Function at 0x14000ef90
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xf8
mov rax, qword [0x1401002b0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rbx, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, 0x3ef
mov rcx, rax
mov rdi, rax
call fcn.14000c5e0
xor r15d, r15d
mov qword [rbp - 0x29], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp - 0x31], r15
mov byte [rbp - 0x41], r15b
cmp byte [rbx], r15b
jne 0x14000eff4
mov r8d, r15d
jmp 0x14000f009
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], r15b
jne 0x14000f000
lea rcx, [rbp - 0x41]
mov rdx, rbx
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0xf0], r14
call fcn.14000b7d0
mov r13, r15
mov qword [rsp + 0x48], r15
mov r12, r15
cmp qword [rbp - 0x31], r15
jbe 0x14000f4bf
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 9]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov dword [rbp - 0x49], r15d
mov dword [rsp + 0x40], r15d
mov qword [rbp + reloc.OLEAUT32.dll_SafeArrayDestroy], 0xf
mov qword [rbp + 7], r15
mov byte [rbp - 9], r12b
call fcn.14000b6a0
lea r9, [rbp - 9]
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x21]
call fcn.14000b9f0
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x79]
call fcn.140004c10
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], ecx
mov ecx, dword [rbp - 0x49]
xor r9d, r9d
mov dword [rsp + 0x28], ecx
lea rcx, [rbp - 0x61]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.14000c7d0
lea rcx, [rbp - 9]
cmp rcx, rax
je 0x14000f0e1
mov r13, qword [rax]
mov r12, qword [rax + 8]
mov qword [rax + 0x10], r15
mov qword [rsp + 0x48], r13
mov qword [rax], r15
mov qword [rax + 8], r15
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x14000f0ef
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub r12, r13
sar r12, 3
mov qword [rsp + 0x40], r12
test r12, r12
je 0x14000f472
mov rbx, r15
mov rdx, r15
mov r14, r15
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x49], r12
mov rsi, r15
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x51], rdx
nop dword [rax]
lea rdi, [rbp - 0x49]
add rdi, rsi
cmp rdi, rbx
jae 0x14000f1b3
cmp r14, rdi
ja 0x14000f1b3
sub rdi, r14
cmp rbx, rdx
jne 0x14000f1a7
mov rax, rdx
sub rax, rbx
cmp rax, 1
jae 0x14000f1a7
mov rax, r14
sub rax, rbx
dec rax
cmp rax, 1
jb 0x14000f2af
sub rdx, r14
or rax, 0xffffffffffffffff
sub rbx, r14
mov rcx, rdx
inc rbx
shr rcx, 1
sub rax, rcx
cmp rax, rdx
jae 0x14000f188
mov rdx, r15
jmp 0x14000f18b
add rdx, rcx
cmp rdx, rbx
lea rcx, [rbp - 0x61]
cmovb rdx, rbx
call fcn.14000a080
mov rdx, qword [rbp - 0x51]
mov rbx, qword [rbp - 0x59]
mov r14, qword [rbp - 0x61]
test rbx, rbx
je 0x14000f220
movzx eax, byte [r14 + rdi]
jmp 0x14000f21e
cmp rbx, rdx
jne 0x14000f216
mov rax, rdx
sub rax, rbx
cmp rax, 1
jae 0x14000f216
mov rax, r14
sub rax, rbx
dec rax
cmp rax, 1
jb 0x14000f2bd
sub rdx, r14
or rax, 0xffffffffffffffff
sub rbx, r14
mov rcx, rdx
inc rbx
shr rcx, 1
sub rax, rcx
cmp rax, rdx
jae 0x14000f1f7
mov rdx, r15
jmp 0x14000f1fa
add rdx, rcx
cmp rdx, rbx
lea rcx, [rbp - 0x61]
cmovb rdx, rbx
call fcn.14000a080
mov rdx, qword [rbp - 0x51]
mov rbx, qword [rbp - 0x59]
mov r14, qword [rbp - 0x61]
test rbx, rbx
je 0x14000f220
movzx eax, byte [rdi]
