Function at 0x1800052b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], rcx
lea rax, vtable.Xbyak::CodeArray.0
mov qword [rcx], rax
xor edi, edi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
lea ecx, [rdi + 0x28]
call fcn.1800ec720
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
mov dword [rbx + 0x18], 2
lea rcx, [rbx + 0x20]
lea rax, vtable.Xbyak::Allocator.0
mov qword [rcx], rax
mov qword [rbx + 0x28], rcx
mov qword [rbx + 0x30], 0x1000
mov rax, qword [vtable.Xbyak::Allocator.0]
mov edx, 0x1000
call rax
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rdi
mov byte [rbx + 0x48], dil
cmp qword [rbx + 0x30], rdi
jbe 0x18000534d
test rax, rax
je 0x180006fdb
cmp dword [rbx + 0x18], 2
jne 0x180005382
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x18]
test al, al
je 0x180005382
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180006fac
lea rax, vtable.Xbyak::CodeGenerator.0
mov qword [rbx], rax
lea rcx, [rbx + 0x50]
call fcn.180003ed0
mov eax, dword [rbx + 0x130]
and eax, 0x80400100
or eax, 0x400100
mov dword [rbx + 0x130], eax
and dword [rbx + 0x134], 0xffffffc0
mov eax, dword [rbx + 0x138]
and eax, 0x80400101
or eax, 0x400101
mov dword [rbx + 0x138], eax
and dword [rbx + 0x13c], 0xffffffc0
mov eax, dword [rbx + 0x140]
and eax, 0x80400102
or eax, 0x400102
mov dword [rbx + 0x140], eax
and dword [rbx + 0x144], 0xffffffc0
mov eax, dword [rbx + 0x148]
and eax, 0x80400103
or eax, 0x400103
mov dword [rbx + 0x148], eax
and dword [rbx + 0x14c], 0xffffffc0
mov eax, dword [rbx + 0x150]
and eax, 0x80400104
or eax, 0x400104
mov dword [rbx + 0x150], eax
and dword [rbx + 0x154], 0xffffffc0
mov eax, dword [rbx + 0x158]
and eax, 0x80400105
or eax, 0x400105
mov dword [rbx + 0x158], eax
and dword [rbx + 0x15c], 0xffffffc0
mov eax, dword [rbx + 0x160]
and eax, 0x80400106
or eax, 0x400106
mov dword [rbx + 0x160], eax
and dword [rbx + 0x164], 0xffffffc0
mov eax, dword [rbx + 0x168]
and eax, 0x80400107
or eax, 0x400107
mov dword [rbx + 0x168], eax
and dword [rbx + 0x16c], 0xffffffc0
mov eax, dword [rbx + 0x170]
and eax, 0x80800400
or eax, 0x800400
mov dword [rbx + 0x170], eax
and dword [rbx + 0x174], 0xffffffc0
mov eax, dword [rbx + 0x178]
and eax, 0x80800401
or eax, 0x800401
mov dword [rbx + 0x178], eax
and dword [rbx + 0x17c], 0xffffffc0
mov eax, dword [rbx + 0x180]
and eax, 0x80800402
or eax, 0x800402
mov dword [rbx + 0x180], eax
and dword [rbx + 0x184], 0xffffffc0
mov eax, dword [rbx + 0x188]
and eax, 0x80800403
or eax, 0x800403
mov dword [rbx + 0x188], eax
and dword [rbx + 0x18c], 0xffffffc0
mov eax, dword [rbx + 0x190]
and eax, 0x80800404
or eax, 0x800404
mov dword [rbx + 0x190], eax
and dword [rbx + 0x194], 0xffffffc0
mov eax, dword [rbx + 0x198]
and eax, 0x80800405
or eax, 0x800405
mov dword [rbx + 0x198], eax
and dword [rbx + 0x19c], 0xffffffc0
mov eax, dword [rbx + 0x1a0]
