Function at 0x140178860
Capabilities:
Allocate or change rwx memory

Disassembly:
mov r11, rsp
push r12
push r14
sub rsp, 0x2a8
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov eax, dword [rdx + 0xf0]
mov r8, rdx
mov qword [rsp + 0x38], rcx
mov r14, rcx
test eax, eax
je 0x140178c35
cmp dword [rdx + 0xf4], 0
je 0x140178c35
mov r10d, dword [rax + rcx + 0xc]
xor r12d, r12d
mov qword [r11 + 0x18], rbx
add r10, rcx
movzx ebx, word [r8 + 6]
mov qword [r11 - 0x18], rbp
mov qword [r11 - 0x28], rdi
mov edi, eax
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r15
movzx r11d, word [rdx + 0x14]
add r11, rdx
mov edx, r12d
test ebx, ebx
je 0x14017890f
mov ecx, r12d
mov r8d, dword [rcx + r11 + 0x24]
lea r9, [r8 + r14]
cmp r10, r9
jb 0x140178905
mov eax, dword ds:[rcx + r11 + 0x28]
add rax, r8
add rax, r14
cmp r10, rax
jb 0x14017894b
inc edx
add rcx, 0x28
cmp edx, ebx
jb 0x1401788e2
mov ebp, 0xc0000049
mov r15, qword [rsp + 0x280]
mov eax, ebp
mov rbp, qword [rsp + 0x2a0]
mov r13, qword [rsp + 0x288]
mov rdi, qword [rsp + 0x290]
mov rsi, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x2d0]
jmp 0x140178c45
mov eax, dword [r11 + rcx + 0x20]
test r9, r9
je 0x14017890f
test rax, rax
je 0x14017890f
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], r9
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov ebp, eax
test eax, eax
js 0x140178914
cmp dword [rdi + r14 + 0xc], r12d
je 0x140178c08
lea r13, [r14 + 4]
add r13, rdi
mov eax, dword [r13 + 0xc]
test eax, eax
je 0x140178bf9
mov ebx, dword ds:[r13]
lea rdx, [0x140287048]
mov edi, dword [r13 + 4]
add rbx, r14
mov esi, dword [r13 + 8]
add rdi, r14
add rsi, r14
mov qword [rsp + 0x50], rdi
mov r14d, eax
mov rcx, rbx
add r14, qword [rsp + 0x38]
xor r15b, r15b
call fcn.1401eea34
test eax, eax
jne 0x140178bbf
lea rdx, [0x140287048]
mov rcx, rbx
call fcn.140206f90
nop dword [rax]
test eax, eax
jne 0x140178a10
mov rdi, qword [0x1402c4fc8]
jmp 0x140178b3a
mov rdi, qword [rdi]
test rdi, rdi
je 0x140178a25
mov ebp, r12d
jmp 0x140178b49
xor edx, edx
mov word [rsp + 0x60], r12w
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.140207110
lea rcx, [rsp + 0x60]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], r12b
jne 0x140178a50
mov r8, rdx
and r8, 0xfffffffffffffffc
je 0x140178a9c
nop word [rax + rax]
movzx eax, byte [rbx]
mov word [rcx], ax
movzx eax, byte [rbx + 1]
mov word [rcx + 2], ax
movzx eax, byte [rbx + 2]
mov word [rcx + 4], ax
movzx eax, byte [rbx + 3]
add rbx, 4
mov word [rcx + 6], ax
add rcx, 8
sub r8, 4
jne 0x140178a70
and edx, 3
sub rdx, 1
je 0x140178acc
sub rdx, 1
je 0x140178abf
cmp rdx, 1
jne 0x140178ad2
movzx eax, byte [rbx]
mov word [rcx], ax
add rcx, 2
inc rbx
movzx eax, byte [rbx]
mov word [rcx], ax
add rcx, 2
inc rbx
movzx eax, byte [rbx]
mov word [rcx], ax
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x140178b37
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x140178b37
cmp dword [0x1402baf40], 0x3e
jae 0x140178bd3
xor r8d, r8d
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x140178bd3
mov r15b, 1
mov ebp, r12d
test rdi, rdi
je 0x140178bef
mov rax, qword [r14]
test rax, rax
je 0x140178ba1
sub r14, rsi
mov ebp, r12d
test rax, rax
jns 0x140178b6c
movzx r8d, ax
xor edx, edx
mov rcx, rdi
call fcn.140177920
jmp 0x140178b85
mov rcx, qword [rsp + 0x38]
movzx r8d, word [rcx + rax]
lea rdx, [rcx + 2]
add rdx, rax
mov rcx, rdi
call fcn.140177f80
test rax, rax
je 0x140178b9c
mov qword [rsi], rax
add rsi, 8
mov rax, qword [r14 + rsi]
test rax, rax
jne 0x140178b5a
jmp 0x140178ba1
mov ebp, 0xc0000138
mov rcx, qword [rsp + 0x50]
mov rax, rdi
xchg qword [rcx], rax
cmp rax, rdi
jne 0x140178bbf
test r15b, r15b
je 0x140178bbf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add r13, 0x20
cmp dword [r13 + 8], r12d
je 0x140178bf9
mov r14, qword [rsp + 0x38]
jmp 0x1401789a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_QiDosErrorToNtStatus
mov ebp, eax
test eax, eax
js 0x140178914
mov ebp, 0xc0000001
jmp 0x140178914
nop dword [rax]
test ebp, ebp
js 0x140178914
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov ebp, eax
jmp 0x140178914
lfence
xor r12d, r12d
neg r12b
sbb eax, eax
and eax, 0xc0000020
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0x2a8
pop r14
pop r12
ret