax, r14
je 0x140089d2d
lea rax, str.instruction_end___int32_t___code_1___jump_target
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_exception_patch_ntdll_patch.c
mov ecx, 0xfffffffc
mov r9d, 0x92
call fcn.1401f7e70
lea r9, [rsp + 0x2c]
mov r8d, dword [r9]
mov edx, 6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, 1
test eax, eax
jne 0x140089a73
lea rdx, str.NaClPatchWindowsExceptionDispatcherWithCheck:_VirtualProtect___failed_to_restore_page_permissions_n
mov ecx, 0xfffffffc
jmp 0x140089a6e