Function at 0x14006ba10
Capabilities:
Allocate or change rwx memory
Inspect section memory permissions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1403705b0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, dword [0x14037c168]
cmp eax, 1
jne 0x14006bbdc
mov dword [rbp + 0x17], 0xeb70a00
mov dword [rbp + 0x1b], 0x1d900a00
mov dword [rbp + 0x1f], 0xee100a10
mov dword [rbp + 0x23], 0xe12fff1e
mov dword [rbp + 0x27], 0xe59019c8
mov dword [rbp + 0x2b], 0xe3a00000
mov dword [rbp + 0x2f], 0xe3510000
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
xor edi, edi
mov qword [rbp + 7], rdi
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea edx, [rdi + 0x1c]
mov r9d, 0x50000000
mov r8d, 0x40000000
lea rcx, [rbp + 0x17]
call fcn.1400b10b0
mov r15d, edi
mov rsi, qword [rbp - 1]
mov rbx, qword [rbp - 9]
sub rsi, rbx
sar rsi, 3
test rsi, rsi
je 0x14006bb63
mov r14, rbx
nop dword [rax + rax]
mov dword [rbp - 0x11], 2
mov rdx, qword [r14]
add rdx, 4
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x3c]
mov rcx, qword [0x14037bfa8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rbp - 0x19], 0x86594
mov rdx, qword [r14]
add rdx, 4
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp - 0x19]
mov rcx, qword [0x14037bfa8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [r14]
add rdx, 4
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x11]
mov r8d, 4
mov rcx, qword [0x14037bfa8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r15d
lea r14, [r14 + 8]
movsxd rax, r15d
cmp rax, rsi
jb 0x14006bad0
test rbx, rbx
je 0x14006bba0
mov rdx, qword [rbp + 7]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rax, rbx
cmp rdx, 0x1000
jb 0x14006bb98
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006be60
mov rcx, rbx
call fcn.140251840
mov qword [rbp - 0x19], reloc.WLDAP32.dll_Ordinal_30
lea rcx, [rbp - 0x19]
call fcn.1400676a0
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140251820
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
cmp eax, 2
jne 0x14006bd08
mov dword [rbp + 0x17], 0xeb70a00
mov dword [rbp + 0x1b], 0x1d900a00
mov dword [rbp + 0x1f], 0xee100a10
mov dword [rbp + 0x23], 0xe12fff1e
mov dword [rbp + 0x27], 0xe59019c8
mov dword [rbp + 0x2b], 0xe3a00000
mov dword [rbp + 0x2f], 0xe3510000
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
xor edi, edi
mov qword [rbp + 7], rdi
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea edx, [rdi + 0x1c]
mov r9d, 0x30000000
mov r8d, 0x20000000
lea rcx, [rbp + 0x17]
call fcn.1400b10b0
mov r15d, edi
mov rsi, qword [rbp - 1]
mov rbx, qword [rbp - 9]
sub rsi, rbx
sar rsi, 3
test rsi, rsi
je 0x14006bd03
mov r14, rbx
nop dword [rax]
nop word [rax + rax]
mov dword [rbp - 0x11], 2
mov rdx, qword [r14]
add rdx, 4
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x3c]
mov rcx, qword [0x14037bfa8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rbp - 0x19], 0x86594
mov rdx, qword [r14]
add rdx, 4
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp - 0x19]
mov rcx, qword [0x14037bfa8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [r14]
add rdx, 4
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x11]
mov r8d, 4
mov rcx, qword [0x14037bfa8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r15d
lea r14, [r14 + 8]
movsxd rax, r15d
cmp rax, rsi
jb 0x14006bc70
jmp 0x14006bb63
cmp eax, 3
jne 0x14006bba0
mov dword [rbp + 0x17], 0xeb70a00
mov dword [rbp + 0x1b], 0x1d900a00
mov dword [rbp + 0x1f], 0xee100a10
mov dword [rbp + 0x23], 0xe12fff1e
mov dword [rbp + 0x27], 0xe59019c8
mov dword [rbp + 0x2b], 0xe3a00000
mov dword [rbp + 0x2f], 0xe3510000
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
xor edi, edi
mov qword [rbp + 7], rdi
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea edx, [rdi + 0x1c]
mov r9d, 0x90000000
mov r8d, 0x80000000
lea rcx, [rbp + 0x17]
call fcn.1400b10b0
mov r15d, edi
mov rsi, qword [rbp - 1]
mov rbx, qword [rbp - 9]
sub rsi, rbx
sar rsi, 3
test rsi, rsi
je 0x14006be23
mov r14, rbx
nop
mov dword [rbp - 0x11], 2
mov rdx, qword [r14]
add rdx, 4
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x3c]
mov rcx, qword [0x14037bfa8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rbp - 0x19], 0x86594
mov rdx, qword [r14]
add rdx, 4
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [rbp - 0x19]
mov rcx, qword [0x14037bfa8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [r14]
add rdx, 4
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x11]
mov r8d, 4
mov rcx, qword [0x14037bfa8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r15d
lea r14, [r14 + 8]
movsxd rax, r15d
cmp rax, rsi
jb 0x14006bd90
test rbx, rbx
je 0x14006bba0
mov rdx, qword [rbp + 7]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rax, rbx
cmp rdx, 0x1000
jb 0x14006bb98
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006bb98
call fcn.140264c90
int3