Function at 0x14000986c
Capabilities:
Allocate or change rwx memory
Resume thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x260
mov r14, rdx
mov rbp, rcx
xor edi, edi
call fcn.14000966c
cmp eax, edi
je 0x140009be3
mov r8d, eax
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rdi
mov rsi, rax
je 0x140009be3
lea rcx, [rsp + 0x68]
xor edx, edx
mov r8d, 0xf0
mov qword [rsp + 0x60], rdi
call sub.msvcrt.dll_memset
lea rcx, str.kernel32.dll
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [0x14001fee0]
lea rcx, [rsp + 0x40]
mov rdx, rax
mov rbx, rax
call fcn.140003e24
lea r8, [0x14001fef8]
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x60], rax
call fcn.140003e24
lea r8, [0x14001ff08]
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x68], rax
call fcn.140003e24
lea r8, [0x14001ff20]
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x70], rax
call fcn.140003e24
mov ebx, 0x1000
xor edx, edx
mov r8d, 0xf8
mov rcx, rsi
mov r9d, ebx
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, ebx
xor edx, edx
mov r8d, 0x400
mov rcx, rsi
mov r13, rax
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, ebx
xor edx, edx
mov r12, rax
mov eax, dword [r14]
mov rcx, rsi
lea r8d, [rax + rax]
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, dword [r14]
mov r9d, ebx
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x20], 4
mov qword [rsp + 0x148], rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp r13, rdi
mov ecx, dword [r14]
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x150], ecx
je 0x140009b83
cmp r12, rdi
je 0x140009b83
cmp qword [rsp + 0x148], rdi
je 0x140009b83
cmp ecx, edi
je 0x140009b83
mov r8, qword [r14 + 8]
mov r9, rcx
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.14000946c
lea r8, [0x14000956c]
mov r9d, 0x400
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14d, 0xf8
lea r8, [rsp + 0x60]
mov r9, r14
mov rdx, r13
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x58], rdi
call fcn.1400025d4
mov rdx, rax
mov rcx, rbp
mov rbx, rax
call fcn.1400097ac
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0x3a98
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8d, [r14 - 8]
lea rcx, [rsp + 0x168]
xor edx, edx
mov qword [rsp + 0x160], rdi
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x160]
mov r9, r14
mov rdx, r13
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r11d, dword [rsp + 0x254]
lea eax, [r11 - 1]
cmp eax, 0xfffffe
ja 0x140009b79
lea edx, [r11 + 0x10]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rsp + 0x254]
mov rdx, qword [rsp + 0x148]
mov r8, rax
mov rcx, rsi
mov rbx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, edi
je 0x140009b70
mov rcx, qword [rsp + 0x2b8]
mov eax, dword [rsp + 0x254]
mov edi, 1
mov qword [rcx + 8], rbx
mov dword [rcx], eax
jmp 0x140009b79
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x50]
call fcn.140002474
mov ebx, 0x8000
xor r8d, r8d
mov rdx, r13
mov r9d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, ebx
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rsp + 0x148]
mov r9d, ebx
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rsp + 0x140]
mov r9d, ebx
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret