Function at 0x1400c717c
Capabilities:
Allocate or change rwx memory
Resume thread
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x560
mov rbx, rcx
mov rsi, rdx
lea rcx, [rax - 0x4e0]
xor r15d, r15d
xor edx, edx
mov r8d, 0x4c8
mov r12, r9
mov qword [rax - 0x4e8], r15
call fcn.1400dd9e0
mov r14d, dword [rsp + 0x5b0]
xor eax, eax
cmp qword [rsp + 0x5d0], r15
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x5d8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x5c8]
lea rdi, [rsp + 0x78]
cmovne rdi, qword [rsp + 0x5d0]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x5c0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x5b8]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x5a8]
mov rcx, rbx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x78], r15
call fcn.1400c702c
cmp qword [rdi], 0xffffffffffffffff
mov ebx, eax
jne 0x1400c726c
mov qword [rdi], r15
cmp qword [rdi + 8], 0xffffffffffffffff
jne 0x1400c7277
mov qword [rdi + 8], r15
cmp eax, r15d
jle 0x1400c7482
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x580], r15
mov qword [rsp + 0x70], r15
cmp qword [rsi + 0x30], rdx
jne 0x1400c72cf
mov eax, dword [rsp + 0x5a0]
mov r8, qword [rsp + 0x60]
cmp r8, rax
jb 0x1400c72cf
mov rcx, qword [rdi]
lea rax, [rsp + 0x70]
mov r9d, pe_nt_image_headers64
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x580], rdx
call qword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
jmp 0x1400c7375
call fcn.1400c6e80
cmp eax, r15d
je 0x1400c7458
mov rcx, qword [rdi]
call fcn.1400c6f30
cmp eax, r15d
je 0x1400c7317
mov r8d, dword [rsp + 0x5a0]
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rdi]
mov r9d, 0x3000
mov dword [rsp + 0x20], pe_nt_image_headers64
call qword [0x140118fc0]
mov qword [rsp + 0x580], rax
jmp 0x1400c731f
mov rax, qword [rsp + 0x580]
cmp rax, r15
jne 0x1400c7383
mov rcx, rsi
call fcn.1400c6e90
cmp eax, r15d
je 0x1400c7458
mov r8d, dword [rsp + 0x5a0]
mov rcx, qword [rdi]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], pe_nt_image_headers64
call qword [0x140118fc0]
mov qword [rsp + 0x580], rax
cmp rax, r15
je 0x1400c7458
mov r8, rax
mov rdx, r12
mov rcx, rsi
call fcn.1400c6ea8
cmp qword [rsp + 0x580], r15
je 0x1400c7458
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rdi]
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x580]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov rdx, qword [rsp + 0x580]
mov r9d, dword [rsp + 0x5a0]
lea rax, [rsp + 0x60]
mov qword [rsi + 0x30], rdx
mov rcx, qword [rdi]
mov r8, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
cmp eax, r15d
je 0x1400c7453
mov rcx, qword [rsp + 0x580]
mov eax, dword [rsi + 0x28]
mov dword [rsp + 0xc0], 0x10000b
cmp rcx, qword [rsp + 0x68]
jne 0x1400c7407
add rax, qword [rsi + 0x30]
jmp 0x1400c740a
add rax, rcx
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x110], rax
call qword [sym.imp.KERNEL32.DLL_SetThreadContext]
test r14b, 4
jne 0x1400c7434
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
cmp qword [rsp + 0x5d0], r15
jne 0x1400c7482
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1400c7482
or ebx, 0xffffffff
jmp 0x1400c745d
mov ebx, 0xfffffffe
mov rcx, qword [rdi]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rdi + 8], r15
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rdi], r15
lea r11, [rsp + 0x560]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret