Function at 0x14004efe0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2060
call fcn.14012a790
sub rsp, rax
mov r13, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
call fcn.14004ef20
mov rdx, rax
call fcn.14004e670
test eax, eax
je 0x14004f24c
mov dword [r14], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r14 + 8], rax
test rax, rax
je 0x14004f24c
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rbx, rax
xor ebp, ebp
test eax, eax
jle 0x14004f0cb
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbp
lea r8, [rsp + 0x38]
mov rdx, rdi
mov rcx, r14
call fcn.14004f2c0
test al, al
jne 0x14004f11e
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14004f0cb
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f0c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f1d3
call fcn.140129cbc
lea r9, str.Failed_To_Apply
mov edx, 8
mov r8d, 0x3e8
lea rcx, [rsp + 0x50]
call fcn.14004d860
mov rax, qword [0x14026ef98]
cmp rax, qword [0x14026efa0]
je 0x14004f1f9
mov r8d, 0x2010
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14026ef98], 0x2010
jmp 0x14004f206
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
cmp rdi, r12
je 0x14004f199
movsxd r15, ebx
mov rbx, qword [rdi]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r15
mov rdx, rbx
mov rcx, qword [r14 + 8]
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
mov qword [rsp + 0x20], rbp
mov r9, r15
mov r8, r13
mov rdx, rbx
mov rcx, qword [r14 + 8]
call qword [sym.imp.ntdll.dll_ZwWriteVirtualMemory]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov r8, r15
mov rdx, rbx
mov rcx, qword [r14 + 8]
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
add rdi, 8
cmp rdi, r12
jne 0x14004f130
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x14004f1e2
mov rax, qword [rsp + 0x48]
sub rax, rdi
sar rax, 3
lea rdx, [rax*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14004f1da
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f1da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140129cbc
lea r9, str.Applied
mov edx, 1
mov r8d, 0x5dc
jmp 0x14004f0dd
lea r8, [rsp + 0x50]
mov rdx, rax
call fcn.14005ddb0
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14004f247
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14004f242
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004f2b6
mov rcx, r8
call fcn.140129cbc
mov byte [rsi], 0
jmp 0x14004f289
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14004f282
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14004f27d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004f2b6
mov rcx, r8
call fcn.140129cbc
xor ebp, ebp
mov byte [rsi], bpl
xor al, al
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsi + 0x10], rbp
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3