Function at 0x1400441e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push r14
sub rsp, 0x50
mov rax, qword [0x1400c1060]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.14004e900
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.14004e9a0
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004eb80
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.14004eb80
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x1400442bd
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1400442bd
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004ec90
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.14004ec90
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x140044360
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x140044360
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004eda0
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.14004eda0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x140044403
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x140044403
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004eeb0
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.14004eeb0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x1400444a6
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1400444a6
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004efc0
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.14004efc0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x140044549
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x140044549
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004f0d0
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.14004f0d0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x1400445ec
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1400445ec
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004f1e0
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.14004f1e0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14004468f
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14004468f
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004f2f0
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.14004f2f0
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x140044732
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x140044732
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004f400
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.14004f400
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x1400447d5
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1400447d5
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004f510
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.14004f510
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x140044878
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x140044878
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004f620
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.14004f620
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x14004491b
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14004491b
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004f730
mov rsi, rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ebx, dword [rax + 4]
sub ebx, dword [rax]
mov rcx, qword [rsp + 0x28]
call fcn.14004f730
mov r14, rax
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
je 0x1400449be
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1400449be
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
nop
mov rcx, qword [rsp + 0x20]
call fcn.14004f840
mov rbx, rax
cmp byte [rax], 0xe9
jne 0x1400449de
movsxd rcx, dword [rax + 1]
add rbx, 5
add rbx, rcx
mov rcx, qword [rsp + 0x28]
call fcn.14004f840
mov rsi, rax
cmp byte [rax], 0xe9
jne 0x1400449fb
movsxd rcx, dword [rax + 1]
add rsi, 5
add rsi, rcx
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
mov ecx, dword [rax + 4]
sub ecx, dword [rax]
mov r14d, ecx
mov r8d, ecx
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, r14
je 0x140044a86
mov byte [0x1401a7ecc], 1
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, r14d
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, r14d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, r14
jne 0x140044a86
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rsp + 0x38]
call rbx
nop
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140092b30
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop r14
ret