Function at 0x140004ee0
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x4c8
mov dword [rsp + 0x48], 0
mov edx, dword [rsp + 0x4d8]
mov ecx, 8
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
jne 0x140004f1c
jmp 0x140005800
mov dword [rsp + 0x80], 0x438
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_Module32FirstW]
test eax, eax
jne 0x140004f4e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x140005800
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_Module32NextW]
test eax, eax
je 0x140005800
lea rdx, str.dbgeng.dll
lea rcx, [rsp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400057fb
mov eax, dword [0x14000d508]
add rax, 0x400000
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], 0xff00000
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x103000
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x4d0]
call qword [0x1400984b0]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x140004fe7
lea rcx, str.HookKd_NtAllocateVirtualMemory_failed
call fcn.140007270
jmp 0x140005800
mov qword [rsp + 0x58], 0xff00000
mov eax, dword [0x14000d508]
mov rcx, qword [rsp + 0x58]
add rcx, 0x400000
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, eax
mov r8, qword [0x14000d500]
mov rdx, rcx
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x140005037
jmp 0x140005800
mov rax, qword [rsp + 0x58]
add rax, 0x400000
mov qword [0x14000d500], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xb040
lea r8, [0x14000d400]
mov edx, 0xff00000
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x140005083
jmp 0x140005800
mov eax, 0xb040
add rax, 0xff00500
mov ecx, 0xb040
add rcx, 0xff00000
sub rax, rcx
mov ecx, 0xb040
add rcx, 0xff00000
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [0x140004d60]
mov rdx, rcx
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x1400050de
jmp 0x140005800
mov eax, 0xb040
add rax, 0xff00600
mov ecx, 0xb040
add rcx, 0xff00500
sub rax, rcx
mov ecx, 0xb040
add rcx, 0xff00500
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [0x140004450]
mov rdx, rcx
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x140005139
jmp 0x140005800
mov eax, 0xb040
add rax, 0xff00700
mov ecx, 0xb040
add rcx, 0xff00600
sub rax, rcx
mov ecx, 0xb040
add rcx, 0xff00600
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [0x1400043c0]
mov rdx, rcx
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x140005194
jmp 0x140005800
mov eax, 0xb040
add rax, 0xff01500
mov ecx, 0xb040
add rcx, 0xff00700
sub rax, rcx
mov ecx, 0xb040
add rcx, 0xff00700
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [0x1400044d0]
mov rdx, rcx
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x1400051ef
jmp 0x140005800
mov eax, 0xb040
add rax, 0xff01700
mov ecx, 0xb040
add rcx, 0xff01500
sub rax, rcx
mov ecx, 0xb040
add rcx, 0xff01500
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [0x1400042e0]
mov rdx, rcx
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x14000524a
jmp 0x140005800
mov eax, 0xb040
add rax, 0xff01e00
mov ecx, 0xb040
add rcx, 0xff01700
sub rax, rcx
mov ecx, 0xb040
add rcx, 0xff01700
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [0x1400040b0]
mov rdx, rcx
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x1400052a5
jmp 0x140005800
mov eax, 0xb040
add rax, 0xff02500
mov ecx, 0xb040
add rcx, 0xff01e00
sub rax, rcx
mov ecx, 0xb040
add rcx, 0xff01e00
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [0x140003c10]
mov rdx, rcx
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x140005300
jmp 0x140005800
mov eax, 0xb040
add rax, 0xff02800
mov ecx, 0xb040
add rcx, 0xff02500
sub rax, rcx
mov ecx, 0xb040
add rcx, 0xff02500
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [0x140004c90]
mov rdx, rcx
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x14000535b
jmp 0x140005800
mov eax, 0xb040
add rax, 0xff02b00
mov ecx, 0xb040
add rcx, 0xff02800
sub rax, rcx
mov ecx, 0xb040
add rcx, 0xff02800
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [0x140004010]
mov rdx, rcx
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x1400053b6
jmp 0x140005800