and eax, 0x80800406
or eax, 0x800406
mov dword [rbx + 0x1a0], eax
and dword [rbx + 0x1a4], 0xffffffc0
mov eax, dword [rbx + 0x1a8]
and eax, 0x80800407
or eax, 0x800407
mov dword [rbx + 0x1a8], eax
and dword [rbx + 0x1ac], 0xffffffc0
mov eax, dword [rbx + 0x1b0]
and eax, 0x81000800
or eax, 0x1000800
mov dword [rbx + 0x1b0], eax
and dword [rbx + 0x1b4], 0xffffffc0
mov eax, dword [rbx + 0x1b8]
and eax, 0x81000801
or eax, 0x1000801
mov dword [rbx + 0x1b8], eax
and dword [rbx + 0x1bc], 0xffffffc0
lea r13, [rbx + 0x1c0]
mov qword [rsp + 0x28], r13
mov eax, dword [r13]
and eax, 0x81000802
or eax, 0x1000802
mov dword [r13], eax
and dword [r13 + 4], 0xffffffc0
lea r12, [rbx + 0x1c8]
mov eax, dword [r12]
and eax, 0x81000803
or eax, 0x1000803
mov dword [r12], eax
and dword [r12 + 4], 0xffffffc0
lea rbp, [rbx + 0x1d0]
mov eax, dword [rbp]
and eax, 0x81000804
or eax, 0x1000804
mov dword [rbp], eax
and dword [rbp + 4], 0xffffffc0
lea r15, [rbx + 0x1d8]
mov eax, dword [r15]
and eax, 0x81000805
or eax, 0x1000805
mov dword [r15], eax
and dword [r15 + 4], 0xffffffc0
lea r14, [rbx + 0x1e0]
mov eax, dword [r14]
and eax, 0x81000806
or eax, 0x1000806
mov dword [r14], eax
and dword [r14 + 4], 0xffffffc0
lea rsi, [rbx + 0x1e8]
mov eax, dword [rsi]
and eax, 0x81000807
or eax, 0x1000807
mov dword [rsi], eax
and dword [rsi + 4], 0xffffffc0
lea rdi, [rbx + 0x1f0]
mov eax, dword [rdi]
and eax, 0x82001000
or eax, 0x2001000
mov dword [rdi], eax
and dword [rdi + 4], 0xffffffc0
add rbx, 0x1f8
mov eax, dword [rbx]
and eax, 0x82001001
or eax, 0x2001001
mov dword [rbx], eax
and dword [rbx + 4], 0xffffffc0
mov rcx, qword [rsp + 0x20]
lea r11, [rcx + 0x200]
mov eax, dword [r11]
and eax, 0x82001002
or eax, 0x2001002
mov dword [r11], eax
and dword [r11 + 4], 0xffffffc0
lea r10, [rcx + 0x208]
mov eax, dword [r10]
and eax, 0x82001003
or eax, 0x2001003
mov dword [r10], eax
and dword [r10 + 4], 0xffffffc0
lea r9, [rcx + 0x210]
mov eax, dword [r9]
and eax, 0x82001004
or eax, 0x2001004
mov dword [r9], eax
and dword [r9 + 4], 0xffffffc0
lea r8, [rcx + 0x218]
mov eax, dword [r8]
and eax, 0x82001005
or eax, 0x2001005
mov dword [r8], eax
and dword [r8 + 4], 0xffffffc0
lea rdx, [rcx + 0x220]
mov eax, dword [rdx]
and eax, 0x82001006
or eax, 0x2001006
mov dword [rdx], eax
and dword [rdx + 4], 0xffffffc0
add rcx, 0x228
mov eax, dword [rcx]
and eax, 0x82001007
or eax, 0x2001007
mov dword [rcx], eax
and dword [rcx + 4], 0xffffffc0
mov r13, qword [rsp + 0x20]
lea rax, [r13 + 0x170]
mov qword [r13 + 0x230], rax
lea rax, [r13 + 0x178]
mov qword [r13 + 0x238], rax
lea rax, [r13 + 0x180]
mov qword [r13 + 0x240], rax
lea rax, [r13 + 0x188]
mov qword [r13 + 0x248], rax
lea rax, [r13 + 0x190]
mov qword [r13 + 0x250], rax
lea rax, [r13 + 0x198]
mov qword [r13 + 0x258], rax
lea rax, [r13 + 0x1a0]
mov qword [r13 + 0x260], rax
lea rax, [r13 + 0x1a8]
