Function at 0x14003e590
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov r15, rcx
mov ecx, Ordinal_50
call fcn.140119f88
mov rbx, rax
mov dword [rax], 0xeb000825
mov dword [rax + 4], 0xeaffffff
mov dword [rax + 8], 0xe59d0024
mov dword [rax + 0xc], 0xe2801d05
mov dword [rax + 0x10], 0xeb0005d5
mov dword [rax + 0x14], 0xeaffffff
mov dword [rax + 0x18], 0xe59d0024
mov dword [rax + 0x1c], 0xe2801d05
mov dword [rax + 0x20], 0xeb00026c
mov dword [rax + 0x24], 0xeaffffff
mov dword [rax + 0x28], 0xeb02c51b
mov dword [rax + 0x2c], 0xe58d000c
mov ecx, 4
call fcn.140119f88
mov qword [rsp + 0x60], rax
mov dword [rax], 0xe3000000
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov qword [rsp + 0x108], rax
test eax, eax
jg 0x14003e63c
xor al, al
jmp 0x14003e8e7
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor r13d, r13d
mov qword [rsp + 0x40], r13
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rsi, rax
xor ecx, ecx
movabs rbp, 0xfffffffffff
mov r14, qword [rsp + 0x38]
nop word [rax + rax]
mov r9d, Ordinal_50
lea r8, [rsp + 0x68]
mov rdx, rcx
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x14003e816
cmp dword [rsp + 0x88], 0x1000
jne 0x14003e800
mov eax, dword [rsp + 0x8c]
bt eax, 8
jb 0x14003e800
cmp eax, 1
je 0x14003e800
cmp eax, 0x10
je 0x14003e800
mov rcx, qword [rsp + 0x80]
call fcn.140119f88
mov rdi, rax
mov qword [rsp + 0x100], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x80]
mov r8, rdi
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14003e7f8
mov r8, rdi
mov rcx, qword [rsp + 0x48]
sub rcx, rsi
lea r9, [rdi + 1]
add r9, rcx
mov qword [rsp + 0x58], r9
lea r12, [rdi - 1]
add r12, rsi
mov r15, r12
lea rbp, [rdi - 1]
add rbp, qword [rsp + 0x48]
cmp rdi, r9
jae 0x14003e7e6
nop dword [rax]
test rsi, rsi
je 0x14003e76b
mov rax, rbx
mov rdx, rdi
sub rdx, rbx
nop
movzx ecx, byte [rax]
cmp cl, 0x3f
je 0x14003e75d
cmp cl, byte [rdx + rax]
jne 0x14003e7b7
inc rax
mov rcx, rax
sub rcx, rbx
cmp rcx, rsi
jb 0x14003e750
mov rax, rdi
sub rax, r8
add rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
cmp r14, r13
je 0x14003e78e
mov qword [r14], rax
add r14, 8
mov qword [rsp + 0x38], r14
jmp 0x14003e7b7
lea r8, [rsp + 0x50]
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.140048120
mov r13, qword [rsp + 0x40]
mov r14, qword [rsp + 0x38]
mov r8, qword [rsp + 0x100]
mov r9, qword [rsp + 0x58]
inc rdi
cmp rdi, rbp
jb 0x14003e7d5
add r15, 0x1000
add rbp, 0x1000
cmp r15, r12
jae 0x14003e7de
mov rdi, r12
cmp rdi, r9
jb 0x14003e740
mov rdi, qword [rsp + 0x100]
movabs rbp, 0xfffffffffff
mov r15, qword [rsp + 0xf0]
mov rcx, rdi
call fcn.140119ee4
mov rcx, qword [rsp + 0x80]
add rcx, qword [rsp + 0x68]
cmp rcx, rbp
jb 0x14003e670
mov rbx, qword [rsp + 0x30]
cmp rbx, r14
jne 0x14003e828
xor dil, dil
jmp 0x14003e8a4
xor esi, esi
sub r14, rbx
sar r14, 3
test r14, r14
je 0x14003e8a1
movsxd rbp, dword [rsp + 0x108]
mov rdi, rbx
mov r12, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x108]
nop
mov edx, dword [rdi]
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, rbp
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, ebx
mov r8, r12
mov rdx, qword [rdi]
mov rcx, qword [r15 + 8]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
inc esi
lea rdi, [rdi + 8]
movsxd rax, esi
cmp rax, r14
jb 0x14003e850
mov rbx, qword [rsp + 0x30]
mov dil, 1
test rbx, rbx
je 0x14003e8e3
sub r13, rbx
and r13, 0xfffffffffffffff8
mov rax, rbx
cmp r13, 0x1000
jb 0x14003e8d8
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e8d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, rbx
call fcn.140119ee4
movzx eax, dil
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret