Function at 0x14000bf50
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rbx
push r12
push r15
lea rbp, [rsp - 0xf8]
sub rsp, 0x1f8
mov rax, qword [0x1400777b8]
xor rax, rsp
mov qword [rbp + 0xd8], rax
xor eax, eax
xor ebx, ebx
mov qword [rsp + 0x40], r8
lea r8, [rsp + 0x60]
lea r9d, [rbx + 0x40]
mov r12, rdx
mov r15, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000c468
lea rcx, [rbp - 0x60]
xor edx, edx
mov r8d, 0x108
call fcn.14003ca60
movsxd rdx, dword [rbp - 0x64]
lea r8, [rbp - 0x60]
add rdx, r12
mov r9d, 0x108
mov rcx, r15
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000c468
mov eax, 0x20b
cmp word [rbp - 0x48], ax
je 0x14000c01c
lea ecx, [rbx + 9]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000c468
mov edx, dword [rbp - 0x64]
movzx ecx, word [rbp - 0x4c]
mov qword [rsp + 0x238], rsi
add edx, 0x18
mov qword [rsp + 0x1f0], rdi
mov qword [rbp + 0x80], rbx
add edx, ecx
mov qword [rsp + 0x1e0], r14
mov edi, ebx
mov esi, ebx
cmp bx, word [rbp - 0x5a]
jae 0x14000c102
mov r14d, edx
nop dword [rax + rax]
xor eax, eax
lea r8, [rbp + 0xb0]
mov r9d, 0x28
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xd0], rax
mov eax, esi
lea rcx, [rax + rax*4]
mov qword [rsp + 0x20], rbx
lea rdx, [r14 + rcx*8]
mov rcx, r15
add rdx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000c450
mov rdx, qword [rbp + 0xc0]
cmp dword [rbp + 0x88], ebx
jne 0x14000c0e7
mov r8d, dword [rbp + 0x30]
mov ecx, dword [rbp + 0xbc]
cmp r8d, ecx
jb 0x14000c0e7
lea eax, [rdx + rcx]
cmp r8d, eax
jae 0x14000c0e7
mov dword [rbp + 0x88], ecx
mov dword [rbp + 0x8c], edx
mov ecx, dword [rbp + 0xc4]
movzx eax, word [rbp - 0x5a]
add ecx, edx
cmp edi, ecx
cmovb edi, ecx
inc esi
cmp esi, eax
jb 0x14000c060
mov esi, dword [rbp + 0x34]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x1e8], r13
mov rax, qword [rax]
add esi, 0x2f
and esi, 0xfffffff8
or rdi, 0xffffffffffffffff
lea r13d, [rsi + 0x20]
inc rdi
cmp byte [rax + rdi], bl
jne 0x14000c123
add edi, 4
and edi, 0xfffffffc
add edi, r13d
mov ecx, edi
mov r14d, edi
call fcn.14003b0c0
mov r15, rax
test rax, rax
je 0x14000c448
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.14003ca60
mov ecx, dword [rbp - 0x40]
mov edx, dword [rbp - 0x3c]
mov r8d, dword [rbp - 0x34]
mov r14, qword [rsp + 0x48]
add rdx, rcx
mov ecx, dword [rbp - 0x44]
add rcx, r12
add rcx, rdx
mov rdx, r12
add r8, rcx
mov rcx, r14
cmp r12, r8
cmovb rdx, r8
mov r8d, edi
call fcn.14000be10
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000c440
mov ecx, dword [rbp + 0x30]
sub eax, r12d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], eax
test ecx, ecx
je 0x14000c1fb
mov r8d, dword [rbp + 0x34]
lea rax, [rsp + 0x30]
lea rdx, [r12 + rcx]
mov r9d, 0x40
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14000c440
mov edx, dword [rbp + 0x30]
mov r9d, dword [rbp + 0x34]
lea r8, [r15 + 0x14]
add rdx, r12
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000c440
mov eax, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x40]
mov ecx, 0x10
add esi, eax