mov qword [r13 + 0x268], rax
lea rax, [r13 + 0x1b0]
mov qword [r13 + 0x270], rax
lea rax, [r13 + 0x1b8]
mov qword [r13 + 0x278], rax
mov r13, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x280], r13
mov r13, rax
mov qword [rax + 0x288], r12
mov qword [rax + 0x290], rbp
mov qword [rax + 0x298], r15
mov qword [rax + 0x2a0], r14
mov qword [rax + 0x2a8], rsi
mov qword [rax + 0x2b0], rdi
mov qword [rax + 0x2b8], rbx
mov qword [rax + 0x2c0], r11
mov qword [rax + 0x2c8], r10
mov qword [rax + 0x2d0], r9
mov qword [rax + 0x2d8], r8
mov qword [rax + 0x2e0], rdx
mov qword [rax + 0x2e8], rcx
mov eax, dword [rax + 0x2f0]
and eax, 0x80200080
or eax, 0x200080
mov dword [r13 + 0x2f0], eax
and dword [r13 + 0x2f4], 0xffffffc0
mov eax, dword [r13 + 0x2f8]
and eax, 0x80200081
or eax, 0x200081
mov dword [r13 + 0x2f8], eax
and dword [r13 + 0x2fc], 0xffffffc0
mov eax, dword [r13 + 0x300]
and eax, 0x80200082
or eax, 0x200082
mov dword [r13 + 0x300], eax
and dword [r13 + 0x304], 0xffffffc0
mov eax, dword [r13 + 0x308]
and eax, 0x80200083
or eax, 0x200083
mov dword [r13 + 0x308], eax
and dword [r13 + 0x30c], 0xffffffc0
mov eax, dword [r13 + 0x310]
and eax, 0x80200084
or eax, 0x200084
mov dword [r13 + 0x310], eax
and dword [r13 + 0x314], 0xffffffc0
mov eax, dword [r13 + 0x318]
and eax, 0x80200085
or eax, 0x200085
mov dword [r13 + 0x318], eax
and dword [r13 + 0x31c], 0xffffffc0
mov eax, dword [r13 + 0x320]
and eax, 0x80200086
or eax, 0x200086
mov dword [r13 + 0x320], eax
and dword [r13 + 0x324], 0xffffffc0
mov eax, dword [r13 + 0x328]
and eax, 0x80200087
or eax, 0x200087
mov dword [r13 + 0x328], eax
and dword [r13 + 0x32c], 0xffffffc0
mov eax, dword [r13 + 0x330]
and eax, 0x80100080
or eax, 0x100080
mov dword [r13 + 0x330], eax
and dword [r13 + 0x334], 0xffffffc0
mov eax, dword [r13 + 0x338]
and eax, 0x80100081
or eax, 0x100081
mov dword [r13 + 0x338], eax
and dword [r13 + 0x33c], 0xffffffc0
mov eax, dword [r13 + 0x340]
and eax, 0x80100082
or eax, 0x100082
mov dword [r13 + 0x340], eax
and dword [r13 + 0x344], 0xffffffc0
mov eax, dword [r13 + 0x348]
and eax, 0x80100083
or eax, 0x100083
mov dword [r13 + 0x348], eax
and dword [r13 + 0x34c], 0xffffffc0
mov eax, dword [r13 + 0x350]
and eax, 0x80100084
or eax, 0x100084
mov dword [r13 + 0x350], eax
and dword [r13 + 0x354], 0xffffffc0
mov eax, dword [r13 + 0x358]
and eax, 0x80100085
or eax, 0x100085
mov dword [r13 + 0x358], eax
and dword [r13 + 0x35c], 0xffffffc0
mov eax, dword [r13 + 0x360]
and eax, 0x80100086
or eax, 0x100086
mov dword [r13 + 0x360], eax
and dword [r13 + 0x364], 0xffffffc0
mov eax, dword [r13 + 0x368]
and eax, 0x80100087
or eax, 0x100087
mov dword [r13 + 0x368], eax
and dword [r13 + 0x36c], 0xffffffc0
mov eax, dword [r13 + 0x370]
and eax, 0x80080080
or eax, 0x80080
mov dword [r13 + 0x370], eax
and dword [r13 + 0x374], 0xffffffc0
mov eax, dword [r13 + 0x378]
and eax, 0x80080081
or eax, 0x80081
mov dword [r13 + 0x378], eax
and dword [r13 + 0x37c], 0xffffffc0
mov eax, dword [r13 + 0x380]
and eax, 0x80080082
or eax, 0x80082
mov dword [r13 + 0x380], eax
and dword [r13 + 0x384], 0xffffffc0
mov eax, dword [r13 + 0x388]
and eax, 0x80080083
or eax, 0x80083
mov dword [r13 + 0x388], eax
and dword [r13 + 0x38c], 0xffffffc0
mov eax, dword [r13 + 0x390]
and eax, 0x80080084
or eax, 0x80084
mov dword [r13 + 0x390], eax
and dword [r13 + 0x394], 0xffffffc0
mov eax, dword [r13 + 0x398]
and eax, 0x80080085
or eax, 0x80085
mov dword [r13 + 0x398], eax
and dword [r13 + 0x39c], 0xffffffc0
mov eax, dword [r13 + 0x3a0]
and eax, 0x80080086
or eax, 0x80086
mov dword [r13 + 0x3a0], eax
and dword [r13 + 0x3a4], 0xffffffc0
mov eax, dword [r13 + 0x3a8]
and eax, 0x80080087
or eax, 0x80087
mov dword [r13 + 0x3a8], eax
and dword [r13 + 0x3ac], 0xffffffc0
xor r11d, r11d
mov dword [r13 + 0x3b0], r11d
mov byte [r13 + 0x3b4], r11b
mov dword [r13 + 0x3b8], 8
mov byte [r13 + 0x3bc], r11b
mov dword [r13 + 0x3c0], 0x10
mov byte [r13 + 0x3c4], r11b
mov dword [r13 + 0x3c8], 0x20
mov byte [r13 + 0x3cc], r11b
mov dword [r13 + 0x3d0], 0x40
mov byte [r13 + 0x3d4], r11b
mov dword [r13 + 0x3d8], 0x80
mov byte [r13 + 0x3dc], r11b
mov dword [r13 + 0x3e0], 0x100
mov byte [r13 + 0x3e4], r11b
mov dword [r13 + 0x3e8], 0x200
mov byte [r13 + 0x3ec], r11b
mov dword [r13 + 0x3f0], r11d
mov byte [r13 + 0x3f4], 1
mov dword [r13 + 0x3f8], 0x80
mov byte [r13 + 0x3fc], 1
mov dword [r13 + 0x400], 0x100
mov byte [r13 + 0x404], 1
mov dword [r13 + 0x408], 0x200
mov byte [r13 + 0x40c], 1
mov eax, dword [r13 + 0x410]
and eax, 0x80200200
or eax, 0x200200
mov dword [r13 + 0x410], eax
and dword [r13 + 0x414], 0xffffffc0
mov eax, dword [r13 + 0x418]
and eax, 0x80200201
or eax, 0x200201
mov dword [r13 + 0x418], eax
and dword [r13 + 0x41c], 0xffffffc0
mov eax, dword [r13 + 0x420]
and eax, 0x80200202
or eax, 0x200202
mov dword [r13 + 0x420], eax
and dword [r13 + 0x424], 0xffffffc0
mov eax, dword [r13 + 0x428]
and eax, 0x80200203
or eax, 0x200203
mov dword [r13 + 0x428], eax
and dword [r13 + 0x42c], 0xffffffc0
mov eax, dword [r13 + 0x430]
and eax, 0x80200204
or eax, 0x200204
mov dword [r13 + 0x430], eax
and dword [r13 + 0x434], 0xffffffc0
mov eax, dword [r13 + 0x438]
and eax, 0x80200205
or eax, 0x200205
mov dword [r13 + 0x438], eax
and dword [r13 + 0x43c], 0xffffffc0
mov eax, dword [r13 + 0x440]
and eax, 0x80200206
or eax, 0x200206
mov dword [r13 + 0x440], eax
and dword [r13 + 0x444], 0xffffffc0
mov eax, dword [r13 + 0x448]
and eax, 0x80200207
or eax, 0x200207
mov dword [r13 + 0x448], eax
and dword [r13 + 0x44c], 0xffffffc0
mov eax, dword [r13 + 0x450]
and eax, 0x80402000
or eax, 0x402000
mov dword [r13 + 0x450], eax
and dword [r13 + 0x454], 0xffffffc0
mov eax, dword [r13 + 0x458]
and eax, 0x80402001
or eax, 0x402001
mov dword [r13 + 0x458], eax
and dword [r13 + 0x45c], 0xffffffc0
mov eax, dword [r13 + 0x460]
and eax, 0x80402002
or eax, 0x402002
mov dword [r13 + 0x460], eax
and dword [r13 + 0x464], 0xffffffc0
mov eax, dword [r13 + 0x468]
and eax, 0x80402003
or eax, 0x402003
mov dword [r13 + 0x468], eax
and dword [r13 + 0x46c], 0xffffffc0
mov eax, dword [r13 + 0x470]
and eax, 0x80402004
or eax, 0x402004
mov dword [r13 + 0x470], eax
and dword [r13 + 0x474], 0xffffffc0
mov eax, dword [r13 + 0x478]
and eax, 0x80402005
or eax, 0x402005
mov dword [r13 + 0x478], eax
and dword [r13 + 0x47c], 0xffffffc0
mov eax, dword [r13 + 0x480]
and eax, 0x80402006
or eax, 0x402006
mov dword [r13 + 0x480], eax
and dword [r13 + 0x484], 0xffffffc0
mov eax, dword [r13 + 0x488]
and eax, 0x80402007
or eax, 0x402007
mov dword [r13 + 0x488], eax
and dword [r13 + 0x48c], 0xffffffc0
mov eax, dword [r13 + 0x490]
and eax, 0x80804000
or eax, 0x804000
mov dword [r13 + 0x490], eax
and dword [r13 + 0x494], 0xffffffc0
mov eax, dword [r13 + 0x498]
and eax, 0x80804001
or eax, 0x804001
mov dword [r13 + 0x498], eax
and dword [r13 + 0x49c], 0xffffffc0
mov eax, dword [r13 + 0x4a0]
and eax, 0x80804002
or eax, 0x804002
mov dword [r13 + 0x4a0], eax
and dword [r13 + 0x4a4], 0xffffffc0
mov eax, dword [r13 + 0x4a8]
and eax, 0x80804003
or eax, 0x804003
mov dword [r13 + 0x4a8], eax
and dword [r13 + 0x4ac], 0xffffffc0
mov dword [r13 + 0x4b0], 5
mov dword [r13 + 0x4b4], 1
mov dword [r13 + 0x4b8], 2
mov dword [r13 + 0x4bc], 3
mov dword [r13 + 0x4c0], 4
mov eax, dword [r13 + 0x4c8]
and eax, 0x80400080
or eax, 0x400080
mov dword [r13 + 0x4c8], eax
and dword [r13 + 0x4cc], 0xffffffc0
mov eax, dword [r13 + 0x4d0]
and eax, 0x80400081
or eax, 0x400081
mov dword [r13 + 0x4d0], eax
and dword [r13 + 0x4d4], 0xffffffc0
mov eax, dword [r13 + 0x4d8]
and eax, 0x80400082
or eax, 0x400082
mov dword [r13 + 0x4d8], eax
and dword [r13 + 0x4dc], 0xffffffc0
mov eax, dword [r13 + 0x4e0]
and eax, 0x80400083
or eax, 0x400083
mov dword [r13 + 0x4e0], eax
and dword [r13 + 0x4e4], 0xffffffc0
mov eax, dword [r13 + 0x4e8]
and eax, 0x80400084
or eax, 0x400084
mov dword [r13 + 0x4e8], eax
and dword [r13 + 0x4ec], 0xffffffc0
mov eax, dword [r13 + 0x4f0]
and eax, 0x80400085
or eax, 0x400085
mov dword [r13 + 0x4f0], eax
and dword [r13 + 0x4f4], 0xffffffc0
mov eax, dword [r13 + 0x4f8]
and eax, 0x80400086
or eax, 0x400086
mov dword [r13 + 0x4f8], eax
and dword [r13 + 0x4fc], 0xffffffc0
mov eax, dword [r13 + 0x500]
and eax, 0x80400087
or eax, 0x400087
mov dword [r13 + 0x500], eax
and dword [r13 + 0x504], 0xffffffc0
mov eax, dword [r13 + 0x508]
and eax, 0x80400088
or eax, 0x400088
mov dword [r13 + 0x508], eax
and dword [r13 + 0x50c], 0xffffffc0
mov eax, dword [r13 + 0x510]
and eax, 0x80400089
or eax, 0x400089
mov dword [r13 + 0x510], eax
and dword [r13 + 0x514], 0xffffffc0
