Function at 0x14000f500
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf8
mov rax, qword [0x140346cb0]
xor rax, rsp
mov qword [rbp + 7], rax
mov r14, r8
mov rsi, rdx
mov r8d, ecx
mov ecx, 0x1fffff
xor edx, edx
mov rbx, r9
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, 0x3ef
mov rcx, rax
mov rdi, rax
call fcn.14000c5e0
xor r15d, r15d
mov qword [rbp - 0x39], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp - 0x41], r15
mov byte [rbp - 0x51], r15b
cmp byte [rbx], r15b
jne 0x14000f56d
mov r8d, r15d
jmp 0x14000f57a
or r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], r15b
jne 0x14000f571
lea rcx, [rbp - 0x51]
mov rdx, rbx
call fcn.14000b7d0
mov r13, r15
mov qword [rsp + 0x48], r15
mov r12, r15
cmp qword [rbp - 0x41], r15
jbe 0x14000fa1f
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x19]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
mov dword [rbp - 0x59], r15d
mov dword [rsp + 0x40], r15d
mov qword [rbp - 1], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp - 9], r15
mov byte [rbp - 0x19], r12b
call fcn.14000b6a0
lea r9, [rbp - 0x19]
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x31]
call fcn.14000b9f0
lea rdx, [rbp - 0x31]
lea rcx, [rsp + 0x50]
call fcn.140004c10
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], ecx
mov ecx, dword [rbp - 0x59]
mov r9, r14
mov dword [rsp + 0x28], ecx
lea rcx, [rbp - 0x71]
mov r8, rsi
mov rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.14000c7d0
lea rcx, [rbp - 0x19]
cmp rcx, rax
je 0x14000f646
mov r13, qword [rax]
mov r12, qword [rax + 8]
mov qword [rax + 0x10], r15
mov qword [rsp + 0x48], r13
mov qword [rax], r15
mov qword [rax + 8], r15
mov rcx, qword [rbp - 0x71]
test rcx, rcx
je 0x14000f654
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub r12, r13
sar r12, 3
mov qword [rsp + 0x40], r12
test r12, r12
je 0x14000f9d2
mov rbx, r15
mov rdx, r15
mov r14, r15
mov qword [rbp - 0x71], r15
mov qword [rbp - 0x59], r12
mov rsi, r15
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x61], rdx
nop
lea rdi, [rbp - 0x59]
add rdi, rsi
cmp rdi, rbx
jae 0x14000f713
cmp r14, rdi
ja 0x14000f713
sub rdi, r14
cmp rbx, rdx
jne 0x14000f707
mov rax, rdx
sub rax, rbx
cmp rax, 1
jae 0x14000f707
mov rax, r14
sub rax, rbx
dec rax
cmp rax, 1
jb 0x14000f80f
sub rdx, r14
or rax, 0xffffffffffffffff
sub rbx, r14
mov rcx, rdx
inc rbx
shr rcx, 1
sub rax, rcx
cmp rax, rdx
jae 0x14000f6e8
mov rdx, r15
jmp 0x14000f6eb
add rdx, rcx
cmp rdx, rbx
lea rcx, [rbp - 0x71]
cmovb rdx, rbx
call fcn.14000a080
mov rdx, qword [rbp - 0x61]
mov rbx, qword [rbp - 0x69]
mov r14, qword [rbp - 0x71]
test rbx, rbx
je 0x14000f780
movzx eax, byte [r14 + rdi]
jmp 0x14000f77e
cmp rbx, rdx
jne 0x14000f776
mov rax, rdx
sub rax, rbx
cmp rax, 1
jae 0x14000f776
mov rax, r14
sub rax, rbx
dec rax
cmp rax, 1
jb 0x14000f81d
sub rdx, r14
or rax, 0xffffffffffffffff
sub rbx, r14
mov rcx, rdx
inc rbx
shr rcx, 1
sub rax, rcx
cmp rax, rdx
jae 0x14000f757
mov rdx, r15
jmp 0x14000f75a
add rdx, rcx
cmp rdx, rbx
lea rcx, [rbp - 0x71]
cmovb rdx, rbx
call fcn.14000a080
mov rdx, qword [rbp - 0x61]
mov rbx, qword [rbp - 0x69]
mov r14, qword [rbp - 0x71]
test rbx, rbx
je 0x14000f780
movzx eax, byte [rdi]
mov byte [rbx], al
inc rbx
inc rsi
mov qword [rbp - 0x69], rbx
cmp rsi, 8
jl 0x14000f690
mov dword [rbp - 0x59], r15d
test r12, r12
je 0x14000f8fe
mov r12, qword [rsp + 0x48]
neg r12
nop dword [rax]
mov rdi, r13
cmp rdi, rbx
jae 0x14000f856
cmp r14, rdi
ja 0x14000f856
mov rsi, rdi
sub rsi, r14
cmp rbx, rdx
jne 0x14000f84a
mov rax, rdx
sub rax, rbx
cmp rax, 1
jae 0x14000f84a
mov rax, r14
sub rax, rbx
dec rax
cmp rax, 1
jb 0x14000f9a9
sub rdx, r14
or rax, 0xffffffffffffffff
sub rbx, r14
mov rcx, rdx
inc rbx
shr rcx, 1
sub rax, rcx
cmp rax, rdx
jae 0x14000f82b
mov rdx, r15
jmp 0x14000f82e
lea rcx, [0x140013360]
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rcx, [0x140013360]
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
add rdx, rcx
cmp rdx, rbx
lea rcx, [rbp - 0x71]
cmovb rdx, rbx
call fcn.14000a080
mov rdx, qword [rbp - 0x61]
mov rbx, qword [rbp - 0x69]
mov r14, qword [rbp - 0x71]
test rbx, rbx
je 0x14000f8c3
movzx eax, byte [rsi + r14]
jmp 0x14000f8c1
cmp rbx, rdx
jne 0x14000f8b9
mov rax, rdx
sub rax, rbx
cmp rax, 1
jae 0x14000f8b9
mov rax, r14
sub rax, rbx
dec rax
cmp rax, 1
jb 0x14000f9b7
sub rdx, r14
or rax, 0xffffffffffffffff
sub rbx, r14
mov rcx, rdx
inc rbx
shr rcx, 1
sub rax, rcx
cmp rax, rdx
jae 0x14000f89a
mov rdx, r15
jmp 0x14000f89d
add rdx, rcx
cmp rdx, rbx
lea rcx, [rbp - 0x71]
cmovb rdx, rbx
call fcn.14000a080
mov rdx, qword [rbp - 0x61]
mov rbx, qword [rbp - 0x69]
mov r14, qword [rbp - 0x71]
test rbx, rbx
je 0x14000f8c3
movzx eax, byte [rdi]
mov byte [rbx], al
inc rdi
inc rbx
lea rax, [r12 + rdi]
mov qword [rbp - 0x69], rbx
cmp rax, 8
jl 0x14000f7b3
mov ecx, dword [rbp - 0x59]
add r13, 8
sub r12, 8
inc ecx
movsxd rax, ecx
mov dword [rbp - 0x59], ecx
cmp rax, qword [rsp + 0x40]
jb 0x14000f7b0
mov r13, qword [rsp + 0x48]
sub rbx, r14
je 0x14000f9c5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x3000
mov r8, rbx
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9, rbx
mov r8, r14
mov rcx, rdi
mov rdx, rax
mov r12, rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov r8d, eax
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
or r8, 0xffffffffffffffff
or rdx, r8
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x14000f9c5
test r14, r14
je 0x14000f9a4
mov rcx, r14
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov r15, r12
jmp 0x14000fa04
lea rcx, [0x140013360]
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rcx, [0x140013360]
call qword [sym.imp.MSVCP110.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
test r14, r14
je 0x14000f9d2
mov rcx, r14
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
or r8, 0xffffffffffffffff
or rdx, r8
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x14000fa12
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
test r13, r13
je 0x14000fa1f
mov rcx, r13
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
cmp qword [rbp - 0x39], 0x10
jb 0x14000fa2f
mov rcx, qword [rbp - 0x51]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, r15
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1400104e0
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret