Function at 0x1400b9c70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
sub rsp, 0x58
mov r12, rdx
mov rbx, rcx
call fcn.14000e5b0
mov rcx, rax
lea r8, str.CryptonightR_update_ASM_code
mov edx, 0xa
call fcn.140012540
mov rcx, qword [r12 + 0x110]
mov edx, 0x10000
test rcx, rcx
jne 0x1400b9ccb
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [r12 + 0x110], rax
jmp 0x1400b9cdf
lea r9, [rsp + 0x98]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rsi, qword [r12 + 0x110]
mov qword [rsp + 0x30], rsi
mov rdi, rsi
test rsi, rsi
je 0x1400ba2d7
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r15
cmp rbx, 2
jne 0x1400ba078
lea rbx, [0x1400f1d35]
lea rax, [0x1400f1a40]
sub rbx, rax
test rbx, rbx
jle 0x1400b9d41
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rdi, [rbx + rsi]
mov eax, dword [r12 + 0x118]
lea rbp, [r12 + 0x148]
mov rbx, qword [rbp]
lea rsi, [0x140000000]
mov dword [rsp + 0x20], eax
mov r15d, 0xffffffff
mov qword [rsp + 0x28], rbp
mov r14d, r15d
cmp bl, 6
je 0x1400b9eb3
mov r9, rbx
mov rcx, rbx
shr r9, 8
movzx r12d, bl
shr rcx, 0x10
mov r13, rbp
movzx eax, cl
movzx edx, r9b
test r12b, r12b
cmovne ecx, eax
movzx eax, dl
movzx r8d, cl
movzx ecx, r9b
cmovne ecx, eax
xor r15d, r15d
test r12b, r12b
movzx ecx, cl
lea eax, [r12 + 2]
mov dword [rsp + 0x98], ecx
movzx eax, al
cmovne r15d, eax
cmp r8b, 8
mov eax, r8d
cmove eax, ecx
shl al, 2
or al, cl
shl al, 3
or r15b, al
lea eax, [r12 - 3]
cmp al, 1
ja 0x1400b9e1a
cmp r8d, r14d
je 0x1400b9e1a
movzx eax, r15b
mov r14d, r8d
mov rdx, qword [rsi + rax*8 + 0xd6410]
mov rbp, qword [rsi + rax*8 + 0xd6418]
sub rbp, rdx
test rbp, rbp
jle 0x1400b9e1a
mov r8, rbp
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rsp + 0x98]
add rdi, rbp
cmp ecx, r14d
movzx ebp, r15b
mov eax, 0xffffffff
cmove r14d, eax
cmp dword [rsp + 0x20], 2
mov rdx, qword [rsi + rbp*8 + 0xd5c00]
jne 0x1400b9e4b
test bl, bl
jne 0x1400b9e4b
cmp byte [rdx], 0x49
jne 0x1400b9e48
mov byte [rdi], 0x41
inc rdi
inc rdx
mov rbp, qword [rsi + rbp*8 + 0xd5c08]
sub rbp, rdx
test rbp, rbp
jle 0x1400b9e69
mov r8, rbp
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbp
cmp r12b, 1
jne 0x1400b9e76
shr rbx, 0x20
mov dword [rdi - 4], ebx
mov rbx, qword [r13 + 8]
add r13, 8
mov rax, rbx
mov rdx, rbx
shr rax, 0x10
movzx r12d, bl
shr rdx, 8
movzx ecx, al
movzx r9d, dl
cmp bl, 6
jne 0x1400b9d93
mov rbp, qword [rsp + 0x28]
mov r15d, 0xffffffff
mov r12, qword [rsp + 0x88]
lea r13, [0x1400f1e84]
mov rbx, r13
lea rdx, [0x1400f1d35]
sub rbx, rdx
test rbx, rbx
jle 0x1400b9eda
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
mov rbx, qword [rbp]
mov r14d, r15d
mov eax, dword [r12 + 0x118]
mov dword [rsp + 0x98], eax
cmp bl, 6
je 0x1400ba030
mov r9, rbx
mov rcx, rbx
shr r9, 8
movzx r12d, bl
shr rcx, 0x10
movzx edx, r9b
movzx eax, cl
test r12b, r12b
cmovne ecx, eax
movzx eax, dl
movzx r8d, cl
movzx ecx, r9b
cmovne ecx, eax
xor r15d, r15d
test r12b, r12b
movzx r13d, cl
lea eax, [r12 + 2]
movzx eax, al
cmovne r15d, eax
cmp r8b, 8
mov eax, r8d
cmove eax, r13d
shl al, 2
or al, r13b
shl al, 3
or r15b, al
lea eax, [r12 - 3]
cmp al, 1
ja 0x1400b9f8e
cmp r8d, r14d
je 0x1400b9f8e
movzx eax, r15b
mov r14d, r8d
mov rdx, qword [rsi + rax*8 + 0xd6410]
mov rbp, qword [rsi + rax*8 + 0xd6418]
sub rbp, rdx
test rbp, rbp
jle 0x1400b9f8e
mov r8, rbp
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbp
cmp r13d, r14d
movzx ebp, r15b
mov eax, 0xffffffff
cmove r14d, eax
cmp dword [rsp + 0x98], 2
mov rdx, qword [rsi + rbp*8 + 0xd5c00]
jne 0x1400b9fc2
test bl, bl
jne 0x1400b9fc2
cmp byte [rdx], 0x49
jne 0x1400b9fbf
mov byte [rdi], 0x41
inc rdi
inc rdx
mov rbp, qword [rsi + rbp*8 + 0xd5c08]
sub rbp, rdx
test rbp, rbp
jle 0x1400b9fe0
mov r8, rbp
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbp
cmp r12b, 1
jne 0x1400b9fed
shr rbx, 0x20
mov dword [rdi - 4], ebx
mov rbp, qword [rsp + 0x28]
add rbp, 8
mov qword [rsp + 0x28], rbp
mov rbx, qword [rbp]
mov rax, rbx
mov rdx, rbx
shr rax, 0x10
movzx r12d, bl
shr rdx, 8
movzx ecx, al
movzx r9d, dl
cmp bl, 6
jne 0x1400b9f12
mov r12, qword [rsp + 0x88]
lea r13, [0x1400f1e84]
lea rbp, [0x1400f1f63]
mov rbx, rbp
sub rbx, r13
test rbx, rbx
jle 0x1400ba053
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
mov rsi, qword [rsp + 0x30]
lea rcx, [0x1400f1a40]
mov eax, esi
lea rbx, [0x1400f1fd6]
sub eax, edi
sub eax, ecx
lea rcx, [0x1400f1bc0]
jmp 0x1400ba24f
lea r15, [0x1400f1932]
mov rbx, r15
lea rax, [0x1400f17c0]
sub rbx, rax
test rbx, rbx
jle 0x1400ba0a3
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rdi, [rbx + rsi]
mov eax, dword [r12 + 0x118]
lea r13, [r12 + 0x148]
mov rbx, qword [r13]
mov r14d, 0xffffffff
mov dword [rsp + 0x20], eax
cmp bl, 6
je 0x1400ba211
mov r9, rbx
lea rsi, [0x140000000]
shr r9, 8
mov rcx, rbx
shr rcx, 0x10
movzx r12d, bl
movzx eax, cl
movzx edx, r9b
nop word [rax + rax]
test r12b, r12b
cmovne ecx, eax
movzx eax, dl
movzx r8d, cl
movzx ecx, r9b
cmovne ecx, eax
xor r15d, r15d
test r12b, r12b
movzx ecx, cl
lea eax, [r12 + 2]
mov dword [rsp + 0x98], ecx
movzx eax, al
cmovne r15d, eax
cmp r8b, 8
mov eax, r8d
cmove eax, ecx
shl al, 2
or al, cl
shl al, 3
or r15b, al
lea eax, [r12 - 3]
cmp al, 1
ja 0x1400ba177
cmp r8d, r14d
je 0x1400ba177
movzx eax, r15b
mov r14d, r8d
mov rdx, qword [rsi + rax*8 + 0xd6410]
mov rbp, qword [rsi + rax*8 + 0xd6418]
sub rbp, rdx
test rbp, rbp
jle 0x1400ba177
mov r8, rbp
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rsp + 0x98]
add rdi, rbp
cmp ecx, r14d
movzx ebp, r15b
mov eax, 0xffffffff
cmove r14d, eax
cmp dword [rsp + 0x20], 2
mov rdx, qword [rsi + rbp*8 + 0xd5c00]
jne 0x1400ba1a8
test bl, bl
jne 0x1400ba1a8
cmp byte [rdx], 0x49
jne 0x1400ba1a5
mov byte [rdi], 0x41
inc rdi
inc rdx
mov rbp, qword [rsi + rbp*8 + 0xd5c08]
sub rbp, rdx
test rbp, rbp
jle 0x1400ba1c6
mov r8, rbp
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbp
cmp r12b, 1
jne 0x1400ba1d3
shr rbx, 0x20
mov dword [rdi - 4], ebx
mov rbx, qword [r13 + 8]
add r13, 8
mov rax, rbx
mov rdx, rbx
shr rax, 0x10
movzx r12d, bl
shr rdx, 8
movzx ecx, al
movzx r9d, dl
cmp bl, 6
jne 0x1400ba0f0
mov r12, qword [rsp + 0x88]
lea r15, [0x1400f1932]
mov rsi, qword [rsp + 0x30]
lea rbp, [0x1400f19d9]
mov rbx, rbp
sub rbx, r15
test rbx, rbx
jle 0x1400ba234
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
lea rcx, [0x1400f17c0]
mov eax, esi
sub eax, edi
lea rbx, [0x1400f1a1d]
sub eax, ecx
lea rcx, [0x1400f1880]
add eax, ecx
sub rbx, rbp
mov dword [rdi - 4], eax
test rbx, rbx
jle 0x1400ba26d
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
mov rcx, qword [r12 + 0x110]
lea r9, [rsp + 0x88]
mov edx, 0x10000
mov qword [r12 + 0x100], rcx
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [r12 + 0x110]
sub rdi, rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rdi
mov rdx, rbx
mov rcx, rax
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x80]
add rsp, 0x58
pop r12
pop rdi
pop rsi
pop rbx
jmp qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call fcn.14000e5b0
mov rcx, rax
lea r8, str.Error:_CPU_CryptonightR_update_ASM_code_ctx__fun_data_is_a_nullptr
xor edx, edx
add rsp, 0x58
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.140012540