sub ecx, eax
neg eax
mov r8d, ebx
mov dword [rsp + 0x38], ebx
lea r11, [r15 + 4]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], ecx
nop
mov r9, qword [rdx]
mov eax, edi
mov ecx, r13d
sub eax, r13d
add rcx, r15
mov r10d, ebx
mov edx, eax
dec rax
cmp rax, 0x7ffffffe
mov eax, 0x80070057
cmova r10d, eax
test r10d, r10d
js 0x14000c2a1
mov r10d, ebx
test rdx, rdx
je 0x14000c291
mov r8d, 0x7ffffffe
sub r8, rdx
sub r9, rcx
nop
lea rax, [r8 + rdx]
test rax, rax
je 0x14000c28c
movzx eax, byte [r9 + rcx]
test al, al
je 0x14000c28c
mov byte [rcx], al
inc rcx
dec rdx
jne 0x14000c260
mov r8d, dword [rsp + 0x38]
dec rcx
mov r10d, 0x8007007a
jmp 0x14000c2a6
test rdx, rdx
jne 0x14000c29a
dec rcx
mov r10d, 0x8007007a
mov r8d, dword [rsp + 0x38]
jmp 0x14000c2a6
test rdx, rdx
je 0x14000c2a8
mov byte [rcx], bl
test r10d, r10d
js 0x14000c440
mov eax, dword [rsp + 0x50]
mov dword [r11 - 4], esi
movabs rdx, 0x8000000000000001
add eax, esi
mov qword [rax + r15], rdx
mov qword [rax + r15 + 8], rbx
lea eax, [rsi + 0x10]
mov dword [r11 + 0xc], eax
mov eax, dword [rsp + 0x48]
add eax, esi
mov qword [rax + r15], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rax + r15 + 8], rbx
mov eax, dword [rsp + 0x34]
mov qword [r11], rbx
add eax, r13d
mov dword [r11 + 8], eax
mov rcx, qword [rdx]
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x14000c300
add eax, 4
inc r8d
add rdx, 8
and eax, 0xfffffffc
add esi, 0x20
add r11, 0x14
add r13d, eax
mov dword [rsp + 0x38], r8d
mov qword [rsp + 0x40], rdx
cmp r8d, 1
jb 0x14000c220
mov ecx, dword [rbp + 0x34]
movabs rax, 0xcccccccccccccccd
mov r8d, ebx
mul rcx
shr rdx, 4
inc rdx
je 0x14000c36e
mov rax, rbx
lea rax, [rax + rax*4]
cmp dword [r15 + rax*4], ebx
jne 0x14000c363
cmp dword [r15 + rax*4 + 0x10], ebx
je 0x14000c36e
inc r8d
mov eax, r8d
cmp rax, rdx
jb 0x14000c352
mov rdx, qword [rsp + 0x58]
mov r9d, r13d
mov r8, r15
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000c440
mov eax, dword [rsp + 0x34]
cmp dword [rbp + 0x88], ebx
jne 0x14000c3a7
mov dword [rbp + 0x88], eax
mov dword [rbp + 0x8c], edi
mov r8d, dword [rbp - 0xc]
mov dword [rbp + 0x30], eax
lea rax, [rsp + 0x30]
mov r9d, 0x40
mov rdx, r12
mov rcx, r14
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x34], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14000c440
lea r8, [rsp + 0x60]
mov r9d, 0x40
mov rdx, r12
mov rcx, r14
mov dword [rbp - 8], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000c440
movsxd rdx, dword [rbp - 0x64]
lea r8, [rbp - 0x60]
mov r9d, 0x108
mov rcx, r14
add rdx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000c440
mov r8d, dword [rbp - 0xc]
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov rdx, r12
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov rcx, r15
call fcn.14003afbc
mov r13, qword [rsp + 0x1e8]
mov rdi, qword [rsp + 0x1f0]
mov rsi, qword [rsp + 0x238]
mov r14, qword [rsp + 0x1e0]
mov eax, ebx
mov rcx, qword [rbp + 0xd8]
xor rcx, rsp
call fcn.14003a5f0
add rsp, 0x1f8
pop r15
pop r12
pop rbx
pop rbp
ret