mov byte [rbx], al
inc rbx
inc rsi
mov qword [rbp - 0x59], rbx
cmp rsi, 8
jl 0x14000f130
mov dword [rbp - 0x49], r15d
test r12, r12
je 0x14000f39e
mov r12, qword [rsp + 0x48]
neg r12
nop dword [rax]
mov rdi, r13
cmp rdi, rbx
jae 0x14000f2f6
cmp r14, rdi
ja 0x14000f2f6
mov rsi, rdi
sub rsi, r14
cmp rbx, rdx
jne 0x14000f2ea
mov rax, rdx
sub rax, rbx
cmp rax, 1
jae 0x14000f2ea
mov rax, r14
sub rax, rbx
dec rax
cmp rax, 1
jb 0x14000f449
sub rdx, r14
or rax, 0xffffffffffffffff
sub rbx, r14
mov rcx, rdx
inc rbx
shr rcx, 1
sub rax, rcx
cmp rax, rdx
jae 0x14000f2cb
mov rdx, r15
jmp 0x14000f2ce
lea rcx, [0x140013360]
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rcx, [0x140013360]
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
add rdx, rcx
cmp rdx, rbx
lea rcx, [rbp - 0x61]
cmovb rdx, rbx
call fcn.14000a080
mov rdx, qword [rbp - 0x51]
mov rbx, qword [rbp - 0x59]
mov r14, qword [rbp - 0x61]
test rbx, rbx
je 0x14000f363
movzx eax, byte [rsi + r14]
jmp 0x14000f361
cmp rbx, rdx
jne 0x14000f359
mov rax, rdx
sub rax, rbx
cmp rax, 1
jae 0x14000f359
mov rax, r14
sub rax, rbx
dec rax
cmp rax, 1
jb 0x14000f457
sub rdx, r14
or rax, 0xffffffffffffffff
sub rbx, r14
mov rcx, rdx
inc rbx
shr rcx, 1
sub rax, rcx
cmp rax, rdx
jae 0x14000f33a
mov rdx, r15
jmp 0x14000f33d
add rdx, rcx
cmp rdx, rbx
lea rcx, [rbp - 0x61]
cmovb rdx, rbx
call fcn.14000a080
mov rdx, qword [rbp - 0x51]
mov rbx, qword [rbp - 0x59]
mov r14, qword [rbp - 0x61]
test rbx, rbx
je 0x14000f363
movzx eax, byte [rdi]
mov byte [rbx], al
inc rdi
inc rbx
lea rax, [r12 + rdi]
mov qword [rbp - 0x59], rbx
cmp rax, 8
jl 0x14000f253
mov ecx, dword [rbp - 0x49]
add r13, 8
sub r12, 8
inc ecx
movsxd rax, ecx
mov dword [rbp - 0x49], ecx
cmp rax, qword [rsp + 0x40]
jb 0x14000f250
mov r13, qword [rsp + 0x48]
sub rbx, r14
je 0x14000f465
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x3000
mov r8, rbx
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9, rbx
mov r8, r14
mov rcx, rdi
mov rdx, rax
mov r12, rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov r8d, eax
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
or r8, 0xffffffffffffffff
or rdx, r8
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x14000f465
test r14, r14
je 0x14000f444
mov rcx, r14
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov r15, r12
jmp 0x14000f4a4
lea rcx, [0x140013360]
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rcx, [0x140013360]
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
test r14, r14
je 0x14000f472
mov rcx, r14
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
or r8, 0xffffffffffffffff
or rdx, r8
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14000f4b2
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
test r13, r13
je 0x14000f4bf
mov rcx, r13
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
cmp qword [rbp - 0x29], 0x10
jb 0x14000f4cf
mov rcx, qword [rbp - 0x41]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov r14, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x140]
mov rax, r15
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400104e0
add rsp, 0xf8
pop r15
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret