Function at 0x1000500f8
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1004c4740]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov r13d, 0xfffffff
mov r14d, 0x8000
lea r11, [0x100000000]
mov r12, qword [rcx + 0x10]
mov r15d, 0x269ec3
mov eax, dword [0x1002f8888]
mov qword [rsp + 0x80], rdx
mov edx, dword [r12 + 5]
and rdx, r13
mov qword [rsp + 0x98], rcx
lea rsi, [rax + rdx - 1]
xor edx, edx
mov rcx, rax
mov rax, rsi
div rcx
mov eax, dword [0x1002f8888]
sub rsi, rdx
mov eax, dword [0x1002f8888]
mov r10d, dword [0x1002a02b4]
mov eax, dword [0x1002a02b4]
test eax, eax
je 0x10005021d
xor r8d, r8d
xor eax, eax
mov edi, dword [0x1002a02b4]
dec edi
inc rdi
mov r9, rdi
je 0x1000501d7
mov rcx, qword [0x1004c43a0]
imul rcx, rcx, 0x343fd
shl rax, 0x10
shr r9, 0x10
add rcx, r15
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
test r9, r9
jne 0x1000501ac
mov qword [0x1004c43a0], rcx
xor edx, edx
div rdi
test r10, r10
je 0x100050212
mov eax, 0x3bd7
mov ecx, 0xffffc428
inc r8
lock cmpxchg dword [r11 + rdx*4 + 0x4c5a60], ecx
je 0x100050487
mov ecx, dword [0x1002a02b4]
lea rax, [rdx + 1]
xor edx, edx
div rcx
cmp r8, r10
jb 0x1000501e1
xor ebx, ebx
test rbx, rbx
jne 0x10005033e
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov ebp, eax
mov rcx, qword [0x1004c4380]
inc rdi
mov r9, rcx
xor eax, eax
test rcx, rcx
mov r8, rcx
je 0x100050270
mov rcx, qword [0x1004c43a0]
imul rcx, rcx, 0x343fd
shl rax, 0x10
shr r9, 0x10
add rcx, r15
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
test r9, r9
jne 0x100050245
mov qword [0x1004c43a0], rcx
mov r9d, 0x40
xor edx, edx
div r8
mov rcx, rdx
mov r8d, 0x3000
mov rdx, rsi
shl rcx, 0x10
add rcx, qword [0x1004c4308]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov rbx, rax
je 0x1000502d8
mov r8d, esi
mov rdx, rax
lea r9, [0x100435424]
and qword [rsp + 0x28], 0
mov rcx, rax
and qword [rsp + 0x20], 0
or rcx, 3
call qword [sym.imp.ntdll.dll_RtlInstallFunctionTableCallback]
test al, al
jne 0x1000502ec
mov rcx, rbx
mov r8d, r14d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp rdi, 0x11
jb 0x100050227
xor ebx, ebx
cmp rbx, 0x10000
jb 0x1000502fa
test bl, 3
je 0x10005031c
test rbx, rbx
je 0x10005031a
mov rcx, rbx
or rcx, 3
call qword [sym.imp.ntdll.dll_RtlDeleteFunctionTable]
mov r8d, r14d
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ebx, ebx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [0x100000000]
test rbx, rbx
je 0x100050175
xor eax, eax
mov rcx, rsi
mov rdi, rbx
rep stosb byte [rdi], al
