Function at 0x140059060
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov qword [rsp + 0x50], r14
lea rax, [0x14018fc68]
mov qword [rsp + 0x58], r15
lea rcx, [0x14018fb20]
mov r15, rdx
mov qword [rsp + 0x20], rax
mov r14, r8
call fcn.1400597e0
mov rbp, qword [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
xor r12d, r12d
test eax, eax
jle 0x14005914c
mov rdx, qword [0x14018fc68]
mov rcx, qword [0x14018fc70]
cmp rdx, rcx
je 0x14005914c
sub rcx, rdx
mov edi, r12d
sar rcx, 3
test rcx, rcx
je 0x14005914c
movsxd rsi, eax
mov ebx, r12d
nop
mov edx, dword [rbx + rdx]
lea rax, [rsp + 0xb8]
mov rcx, qword [0x14018fb28]
mov r9d, 0x40
mov r8, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdx, qword [0x14018fc68]
mov r9, rsi
mov rcx, qword [0x14018fb28]
mov r8, rbp
mov qword [rsp + 0x20], r12
mov rdx, qword [rbx + rdx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14018fc70]
lea rbx, [rbx + 8]
mov rdx, qword [0x14018fc68]
inc edi
sub rcx, rdx
movsxd rax, edi
sar rcx, 3
cmp rax, rcx
jb 0x1400590e0
mov r9, qword [rsp + 0x78]
lea rax, [0x14018fc80]
mov r8, r14
mov qword [rsp + 0x20], rax
mov rdx, r15
lea rcx, [0x14018fb20]
call fcn.1400597e0
mov rbp, qword [rsp + 0x80]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
test eax, eax
jle 0x140059220
mov rdx, qword [0x14018fc80]
mov rcx, qword [0x14018fc88]
cmp rdx, rcx
je 0x140059220
sub rcx, rdx
mov edi, r12d
sar rcx, 3
test rcx, rcx
je 0x140059220
movsxd rsi, eax
mov rbx, r12
mov edx, dword [rbx + rdx]
lea rax, [rsp + 0xb8]
mov rcx, qword [0x14018fb28]
mov r9d, 0x40
mov r8, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdx, qword [0x14018fc80]
mov r9, rsi
mov rcx, qword [0x14018fb28]
mov r8, rbp
mov qword [rsp + 0x20], r12
mov rdx, qword [rbx + rdx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14018fc88]
lea rbx, [rbx + 8]
mov rdx, qword [0x14018fc80]
inc edi
sub rcx, rdx
movsxd rax, edi
sar rcx, 3
cmp rax, rcx
jb 0x1400591b4
mov r9, qword [rsp + 0x88]
lea rax, [0x14018fc98]
mov r8, r14
mov qword [rsp + 0x20], rax
mov rdx, r15
lea rcx, [0x14018fb20]
call fcn.1400597e0
mov rbp, qword [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
test eax, eax
jle 0x1400592fc
mov rdx, qword [0x14018fc98]
mov rcx, qword [0x14018fca0]
cmp rdx, rcx
je 0x1400592fc
sub rcx, rdx
mov edi, r12d
sar rcx, 3
test rcx, rcx
je 0x1400592fc
movsxd rsi, eax
mov rbx, r12
nop dword [rax + rax]
mov edx, dword [rbx + rdx]
lea rax, [rsp + 0xb8]
mov rcx, qword [0x14018fb28]
mov r9d, 0x40
mov r8, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdx, qword [0x14018fc98]
mov r9, rsi
mov rcx, qword [0x14018fb28]
mov r8, rbp
mov qword [rsp + 0x20], r12
mov rdx, qword [rbx + rdx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14018fca0]
lea rbx, [rbx + 8]
mov rdx, qword [0x14018fc98]
inc edi
sub rcx, rdx
movsxd rax, edi
sar rcx, 3
cmp rax, rcx
jb 0x140059290
mov r9, qword [rsp + 0x98]
lea rax, [0x14018fcb0]
mov r8, r14
mov qword [rsp + 0x20], rax
mov rdx, r15
lea rcx, [0x14018fb20]
call fcn.1400597e0
mov rbp, qword [rsp + 0xa0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
test eax, eax
jle 0x1400593dd
mov r8, qword [0x14018fcb0]
mov rcx, qword [0x14018fcb8]
cmp r8, rcx
je 0x1400593dd
sub rcx, r8
mov edi, r12d
sar rcx, 3
test rcx, rcx
je 0x1400593dd
movsxd rsi, eax
mov rbx, r12
nop word [rax + rax]
mov edx, dword [r8 + rbx]
lea rax, [rsp + 0xb8]
mov rcx, qword [0x14018fb28]
mov r8, rsi
mov r9d, 0x40
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdx, qword [0x14018fcb0]
mov r9, rsi
mov rcx, qword [0x14018fb28]
mov r8, rbp
mov qword [rsp + 0x20], r12
mov rdx, qword [rdx + rbx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14018fcb8]
lea rbx, [rbx + 8]
mov r8, qword [0x14018fcb0]
inc edi
sub rdx, r8
movsxd rax, edi
sar rdx, 3
cmp rax, rdx
jb 0x140059370
mov r9, qword [rsp + 0xa8]
lea rax, [0x14018fcc8]
mov r8, r14
mov qword [rsp + 0x20], rax
mov rdx, r15
lea rcx, [0x14018fb20]
call fcn.1400597e0
mov rbp, qword [rsp + 0xb0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov r15, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
test eax, eax
jle 0x1400594be
mov rdx, qword [0x14018fcc8]
mov rcx, qword [0x14018fcd0]
cmp rdx, rcx
je 0x1400594be
sub rcx, rdx
mov edi, r12d
sar rcx, 3
test rcx, rcx
je 0x1400594be
movsxd rsi, eax
mov rbx, r12
mov edx, dword [rbx + rdx]
lea rax, [rsp + 0xb8]
mov rcx, qword [0x14018fb28]
mov r9d, 0x40
mov r8, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdx, qword [0x14018fcc8]
mov r9, rsi
mov rcx, qword [0x14018fb28]
mov r8, rbp
mov qword [rsp + 0x20], r12
mov rdx, qword [rbx + rdx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14018fcd0]
lea rbx, [rbx + 8]
mov rdx, qword [0x14018fcc8]
inc edi
sub rcx, rdx
movsxd rax, edi
sar rcx, 3
cmp rax, rcx
jb 0x140059452
mov edx, 0x66
call fcn.1400579f0
mov rbx, qword [rsp + 0x60]
mov al, 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret