Function at 0x140099dc0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x14039f5e8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r12d, r12d
mov dword [rbp + 7], 0x3f7e0f66
cmp byte [0x14065871f], r12b
lea rax, [rbp - 0x11]
mov ebx, r12d
mov dword [rbp + 0xb], 0x228
xorps xmm0, xmm0
mov word [rbp + 0xf], 0x45c7
xorps xmm1, xmm1
mov dword [0x14065884c], r12d
lea edx, [r12 + 0xa]
mov dword [rbp - 0x59], ebx
movdqu xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], r12
lea rcx, [rbp + 7]
movdqu xmmword [rbp - 0x41], xmm1
mov r14d, r12d
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x31], r12
mov qword [rsp + 0x20], rax
je 0x140099e6a
mov r9d, 0x20000000
mov r8d, 0x18000000
call fcn.1400df1d0
mov byte [0x1403a03ac], 0x40
jmp 0x140099e82
mov r9d, 0x10000000
mov r8d, 0xd000000
call fcn.1400df1d0
mov byte [0x1403a03ac], 0x50
mov r15, qword [rbp - 9]
mov edi, r12d
mov rax, qword [rbp - 0x11]
mov rsi, qword [rbp - 0x39]
sub r15, rax
sar r15, 3
test r15, r15
je 0x140099f46
mov rbx, rax
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [rbx]
lea r8, [rbp - 0x49]
mov rcx, qword [0x140658a48]
add edx, 0xb
mov r9d, 1
mov byte [rbp - 0x49], r12b
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx ecx, byte [rbp - 0x49]
test eax, eax
cmove ecx, r12d
cmp cl, byte [0x140658616]
jne 0x140099f2d
cmp rsi, r14
je 0x140099efc
mov rax, qword [rbx]
mov qword [rsi], rax
add rsi, 8
mov qword [rbp - 0x39], rsi
jmp 0x140099f13
mov r8, rbx
lea rcx, [rbp - 0x41]
mov rdx, rsi
call fcn.14009b6d0
mov r14, qword [rbp - 0x31]
mov rsi, qword [rbp - 0x39]
movzx eax, byte [0x140658617]
mov byte [reloc.WLDAP32.dll_Ordinal_60], al
movzx eax, byte [0x1406575c7]
mov byte [0x1403a03bc], al
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, r15
jb 0x140099eb0
mov qword [rbp - 0x51], r14
mov ebx, r12d
mov rax, qword [rbp - 0x41]
lea rcx, [0x140658770]
sub rsi, rax
mov r8d, r12d
sar rsi, 3
mov qword [rbp + 7], rsi
test rsi, rsi
je 0x140099f8c
mov rdx, rax
nop word [rax + rax]
mov eax, dword [rdx]
lea rdx, [rdx + 8]
inc r8d
mov dword [rcx], eax
movsxd rax, r8d
lea rcx, [rcx + 4]
inc ebx
cmp rax, rsi
jb 0x140099f70
mov dword [rbp - 0x59], ebx
cmp byte [0x14065871f], r12b
lea rax, [rbp - 0x29]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r12
lea rcx, [rbp + 0x1f]
mov dword [rbp + 0x1f], 0x3f7e0f66
mov edx, 9
mov dword [rbp + 0x23], 0x228
mov byte [rbp + 0x27], 0xe8
je 0x140099fdf
mov r9d, 0x20000000
mov r8d, 0x18000000
call fcn.1400df1d0
mov byte [0x1403a03ac], 0x40
jmp 0x140099ff7
mov r9d, 0x10000000
mov r8d, 0xd000000
call fcn.1400df1d0
mov byte [0x1403a03ac], 0x50
mov ecx, dword [0x140658918]
xor r15d, r15d
mov r12, qword [rbp - 0x21]
mov r13, qword [rbp - 0x29]
test ecx, ecx
jne 0x14009a0a5
mov rax, r12
sub rax, r13
test rax, 0xfffffffffffffff8
je 0x14009a0a5
mov edx, dword [r13]
lea r9d, [rcx + 4]
mov rcx, qword [0x140658a48]
lea r8, [rbp - 0x45]
add edx, 9
mov dword [rbp - 0x45], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [rbp - 0x45]
lea r9d, [r15 + 4]
mov edi, dword [r13]
lea r8, [rbp + 0x17]
test eax, eax
mov dword [rbp + 0x17], r15d
mov qword [rsp + 0x20], r15
cmove ecx, r15d
add edi, ecx
mov rcx, qword [0x140658a48]
lea edx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, dword [rbp + 0x17]
test eax, eax
mov rax, qword [0x140655ab0]
cmove ebx, r15d
movsxd rcx, dword [rax + 4]
lea rax, [0x140655ab0]
add rcx, rax
call fcn.140093490
lea ecx, [rdi + 0x19]
add ecx, ebx
mov dword [0x140658918], ecx
sub r12, r13
lea rdi, [0x140658850]
sar r12, 3
test r12, r12
je 0x14009a19d
movsxd rax, dword [rbp - 0x59]
mov rbx, r13
mov r13d, dword [rbp - 0x59]
xor r14d, r14d
lea rsi, [rax*4]
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rbx]
lea r8, [rbp + 0x17]
mov rcx, qword [0x140658a48]
add edx, 9
mov r9d, 4
mov dword [rbp + 0x17], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [rbp + 0x17]
test eax, eax
mov eax, dword [rbx]
cmove ecx, r14d
add eax, 0xd
add eax, ecx
mov dword [rbp - 0x45], eax
je 0x14009a174
mov rcx, qword [0x140658a48]
lea r8, [rbp + 0x1f]
mov edx, eax
mov r9d, 7
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbx]
lea r8, [rbp + 0x1f]
mov rcx, qword [0x140658a48]
add rdx, 8
mov r9d, 7
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [rbx]
lea rcx, [0x140658770]
mov dword [rsi + rcx], eax
inc r13d
mov eax, dword [rbp - 0x45]
mov dword [rsi + rdi], eax
add rsi, 4
inc r15d
add rbx, 8
movsxd rax, r15d
cmp rax, r12
jb 0x14009a0e0
mov ecx, dword [0x140658918]
mov rsi, qword [rbp + 7]
mov r14, qword [rbp - 0x51]
mov dword [rbp - 0x59], r13d
mov r13, qword [rbp - 0x29]
test r13, r13
je 0x14009a1e0
mov rdx, qword [rbp - 0x19]
mov rax, r13
sub rdx, r13
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14009a1d2
mov r13, qword [r13 - 8]
add rdx, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009a450
mov rcx, r13
call fcn.140279710
mov ecx, dword [0x140658918]
test rsi, rsi
je 0x14009a3a7
test ecx, ecx
jne 0x14009a219
mov rcx, qword [0x140658a48]
xor edx, edx
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1f4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, rax
mov dword [0x140658918], eax
mov edx, ecx
lea r8, [0x1403a03a0]
xor r13d, r13d
mov qword [rsp + 0x20], r13
lea rcx, [rdx + 0x5e]
movzx eax, cl
mov qword [rbp + 7], rcx
mov rax, rcx
mov byte [0x1403a03a2], cl
shr rax, 8
lea r9d, [r13 + 0x5a]
mov byte [0x1403a03a3], al
mov rax, rcx
shr rcx, 0x18
mov byte [0x1403a03a5], cl
mov rcx, qword [0x140658a48]
shr rax, 0x10
mov byte [reloc.WS2_32.dll_accept], al
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r15d, r13d
test rsi, rsi
je 0x14009a3a7
mov r12, qword [rbp - 0x41]
mov rdx, qword [r12]
lea r8, [0x140658768]
mov rcx, qword [0x140658a48]
add rdx, 8
mov r9d, 7
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [0x140658768]
mov byte [0x1403a0388], al
movzx eax, byte [0x140658769]
mov byte [0x1403a0389], al
movzx eax, byte [0x14065876a]
mov byte [0x1403a038a], al
movzx eax, byte [0x14065876b]
mov byte [0x1403a038b], al
movzx eax, byte [0x14065876c]
mov byte [0x1403a038c], al
movzx eax, byte [0x14065876d]
mov byte [0x1403a038d], al
movzx eax, byte [0x14065876e]
mov byte [0x1403a038e], al
mov eax, dword [rdi]
test eax, eax
jne 0x14009a332
mov rcx, qword [0x140658a48]
lea r8d, [rax + 0x64]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test eax, eax
je 0x14009a390
jmp 0x14009a334
mov ebx, eax
mov rcx, qword [0x140658a48]
lea r8, [0x1403a0388]
mov edx, ebx
mov r9d, reloc.WS2_32.dll_sendto
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x140658918]
lea ecx, [rbx + 7]
sub eax, ecx
mov edx, ecx
mov rcx, qword [0x140658a48]
lea r8, [rbp + 0x17]
sub eax, 5
mov dword [rdi], ebx
mov r9d, 7
mov dword [rbp + 0x18], eax
mov byte [rbp + 0x17], 0xe8
mov word [rbp + 0x1c], 0x9090
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc r15d
add r12, 8
movsxd rax, r15d
add rdi, 4
cmp rax, rsi
jb 0x14009a280
mov rcx, qword [rbp - 0x41]
mov eax, dword [rbp - 0x59]
mov dword [0x14065884c], eax
test rcx, rcx
je 0x14009a3e9
sub r14, rcx
mov rax, rcx
and r14, 0xfffffffffffffff8
cmp r14, 0x1000
jb 0x14009a3e1
mov rcx, qword [rcx - 8]
add r14, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009a450
mov rdx, r14
call fcn.140279710
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x14009a423
mov rdx, qword [rbp - 1]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14009a41e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009a450
call fcn.140279710
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1402796f0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140292364
int3