mov eax, 0xb040
add rax, 0xff02d00
mov ecx, 0xb040
add rcx, 0xff02b00
sub rax, rcx
mov ecx, 0xb040
add rcx, 0xff02b00
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [0x140003fa0]
mov rdx, rcx
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x140005411
jmp 0x140005800
mov eax, dword [rsp + 0xa0]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140005432
jmp 0x140005800
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0xa0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x140005486
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140005800
mov eax, 0xb040
add rax, 0xff00000
mov r9, rax
lea r8, str.CreateFileW
lea rdx, str.api_ms_win_core_file_l1_1_0.dll
mov rcx, qword [rsp + 0x38]
call fcn.140005820
test eax, eax
jne 0x1400054d6
mov eax, 0xb040
add rax, 0xff00000
mov r9, rax
lea r8, [0x14000ac48]
lea rdx, str.kernel32.dll
mov rcx, qword [rsp + 0x38]
call fcn.140005820
mov eax, 0xb040
add rax, 0xff00600
mov r9, rax
lea r8, str.CreateFileMappingW
lea rdx, str.api_ms_win_core_memory_l1_1_0.dll
mov rcx, qword [rsp + 0x38]
call fcn.140005820
test eax, eax
jne 0x140005526
mov eax, 0xb040
add rax, 0xff00600
mov r9, rax
lea r8, [0x14000abe0]
lea rdx, [0x14000abd0]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
mov eax, 0xb040
add rax, 0xff00700
mov r9, rax
lea r8, str.MapViewOfFile
lea rdx, [0x14000ab98]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
test eax, eax
jne 0x140005576
mov eax, 0xb040
add rax, 0xff00700
mov r9, rax
lea r8, [0x14000ab88]
lea rdx, [0x14000ab78]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
mov eax, 0xb040
add rax, 0xff01500
mov r9, rax
lea r8, str.UnmapViewOfFile
lea rdx, [0x14000ab40]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
test eax, eax
jne 0x1400055c6
mov eax, 0xb040
add rax, 0xff01500
mov r9, rax
lea r8, [0x14000ab30]
lea rdx, [0x14000ab20]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
mov eax, 0xb040
add rax, 0xff01700
mov r9, rax
lea r8, str.GetFileSize
lea rdx, [0x14000aaf0]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
test eax, eax
jne 0x140005616
mov eax, 0xb040
add rax, 0xff01700
mov r9, rax
lea r8, [0x14000aae0]
lea rdx, [0x14000aad0]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
mov eax, 0xb040
add rax, 0xff01e00
mov r9, rax
lea r8, str.VirtualProtect
lea rdx, [0x14000aa98]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
test eax, eax
jne 0x140005666
mov eax, 0xb040
add rax, 0xff01e00
mov r9, rax
lea r8, [0x14000aa88]
lea rdx, [0x14000aa78]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
mov eax, 0xb040
add rax, 0xff02500
mov r9, rax
lea r8, str.CloseHandle
lea rdx, str.api_ms_win_core_handle_l1_1_0.dll
mov rcx, qword [rsp + 0x38]
call fcn.140005820
test eax, eax
jne 0x1400056b6
mov eax, 0xb040
add rax, 0xff02500
mov r9, rax
lea r8, [0x14000aa30]
lea rdx, [0x14000aa20]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
mov eax, 0xb040
add rax, 0xff02800
mov r9, rax
lea r8, str.DuplicateHandle
lea rdx, [0x14000a9e8]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
test eax, eax
jne 0x140005706
mov eax, 0xb040
add rax, 0xff02800
mov r9, rax
lea r8, [0x14000a9d8]
lea rdx, [0x14000a9c8]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
mov eax, 0xb040
add rax, 0xff02b00
mov r9, rax
lea r8, str.SetFilePointer
lea rdx, [0x14000a998]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
test eax, eax
jne 0x140005756
mov eax, 0xb040
add rax, 0xff02b00
mov r9, rax
lea r8, [0x14000a988]
lea rdx, [0x14000a978]
mov rcx, qword [rsp + 0x38]
call fcn.140005820
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0xa0]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
mov r8d, eax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x1400057a4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140005800
mov eax, dword [rsp + 0xa0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x1400057e8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140005800
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [rsp + 0x48], 1
jmp 0x140004f4e
mov eax, dword [rsp + 0x48]
add rsp, 0x4c8
ret