Function at 0x140005680
Capabilities:
Allocate or change rwx memory
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1400970c0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, r8
mov r15, rcx
mov qword [rbp + 0x1f], rcx
xor r12d, r12d
xor dil, dil
mov r14d, r12d
mov dword [rbp + 0x27], r12d
test dl, dl
je 0x140005720
cmp dl, 3
jne 0x140005b16
mov edx, 0x1000
xor ecx, ecx
lea r9d, [r12 + 0x40]
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x140005b16
mov byte [rax], 3
inc rbx
mov dword [rbx], esi
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x27]
lea r8d, [r12 + 5]
mov rdx, rbx
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
jmp 0x140005aee
call fcn.1400747f0
mov r14, rax
test rax, rax
je 0x140005b16
mov edx, 0x1000
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
mov qword [rbp + 0x17], rax
test rax, rax
je 0x140005b09
mov byte [rax], dil
mov rsi, 0xffffffffffffffff
mov rbx, rsi
inc rbx
cmp word [r14 + rbx*2], r12w
jne 0x140005762
mov rax, rsi
nop
inc rax
cmp word [r14 + rax*2], r12w
jne 0x140005770
mov byte [rcx + 1], al
lea rdi, [rcx + 2]
add rbx, rbx
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [r14 + 0x1000]
mov word [rbx + rdi], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx + rdi + 2], eax
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [r14 + rax*2 + 0x400], r12w
jne 0x1400057b0
mov edx, 0x400
mov ecx, 0x800
test rax, rax
cmove edx, ecx
add rdx, r14
inc rsi
cmp word [rdx + rsi*2], r12w
jne 0x1400057d1
mov byte [rbx + rdi + 7], sil
add rdi, 8
add rdi, rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbx + rdi]
mov qword [rbp - 0x39], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], r12
mov r15, qword [0x140097200]
lea rbx, [0x1400971f0]
mov r12, rbx
mov rcx, qword [0x1400971f0]
mov rdx, qword [reloc.OLEAUT32.dll_VariantInit]
cmp rdx, 8
cmovae r12, rcx
movabs r8, 0x7ffffffffffffffe
cmp r15, r8
ja 0x140005b4d
mov edi, 7
lea r9d, [rdi + 3]
cmp r15, 8
jae 0x140005870
mov qword [rbp - 0x21], r15
mov esi, edi
mov qword [rbp - 0x19], rdi
movups xmm0, xmmword [r12]
movups xmmword [rbp - 0x31], xmm0
movq r13, xmm0
jmp 0x1400058db
mov rsi, r15
or rsi, rdi
cmp rsi, r8
jbe 0x140005880
mov rsi, r8
jmp 0x140005887
cmp rsi, r9
cmovb rsi, r9
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x31]
call fcn.140003e50
mov r13, rax
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], rsi
lea r8, [r15*2 + 2]
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [reloc.OLEAUT32.dll_VariantInit]
mov r15, qword [0x140097200]
mov rcx, qword [0x1400971f0]
movabs r8, 0x7ffffffffffffffe
mov r9d, 0xa
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp + 7], 0
mov rax, rbx
cmp rdx, 8
cmovae rax, rcx
mov qword [rbp + 0xf], rax
cmp r15, r8
ja 0x140005b47
cmp r15, 8
jae 0x140005921
mov qword [rbp - 1], r15
mov rbx, rdi
mov qword [rbp + 7], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x11], xmm0
movq r12, xmm0
jmp 0x14000596a
mov rbx, r15
or rbx, 7
cmp rbx, r8
jbe 0x140005932
mov rbx, r8
jmp 0x14000593a
cmp rbx, 0xa
cmovb rbx, r9
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x11]
call fcn.140003e50
mov r12, rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 1], r15
mov qword [rbp + 7], rbx
lea r8, [r15*2 + 2]
mov rdx, qword [rbp + 0xf]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp - 0x11]
cmp rbx, 8
cmovae rdx, r12
mov r8, qword [rbp - 0x21]
add r8, r8
mov rcx, qword [rbp - 0x39]
call sub.VCRUNTIME140.dll_memcpy
cmp rbx, 8
jb 0x1400059c6
lea rdx, [rbx*2 + 2]
mov rax, r12
cmp rdx, 0x1000
jb 0x1400059bd
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400059bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.14006e3d4
nop
cmp rsi, 8
jb 0x140005a01
lea rdx, [rsi*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x1400059f9
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005ab8
mov rcx, r13
call fcn.14006e3d4
mov rbx, qword [0x140097200]
cmp qword [reloc.OLEAUT32.dll_VariantInit], 8
lea r15, [0x1400971f0]
cmovae r15, qword [0x1400971f0]
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
ja 0x140005b4d
cmp rbx, 8
jae 0x140005a3d
mov rsi, qword [r15]
jmp 0x140005a7e
mov rdi, rbx
or rdi, 7
cmp rdi, rax
jbe 0x140005a4e
mov rdi, rax
jmp 0x140005a5b
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x11]
call fcn.140003e50
mov rsi, rax
lea r8, [rbx*2 + 2]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp - 0x39]
lea rbx, [rax + rbx*2]
mov r15d, ebx
cmp rdi, 8
jb 0x140005ac7
lea rdx, [rdi*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140005abf
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005abf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14006e3d4
mov rdx, qword [rbp + 0x17]
sub r15d, edx
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x27]
mov r8d, r15d
mov rcx, qword [rbp + 0x1f]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
movzx edi, al
test rbx, rbx
je 0x140005b04
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14, r14
je 0x140005b16
mov edx, 0x1004
mov rcx, r14
call fcn.14006e3d4
movzx eax, dil
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14006e370
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001b10
nop
call fcn.140001b10
int3