Function at 0x180002e90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180042008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x60]
mov r15, r9
mov rdi, r8
mov rsi, rdx
test rdx, rdx
je 0x180003111
test r8, r8
je 0x180003111
test r13, r13
je 0x180003111
mov rcx, r8
mov qword [rdx + 0x50], r8
sub rcx, r9
mov rax, r9
sub rax, r8
mov r12d, 0x80000000
cmp r8, r9
mov r8, rdx
cmovb rcx, rax
cmp rcx, r12
jb 0x18000313a
lea rbx, [rdx + 0x58]
mov rax, rdi
sub rax, rbx
mov rcx, rbx
sub rcx, rdi
mov rdx, rdi
cmp rdi, rbx
cmovb rax, rcx
cmp rax, r12
jb 0x18000302f
mov r9d, 0xe
call fcn.180002bd0
mov byte [rbp - 0x50], al
test al, al
je 0x180003111
movzx ebx, al
lea rcx, [rsi + 0x30]
mov r8d, ebx
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea r8, [rdi + rbx]
mov r12d, 0x25ff
lea rdx, [rsi + rbx]
mov rcx, r8
sub rcx, rdx
mov rax, rdx
sub rax, r8
cmp rdx, r8
cmovb rax, rcx
xor r14d, r14d
mov ecx, 0x80000000
cmp rax, rcx
jae 0x180002f91
sub r8d, edx
mov byte [rdx], 0xe9
lea eax, [r8 - 5]
mov dword [rdx + 1], eax
jmp 0x180002f9d
mov word [rdx], r12w
mov dword [rdx + 2], r14d
mov qword [rdx + 6], r8
movzx eax, byte [rbp - 0x50]
mov byte [rsi + 0x66], al
mov qword [r13], rsi
sfence
lea rax, [rbp - 0x30]
mov word [rbp - 0x28], r12w
mov r9d, 0x40
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x48]
mov dword [rbp - 0x26], r14d
lea rdx, [rbp - 0x18]
mov qword [rbp - 0x22], r15
mov rcx, 0xffffffffffffffff
mov qword [rbp - 0x48], 0xe
mov qword [rbp - 0x18], rdi
mov dword [rbp - 0x30], r14d
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
test eax, eax
mov r9d, r14d
cmovns r9d, dword [rbp - 0x30]
test r9d, r9d
je 0x18000310d
movsd xmm0, qword [rbp - 0x28]
lea r8, [rbp - 0x40]
mov eax, dword [rbp - 0x20]
lea rdx, [rbp - 0x28]
movsd qword [rdi], xmm0
mov dword [rdi + 8], eax
movzx eax, word [rbp - 0x1c]
mov word [rdi + 0xc], ax
mov qword [rbp - 0x40], 0xe
mov qword [rbp - 0x28], rdi
jmp 0x180003224
mov r9d, 5
call fcn.180002bd0
mov byte [rbp - 0x50], al
test al, al
je 0x180003111
mov r12d, 0x25ff
lea rcx, [rsi + 0x30]
mov word [rbx], r12w
xor r14d, r14d
mov dword [rbx + 2], r14d
mov rdx, rdi
mov qword [rbx + 6], r15
movzx ebx, al
mov r8d, ebx
call sub.VCRUNTIME140.dll_memcpy
lea r8, [rdi + rbx]
lea rdx, [rsi + rbx]
mov rcx, r8
sub rcx, rdx
mov rax, rdx
sub rax, r8
cmp rdx, r8
cmovb rax, rcx
mov ecx, 0x80000000
cmp rax, rcx
jae 0x1800030a0
sub r8d, edx
mov byte [rdx], 0xe9
lea eax, [r8 - 5]
mov dword [rdx + 1], eax
jmp 0x1800030ac
mov word [rdx], r12w
mov dword [rdx + 2], r14d
mov qword [rdx + 6], r8
movzx eax, byte [rbp - 0x50]
mov byte [rsi + 0x66], al
mov qword [r13], rsi
sfence
lea rax, [rbp - 0x30]
mov byte [rbp - 0x38], 0xe9
sub esi, edi
mov qword [rbp - 0x28], 5
add esi, 0x53
mov qword [rbp - 0x40], rdi
mov r9d, 0x40
mov dword [rbp - 0x37], esi
lea r8, [rbp - 0x28]
mov dword [rbp - 0x30], r14d
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
test eax, eax
mov r9d, r14d
cmovns r9d, dword [rbp - 0x30]
test r9d, r9d
jne 0x180003204
mov qword [r13], r14
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800037c0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, 5
mov rdx, rdi
call fcn.180002bd0
mov byte [rbp - 0x50], al
test al, al
je 0x180003111
movzx ebx, al
lea rcx, [rsi + 0x30]
mov r8d, ebx
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea r8, [rbx + rdi]
lea rdx, [rsi + rbx]
mov rcx, r8
sub rcx, rdx
mov rax, rdx
sub rax, r8
cmp rdx, r8
cmovb rax, rcx
xor r14d, r14d
cmp rax, r12
jae 0x180003193
sub r8d, edx
mov byte [rdx], 0xe9
lea eax, [r8 - 5]
mov dword [rdx + 1], eax
jmp 0x1800031a0
mov word [rdx], 0x25ff
mov dword [rdx + 2], r14d
mov qword [rdx + 6], r8
movzx eax, byte [rbp - 0x50]
mov byte [rsi + 0x66], al
mov qword [r13], rsi
sfence
lea rax, [rbp - 0x30]
mov byte [rbp - 0x38], 0xe9
sub r15d, edi
mov qword [rbp - 0x28], 5
sub r15d, 5
mov qword [rbp - 0x40], rdi
mov r9d, 0x40
mov dword [rbp - 0x37], r15d
lea r8, [rbp - 0x28]
mov dword [rbp - 0x30], r14d
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
test eax, eax
mov r9d, r14d
cmovns r9d, dword [rbp - 0x30]
test r9d, r9d
je 0x180003111
mov eax, dword [rbp - 0x38]
lea rdx, [rbp - 0x48]
mov dword [rdi], eax
lea r8, [rbp - 0x18]
movzx eax, byte [rbp - 0x34]
mov byte [rdi + 4], al
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x18], 5
lea rax, [rbp - 0x38]
mov dword [rbp - 0x38], r14d
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
mov al, 1
jmp 0x180003113