Function at 0x140031a30
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x400]
sub rsp, 0x500
lea rax, [rsp + 0x78]
mov rsi, rdx
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x70]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x28], 0x400
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov rdi, rcx
call fcn.140031530
test eax, eax
js 0x140031cb1
cmp dword [rbp - 0x20], 2
mov qword [rsp + 0x520], rbx
mov qword [rsp + 0x528], r13
mov qword [rsp + 0x4f8], r14
mov qword [rsp + 0x4f0], r15
jne 0x140031b5f
mov rdx, qword [rsp + 0x48]
lea rax, [rbp + 0x430]
lea r9, [rbp + 0x438]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x78]
mov rcx, rdi
call fcn.1400318a0
mov edi, eax
test eax, eax
js 0x140031c91
sub rsi, qword [rbp - 0x40]
xor ebx, ebx
mov edx, dword [rbp + 0x430]
test edx, edx
je 0x140031b0f
mov r8, qword [rbp + 0x438]
nop
mov eax, ebx
lea rcx, [rax + rax*2]
mov eax, dword [r8 + rcx*4]
cmp rsi, rax
jb 0x140031b09
mov eax, dword [r8 + rcx*4 + 4]
cmp rsi, rax
jb 0x140031b39
inc ebx
cmp ebx, edx
jb 0x140031af0
mov edi, 0xc0000225
mov rax, qword gs:[0x30]
xor edx, edx
mov r8, qword [rbp + 0x438]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140031c8f
mov eax, ebx
lea rcx, [rax + rax*2]
lea rax, [r8 + rcx*4]
test rax, rax
je 0x140031b0f
movsd xmm0, qword [rax]
movsd qword [0x14015be00], xmm0
mov eax, dword [rax + 8]
mov dword [0x14015be08], eax
jmp 0x140031b14
mov r15d, dword [rbp - 0x1c]
cmp r15d, 0x100000
jbe 0x140031b76
mov edi, 0x80000005
jmp 0x140031c8f
lea r13, [r15 + r15*2]
mov dword [rsp + 0x28], 4
shl r13, 2
lea r9, [rsp + 0x50]
xor ebx, ebx
mov qword [rsp + 0x50], r13
xor r8d, r8d
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 0x1000
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x140031c8a
mov r14, qword [rsp + 0x40]
test r14, r14
je 0x140031c8a
mov rdx, qword [rbp - 0x60]
mov r9, r13
mov r8, r14
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call sym.ProcessHacker.exe_PhReadVirtualMemory
mov edi, eax
test eax, eax
js 0x140031bf4
mov qword [rbp + 0x438], r14
mov dword [rbp + 0x430], r15d
jmp 0x140031c26
mov r9d, 0x8000
mov qword [rsp + 0x60], r14
lea r8, [rsp + 0x58]
mov qword [rsp + 0x58], rbx
lea rdx, [rsp + 0x60]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov r15d, dword [rbp + 0x430]
mov r14, qword [rbp + 0x438]
test edi, edi
js 0x140031c8f
sub rsi, qword [rbp - 0x40]
mov edx, r15d
cmp dword [rbp - 0x20], ebx
mov r9, rsi
mov rcx, r14
sete r8b
call fcn.1400317f0
test rax, rax
je 0x140031c5f
movsd xmm0, qword [rax]
movsd qword [0x14015be00], xmm0
mov eax, dword [rax + 8]
mov dword [0x14015be08], eax
jmp 0x140031c64
mov edi, 0xc0000225
mov r9d, 0x8000
mov qword [rsp + 0x70], r14
lea r8, [rsp + 0x68]
mov qword [rsp + 0x68], rbx
lea rdx, [rsp + 0x70]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
jmp 0x140031c8f
mov edi, 0xc0000017
mov eax, edi
mov r14, qword [rsp + 0x4f8]
mov r13, qword [rsp + 0x528]
mov rbx, qword [rsp + 0x520]
mov r15, qword [rsp + 0x4f0]
add rsp, 0x500
pop rdi
pop rsi
pop rbp
ret