Function at 0x140142008
Capabilities:
Allocate or change rwx memory
Inspect section memory permissions
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx ecx, word [0x140148060]
xor r14d, r14d
mov r12, rax
mov edi, r14d
lea r13d, [r14 + 1]
cmp r14w, cx
jae 0x140142123
lea rbx, [0x140148064]
cmp dword [rbx + 4], r14d
je 0x140142111
mov esi, dword [rbx]
lea r8, [rbp - 0x40]
mov r14d, dword [rbx + 4]
add rsi, r12
mov rdx, rsi
mov r9d, r14d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [rbp - 0x20], 0x10000
jne 0x140142107
cmp dword [rbx + 0x10], 0x20000000
mov eax, 0x40
je 0x1401420be
cmp dword [rbx + 0x10], 0x40000000
je 0x1401420b7
cmp dword [rbx + 0x10], 0x80000000
jne 0x1401420c3
mov eax, 4
jmp 0x1401420c3
mov eax, 2
jmp 0x1401420c3
mov eax, 0x10
mov r9d, 0x1000
mov dword [rsp + 0x20], eax
mov r8, r14
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor r14d, r14d
test rax, rax
jne 0x14014210a
xor r9d, r9d
lea r8, [0x1401462a8]
lea rdx, [0x1401462b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor r14d, r14d
movzx ecx, word [0x140148060]
add edi, r13d
movzx eax, cx
add rbx, 0x18
cmp edi, eax
jl 0x140142061
mov rdi, qword [0x140148048]
mov esi, r14d
cmp r14w, cx
jae 0x14014224e
lea rbx, [0x140148068]
mov edx, dword [rbx + 0x10]
test edx, edx
je 0x1401421e6
cmp edx, r13d
jne 0x140142235
mov ecx, dword [rbx]
call fcn.140144450
mov ecx, dword [rbx + 8]
lea r9, [rbp + 0x58]
mov r8d, dword [rbx + 4]
lea rdx, [rbp + 0x50]
add r8, rdi
mov qword [rbp + 0x58], rcx
mov r14, rax
mov rcx, qword [r8]
mov qword [rbp + 0x50], rcx
lea rcx, [r8 + 0x10]
mov qword [rsp + 0x20], rcx
add r8, 0x18
mov rcx, rax
call fcn.1401423c4
cmp qword [rbp + 0x50], 0
je 0x14014230e
mov ecx, dword [rbx - 4]
lea r9, [rbp + 0x48]
mov edx, dword [rbx]
add rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [rbx - 4]
mov rdx, r14
mov r8d, dword [rbx]
add rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov ecx, dword [rbx - 4]
lea r9, [rbp + 0x48]
mov edx, dword [rbx]
add rcx, rdi
mov r8d, dword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, r14
call fcn.140144448
xor r14d, r14d
jmp 0x14014222e
cmp dword [rbx], r14d
je 0x140142235
mov ecx, dword [rbx - 4]
lea r9, [rbp + 0x48]
mov edx, dword [rbx]
add rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [rbx + 4]
mov ecx, dword [rbx - 4]
add rdx, rdi
mov r8d, dword [rbx]
add rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov ecx, dword [rbx - 4]
lea r9, [rbp + 0x48]
mov edx, dword [rbx]
add rcx, rdi
mov r8d, dword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx ecx, word [0x140148060]
add esi, r13d
movzx eax, cx
add rbx, 0x18
cmp esi, eax
jl 0x14014213e
mov rdi, qword [0x140148048]
mov eax, dword [0x140148050]
mov r12d, r14d
mov ecx, dword [0x140148058]
add rax, rdi
mov ebx, dword [0x140148054]
mov qword [0x140148888], rax
add rbx, rdi
movabs rax, 0xcccccccccccccccd
mov dword [rbp + 0x58], r14d
mul rcx
mov r13, rdx
shr r13, 4
test r13d, r13d
je 0x140142388
cmp dword [rbx], r14d
je 0x140142374
mov ecx, dword [rbx + 0xc]
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [rbx]
mov r15d, dword [rbx + 0x10]
add rsi, rdi
add r15, rdi
mov qword [rbp + 0x60], rax
cmp qword [rsi], 0
je 0x1401422c6
inc r14d
cmp qword [rsi + r14*8], 0
jne 0x1401422bc
mov eax, r14d
lea r9, [rbp + 0x50]
shl rax, 3
mov r8d, 0x40
mov rdx, rax
mov qword [rbp - 0x48], rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
and dword [rbp + 0x48], 0
test r14d, r14d
je 0x14014235c
mov r12, r15
sub rsi, r15
mov rcx, qword [r12 + rsi]
mov rax, rcx
shr rax, 0x3f
cmp al, 1
je 0x140142331
lea rdx, [rdi + 2]
add rdx, rcx
jmp 0x140142334
xor r9d, r9d
lea r8, [0x1401462a8]
lea rdx, [0x1401462c8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movzx edx, cx
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014239d
mov edx, dword [rbp + 0x48]
inc edx
mov qword [r12], rax
add r12, 8
mov dword [rbp + 0x48], edx
cmp edx, r14d
jb 0x1401422f6
mov r12d, dword [rbp + 0x58]
mov r8d, dword [rbp + 0x50]
lea r9, [rbp + 0x50]
mov rdx, qword [rbp - 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r14d, r14d
inc r12d
add rbx, 0x14
mov dword [rbp + 0x58], r12d
cmp r12d, r13d
jb 0x140142291
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
jmp 0x140144440
xor r9d, r9d
lea r8, [0x1401462a8]
lea rdx, [0x1401462d8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
push qword [0x140148888]
ret