Function at 0x140002f68
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x130
xor ebx, ebx
mov eax, 0x5a4d
mov r14, rdx
mov r13, rcx
mov qword [rsp + 0x48], rbx
mov qword [rbp - 0x6c], rbx
mov dword [rbp - 0x64], ebx
mov dword [rbp - 0x5d], ebx
mov byte [rbp - 0x59], bl
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
cmp word [rdx], ax
je 0x140002fd9
mov r8d, 0xc000000d
lea rcx, [0x140003d10]
mov dl, 1
call fcn.140003448
mov eax, 0xc000000d
jmp 0x1400033b3
movsxd rsi, dword [rdx + 0x3c]
mov eax, 0x8664
add rsi, r14
cmp word [rsi + 4], ax
je 0x140003009
mov r8d, 0xc00000bb
lea rcx, [0x140003d40]
mov dl, 1
call fcn.140003448
mov eax, 0xc00000bb
jmp 0x1400033b3
mov eax, dword [rsi + 0x50]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x28], 0x40
lea rdx, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x40], rax
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov edi, eax
test eax, eax
jns 0x140003056
lea rcx, [0x140003ba0]
mov r8d, edi
mov dl, 1
call fcn.140003448
mov eax, edi
jmp 0x1400033b3
mov r12, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rcx, r12
rep stosb byte [rdi], al
mov rax, qword [0x140006388]
mov qword [rsp + 0x78], rax
mov rax, qword [0x140006380]
mov qword [rsp + 0x70], rax
mov rax, qword [0x140006390]
mov qword [rbp - 0x80], rax
mov rax, qword [rsp + 0x48]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x68], r12
mov dword [rbp - 0x70], ebx
mov word [rbp - 0x5f], bx
mov byte [rbp - 0x60], 1
mov qword [rbp - 0x58], r12
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r9, qword [rsp + 0x48]
mov rdx, r14
mov r15, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov r8, r15
mov byte [rsp + 0x28], bl
mov rcx, r15
mov qword [rsp + 0x20], 0x1000
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov edi, eax
test eax, eax
jns 0x1400030ec
lea rcx, [0x140003d90]
jmp 0x140003045
movzx edi, word [rsi + 0x14]
mov ecx, ebx
add rdi, 0x24
mov dword [rbp + 0x78], ebx
cmp bx, word [rsi + 6]
jae 0x140003155
add rdi, rsi
mov eax, dword [rdi + 4]
test eax, eax
je 0x14000313f
mov r9d, dword [rdi]
lea rcx, [rsp + 0x60]
mov edx, dword [rdi + 8]
mov r8, r15
add r9, qword [rsp + 0x48]
add rdx, r14
mov qword [rsp + 0x30], rcx
mov rcx, r15
mov byte [rsp + 0x28], bl
mov qword [rsp + 0x20], rax
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov r12d, eax
test eax, eax
js 0x140003197
mov ecx, dword [rbp + 0x78]
movzx eax, word [rsi + 6]
inc ecx
add rdi, 0x28
mov dword [rbp + 0x78], ecx
cmp ecx, eax
jl 0x140003102
mov r12, qword [rsp + 0x68]
mov r14d, 0x1000
lea r9, [rsp + 0x40]
mov esi, 0x40
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x28], esi
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x20], r14d
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov edi, eax
test eax, eax
jns 0x1400031b0
lea rcx, [0x140004020]
jmp 0x140003045
mov r8d, r12d
lea rcx, [0x140004000]
mov dl, 1
call fcn.140003448
mov eax, r12d
jmp 0x1400033b3
mov rdi, qword [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
xor eax, eax
rep stosb byte [rdi], al
mov r9, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov r8, r15
mov byte [rsp + 0x28], bl
mov rcx, r15
mov qword [rsp + 0x20], rsi
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov edi, eax
test eax, eax
jns 0x1400031f8
lea rcx, [0x140004050]
jmp 0x140003045
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x20], r14d
lea rdx, [rsp + 0x58]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov edi, eax
test eax, eax
jns 0x14000322a
lea rcx, [0x140004080]
jmp 0x140003045
mov rdi, qword [rsp + 0x58]
lea rdx, [0x140003488]
mov rcx, qword [rsp + 0x40]
xor eax, eax
rep stosb byte [rdi], al
mov r9, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov r8, r15
mov rax, qword [rsp + 0x40]
mov rcx, r15
mov byte [rsp + 0x28], bl
mov qword [rsp + 0x20], rax
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov esi, eax
test eax, eax
jns 0x140003283
mov r8d, eax
lea rcx, [0x1400040b0]
mov dl, 1
call fcn.140003448
jmp 0x1400033b1
movaps xmm0, xmmword [str.PQRSUVWAPAQARASATAUAVAWH]
lea r9, [rsp + 0x40]
movaps xmm1, xmmword [0x1400062b0]
xor r8d, r8d
movzx eax, word [0x140006310]
or rcx, 0xffffffffffffffff
movaps xmmword [rbp - 0x50], xmm0
movaps xmm0, xmmword [0x1400062c0]
movaps xmmword [rbp - 0x30], xmm0
movaps xmm0, xmmword [0x1400062e0]
movaps xmmword [rbp - 0x40], xmm1
movaps xmm1, xmmword [0x1400062d0]
mov word [rbp + 0x20], ax
mov rax, qword [rsp + 0x50]
movaps xmmword [rbp - 0x20], xmm1
movaps xmm1, xmmword [0x1400062f0]
movaps xmmword [rbp - 0x10], xmm0
movaps xmm0, xmmword [0x140006300]
mov qword [rbp - 0x25], rax
mov rax, qword [rsp + 0x58]
movaps xmmword [rbp + 0x10], xmm0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], r14d
mov r14, qword [rbp + 0x80]
mov rdx, r14
mov qword [rbp + 0x12], rax
movaps xmmword [rbp], xmm1
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x50]
mov rdi, qword [r14]
xor eax, eax
rep stosb byte [rdi], al
mov r9, qword [r14]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov r8, r15
mov byte [rsp + 0x28], bl
mov rcx, r15
mov qword [rsp + 0x20], 0x72
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov rax, qword [rbp + 0x88]
mov edi, 0x18
mov rdx, qword [rsp + 0x50]
mov qword [rax], rdx
test r12, r12
je 0x140003388
mov rdx, qword [rsp + 0x48]
mov r8d, edi
add rdx, rbx
mov rcx, r13
call fcn.140002904
add rbx, 0x1000
cmp rbx, r12
jb 0x140003364
mov rdx, qword [rsp + 0x50]
mov r8d, edi
mov rcx, r13
call fcn.140002904
mov rdx, qword [rsp + 0x58]
mov r8d, edi
mov rcx, r13
call fcn.140002904
mov r8d, edi
mov rdx, r14
mov rcx, r13
call fcn.140002904
mov eax, esi
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret