Function at 0x1400025f8
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Resume thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x218]
sub rsp, 0x318
movsxd rdi, dword [rdx + 0x3c]
mov r15, rdx
add rdi, rdx
mov dword [rsp + 0x20], 0x40
mov rsi, rcx
mov qword [rsp + 0x30], rdi
mov rcx, qword [rcx]
xor edx, edx
mov r9d, 0x3000
mov r8d, dword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor ebx, ebx
mov qword [rbp + 0x268], rax
test rax, rax
je 0x140002890
mov r9d, dword [rdi + 0x54]
mov ecx, eax
sub ecx, dword [rdi + 0x34]
mov r8, r15
mov dword [rdi + 0x34], eax
mov rdx, qword [rbp + 0x268]
mov dword [rbp + 0x260], ecx
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140002890
mov rcx, r15
call fcn.140002064
xor r11d, r11d
mov qword [rbp + 0x278], rax
mov rbx, rax
mov r12d, r11d
mov r13d, r11d
cmp r11w, word [rdi + 6]
jae 0x140002890
mov r14d, r11d
movzx edx, word [rdi + 0x14]
add rdx, 0x18
add rdx, r14
add rdx, rdi
mov r10d, dword [rdx + 0xc]
cmp ebx, r10d
jb 0x1400026d3
mov ecx, dword [rdx + 8]
add ecx, r10d
cmp ebx, ecx
cmovb r12, rdx
mov r8d, dword [rdx + 0x14]
mov r9d, dword [rdx + 0x10]
add r8, r15
mov rcx, qword [rsi]
mov rdx, r10
add rdx, qword [rbp + 0x268]
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r11d, r11d
test eax, eax
je 0x140002890
movzx eax, word [rdi + 6]
inc r13d
add r14, 0x28
cmp r13d, eax
jl 0x1400026b0
test r12, r12
je 0x140002890
mov r14d, r11d
cmp dword [rbp + 0x27c], r11d
jbe 0x14000280c
mov edi, dword [rbp + 0x260]
mov eax, dword [r12 + 0x14]
add rax, r15
mov r13d, r14d
add r13, rax
add r14d, 8
mov eax, dword [r13 + 4]
sub rax, 8
shr rax, 1
test eax, eax
je 0x1400027fa
mov edx, eax
mov qword [rbp + 0x270], rdx
mov eax, dword [r12 + 0x14]
add rax, r15
mov ecx, r14d
add r14d, 2
movzx r8d, word [rcx + rax]
mov eax, 0x1000
cmp r8w, ax
jb 0x1400027e9
mov rcx, qword [rbp + 0x268]
and r8d, 0xfff
mov ebx, dword [r13]
add rcx, r8
add rbx, rcx
mov dword [rbp + 0x260], r11d
mov rcx, qword [rsi]
lea r8, [rbp + 0x260]
mov rdx, rbx
mov qword [rsp + 0x20], r11
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rsi]
lea r8, [rbp + 0x260]
add dword [rbp + 0x260], edi
mov r9d, 4
and qword [rsp + 0x20], 0
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rbp + 0x270]
xor r11d, r11d
sub rdx, 1
mov qword [rbp + 0x270], rdx
jne 0x14000275e
cmp r14d, dword [rbp + 0x27c]
jb 0x140002730
mov rdi, qword [rsp + 0x30]
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x2c8
call fcn.14000378c
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x140002890
mov edx, dword [rbp - 0x1c]
lea r8, [rbp + 0x268]
mov rcx, qword [rsi]
add rdx, 8
and qword [rsp + 0x20], 0
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140002890
mov edx, dword [rdi + 0x28]
add edx, dword [rbp + 0x268]
mov rcx, qword [rsi + 8]
mov dword [rbp - 0x10], edx
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
test eax, eax
je 0x140002890
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
jmp 0x140002892
xor eax, eax
add rsp, 0x318
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret