Function at 0x180001e80
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xc8
mov rax, qword [0x1800d6a88]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0xf], r8
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x180001e70
test rdx, rdx
je 0x180001e70
mov rdi, rcx
mov qword [rbp - 0x69], 0
xor r8d, r8d
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x39]
and rdi, 0xffffffffffff0000
mov qword [rsp + 0x20], 0x30
mov rdx, rdi
lea rcx, [r8 - 1]
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
mov r8d, 0x80000000
test eax, eax
js 0x180001bf8
cmp qword [rbp - 0x69], 0
je 0x180001bf8
cmp dword [rbp - 0x19], 0x10000
je 0x180001bfa
mov rdx, qword [rbp - 0x39]
mov rax, rbx
sub rax, rdx
mov rcx, rdx
sub rcx, rbx
lea rdi, [rdx - 1]
and rdi, 0xffffffffffff0000
cmp rbx, rdx
cmovb rax, rcx
cmp rax, r8
ja 0x180001bf8
xor r8d, r8d
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x39]
mov rdx, rdi
mov qword [rsp + 0x20], 0x30
lea rcx, [r8 - 1]
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
mov r8d, 0x80000000
test eax, eax
jns 0x180001b91
xor edi, edi
xor r15b, r15b
mov rax, rbx
sub rax, rsi
mov r14, rsi
sub r14, rbx
cmp rbx, rsi
cmovae r14, rax
cmp r14, r8
jbe 0x180001c1c
test rdi, rdi
sete r15b
mov qword [rbp - 0x69], rdi
lea r9, [rbp + 0x17]
neg rdi
mov dword [rsp + 0x28], 0x40
lea rdx, [rbp - 0x69]
mov qword [rbp + 0x17], 0x60
sbb r8d, r8d
mov dword [rsp + 0x20], 0x3000
and r8d, 0xc
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
xor edi, edi
test eax, eax
cmovns rdi, qword [rbp - 0x69]
test rdi, rdi
je 0x180001e70
test r15b, r15b
mov qword [rsp + 0x108], r12
mov qword [rsp + 0xc0], r13
mov eax, 0xe
mov r13d, 5
mov qword [rdi + 0x10], rbx
mov ecx, r13d
mov r9, rdi
cmovne ecx, eax
mov rdx, rbx
mov dword [rdi + 0x1c], ecx
sub r9, rbx
mov r8d, ecx
movzx eax, byte [rdx]
mov byte [r9 + rdx + 0x40], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x180001ca0
lea r12, [rdi + 0x20]
mov rcx, rbx
mov rdx, r12
call fcn.1800017e0
movzx eax, al
mov dword [rdi + 0x18], eax
test eax, eax
je 0x180001e64
lea rcx, [rax + rdi]
mov qword [rbp - 0x61], rbx
add rax, rbx
lea r8, [rbp - 1]
mov qword [rcx + 0x26], rax
mov edx, 0x25ff
mov word [rcx + 0x20], dx
mov eax, 0xe
xor edx, edx
mov dword [rcx + 0x22], edx
test r15b, r15b
mov dword [rbp - 9], edx
mov rcx, 0xffffffffffffffff
cmovne r13, rax
lea rax, [rbp - 9]
lea r9d, [rdx + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x61]
mov qword [rbp - 1], r13
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x180001e64
call fcn.180001780
mov eax, 0x80000000
cmp r14, rax
jbe 0x180001d74
test r15b, r15b
je 0x180001d52
mov eax, 0x25ff
mov dword [rbx + 2], 0
mov word [rbx], ax
mov qword [rbx + 6], rsi
jmp 0x180001d7f
mov byte [rbx], 0xe9
mov eax, edi
sub eax, ebx
sub eax, 5
mov dword [rbx + 1], eax
mov eax, 0x25ff
mov word [rdi], ax
mov dword [rdi + 2], 0
mov qword [rdi + 6], rsi
jmp 0x180001d7f
sub esi, ebx
mov byte [rbx], 0xe9
sub esi, 5
mov dword [rbx + 1], esi
mov rax, qword [rbp + 0xf]
test rax, rax
je 0x180001d8b
mov qword [rax], r12
mov r9d, dword [rbp - 9]
lea rax, [rbp - 9]
lea r8, [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x61]
mov qword [rbp + 0xf], r13
mov rcx, 0xffffffffffffffff
mov qword [rbp - 0x61], rbx
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov rax, qword gs:[0x30]
lea rcx, [0x1800019c0]
mov edx, dword [rax + 0x40]
mov dword [rbp - 0x59], edx
mov rax, qword gs:[0x30]
mov edx, dword [rax + 0x48]
mov dword [rbp - 0x55], edx
lea rdx, [rbp - 0x59]
mov qword [rbp - 0x51], rbx
mov qword [rbp - 0x49], r12
mov eax, dword [rdi + 0x18]
mov qword [rbp - 0x41], rax
call fcn.180001570
xor edx, edx
xor r8d, r8d
lea rcx, [rdx - 1]
call qword [sym.imp.ntdll.dll_NtFlushInstructionCache]
mov rax, qword gs:[0x30]
lea rdx, [rbp - 1]
mov ecx, dword [rax + 0x40]
mov dword [rbp - 1], ecx
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
mov dword [rbp + 3], ecx
lea rcx, [0x180001670]
mov dword [rbp + 7], 1
call fcn.180001570
mov al, 1
mov r12, qword [rsp + 0x108]
mov r13, qword [rsp + 0xc0]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.18003c840
add rsp, 0xc8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, rdi
call fcn.180001520
xor al, al
jmp 0x180001e38
xor al, al
jmp 0x180001e48
jmp 0x180001b10