Function at 0x140003370
Capabilities:
Inspect section memory permissions

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x38
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r14, rdx
mov rdi, rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Overwriting_the_mapping_n
mov rsi, r8
call fcn.140002950
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r13d, r13d
mov rcx, rdi
mov dword [rsp + 0x20], r13d
call fcn.140004f00
mov ebx, eax
lea r12d, [r13 + 2]
test eax, eax
je 0x14000340d
lea r9, [rsp + 0x20]
mov edx, ebx
lea r8d, [r13 + 4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000349c
mov r8d, ebx
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x20]
mov r8d, r12d
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000349c
lea r9, [rsp + 0x20]
mov r8d, 4
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400034a3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.implant_size:
call fcn.140002950
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140008d00]
call fcn.140002950
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.prev_size:
call fcn.140002950
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140008d00]
call fcn.140002950
cmp rsi, rbx
jbe 0x14000349c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.____The_implant_is_too_big_for_the_target__n
call fcn.140002950
xor al, al
jmp 0x1400035b2
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x24]
mov dword [rsp + 0x24], r13d
mov r8d, r12d
mov edx, 0x1000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400034d7
xor bl, bl
jmp 0x1400035ad
mov qword [rsp + 0x88], rbp
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x30], r15
mov bl, 1
call fcn.140005148
mov r15, rax
mov rbp, r13
test rax, rax
je 0x1400035a0
mov r8, rbp
mov rdx, rsi
mov rcx, r14
call fcn.1400050a4
mov r9, rax
test rax, rax
je 0x1400035a0
mov edx, dword [rax + 0x24]
mov ecx, edx
and ecx, 0xe0000000
cmp ecx, 0xe0000000
jne 0x140003535
mov r8d, 0x40
jmp 0x140003575
mov eax, edx
and eax, 0x60000000
cmp eax, 0x60000000
jne 0x14000354b
mov r8d, 0x20
jmp 0x140003575
bt edx, 0x1d
jae 0x140003559
mov r8d, 0x20
jmp 0x140003575
mov eax, edx
mov r8d, 4
and eax, 0xc0000000
cmp eax, 0xc0000000
je 0x140003575
bt edx, 0x1e
cmovb r8d, r12d
mov ecx, dword [r9 + 0xc]
mov edx, dword [r9 + 8]
add rcx, rdi
lea r9, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
movzx ebx, bl
cmove ebx, r13d
inc rbp
cmp rbp, r15
jb 0x140003500
mov rbp, qword [rsp + 0x88]
mov r15, qword [rsp + 0x30]
test bl, bl
setne al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140006410
add rsp, 0x38
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret