Function at 0x140002690
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14005e040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x14005fd38]
xor r12d, r12d
mov rcx, qword [0x14005fd20]
mov r8d, pe_nt_image_headers64
movss dword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r12d
lea rbp, [rax + 0x4b1db8b]
lea r15, [rax + 0x34e807e]
mov rdx, rbp
mov rax, r15
lea r9d, [r12 + 0x40]
sub rax, rbp
sub rax, 0xc
mov qword [0x14005fd48], rax
mov rax, rbp
sub rax, r15
sub rax, 5
mov qword [0x14005fd40], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x14005fd20]
lea r9d, [r12 + 0xb]
lea r8, [0x14005e108]
mov qword [rsp + 0x20], r12
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14005fd20]
lea rax, [rsp + 0x30]
lea r9d, [r12 + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, pe_nt_image_headers64
mov dword [rsp + 0x30], r12d
lea rdx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x14005fd20]
lea r9d, [r12 + 4]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], r12
lea rdx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14005fd20]
lea rax, [rsp + 0x30]
lea r9d, [r12 + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, pe_nt_image_headers64
mov dword [rsp + 0x30], r12d
lea rdx, [rbp + 0xc]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x14005fd20]
lea r9d, [r12 + 5]
lea r8, [0x14005e114]
mov qword [rsp + 0x20], r12
lea rdx, [rbp + 0xc]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14005fd20]
lea rax, [rsp + 0x30]
lea r9d, [r12 + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, pe_nt_image_headers64
mov dword [rsp + 0x30], r12d
lea rdx, [rbp + 0xd]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x14005fd20]
lea r9d, [r12 + 8]
lea r8, [0x14005fd48]
mov qword [rsp + 0x20], r12
lea rdx, [rbp + 0xd]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14005fd20]
lea rdx, [rbp + 0xd]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8d, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x14005fd20]
lea rdx, [rbp + 0xc]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8d, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x14005fd20]
lea rdx, [rbp + 8]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8d, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x14005fd20]
xor r9d, r9d
mov r8d, pe_nt_image_headers64
mov qword [rsp + 0x20], r12
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x14005fd20]
lea rax, [rsp + 0x30]
lea r9d, [r12 + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, pe_nt_image_headers64
mov dword [rsp + 0x30], r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x14005fd20]
lea r9d, [r12 + 5]
lea r8, [0x14005e100]
mov qword [rsp + 0x20], r12
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14005fd20]
lea rax, [rsp + 0x30]
lea r9d, [r12 + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, pe_nt_image_headers64
mov dword [rsp + 0x30], r12d
lea rdx, [r15 + 1]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x14005fd20]
lea r9d, [r12 + 4]
lea r8, [0x14005fd40]
mov qword [rsp + 0x20], r12
lea rdx, [r15 + 1]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14005fd20]
lea rdx, [r15 + 1]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8d, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x14005fd20]
xor r9d, r9d
mov r8d, pe_nt_image_headers64
mov qword [rsp + 0x20], r12
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400436c0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret