Function at 0x140001000
Capabilities:
Allocate or change rwx memory

Disassembly:
mov byte [rsp + 0x20], r9b
push rbp
push rdi
push r14
push r15
sub rsp, 0x78
mov eax, 0x5a4d
mov rbp, rcx
cmp word [0x140005040], ax
jne 0x1400012e3
movsxd rdi, dword [0x14000507c]
lea r15, [0x140005040]
add rdi, r15
mov eax, 0x8664
cmp word [rdi + 4], ax
jne 0x1400012e3
mov r8d, dword [rdi + 0x50]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x1400012e3
mov qword [rsp + 0xa0], rbx
lea rax, [rsp + 0xb8]
mov qword [rsp + 0xa8], rsi
mov rdx, r14
mov qword [rsp + 0xb0], r12
mov rcx, rbp
xor r12d, r12d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xb8], r12d
mov r8d, dword [rdi + 0x50]
lea r9d, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9d, 0x1000
mov qword [rsp + 0x30], rax
mov r8, r15
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, r14
mov qword [rsp + 0x38], rax
mov rcx, rbp
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400012d2
movzx ebx, word [rdi + 0x14]
mov esi, r12d
add rbx, 0x2c
cmp word [rdi + 6], r12w
je 0x14000116a
add rbx, rdi
nop dword [rax + rax]
mov eax, dword [rbx - 4]
test eax, eax
je 0x14000115c
mov r8d, dword [rbx]
mov r9d, eax
mov edx, dword [rbx - 8]
add r8, r15
add rdx, r14
mov qword [rsp + 0x20], r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400012d2
movzx eax, word [rdi + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jne 0x140001130
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov rcx, rbp
lea r8d, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x1400012d2
mov r9d, 0x40
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001202
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xb0]
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rbp
ret
mov esi, r12d
movzx eax, word [rdi + 0x14]
lea rbx, [rax + 0x3c]
cmp word [rdi + 6], r12w
je 0x140001287
mov qword [rsp + 0x70], r13
add rbx, rdi
mov r13d, 0x20
mov ecx, dword [rbx - 0x1c]
test ecx, ecx
je 0x140001270
mov eax, dword [rbx]
mov dword [rsp + 0xc0], r12d
test eax, 0x80000000
jbe 0x140001242
mov r9d, 4
jmp 0x140001251
test eax, 0x20000000
mov r9d, 2
cmova r9d, r13d
mov edx, dword [rbx - 0x18]
lea rax, [rsp + 0xc0]
mov r8, rcx
mov qword [rsp + 0x20], rax
add rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movzx eax, word [rdi + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jne 0x140001222
movzx eax, word [rdi + 0x14]
mov r13, qword [rsp + 0x70]
movzx eax, ax
mov r9d, 2
mov dword [rsp + 0xc8], r12d
mov rdx, r14
mov rcx, rbp
mov r8d, dword [rax + rdi + 0x24]
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, 1
jmp 0x1400011df
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
jmp 0x1400011d4
xor al, al
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rbp
ret