mov eax, 0xbb879374
mov edx, dword [r12 + 1]
mov r8d, dword [0x1002f8888]
shr rdx, 2
mov r14d, dword [r12 + 5]
and r14, r13
mov qword [rsp + 0x90], r14
and edx, 7
lea rbp, [rdx + r12 + 9]
mov esi, ebp
mov qword [rsp + 0x88], rbp
sub r8, r14
lea r12, [0x100000000]
xor eax, eax
sub esi, r12d
mov dword [rsp + 0x48], esi
inc r8
mov rdi, r8
je 0x1000503c2
mov rcx, qword [0x1004c43a0]
imul rcx, rcx, 0x343fd
shl rax, 0x10
shr rdi, 0x10
add rcx, r15
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
test rdi, rdi
jne 0x100050397
mov qword [0x1004c43a0], rcx
mov ecx, esi
xor edx, edx
div r8
add rbx, rdx
mov qword [rsp + 0x70], rbx
mov rdx, r14
mov r8, rbx
mov eax, 0xe08671b1
mov rdx, qword [r14 + rbp]
xor dil, dil
mov qword [rsp + 0x78], rdx
lea rcx, [rsp + 0x78]
mov eax, 0x36f94f52
mov rcx, r12
mov r11, 0xfffffffffffff000
mov rax, qword [0x1000487b8]
mov r9d, dword [rsp + 0x7c]
mov r10, qword [rsp + 0x78]
and qword [rsp + 0x40], 0
and r10, r13
and r9, r13
mov r13d, 4
add r10, r12
sub rcx, rax
mov qword [rsp + 0x68], rcx
jne 0x10005049e
xor r8d, r8d
test r9, r9
je 0x100050743
mov edx, dword [rsp + 0x40]
mov r11d, 0xab30505f
mov ecx, dword [rsp + 0x44]
movzx eax, byte [r8 + r10]
inc r8
sub eax, 0x54cfafa1
add edx, eax
add eax, ecx
imul rax, r11
mov qword [rsp + 0x30], rax
shr rax, 0x20
mov ecx, dword [rsp + 0x30]
add ecx, eax
imul ecx, ecx, 0xab30505f
ror ecx, 0xb
add edx, ecx
cmp r8, r9
jb 0x100050446
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x40], edx
jmp 0x100050743
mov ecx, dword [0x1002f8888]
imul rcx, rdx
lea rbx, [rcx + r11 + 0x454000]
jmp 0x100050214
movsxd rcx, dword [0x10000003c]
lea rax, [r10 + r9]
mov r8d, dword [rcx + r12 + 0xb0]
add r8, r12
mov ecx, dword [rcx + r12 + 0xb4]
mov qword [rsp + 0x60], rax
mov eax, r10d
sub eax, r12d
mov ebx, eax
mov r12d, eax
add rax, r9
mov r15, rax
and rbx, r11
and r15, r11
sub r12, rbx
sub rax, r15
add rcx, r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x58], rax
jmp 0x1000504fc
mov eax, dword [r8]
cmp rax, rbx
jae 0x100050501
mov eax, dword [r8 + 4]
add r8, rax
cmp r8, rcx
jne 0x1000504ed
xor r11d, r11d
cmp r8, rcx
je 0x100050540
mov eax, dword [r8]
cmp rax, rbx
jne 0x100050540
mov ecx, dword [r8 + 4]
sub rcx, 8
shr rcx, 1
je 0x10005053b
lea rdx, [r8 + 8]
movzx eax, word [rdx]
and eax, 0xfff
cmp rax, r12
jae 0x10005053b
inc r11
add rdx, 2
cmp r11, rcx
jne 0x100050522
mov rcx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x40]
mov edx, dword [rsp + 0x44]
mov esi, 0xab30505f
lea rbp, [0x100000000]
cmp r8, rcx
je 0x1000506d7
mov eax, dword [r8]
cmp rax, r15
ja 0x1000506d7
mov edi, dword [r8 + 4]
lea rax, [rdi - 8]
shr rax, 1
cmp r11, rax
jne 0x10005059c
add r8, rdi
cmp r8, rcx
je 0x1000506d7
mov eax, dword [r8]
cmp rax, r15
ja 0x1000506d7
xor r11d, r11d
jmp 0x10005056f
mov eax, dword [r8]
cmp rax, r15
jne 0x1000505ba
movzx eax, word [r8 + r11*2 + 8]
and eax, 0xfff
cmp rax, qword [rsp + 0x58]
jae 0x1000506d7
mov rax, r11
inc r11
mov edi, 0xf000
test word [r8 + rax*2 + 8], di
je 0x10005055a
movzx ecx, word [r8 + rax*2 + 8]
mov ebx, ecx
xor r12d, r12d
and ebx, 0xfff
add ebx, dword [r8]
add rbx, rbp
mov rax, rbx
sub rax, r10
je 0x10005062e
mov rdi, rax
movzx eax, byte [r10 + r12]
inc r12
sub eax, 0x54cfafa1
add r9d, eax
add eax, edx
imul rax, rsi
mov qword [rsp + 0x50], rax
shr rax, 0x20
mov edx, dword [rsp + 0x50]
add edx, eax
imul edx, edx, 0xab30505f
ror edx, 0xb
add r9d, edx
cmp r12, rdi
jb 0x1000505ef
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x40], r9d
mov rax, qword [rbx]
mov qword [rsp + 0x50], rax
shr ecx, 0xc
cmp ecx, 3
je 0x10005064c
sub ecx, 0xa
neg ecx
sbb r10d, r10d
add r10d, 3
jmp 0x100050652
mov r10d, 2
mov r12, r14
neg r12
sub r10d, 2
je 0x100050679
cmp r10d, 1
je 0x10005066a
or rcx, 0xffffffffffffffff
jmp 0x100050681
add rax, r12
mov ecx, 8
mov qword [rsp + 0x50], rax
jmp 0x100050681
add dword [rsp + 0x50], r12d
mov rcx, r13
xor r10d, r10d
test rcx, rcx
je 0x1000506c9
movzx eax, byte [rsp + r10 + 0x50]
inc r10
sub eax, 0x54cfafa1
add r9d, eax
add eax, edx
imul rax, rsi
mov qword [rsp + 0x68], rax
mov edx, dword [rsp + 0x68]
shr rax, 0x20
add edx, eax
imul edx, edx, 0xab30505f
ror edx, 0xb
add r9d, edx
cmp r10, rcx
jb 0x100050689
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x40], r9d
lea r10, [rcx + rbx]
mov rcx, qword [rsp + 0x30]
jmp 0x10005055a
mov esi, dword [rsp + 0x48]
xor ecx, ecx
mov dil, cl
mov r14, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov r8, qword [rsp + 0x60]
sub r8, r10
je 0x10005073e
mov ebx, 0xab30505f
movzx eax, byte [rcx + r10]
inc rcx
sub eax, 0x54cfafa1
add r9d, eax
add eax, edx
imul rax, rbx
mov qword [rsp + 0x30], rax
shr rax, 0x20
mov edx, dword [rsp + 0x30]
add edx, eax
imul edx, edx, 0xab30505f
ror edx, 0xb
add r9d, edx
cmp rcx, r8
jb 0x1000506ff
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x40], r9d
mov rbx, qword [rsp + 0x70]
xor ecx, ecx
mov rax, rcx
inc rcx
and eax, 7
mov al, byte [rsp + rax + 0x40]
mov byte [rsp + rcx + 0x9f], al
cmp rcx, 8
jb 0x100050745
mov eax, 0xbad57f86
mov rax, qword [rsp + 0xa0]
mov r15, rbp
mov qword [rsp + 0x30], rbx
mov r10, rbx
mov r12, r14
and r12d, 7
je 0x100050c43
xor r8d, r8d
mov dword [rsp + 0x58], r8d
mov ebx, esi
not ebx
xor r11d, r11d
xor r10d, r10d
mov dword [rsp + 0x4c], r11d
test r12d, r12d
jle 0x1000507d9
lea r9d, [r8 + 0x38]
movzx edx, byte [r15]
cmp r10d, r13d
jge 0x1000507b8
lea ecx, [r9 - 0x20]
shl edx, cl
or r11d, edx
jmp 0x1000507c0
mov ecx, r9d
shl edx, cl
or r8d, edx
inc r10d
inc r15
sub r9d, 8
cmp r10d, r12d
jl 0x1000507a4
mov dword [rsp + 0x4c], r11d
mov dword [rsp + 0x58], r8d
mov edx, dword [rsp + 0xa4]
movzx r11d, word [rsp + 0xa4]
movzx r9d, ax
movzx r8d, word [rsp + 0xa6]
xor edx, esi
movzx r10d, word [rsp + 0xa2]
mov ecx, eax
sub ecx, edx
xor ebx, ecx
mov esi, ebx
mov ecx, ebx
shr ecx, 0xf
sub esi, r9d
imul esi, r11d
sub esi, ecx
xor esi, dword [rsp + 0x48]
mov ecx, esi
mov edx, esi
xor edx, r8d
rol edx, 3
ror ecx, 2
imul edx, r10d
add ecx, edx
mov edx, dword [rsp + 0xa4]
xor ebx, ecx
sub edx, ebx
rol edx, 6
mov ecx, ebx
ror ecx, 0xb
imul edx, r9d
xor ecx, edx
xor esi, ecx
mov ecx, esi
not ecx
ror ecx, 2
add ecx, r8d
imul ecx, r11d
xor ebx, ecx
mov edx, ebx
ror edx, 7
mov ecx, ebx
xor ecx, r10d
imul ecx, r11d
sub ecx, edx
xor esi, ecx
mov ecx, esi
mov edx, dword [rsp + 0xa4]
xor edx, esi
rol edx, 6
shr ecx, 6
imul edx, r10d
sub edx, ecx
xor ebx, edx
mov edx, dword [rsp + 0xa4]
mov ecx, ebx
sub edx, ebx
ror edx, 9
ror ecx, 0xc
imul edx, r9d
sub edx, ecx
xor esi, edx
mov edx, esi
sub edx, eax
mov ecx, esi
ror edx, 9
ror ecx, 6
imul edx, r8d
add ecx, edx
mov edx, eax
xor ebx, ecx
sub edx, ebx
ror edx, 8
mov ecx, ebx
ror ecx, 7
imul edx, r11d
mov r11d, dword [rsp + 0x58]
add ecx, edx
xor esi, ecx
mov edx, dword [rsp + 0xa4]
mov ecx, esi
xor edx, esi
rol edx, 2
rol ecx, 8
imul edx, r10d
sub edx, ecx
xor r9d, r9d
mov ecx, eax
xor ecx, dword [rsp + 0xa4]
xor ebx, edx
mov edx, dword [rsp + 0x4c]
xor ecx, edx
xor ecx, ebx
xor ebx, r11d
xor esi, ecx
mov r8d, ebx
test r12d, r12d
mov edx, esi
jle 0x100050937
mov rcx, qword [rsp + 0x30]
cmp r9d, r13d
jge 0x10005091d
rol edx, 8
mov byte [rcx], dl
inc rcx
xor dil, dl
jmp 0x10005092a
rol r8d, 8
mov byte [rcx], r8b
inc rcx
xor dil, r8b
inc r9d
cmp r9d, r12d
jl 0x10005090b
mov qword [rsp + 0x30], rcx
lea ecx, [r12 - 4]
test ecx, ecx
jle 0x100050c2b
sub r13d, ecx
shl r13d, 3
mov ecx, r13d
shr ebx, cl
shl ebx, cl
mov r10, qword [rsp + 0x30]
mov r13, r14
shr r13, 3
test r13, r13
je 0x100050b6d
mov ebp, dword [rsp + 0x4c]
mov r12d, dword [rsp + 0xa4]
