Function at 0x1400097f4
Capabilities:
Allocate or change rwx memory
Resume thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x260
mov r14, rdx
mov rbp, rcx
xor edi, edi
call fcn.1400095f4
cmp eax, edi
je 0x140009b6b
mov r8d, eax
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rdi
mov rsi, rax
je 0x140009b6b
lea rcx, [rsp + 0x68]
xor edx, edx
mov r8d, 0xf0
mov qword [rsp + 0x60], rdi
call sub.msvcrt.dll_memset
lea rcx, str.kernel32.dll
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [0x14001fef0]
lea rcx, [rsp + 0x40]
mov rdx, rax
mov rbx, rax
call fcn.140003e04
lea r8, [0x14001ff08]
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x60], rax
call fcn.140003e04
lea r8, [0x14001ff18]
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x68], rax
call fcn.140003e04
lea r8, [0x14001ff30]
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x70], rax
call fcn.140003e04
mov ebx, 0x1000
xor edx, edx
mov r8d, 0xf8
mov rcx, rsi
mov r9d, ebx
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, ebx
xor edx, edx
mov r8d, 0x400
mov rcx, rsi
mov r13, rax
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, ebx
xor edx, edx
mov r12, rax
mov eax, dword [r14]
mov rcx, rsi
lea r8d, [rax + rax]
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, dword [r14]
mov r9d, ebx
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x20], 4
mov qword [rsp + 0x148], rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp r13, rdi
mov ecx, dword [r14]
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x150], ecx
je 0x140009b0b
cmp r12, rdi
je 0x140009b0b
cmp qword [rsp + 0x148], rdi
je 0x140009b0b
cmp ecx, edi
je 0x140009b0b
mov r8, qword [r14 + 8]
mov r9, rcx
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.1400093f4
lea r8, [0x1400094f4]
mov r9d, 0x400
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14d, 0xf8
lea r8, [rsp + 0x60]
mov r9, r14
mov rdx, r13
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x58], rdi
call fcn.1400025b4
mov rdx, rax
mov rcx, rbp
mov rbx, rax
call fcn.140009734
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0x3a98
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8d, [r14 - 8]
lea rcx, [rsp + 0x168]
xor edx, edx
mov qword [rsp + 0x160], rdi
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x160]
mov r9, r14
mov rdx, r13
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r11d, dword [rsp + 0x254]
lea eax, [r11 - 1]
cmp eax, 0xfffffe
ja 0x140009b01
lea edx, [r11 + 0x10]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rsp + 0x254]
mov rdx, qword [rsp + 0x148]
mov r8, rax
mov rcx, rsi
mov rbx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, edi
je 0x140009af8
mov rcx, qword [rsp + 0x2b8]
mov eax, dword [rsp + 0x254]
mov edi, 1
mov qword [rcx + 8], rbx
mov dword [rcx], eax
jmp 0x140009b01
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x50]
call fcn.140002454
mov ebx, 0x8000
xor r8d, r8d
mov rdx, r13
mov r9d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, ebx
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rsp + 0x148]
mov r9d, ebx
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rsp + 0x140]
mov r9d, ebx
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret