Function at 0x140175620
Capabilities:
Allocate or change rwx memory

Disassembly:
mov r11, rsp
push r12
push r14
sub rsp, 0x2a8
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov eax, dword [rdx + 0xf0]
mov r8, rdx
mov qword [rsp + 0x38], rcx
mov r14, rcx
test eax, eax
je 0x1401759f5
cmp dword [rdx + 0xf4], 0
je 0x1401759f5
mov r10d, dword [rax + rcx + 0xc]
xor r12d, r12d
mov qword [r11 + 0x18], rbx
add r10, rcx
movzx ebx, word [r8 + 6]
mov qword [r11 - 0x18], rbp
mov qword [r11 - 0x28], rdi
mov edi, eax
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r15
movzx r11d, word [rdx + 0x14]
add r11, rdx
mov edx, r12d
test ebx, ebx
je 0x1401756cf
mov ecx, r12d
mov r8d, dword [rcx + r11 + 0x24]
lea r9, [r8 + r14]
cmp r10, r9
jb 0x1401756c5
mov eax, dword ds:[rcx + r11 + 0x28]
add rax, r8
add rax, r14
cmp r10, rax
jb 0x14017570b
inc edx
add rcx, 0x28
cmp edx, ebx
jb 0x1401756a2
mov ebp, 0xc0000049
mov r15, qword [rsp + 0x280]
mov eax, ebp
mov rbp, qword [rsp + 0x2a0]
mov r13, qword [rsp + 0x288]
mov rdi, qword [rsp + 0x290]
mov rsi, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x2d0]
jmp 0x140175a05
mov eax, dword [r11 + rcx + 0x20]
test r9, r9
je 0x1401756cf
test rax, rax
je 0x1401756cf
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], r9
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov ebp, eax
test eax, eax
js 0x1401756d4
cmp dword [rdi + r14 + 0xc], r12d
je 0x1401759c8
lea r13, [r14 + 4]
add r13, rdi
mov eax, dword [r13 + 0xc]
test eax, eax
je 0x1401759b9
mov ebx, dword ds:[r13]
lea rdx, [0x140282828]
mov edi, dword [r13 + 4]
add rbx, r14
mov esi, dword [r13 + 8]
add rdi, r14
add rsi, r14
mov qword [rsp + 0x50], rdi
mov r14d, eax
mov rcx, rbx
add r14, qword [rsp + 0x38]
xor r15b, r15b
call fcn.1401eb994
test eax, eax
jne 0x14017597f
lea rdx, [0x140282828]
mov rcx, rbx
call fcn.140204080
nop dword [rax]
test eax, eax
jne 0x1401757d0
mov rdi, qword [0x1402bfd08]
jmp 0x1401758fa
mov rdi, qword [rdi]
test rdi, rdi
je 0x1401757e5
mov ebp, r12d
jmp 0x140175909
xor edx, edx
mov word [rsp + 0x60], r12w
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.1401dff50
lea rcx, [rsp + 0x60]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], r12b
jne 0x140175810
mov r8, rdx
and r8, 0xfffffffffffffffc
je 0x14017585c
nop word [rax + rax]
movzx eax, byte [rbx]
mov word [rcx], ax
movzx eax, byte [rbx + 1]
mov word [rcx + 2], ax
movzx eax, byte [rbx + 2]
mov word [rcx + 4], ax
movzx eax, byte [rbx + 3]
add rbx, 4
mov word [rcx + 6], ax
add rcx, 8
sub r8, 4
jne 0x140175830
and edx, 3
sub rdx, 1
je 0x14017588c
sub rdx, 1
je 0x14017587f
cmp rdx, 1
jne 0x140175892
movzx eax, byte [rbx]
mov word [rcx], ax
add rcx, 2
inc rbx
movzx eax, byte [rbx]
mov word [rcx], ax
add rcx, 2
inc rbx
movzx eax, byte [rbx]
mov word [rcx], ax
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401758f7
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x1401758f7
cmp dword [0x1402b5e88], 0x3e
jae 0x140175993
xor r8d, r8d
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x140175993
mov r15b, 1
mov ebp, r12d
test rdi, rdi
je 0x1401759af
mov rax, qword [r14]
test rax, rax
je 0x140175961
sub r14, rsi
mov ebp, r12d
test rax, rax
jns 0x14017592c
movzx r8d, ax
xor edx, edx
mov rcx, rdi
call fcn.1401746e0
jmp 0x140175945
mov rcx, qword [rsp + 0x38]
movzx r8d, word [rcx + rax]
lea rdx, [rcx + 2]
add rdx, rax
mov rcx, rdi
call fcn.140174d40
test rax, rax
je 0x14017595c
mov qword [rsi], rax
add rsi, 8
mov rax, qword [r14 + rsi]
test rax, rax
jne 0x14017591a
jmp 0x140175961
mov ebp, 0xc0000138
mov rcx, qword [rsp + 0x50]
mov rax, rdi
xchg qword [rcx], rax
cmp rax, rdi
jne 0x14017597f
test r15b, r15b
je 0x14017597f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add r13, 0x20
cmp dword [r13 + 8], r12d
je 0x1401759b9
mov r14, qword [rsp + 0x38]
jmp 0x140175763
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov ebp, eax
test eax, eax
js 0x1401756d4
mov ebp, 0xc0000001
jmp 0x1401756d4
nop dword [rax]
test ebp, ebp
js 0x1401756d4
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov ebp, eax
jmp 0x1401756d4
lfence
xor r12d, r12d
neg r12b
sbb eax, eax
and eax, 0xc0000020
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0x2a8
pop r14
pop r12
ret