movzx ecx, ax
mov dword [rsp + 0x58], ecx
movzx ecx, word [rsp + 0xa6]
mov dword [rsp + 0x30], ecx
movzx ecx, r12w
mov dword [rsp + 0x60], ecx
movzx ecx, word [rsp + 0xa2]
mov dword [rsp + 0x48], ecx
mov ecx, eax
xor ecx, r12d
mov r14d, ecx
movzx r9d, byte [r15 + 1]
movzx ecx, byte [r15]
movzx r8d, byte [r15 + 4]
mov edx, eax
shl ecx, 8
shl r8d, 8
add r15, 8
or r9d, ecx
shl r9d, 8
movzx ecx, byte [r15 - 6]
or r9d, ecx
movzx ecx, byte [r15 - 5]
shl r9d, 8
or r9d, ecx
movzx ecx, byte [r15 - 3]
or r8d, ecx
xor esi, r9d
shl r8d, 8
movzx ecx, byte [r15 - 2]
or r8d, ecx
movzx ecx, byte [r15 - 1]
shl r8d, 8
or r8d, ecx
mov ecx, r12d
xor ecx, esi
sub edx, ecx
xor edx, r8d
xor ebx, edx
mov edx, ebx
mov ecx, ebx
sub edx, dword [rsp + 0x58]
shr ecx, 0xf
imul edx, dword [rsp + 0x60]
sub edx, ecx
xor esi, edx
movzx ecx, word [rsp + 0xa6]
mov edx, esi
xor edx, ecx
mov ecx, esi
rol edx, 3
ror ecx, 2
imul edx, dword [rsp + 0x48]
add ecx, edx
mov edx, r12d
xor ebx, ecx
mov ecx, ebx
sub edx, ebx
rol edx, 6
ror ecx, 0xb
imul edx, dword [rsp + 0x58]
xor ecx, edx
xor esi, ecx
mov ecx, esi
not ecx
movzx edx, word [rsp + 0xa6]
ror ecx, 2
add ecx, edx
imul ecx, dword [rsp + 0x60]
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, dword [rsp + 0x48]
ror edx, 7
imul ecx, dword [rsp + 0x60]
sub ecx, edx
xor esi, ecx
movzx ecx, word [rsp + 0xa2]
mov edx, r12d
xor edx, esi
rol edx, 6
imul edx, ecx
mov ecx, esi
shr ecx, 6
sub edx, ecx
xor ebx, edx
mov ecx, ebx
mov edx, r12d
sub edx, ebx
ror edx, 9
ror ecx, 0xc
imul edx, dword [rsp + 0x58]
sub edx, ecx
xor esi, edx
mov edx, esi
sub edx, eax
mov ecx, esi
ror edx, 9
ror ecx, 6
imul edx, dword [rsp + 0x30]
add ecx, edx
xor ebx, ecx
mov ecx, ebx
mov edx, eax
sub edx, ebx
ror edx, 8
ror ecx, 7
imul edx, dword [rsp + 0x60]
add ecx, edx
xor esi, ecx
mov edx, r12d
xor edx, esi
rol edx, 2
mov ecx, esi
rol ecx, 8
imul edx, dword [rsp + 0x48]
sub edx, ecx
mov ecx, r14d
xor ecx, ebp
xor ebx, edx
xor ecx, ebx
xor ebx, r11d
xor esi, ecx
xor dil, sil
mov byte [r10 + 7], bl
mov byte [r10 + 3], sil
mov ebp, r9d
mov r11d, r8d
ror esi, 8
mov byte [r10 + 2], sil
xor dil, bl
ror ebx, 8
xor dil, sil
mov byte [r10 + 6], bl
ror esi, 8
mov byte [r10 + 1], sil
xor dil, bl
ror ebx, 8
mov byte [r10 + 5], bl
xor dil, sil
ror esi, 8
xor dil, bl
ror ebx, 8
mov byte [r10], sil
mov byte [r10 + 4], bl
add r10, 8
mov cl, bl
xor cl, sil
xor dil, cl
ror esi, 8
ror ebx, 8
sub r13, 1
jne 0x1000509a2
mov r14, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
cmp dil, byte [r14 + rbp + 8]
je 0x100050c6f
call fcn.100058248
mov rbx, qword [rsp + 0x98]
mov r10d, 0xffff
mov r11, rax
mov rax, 0xfffffffffffff000
lea r8, [rbx + 0x18]
lea r12, [0x1001094ec]
and r8, 0xfffffffffffffff8
mov qword [rbx + 0x10], r12
mov rcx, qword [0x1004c43a0]
lea r9, [r8 + 0xfff]
and r11, rax
and r9, rax
xor edi, edi
imul rcx, rcx, 0x343fd
shl rdi, 0x10
shr r10, 0x10
add rcx, 0x269ec3
mov rax, rcx
shr rax, 0x10
movzx edx, ax
or rdi, rdx
test r10, r10
jne 0x100050bbe
mov qword [0x1004c43a0], rcx
movabs rax, 0x8000800080008001
mul rdi
shr rdx, 0xf
mov rax, qword [rsp + 0x80]
imul rdx, rdx, 0xffff
mov qword [rax + 0x98], r11
sub rdi, rdx
inc rdi
mov qword [rax + 0xb0], rdi
mov qword [rsp + 0x80], r10
jmp 0x100050c65
xor ebx, ebx
test ecx, ecx
jns 0x100050952
neg ecx
shl ecx, 3
shr esi, cl
shl esi, cl
jmp 0x100050952
xor ebx, ebx
mov r11d, esi
not r11d
mov dword [rsp + 0x4c], esi
xor esi, esi
jmp 0x100050957
mov rax, qword [rsp + 0x80]
mov qword [r8], rax
add r8, 8
cmp r8, r9
jb 0x100050c56
jmp 0x100050d85
mov rax, qword [0x1000487b8]
lea r15, [0x100000000]
mov r12, qword [rsp + 0x70]
mov rbx, rbp
mov rsi, r15
sub rbx, r12
sub rsi, rax
jne 0x100050c99
test rbx, rbx
je 0x100050d72
mov r11, r12
mov rcx, qword [0x1001d1e58]
xor edi, edi
lea r8d, [rcx - 1]
sub r11, rbp
sub ebp, r15d
lea r13d, [r14 + rbp]
test r8d, r8d
lea r14, [0x100000000]
js 0x100050cef
lea eax, [r8 + rdi]
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
mov r9d, dword [r14 + rdx*4 + 0x1d1e5c]
and r9d, 0xfffffff
cmp ebp, r9d
jae 0x100050ce5
lea r8d, [rax - 1]
jmp 0x100050cea
jbe 0x100050cf4
lea edi, [rax + 1]
cmp r8d, edi
jge 0x100050cbf
movsxd r10, edi
jmp 0x100050d6b
movsxd r10, eax
jmp 0x100050d6b
mov edx, dword [r14 + r10*4 + 0x1d1e5c]
mov eax, edx
and eax, 0xfffffff
cmp eax, r13d
jae 0x100050d72
mov edi, edx
mov r8, rdx
sar edx, 0x1e
shl edi, 2
and r8d, 0xfffffff
and edx, 3
sar edi, 0x1e
add r8, r15
xor r9d, r9d
and edi, 3
sub edi, 1
je 0x100050d47
sub edi, 1
je 0x100050d42
cmp edi, 1
jne 0x100050d4d
mov r9, rsi
jmp 0x100050d4d
mov r9, rbx
jmp 0x100050d4d
mov r9, rsi
sub r9, rbx
sub edx, 2
je 0x100050d5d
cmp edx, 1
jne 0x100050d68
add qword [r8 + r11], r9
jmp 0x100050d61
add dword [r8 + r11], r9d
mov rcx, qword [0x1001d1e58]
inc r10
mov eax, ecx
cmp r10, rax
jb 0x100050cf9
mov eax, dword [0x1002f8888]
mov eax, 0x7d63eee9
mov rbx, qword [rsp + 0x98]
mov qword [rbx + 0x10], r12
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.10027d5f4
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret