Function at 0x1400ee6a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rbx
push r12
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x140142088]
xor rax, rsp
mov qword [rbp + 0xe8], rax
xor eax, eax
mov dword [rsp + 0x30], r9d
xor ebx, ebx
mov qword [rsp + 0x40], r8
mov r14, r8
mov qword [rsp + 0x60], rdx
lea r8, [rsp + 0x70]
mov qword [rsp + 0x50], rcx
mov r12, rdx
mov qword [rsp + 0x70], rax
lea r9d, [rbx + 0x40]
mov qword [rsp + 0x78], rax
mov r15, rcx
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400eeb8a
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x108
call fcn.1400ff9e0
movsxd rdx, dword [rbp - 0x54]
lea r8, [rbp - 0x50]
add rdx, r12
mov qword [rsp + 0x20], rbx
mov r9d, 0x108
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400eeb8a
mov eax, 0x20b
cmp word [rbp - 0x38], ax
je 0x1400ee779
lea ecx, [rbx + 9]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400eeb8a
mov edx, dword [rbp - 0x54]
movzx ecx, word [rbp - 0x3c]
add edx, 0x18
mov qword [rsp + 0x208], rsi
add edx, ecx
mov esi, ebx
mov qword [rsp + 0x200], rdi
mov edi, ebx
mov qword [rbp + 0x90], rbx
cmp bx, word [rbp - 0x4a]
jae 0x1400ee857
mov r14d, edx
nop dword [rax]
xor eax, eax
mov qword [rsp + 0x20], rbx
mov qword [rbp + 0xc0], rax
lea r8, [rbp + 0xc0]
mov qword [rbp + 0xc8], rax
mov r9d, 0x28
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe0], rax
mov eax, esi
lea rcx, [rax + rax*4]
lea rdx, [r14 + rcx*8]
mov rcx, r15
add rdx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400eeb7a
mov rdx, qword [rbp + 0xd0]
cmp dword [rbp + 0x98], ebx
jne 0x1400ee837
mov r8d, dword [rbp + 0x40]
mov ecx, dword [rbp + 0xcc]
cmp r8d, ecx
jb 0x1400ee837
lea eax, [rdx + rcx]
cmp r8d, eax
jae 0x1400ee837
mov dword [rbp + 0x98], ecx
mov dword [rbp + 0x9c], edx
mov ecx, dword [rbp + 0xd4]
movzx eax, word [rbp - 0x4a]
add ecx, edx
cmp edi, ecx
cmovb edi, ecx
inc esi
cmp esi, eax
jb 0x1400ee7b0
mov r14, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rbp + 0x44]
mov esi, ecx
add eax, 0x1b
shl esi, 5
mov qword [rsp + 0x1f8], r13
lea r15d, [rcx + rcx*4]
shl r15d, 2
add eax, r15d
and eax, 0xfffffff8
add esi, eax
mov dword [rsp + 0x3c], eax
mov r13d, esi
test ecx, ecx
je 0x1400ee8b2
mov rdx, r14
mov r8d, ecx
nop
mov rcx, qword [rdx]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], bl
jne 0x1400ee897
add eax, 4
add rdx, 8
and eax, 0xfffffffc
add r13d, eax
sub r8, 1
jne 0x1400ee890
mov ecx, r13d
mov r14d, r13d
call fcn.1400fd4d0
mov rdi, rax
test rax, rax
je 0x1400eeb72
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.1400ff9e0
mov ecx, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
mov r8d, dword [rbp - 0x24]
add rdx, rcx
mov ecx, dword [rbp - 0x34]
mov r14, qword [rsp + 0x50]
add rcx, r12
add rcx, rdx
mov rdx, r12
add r8, rcx
mov rcx, r14
cmp r12, r8
cmovb rdx, r8
mov r8d, r13d
call fcn.1400ee160
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400eeb6a
mov ecx, dword [rbp + 0x40]
sub eax, r12d
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], ebx
test ecx, ecx
je 0x1400ee97c
mov r8d, dword [rbp + 0x44]
lea rdx, [r12 + rcx]
lea rax, [rsp + 0x38]
mov rcx, r14
mov r9d, 0x40
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1400eeb6a
mov edx, dword [rbp + 0x40]
mov rcx, r14
mov r9d, dword [rbp + 0x44]
add rdx, r12
mov r8d, r15d
add r8, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400eeb6a
mov eax, dword [rsp + 0x34]
mov r12d, ebx
cmp dword [rsp + 0x30], ebx
jbe 0x1400eea54
mov r15d, dword [rsp + 0x3c]
lea r14, [rdi + 4]
mov ecx, 0x10
add r15d, eax
sub ecx, eax
neg eax
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x3c], eax
nop word [rax + rax]
mov r8, qword [rsp + 0x40]
mov edx, r13d
mov ecx, esi
sub edx, esi
add rcx, rdi
mov r8, qword [r8]
call fcn.1400ee2a0
test eax, eax
js 0x1400eeb6a
mov eax, dword [rsp + 0x3c]
movabs rdx, 0x8000000000000001
add eax, r15d
mov dword [r14 - 4], r15d
mov qword [rax + rdi], rdx
mov qword [rax + rdi + 8], rbx
lea eax, [r15 + 0x10]
mov dword [r14 + 0xc], eax
mov eax, dword [rsp + 0x48]
add eax, r15d
mov qword [rax + rdi], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rax + rdi + 8], rbx
mov eax, dword [rsp + 0x34]
add eax, esi
mov qword [r14], rbx
mov dword [r14 + 8], eax
or rax, 0xffffffffffffffff
mov rcx, qword [rdx]
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x1400eea20
add eax, 4
add rdx, 8
and eax, 0xfffffffc
mov qword [rsp + 0x40], rdx
add esi, eax
inc r12d
add r15d, 0x20
add r14, 0x14
cmp r12d, dword [rsp + 0x30]
jb 0x1400ee9b0
mov r14, qword [rsp + 0x50]
mov ecx, dword [rbp + 0x44]
movabs rax, 0xcccccccccccccccd
mul rcx
mov eax, dword [rsp + 0x30]
mov r8d, ebx
shr rdx, 4
add rdx, rax
je 0x1400eea91
mov rax, rbx
lea rax, [rax + rax*4]
cmp dword [rdi + rax*4], ebx
jne 0x1400eea86
cmp dword [rdi + rax*4 + 0x10], ebx
je 0x1400eea91
inc r8d
mov eax, r8d
cmp rax, rdx
jb 0x1400eea77
mov rdx, qword [rsp + 0x58]
mov r8, rdi
mov r9d, esi
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400eeb6a
mov eax, dword [rsp + 0x34]
cmp dword [rbp + 0x98], ebx
jne 0x1400eeacb
mov dword [rbp + 0x98], eax
mov dword [rbp + 0x9c], r13d
mov rsi, qword [rsp + 0x60]
mov r9d, 0x40
mov r8d, dword [rbp + 4]
mov rdx, rsi
mov dword [rbp + 0x40], eax
mov rcx, r14
lea rax, [rsp + 0x38]
mov dword [rbp + 0x44], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1400eeb6a
mov r9d, 0x40
mov dword [rbp + 8], ebx
lea r8, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400eeb6a
movsxd rdx, dword [rbp - 0x54]
lea r8, [rbp - 0x50]
add rdx, rsi
mov qword [rsp + 0x20], rbx
mov r9d, 0x108
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400eeb6a
mov r8d, dword [rbp + 4]
lea rax, [rsp + 0x38]
mov r9d, dword [rsp + 0x38]
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
mov ecx, 1
cmovne ebx, ecx
mov rcx, rdi
call fcn.1400fd200
mov r13, qword [rsp + 0x1f8]
mov rsi, qword [rsp + 0x208]
mov rdi, qword [rsp + 0x200]
mov eax, ebx
mov rcx, qword [rbp + 0xe8]
xor rcx, rsp
call fcn.1400fcbc0
add rsp, 0x210
pop r15
pop r14
pop r12
pop rbx
pop rbp
ret