Function at 0x140001230
Capabilities:
Allocate or change rwx memory
Delete file
Enumerate pe sections
Parse pe header
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4c8]
sub rsp, 0x590
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov rbx, r8
mov r12, rcx
mov qword [rbp + 0x1b0], rbx
xor r13d, r13d
mov dword [rbp + 0x1c0], 0x238
lea ecx, [r13 + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp rax, 0xffffffffffffffff
je 0x1400018ca
lea rdx, [rbp + 0x1c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
mov r14, qword [rbp + 0x1d8]
test r14, r14
je 0x1400018ca
mov rdx, r14
lea rcx, str.___module_base___p__n
call fcn.140001010
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 0x40]
lea r8, [rsp + 0x50]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movups xmm6, xmmword [rsp + 0x50]
movups xmm7, xmmword [rsp + 0x60]
movups xmm8, xmmword [rsp + 0x70]
movups xmm9, xmmword [rbp - 0x80]
movdqa xmm0, xmm9
psrldq xmm0, 0xc
movd eax, xmm0
movsxd rdx, eax
add rdx, r14
mov qword [rsp + 0x20], r13
mov r9d, 0x108
lea r8, [rbp - 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x60], xmm7
movaps xmmword [rsp + 0x70], xmm8
movaps xmmword [rbp - 0x80], xmm9
lea rdx, [rsp + 0x50]
lea rcx, str.___dos_header___p__n
call fcn.140001010
lea rcx, [rbp + 0xa0]
lea rax, [rbp - 0x70]
lea edx, [r13 + 2]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140001360
mov rax, qword [rax]
mov qword [rcx], rax
lea rdx, [rbp + 0xa0]
lea rcx, str.___nt_header___p__n_n
call fcn.140001010
mov esi, dword [rbp - 0x20]
mov edx, esi
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov r8d, esi
mov rdx, rax
lea rcx, str.___allocated_memory_at___p__with_size___i__n
call fcn.140001010
mov edi, r13d
test esi, esi
je 0x140001428
nop
mov ecx, edi
lea r8, [rcx + r15]
lea rdx, [rcx + r14]
mov qword [rsp + 0x20], r13
mov r9d, 0x1000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add edi, 0x1000
cmp edi, esi
jb 0x140001400
mov eax, 0x5a4d
cmp word [r15], ax
je 0x14000143f
lea rcx, str.____invalid_dos_header_signature_n
jmp 0x1400018d1
mov rdx, r15
lea rcx, str.___image_dos_header___p__n
call fcn.140001010
movsxd r14, dword [r15 + 0x3c]
add r14, r15
mov rdx, r14
lea rcx, str.___image_nt_header___p__n_n
call fcn.140001010
cmp dword [r14], 0x4550
je 0x140001479
lea rcx, str.____invalid_nt_header_signature_n
jmp 0x1400018d1
movzx edi, word [r14 + 0x14]
add rdi, 0x18
add rdi, r14
mov esi, r13d
cmp r13w, word [r14 + 6]
jae 0x140001541
nop dword [rax]
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rbp + 0x420]
call fcn.1400019d0
movups xmm7, xmmword [rbp + 0x420]
movaps xmmword [rsp + 0x50], xmm7
movups xmm6, xmmword [rbp + 0x430]
movaps xmmword [rsp + 0x60], xmm6
mov r9d, dword [rdi + 8]
mov r8d, dword [rdi + 0xc]
lea rdx, [rsp + 0x50]
lea rcx, str.___fixing_section___s__address___p__size___i__n
call fcn.140001010
mov eax, dword [rdi + 0xc]
mov dword [rdi + 0x14], eax
mov eax, dword [rdi + 8]
mov dword [rdi + 0x10], eax
psrldq xmm6, 8
movq rdx, xmm6
cmp rdx, 0x10
jb 0x14000152e
inc rdx
movq rcx, xmm7
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001529
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400018c3
call fcn.140001f1c
inc esi
add rdi, 0x28
movzx eax, word [r14 + 6]
cmp esi, eax
jl 0x1400014a0
mov r13, qword [rbx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 7
jb 0x140001963
mov qword [rsp + 0x40], rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140001573
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x400], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x410], xmm1
lea r12, [r13 + 7]
mov edi, 0xf
lea rsi, [rbp + 0x400]
cmp r12, rdi
jbe 0x140001619
mov rdi, r12
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400015d9
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001ee0
test rax, rax
je 0x1400018c3
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001612
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001601
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001969
jmp 0x1400015ba
test rcx, rcx
je 0x140001610
call fcn.140001ee0
mov rsi, rax
jmp 0x140001612
xor esi, esi
mov qword [rbp + 0x400], rsi
mov qword [rbp + 0x410], r12
mov qword [rbp + 0x418], rdi
mov rax, qword [str.Dumped_]
mov dword [rsi], eax
movzx eax, word [0x14000353c]
mov word [rsi + 4], ax
movzx eax, byte [0x14000353e]
mov byte [rsi + 6], al
lea rcx, [rsi + 7]
mov r8, r13
mov rdx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r12], 0
lea rcx, [rbp + 0x400]
cmp qword [rbp + 0x418], 0x10
cmovae rcx, qword [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0x400]
cmp qword [rbp + 0x418], 0x10
cmovae rcx, qword [rbp + 0x400]
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
test rax, rax
jne 0x140001775
lea rcx, str.____failed_to_create_file_n
call fcn.140001010
mov rdx, qword [rbp + 0x418]
cmp rdx, 0x10
jb 0x140001710
inc rdx
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000170b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400018c3
call fcn.140001f1c
movdqa xmm0, xmmword [0x1400036a0]
mov byte [rbp + 0x400], sil
movdqu xmmword [rbp + 0x410], xmm0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140001761
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x14000175c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000195c
mov rcx, r8
call fcn.140001f1c
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x14000191c
mov rdx, rdi
lea rcx, str._n___file_handle___p__n
call fcn.140001010
mov edx, dword [r14 + 0x50]
lea rcx, str.___size_of_dump___i_MB__n
call fcn.140001010
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, dword [r14 + 0x50]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000187f
lea rdx, [rbp + 0x400]
cmp qword [rbp + 0x418], 0x10
cmovae rdx, qword [rbp + 0x400]
lea rcx, str.___wrote_dumped_process_to_file___s__n
call fcn.140001010
mov rdx, qword [rbp + 0x418]
cmp rdx, 0x10
jb 0x140001818
inc rdx
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001813
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400018c3
call fcn.140001f1c
movdqa xmm0, xmmword [0x1400036a0]
movdqu xmmword [rbp + 0x410], xmm0
mov byte [rbp + 0x400], sil
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140001869
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140001864
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000195c
mov rcx, r8
call fcn.140001f1c
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov al, 1
jmp 0x14000191e
mov rdx, qword [rbp + 0x418]
cmp rdx, 0x10
jb 0x140001710
inc rdx
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000170b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000170b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, str.____failed_to_get_module_base_of_game._disable_anticheat
call fcn.140001010
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000190d
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140001908
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000195c
mov rcx, r8
call fcn.140001f1c
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r13
xor al, al
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.140001ec0
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001210
nop
call fcn.140001170
int3