mov eax, dword [r13 + 0x518]
and eax, 0x8040008a
or eax, 0x40008a
mov dword [r13 + 0x518], eax
and dword [r13 + 0x51c], 0xffffffc0
mov eax, dword [r13 + 0x520]
and eax, 0x8040008b
or eax, 0x40008b
mov dword [r13 + 0x520], eax
and dword [r13 + 0x524], 0xffffffc0
mov eax, dword [r13 + 0x528]
and eax, 0x8040008c
or eax, 0x40008c
mov dword [r13 + 0x528], eax
and dword [r13 + 0x52c], 0xffffffc0
mov eax, dword [r13 + 0x530]
and eax, 0x8040008d
or eax, 0x40008d
mov dword [r13 + 0x530], eax
and dword [r13 + 0x534], 0xffffffc0
mov eax, dword [r13 + 0x538]
and eax, 0x8040008e
or eax, 0x40008e
mov dword [r13 + 0x538], eax
and dword [r13 + 0x53c], 0xffffffc0
mov eax, dword [r13 + 0x540]
and eax, 0x8040008f
or eax, 0x40008f
mov dword [r13 + 0x540], eax
and dword [r13 + 0x544], 0xffffffc0
mov eax, dword [r13 + 0x548]
and eax, 0x80200088
or eax, 0x200088
mov dword [r13 + 0x548], eax
and dword [r13 + 0x54c], 0xffffffc0
mov eax, dword [r13 + 0x550]
and eax, 0x80200089
or eax, 0x200089
mov dword [r13 + 0x550], eax
and dword [r13 + 0x554], 0xffffffc0
mov eax, dword [r13 + 0x558]
and eax, 0x8020008a
or eax, 0x20008a
mov dword [r13 + 0x558], eax
and dword [r13 + 0x55c], 0xffffffc0
mov eax, dword [r13 + 0x560]
and eax, 0x8020008b
or eax, 0x20008b
mov dword [r13 + 0x560], eax
and dword [r13 + 0x564], 0xffffffc0
mov eax, dword [r13 + 0x568]
and eax, 0x8020008c
or eax, 0x20008c
mov dword [r13 + 0x568], eax
and dword [r13 + 0x56c], 0xffffffc0
mov eax, dword [r13 + 0x570]
and eax, 0x8020008d
or eax, 0x20008d
mov dword [r13 + 0x570], eax
and dword [r13 + 0x574], 0xffffffc0
mov eax, dword [r13 + 0x578]
and eax, 0x8020008e
or eax, 0x20008e
mov dword [r13 + 0x578], eax
and dword [r13 + 0x57c], 0xffffffc0
mov eax, dword [r13 + 0x580]
and eax, 0x8020008f
or eax, 0x20008f
mov dword [r13 + 0x580], eax
and dword [r13 + 0x584], 0xffffffc0
mov eax, dword [r13 + 0x588]
and eax, 0x80100088
or eax, 0x100088
mov dword [r13 + 0x588], eax
and dword [r13 + 0x58c], 0xffffffc0
mov eax, dword [r13 + 0x590]
and eax, 0x80100089
or eax, 0x100089
mov dword [r13 + 0x590], eax
and dword [r13 + 0x594], 0xffffffc0
mov eax, dword [r13 + 0x598]
and eax, 0x8010008a
or eax, 0x10008a
mov dword [r13 + 0x598], eax
and dword [r13 + 0x59c], 0xffffffc0
mov eax, dword [r13 + 0x5a0]
and eax, 0x8010008b
or eax, 0x10008b
mov dword [r13 + 0x5a0], eax
and dword [r13 + 0x5a4], 0xffffffc0
mov eax, dword [r13 + 0x5a8]
and eax, 0x8010008c
or eax, 0x10008c
mov dword [r13 + 0x5a8], eax
and dword [r13 + 0x5ac], 0xffffffc0
mov eax, dword [r13 + 0x5b0]
and eax, 0x8010008d
or eax, 0x10008d
mov dword [r13 + 0x5b0], eax
and dword [r13 + 0x5b4], 0xffffffc0
mov eax, dword [r13 + 0x5b8]
and eax, 0x8010008e
or eax, 0x10008e
mov dword [r13 + 0x5b8], eax
and dword [r13 + 0x5bc], 0xffffffc0
mov eax, dword [r13 + 0x5c0]
and eax, 0x8010008f
or eax, 0x10008f
mov dword [r13 + 0x5c0], eax
