Function at 0x180014d90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18025e060]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp byte [0x180262289], 0
je 0x180014f93
mov rax, qword [0x180262258]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, dword [rax + 0x10]
mov rdi, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x40
lea rdx, [rdi + 0x968ae5]
mov rbx, rax
lea rax, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r8d, [r9 - 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180262258]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, dword [rax + 0x10]
mov rdi, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x40
lea rdx, [rdi + 0x98086b]
mov rbx, rax
lea rax, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r8d, [r9 - 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180262258]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, dword [rax + 0x10]
mov rdi, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x40
lea rdx, [rdi + 0x980873]
mov rbx, rax
lea rax, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r8d, [r9 - 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180262258]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, dword [rax + 0x10]
mov rdi, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x40
lea rdx, [rdi + 0x666338]
mov rbx, rax
lea rax, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r8d, [r9 - 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180262258]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, dword [rax + 0x10]
mov rdi, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x40
lea rdx, [rdi + 0x66a905]
mov rbx, rax
lea rax, [rsp + 0x3c]
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r8d, [r9 - 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180262258]
mov rax, qword [rcx + 0x18]
movabs rdx, 0xffff00000c6085c7
mov byte [rax + 0x968ae5], 0xeb
mov rax, qword [rcx + 0x18]
mov qword [rax + 0x98086b], rdx
movabs rdx, 0x41ffffffffbaffff
mov rax, qword [rcx + 0x18]
mov qword [rax + 0x980873], rdx
movabs rdx, 0x3944909090909090
mov rax, qword [rcx + 0x18]
mov qword [rax + 0x666338], rdx
mov rax, qword [rcx + 0x18]
mov byte [rax + 0x66a905], 0xeb
cmp byte [0x18026228a], 0
je 0x180014fd1
mov rax, qword [0x180262258]
mov rcx, qword [rax + 0x18]
add rcx, 0x6c782f8
call fcn.18001eff0
test rax, rax
je 0x180014fd1
lea rcx, [rax + 0x423]
mov r8d, 0x2f
lea rdx, [0x18025ecc0]
call fcn.180013bb0
cmp byte [0x18026227c], 0
je 0x18001500f
mov rax, qword [0x180262258]
mov rcx, qword [rax + 0x18]
add rcx, 0x6c782f8
call fcn.18001eff0
test rax, rax
je 0x18001500f
lea rcx, [rax + 0x4bf]
mov r8d, 0x24
lea rdx, [0x18025ecf0]
call fcn.180013bb0
xor esi, esi
lea rbx, [0x18025f078]
cmp byte [0x180262267], sil
je 0x1800150f9
mov rax, qword [0x180262258]
mov rcx, qword [rax + 0x18]
add rcx, 0x7250c80
call fcn.18001eff0
test rax, rax
je 0x1800150f9
lea rcx, [rax + 0x3e0]
call fcn.18001eff0
test rax, rax
je 0x1800150f9
cmp qword [0x18025f090], 0x10
lea rdi, [rax + 0x40]
mov rax, rbx
mov dword [rsp + 0x30], 0x42c60000
cmovae rax, qword [0x18025f078]
cmp qword [0x18025f088], 3
jne 0x1800150b3
cmp word [rax], 0x7865
jne 0x1800150b3
cmp byte [rax + 2], 0x65
jne 0x1800150b3
mov rcx, qword [0x180262258]
lea r9d, [rsi + 4]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
mov rdx, rdi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x1800150f9
cmp qword [0x18025f090], 0x10
mov rax, rbx
cmovae rax, qword [0x18025f078]
cmp qword [0x18025f088], 3
jne 0x1800150f9
cmp word [rax], 0x6c64
jne 0x1800150f9
cmp byte [rax + 2], 0x6c
jne 0x1800150f9
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1800150f9
movss xmm0, dword [rsp + 0x30]
movss dword [rdi], xmm0
cmp byte [0x180262288], sil
je 0x1800151ee
mov rax, qword [0x180262258]
mov rcx, qword [rax + 0x18]
add rcx, 0x57cac30
call fcn.18001eff0
test rax, rax
je 0x1800151ee
lea rcx, [rax + 0x30]
call fcn.18001eff0
test rax, rax
je 0x1800151ee
lea rcx, [rax + 0x18]
call fcn.18001eff0
test rax, rax
je 0x1800151ee
cmp qword [0x18025f090], 0x10
lea rdi, [rax + 0x444]
mov rax, rbx
mov dword [rsp + 0x34], 0x42c60000
cmovae rax, qword [0x18025f078]
cmp qword [0x18025f088], 3
jne 0x1800151a8
cmp word [rax], 0x7865
jne 0x1800151a8
cmp byte [rax + 2], 0x65
jne 0x1800151a8
mov rcx, qword [0x180262258]
lea r8, [rsp + 0x34]
mov r9d, 4
mov qword [rsp + 0x20], rsi
mov rdx, rdi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x1800151ee
cmp qword [0x18025f090], 0x10
mov rax, rbx
cmovae rax, qword [0x18025f078]
cmp qword [0x18025f088], 3
jne 0x1800151ee
cmp word [rax], 0x6c64
jne 0x1800151ee
cmp byte [rax + 2], 0x6c
jne 0x1800151ee
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1800151ee
movss xmm0, dword [rsp + 0x34]
movss dword [rdi], xmm0
cmp byte [0x180262266], sil
je 0x1800152a0
cmp qword [0x18025f090], 0x10
mov rax, rbx
mov rcx, qword [0x180262258]
cmovae rax, qword [0x18025f078]
cmp qword [0x18025f088], 3
mov dword [rsp + 0x38], esi
mov rdi, qword [rcx + 0x18]
jne 0x180015256
cmp word [rax], 0x7865
jne 0x180015256
cmp byte [rax + 2], 0x65
jne 0x180015256
mov rcx, qword [rcx]
lea r8, [rsp + 0x38]
mov r9d, 4
mov qword [rsp + 0x20], rsi
lea rdx, [rdi + 0x6be57a4]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x1800152a0
cmp qword [0x18025f090], 0x10
mov rax, rbx
cmovae rax, qword [0x18025f078]
cmp qword [0x18025f088], 3
jne 0x1800152a0
cmp word [rax], 0x6c64
jne 0x1800152a0
cmp byte [rax + 2], 0x6c
jne 0x1800152a0
mov edx, 1
lea rcx, [rdi + 0x6be57a4]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1800152a0
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x6be57a4], eax
cmp byte [0x180262265], sil
je 0x18001534f
cmp qword [0x18025f090], 0x10
mov rax, rbx
mov rcx, qword [0x180262258]
cmovae rax, qword [0x18025f078]
cmp qword [0x18025f088], 3
mov rdi, qword [rcx + 0x18]
jne 0x180015306
cmp word [rax], 0x7865
jne 0x180015306
cmp byte [rax + 2], 0x65
jne 0x180015306
mov rcx, qword [rcx]
lea r8, [0x18025ed14]
mov r9d, 4
mov qword [rsp + 0x20], rsi
lea rdx, [rdi + 0x5e2f0c4]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x18001534f
cmp qword [0x18025f090], 0x10
cmovae rbx, qword [0x18025f078]
cmp qword [0x18025f088], 3
jne 0x18001534f
cmp word [rbx], 0x6c64
jne 0x18001534f
cmp byte [rbx + 2], 0x6c
jne 0x18001534f
mov edx, 1
lea rcx, [rdi + 0x5e2f0c4]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x18001534f
mov eax, dword [0x18025ed14]
mov dword [rdi + 0x5e2f0c4], eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180067140
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret