Function at 0x14003e590
Capabilities:
Allocate or change rwx memory
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov r15, rcx
mov ecx, 0x48
call fcn.14011a568
mov rbx, rax
mov dword [rax], 0xeb02c82d
mov dword [rax + 4], 0xeaffffff
mov dword [rax + 8], 0xe59d0024
mov dword [rax + 0xc], 0xe2801d05
mov dword [rax + 0x10], 0xeb000139
mov dword [rax + 0x14], 0xeaffffff
mov dword [rax + 0x18], 0xebffa3e4
mov dword [rax + 0x1c], 0xe58d0008
mov dword [rax + 0x20], 0xeaffffff
mov dword [rax + 0x24], 0xe59d0024
mov dword [rax + 0x28], 0xe59012fc
mov dword [rax + 0x2c], 0xe59d0008
mov dword [rax + 0x30], 0xebffa439
mov dword [rax + 0x34], 0xeaffffff
mov dword [rax + 0x38], 0xeb02043c
mov dword [rax + 0x3c], 0xe58d0004
mov dword [rax + 0x40], 0xeaffffff
mov dword [rax + 0x44], 0xe59d0024
mov ecx, 4
call fcn.14011a568
mov qword [rsp + 0x60], rax
mov dword [rax], 0xe3000000
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov qword [rsp + 0x108], rax
test eax, eax
jg 0x14003e666
xor al, al
jmp 0x14003e917
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor r13d, r13d
mov qword [rsp + 0x40], r13
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rsi, rax
xor ecx, ecx
movabs rbp, 0xfffffffffff
mov r14, qword [rsp + 0x38]
nop dword [rax]
nop dword [rax + rax]
mov r9d, Ordinal_50
lea r8, [rsp + 0x68]
mov rdx, rcx
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x14003e846
cmp dword [rsp + 0x88], 0x1000
jne 0x14003e830
mov eax, dword [rsp + 0x8c]
bt eax, 8
jb 0x14003e830
cmp eax, 1
je 0x14003e830
cmp eax, 0x10
je 0x14003e830
mov rcx, qword [rsp + 0x80]
call fcn.14011a568
mov rdi, rax
mov qword [rsp + 0x100], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x80]
mov r8, rdi
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14003e828
mov r8, rdi
mov rcx, qword [rsp + 0x48]
sub rcx, rsi
lea r9, [rdi + 1]
add r9, rcx
mov qword [rsp + 0x58], r9
lea r12, [rdi - 1]
add r12, rsi
mov r15, r12
lea rbp, [rdi - 1]
add rbp, qword [rsp + 0x48]
cmp rdi, r9
jae 0x14003e816
nop dword [rax]
test rsi, rsi
je 0x14003e79b
mov rax, rbx
mov rdx, rdi
sub rdx, rbx
nop
movzx ecx, byte [rax]
cmp cl, 0x3f
je 0x14003e78d
cmp cl, byte [rdx + rax]
jne 0x14003e7e7
inc rax
mov rcx, rax
sub rcx, rbx
cmp rcx, rsi
jb 0x14003e780
mov rax, rdi
sub rax, r8
add rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
cmp r14, r13
je 0x14003e7be
mov qword [r14], rax
add r14, 8
mov qword [rsp + 0x38], r14
jmp 0x14003e7e7
lea r8, [rsp + 0x50]
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.140048700
mov r13, qword [rsp + 0x40]
mov r14, qword [rsp + 0x38]
mov r8, qword [rsp + 0x100]
mov r9, qword [rsp + 0x58]
inc rdi
cmp rdi, rbp
jb 0x14003e805
add r15, 0x1000
add rbp, 0x1000
cmp r15, r12
jae 0x14003e80e
mov rdi, r12
cmp rdi, r9
jb 0x14003e770
mov rdi, qword [rsp + 0x100]
movabs rbp, 0xfffffffffff
mov r15, qword [rsp + 0xf0]
mov rcx, rdi
call fcn.14011a4c4
mov rcx, qword [rsp + 0x80]
add rcx, qword [rsp + 0x68]
cmp rcx, rbp
jb 0x14003e6a0
mov rbx, qword [rsp + 0x30]
cmp rbx, r14
jne 0x14003e855
xor dil, dil
jmp 0x14003e8d4
xor esi, esi
sub r14, rbx
sar r14, 3
test r14, r14
je 0x14003e8d1
movsxd rbp, dword [rsp + 0x108]
mov rdi, rbx
mov r12, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x108]
nop dword [rax + rax]
mov edx, dword [rdi]
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, rbp
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, ebx
mov r8, r12
mov rdx, qword [rdi]
mov rcx, qword [r15 + 8]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
inc esi
lea rdi, [rdi + 8]
movsxd rax, esi
cmp rax, r14
jb 0x14003e880
mov rbx, qword [rsp + 0x30]
mov dil, 1
test rbx, rbx
je 0x14003e913
sub r13, rbx
and r13, 0xfffffffffffffff8
mov rax, rbx
cmp r13, 0x1000
jb 0x14003e908
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e908
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, rbx
call fcn.14011a4c4
movzx eax, dil
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret