Function at 0x140005540
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x7a8
mov rax, qword [0x140016030]
xor rax, rsp
mov qword [rsp + 0x790], rax
mov rsi, rcx
movzx r12d, r8w
mov rbp, rdx
lea rcx, [rsp + 0x150]
xor edx, edx
mov r8d, 0xf8
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x108
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x290]
xor edx, edx
mov r8d, 0x500
call sub.MSVCR90.dll_memset
xor ebx, ebx
lea r8, [rsp + 0x250]
lea r9d, [rbx + 0x40]
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400058fd
mov qword [rsp + 0x7a0], rdi
movsxd rdi, dword [rsp + 0x28c]
lea r8, [rsp + 0x150]
add rdi, rbp
mov r9d, 0xf8
mov rcx, rsi
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400058c3
movzx ecx, word [rsp + 0x156]
cmp cx, 0x20
ja 0x1400058c3
movzx eax, word [rsp + 0x164]
lea r8, [rsp + 0x290]
mov qword [rsp + 0x20], rbx
lea rdx, [rax + rdi + 0x18]
movzx eax, cx
mov rcx, rsi
lea r9d, [rax + rax*4]
shl r9d, 3
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400058c3
mov eax, dword [rsp + 0x150]
lea rcx, [rsp + 0x154]
lea rdx, [rsp + 0x44]
mov dword [rsp + 0x40], eax
mov eax, dword [rcx]
mov r8d, 0x80
mov dword [rdx], eax
mov eax, dword [rcx + 4]
mov dword [rdx + 4], eax
mov eax, dword [rcx + 8]
mov dword [rdx + 8], eax
mov eax, dword [rcx + 0xc]
mov dword [rdx + 0xc], eax
mov eax, dword [rcx + 0x10]
lea rcx, [rsp + 0xc8]
mov dword [rdx + 0x10], eax
mov eax, pe_nt_image_headers64
lea rdx, [rsp + 0x1c8]
mov word [rsp + 0x54], ax
mov eax, 0x20b
mov word [rsp + 0x44], r12w
mov word [rsp + 0x58], ax
movzx eax, byte [rsp + 0x16a]
mov byte [rsp + 0x5a], al
movzx eax, byte [rsp + 0x16b]
mov byte [rsp + 0x5b], al
mov eax, dword [rsp + 0x16c]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x170]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x174]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x178]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x17c]
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x184]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x188]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x18c]
mov dword [rsp + 0x7c], eax
movzx eax, word [rsp + 0x190]
mov word [rsp + 0x80], ax
movzx eax, word [rsp + 0x192]
mov word [rsp + 0x82], ax
movzx eax, word [rsp + 0x194]
mov word [rsp + 0x84], ax
movzx eax, word [rsp + 0x196]
mov word [rsp + 0x86], ax
movzx eax, word [rsp + 0x198]
mov word [rsp + 0x88], ax
movzx eax, word [rsp + 0x19a]
mov word [rsp + 0x8a], ax
mov eax, dword [rsp + 0x19c]
mov dword [rsp + 0x8c], eax
mov eax, dword [rsp + 0x1a0]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x1a4]
mov dword [rsp + 0x94], eax
mov eax, dword [rsp + 0x1a8]
mov dword [rsp + 0x98], eax
movzx eax, word [rsp + 0x1ac]
mov word [rsp + 0x9c], ax
movzx eax, word [rsp + 0x1ae]
mov word [rsp + 0x9e], ax
mov eax, dword [rsp + 0x1b0]
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x1b4]
mov qword [rsp + 0xa8], rax
mov eax, dword [rsp + 0x1b8]
mov qword [rsp + 0xb0], rax
mov eax, dword [rsp + 0x1bc]
mov qword [rsp + 0xb8], rax
mov eax, dword [rsp + 0x1c0]
mov dword [rsp + 0xc0], eax
mov eax, dword [rsp + 0x1c4]
mov dword [rsp + 0xc4], eax
call sub.MSVCR90.dll_memcpy
mov dword [rsp + 0xd0], ebx
mov dword [rsp + 0xd4], ebx
mov r8d, dword [rsp + 0x94]
lea rax, [rsp + 0x30]
mov r9d, 0x40
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1400058c3
lea r8, [rsp + 0x40]
mov r9d, 0x108
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400058c3
movzx eax, word [rsp + 0x54]
lea r8, [rsp + 0x290]
mov rcx, rsi
lea rdx, [rax + rdi + 0x18]
movzx eax, word [rsp + 0x46]
mov qword [rsp + 0x20], rbx
lea r9d, [rax + rax*4]
shl r9d, 3
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400058c7
xor eax, eax
jmp 0x1400058f5
mov r8d, dword [rsp + 0x94]
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x34]
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
setne bl
mov eax, ebx
mov rdi, qword [rsp + 0x7a0]
mov rcx, qword [rsp + 0x790]
xor rcx, rsp
call fcn.140009f00
add rsp, 0x7a8
pop r12
pop rsi
pop rbp
pop rbx
ret