Function at 0x1400b72f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x400]
sub rsp, 0x500
lea rax, [rsp + 0x78]
mov rsi, rdx
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x70]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x28], 0x400
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov rdi, rcx
call fcn.1400b6df0
test eax, eax
js 0x1400b7571
cmp dword [rbp - 0x20], 2
mov qword [rsp + 0x520], rbx
mov qword [rsp + 0x528], r13
mov qword [rsp + 0x4f8], r14
mov qword [rsp + 0x4f0], r15
jne 0x1400b741f
mov rdx, qword [rsp + 0x48]
lea rax, [rbp + 0x430]
lea r9, [rbp + 0x438]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x78]
mov rcx, rdi
call fcn.1400b7160
mov edi, eax
test eax, eax
js 0x1400b7551
sub rsi, qword [rbp - 0x40]
xor ebx, ebx
mov edx, dword [rbp + 0x430]
test edx, edx
je 0x1400b73cf
mov r8, qword [rbp + 0x438]
nop
mov eax, ebx
lea rcx, [rax + rax*2]
mov eax, dword [r8 + rcx*4]
cmp rsi, rax
jb 0x1400b73c9
mov eax, dword [r8 + rcx*4 + 4]
cmp rsi, rax
jb 0x1400b73f9
inc ebx
cmp ebx, edx
jb 0x1400b73b0
mov edi, 0xc0000225
mov rax, qword gs:[0x30]
xor edx, edx
mov r8, qword [rbp + 0x438]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1400b754f
mov eax, ebx
lea rcx, [rax + rax*2]
lea rax, [r8 + rcx*4]
test rax, rax
je 0x1400b73cf
movsd xmm0, qword [rax]
movsd qword [0x14015ec60], xmm0
mov eax, dword [rax + 8]
mov dword [0x14015ec68], eax
jmp 0x1400b73d4
mov r15d, dword [rbp - 0x1c]
cmp r15d, 0x100000
jbe 0x1400b7436
mov edi, 0x80000005
jmp 0x1400b754f
lea r13, [r15 + r15*2]
mov dword [rsp + 0x28], 4
shl r13, 2
lea r9, [rsp + 0x50]
xor ebx, ebx
mov qword [rsp + 0x50], r13
xor r8d, r8d
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 0x1000
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x1400b754a
mov r14, qword [rsp + 0x40]
test r14, r14
je 0x1400b754a
mov rdx, qword [rbp - 0x60]
mov r9, r13
mov r8, r14
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call sym.ProcessHacker.exe_PhReadVirtualMemory
mov edi, eax
test eax, eax
js 0x1400b74b4
mov qword [rbp + 0x438], r14
mov dword [rbp + 0x430], r15d
jmp 0x1400b74e6
mov r9d, 0x8000
mov qword [rsp + 0x60], r14
lea r8, [rsp + 0x58]
mov qword [rsp + 0x58], rbx
lea rdx, [rsp + 0x60]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov r15d, dword [rbp + 0x430]
mov r14, qword [rbp + 0x438]
test edi, edi
js 0x1400b754f
sub rsi, qword [rbp - 0x40]
mov edx, r15d
cmp dword [rbp - 0x20], ebx
mov r9, rsi
mov rcx, r14
sete r8b
call fcn.1400b70b0
test rax, rax
je 0x1400b751f
movsd xmm0, qword [rax]
movsd qword [0x14015ec60], xmm0
mov eax, dword [rax + 8]
mov dword [0x14015ec68], eax
jmp 0x1400b7524
mov edi, 0xc0000225
mov r9d, 0x8000
mov qword [rsp + 0x70], r14
lea r8, [rsp + 0x68]
mov qword [rsp + 0x68], rbx
lea rdx, [rsp + 0x70]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
jmp 0x1400b754f
mov edi, 0xc0000017
mov eax, edi
mov r14, qword [rsp + 0x4f8]
mov r13, qword [rsp + 0x528]
mov rbx, qword [rsp + 0x520]
mov r15, qword [rsp + 0x4f0]
add rsp, 0x500
pop rdi
pop rsi
pop rbp
ret