Function at 0x140001230
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x2e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2c8], rax
mov rdi, r8
mov qword [rsp + 0x30], r9
mov ebx, edx
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x84]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
test ebx, ebx
je 0x1400012e3
mov edx, ebx
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400012e3
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x80], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1400012da
mov rdx, rdi
lea rcx, [rsp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x1400012ea
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1400012b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400014ac
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x1400012e3
xorps xmm0, xmm0
lea r8, [rsp + 0x40]
xor ebx, ebx
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x20], rbx
movups xmmword [rsp + 0x40], xmm0
lea r9d, [rbx + 0x40]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400012e3
mov eax, _register_thread_local_exe_atexit_callback
cmp word [rsp + 0x40], ax
jne 0x1400012e3
lea rdx, [rsp + 0x2c0]
mov dword [rsp + 0x2c0], ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1400012e3
cmp dword [rsp + 0x2c0], ebx
lea r9d, [rbx + 0x40]
mov eax, pe_nt_image_headers64
mov ebp, 0x108
cmovne ebp, eax
mov r8d, 0x3000
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1400012e3
movsxd rdx, dword [rsp + 0x7c]
mov r9d, ebp
add rdx, rsi
mov qword [rsp + 0x20], rbx
mov r8, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140001502
cmp dword [rdi], 0x4550
jne 0x140001502
cmp dword [rsp + 0x2c0], ebx
mov eax, 0x78
mov ecx, 0x88
cmove eax, ecx
mov r15d, dword [rax + rdi]
test r15d, r15d
je 0x140001502
mov ebp, dword [rax + rdi + 4]
test ebp, ebp
je 0x140001502
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r9d, [rbx + 0x40]
mov r8d, 0x3000
mov edx, ebp
xor ecx, ecx
mov r13d, ebp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1400012e3
mov qword [rsp + 0x2d8], r12
mov r9d, ebp
mov r12d, r15d
mov qword [rsp + 0x20], rbx
add r15, rsi
mov r8, rax
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140001491
mov r14d, dword [rdi + 0x20]
mov rbp, rdi
mov eax, dword [rdi + 0x24]
sub rbp, r12
mov r12d, dword [rdi + 0x1c]
add rax, rbp
add r12, rbp
mov qword [rsp + 0x38], rax
add r14, rbp
cmp dword [rdi + 0x18], ebx
jbe 0x140001491
nop
mov ecx, dword [r14 + rbx*4]
mov rdx, qword [rsp + 0x30]
add rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400014ce
mov eax, dword [rdi + 0x18]
inc rbx
cmp rbx, rax
jb 0x140001470
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov r12, qword [rsp + 0x2d8]
mov rcx, qword [rsp + 0x2c8]
xor rcx, rsp
call fcn.140002e50
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + rbx*2]
mov ebx, dword [r12 + rax*4]
add rbx, rsi
cmp rbx, r15
jb 0x1400014ec
lea rcx, [r15 + r13]
cmp rbx, rcx
jbe 0x140001491
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbx
jmp 0x1400014a4
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x1400014ac