and dword [r13 + 0x5c4], 0xffffffc0
mov eax, dword [r13 + 0x5c8]
and eax, 0x80080088
or eax, 0x80088
mov dword [r13 + 0x5c8], eax
and dword [r13 + 0x5cc], 0xffffffc0
mov eax, dword [r13 + 0x5d0]
and eax, 0x80080089
or eax, 0x80089
mov dword [r13 + 0x5d0], eax
and dword [r13 + 0x5d4], 0xffffffc0
mov eax, dword [r13 + 0x5d8]
and eax, 0x8008008a
or eax, 0x8008a
mov dword [r13 + 0x5d8], eax
and dword [r13 + 0x5dc], 0xffffffc0
mov eax, dword [r13 + 0x5e0]
and eax, 0x8008008b
or eax, 0x8008b
mov dword [r13 + 0x5e0], eax
and dword [r13 + 0x5e4], 0xffffffc0
mov eax, dword [r13 + 0x5e8]
and eax, 0x8008008c
or eax, 0x8008c
mov dword [r13 + 0x5e8], eax
and dword [r13 + 0x5ec], 0xffffffc0
mov eax, dword [r13 + 0x5f0]
and eax, 0x8008008d
or eax, 0x8008d
mov dword [r13 + 0x5f0], eax
and dword [r13 + 0x5f4], 0xffffffc0
mov eax, dword [r13 + 0x5f8]
and eax, 0x8008008e
or eax, 0x8008e
mov dword [r13 + 0x5f8], eax
and dword [r13 + 0x5fc], 0xffffffc0
mov eax, dword [r13 + 0x600]
and eax, 0x8008008f
or eax, 0x8008f
mov dword [r13 + 0x600], eax
and dword [r13 + 0x604], 0xffffffc0
mov eax, dword [r13 + 0x608]
and eax, 0x800800a4
or eax, 0x800a4
mov dword [r13 + 0x608], eax
and dword [r13 + 0x60c], 0xffffffc0
mov eax, dword [r13 + 0x610]
and eax, 0x800800a5
or eax, 0x800a5
mov dword [r13 + 0x610], eax
and dword [r13 + 0x614], 0xffffffc0
mov eax, dword [r13 + 0x618]
and eax, 0x800800a6
or eax, 0x800a6
mov dword [r13 + 0x618], eax
and dword [r13 + 0x61c], 0xffffffc0
mov eax, dword [r13 + 0x620]
and eax, 0x800800a7
or eax, 0x800a7
mov dword [r13 + 0x620], eax
and dword [r13 + 0x624], 0xffffffc0
mov eax, dword [r13 + 0x628]
and eax, 0x80800408
or eax, 0x800408
mov dword [r13 + 0x628], eax
and dword [r13 + 0x62c], 0xffffffc0
mov eax, dword [r13 + 0x630]
and eax, 0x80800409
or eax, 0x800409
mov dword [r13 + 0x630], eax
and dword [r13 + 0x634], 0xffffffc0
mov eax, dword [r13 + 0x638]
and eax, 0x8080040a
or eax, 0x80040a
mov dword [r13 + 0x638], eax
and dword [r13 + 0x63c], 0xffffffc0
mov eax, dword [r13 + 0x640]
and eax, 0x8080040b
or eax, 0x80040b
mov dword [r13 + 0x640], eax
and dword [r13 + 0x644], 0xffffffc0
mov eax, dword [r13 + 0x648]
and eax, 0x8080040c
or eax, 0x80040c
mov dword [r13 + 0x648], eax
and dword [r13 + 0x64c], 0xffffffc0
mov eax, dword [r13 + 0x650]
and eax, 0x8080040d
or eax, 0x80040d
mov dword [r13 + 0x650], eax
and dword [r13 + 0x654], 0xffffffc0
mov eax, dword [r13 + 0x658]
and eax, 0x8080040e
or eax, 0x80040e
mov dword [r13 + 0x658], eax
and dword [r13 + 0x65c], 0xffffffc0
mov eax, dword [r13 + 0x660]
and eax, 0x8080040f
or eax, 0x80040f
mov dword [r13 + 0x660], eax
and dword [r13 + 0x664], 0xffffffc0
mov eax, dword [r13 + 0x668]
and eax, 0x80800410
or eax, 0x800410
mov dword [r13 + 0x668], eax
and dword [r13 + 0x66c], 0xffffffc0
mov eax, dword [r13 + 0x670]
and eax, 0x80800411
or eax, 0x800411
mov dword [r13 + 0x670], eax
and dword [r13 + 0x674], 0xffffffc0
mov eax, dword [r13 + 0x678]
and eax, 0x80800412
or eax, 0x800412
mov dword [r13 + 0x678], eax
and dword [r13 + 0x67c], 0xffffffc0
mov eax, dword [r13 + 0x680]
and eax, 0x80800413
or eax, 0x800413
mov dword [r13 + 0x680], eax
and dword [r13 + 0x684], 0xffffffc0
mov eax, dword [r13 + 0x688]
and eax, 0x80800414
or eax, 0x800414
mov dword [r13 + 0x688], eax
and dword [r13 + 0x68c], 0xffffffc0
mov eax, dword [r13 + 0x690]
and eax, 0x80800415
or eax, 0x800415
mov dword [r13 + 0x690], eax
and dword [r13 + 0x694], 0xffffffc0
mov eax, dword [r13 + 0x698]
and eax, 0x80800416
or eax, 0x800416
mov dword [r13 + 0x698], eax
and dword [r13 + 0x69c], 0xffffffc0
mov eax, dword [r13 + 0x6a0]
and eax, 0x80800417
or eax, 0x800417
mov dword [r13 + 0x6a0], eax
and dword [r13 + 0x6a4], 0xffffffc0
mov eax, dword [r13 + 0x6a8]
and eax, 0x80800418
or eax, 0x800418
mov dword [r13 + 0x6a8], eax
and dword [r13 + 0x6ac], 0xffffffc0
mov eax, dword [r13 + 0x6b0]
and eax, 0x80800419
or eax, 0x800419
mov dword [r13 + 0x6b0], eax
and dword [r13 + 0x6b4], 0xffffffc0
mov eax, dword [r13 + 0x6b8]
and eax, 0x8080041a
or eax, 0x80041a
mov dword [r13 + 0x6b8], eax
and dword [r13 + 0x6bc], 0xffffffc0
mov eax, dword [r13 + 0x6c0]
and eax, 0x8080041b
or eax, 0x80041b
mov dword [r13 + 0x6c0], eax
and dword [r13 + 0x6c4], 0xffffffc0
mov eax, dword [r13 + 0x6c8]
and eax, 0x8080041c
or eax, 0x80041c
mov dword [r13 + 0x6c8], eax
and dword [r13 + 0x6cc], 0xffffffc0
mov eax, dword [r13 + 0x6d0]
and eax, 0x8080041d
or eax, 0x80041d
mov dword [r13 + 0x6d0], eax
and dword [r13 + 0x6d4], 0xffffffc0
mov eax, dword [r13 + 0x6d8]
and eax, 0x8080041e
or eax, 0x80041e
mov dword [r13 + 0x6d8], eax
and dword [r13 + 0x6dc], 0xffffffc0
mov eax, dword [r13 + 0x6e0]
and eax, 0x8080041f
or eax, 0x80041f
mov dword [r13 + 0x6e0], eax
and dword [r13 + 0x6e4], 0xffffffc0
mov eax, dword [r13 + 0x6e8]
and eax, 0x81000808
or eax, 0x1000808
mov dword [r13 + 0x6e8], eax
and dword [r13 + 0x6ec], 0xffffffc0
mov eax, dword [r13 + 0x6f0]
and eax, 0x81000809
or eax, 0x1000809
mov dword [r13 + 0x6f0], eax
and dword [r13 + 0x6f4], 0xffffffc0
mov eax, dword [r13 + 0x6f8]
and eax, 0x8100080a
or eax, 0x100080a
mov dword [r13 + 0x6f8], eax
and dword [r13 + 0x6fc], 0xffffffc0
mov eax, dword [r13 + 0x700]
and eax, 0x8100080b
or eax, 0x100080b
mov dword [r13 + 0x700], eax
and dword [r13 + 0x704], 0xffffffc0
mov eax, dword [r13 + 0x708]
and eax, 0x8100080c
or eax, 0x100080c
mov dword [r13 + 0x708], eax
and dword [r13 + 0x70c], 0xffffffc0
mov eax, dword [r13 + 0x710]
and eax, 0x8100080d
or eax, 0x100080d
mov dword [r13 + 0x710], eax
and dword [r13 + 0x714], 0xffffffc0
mov eax, dword [r13 + 0x718]
and eax, 0x8100080e
or eax, 0x100080e
mov dword [r13 + 0x718], eax
and dword [r13 + 0x71c], 0xffffffc0
mov eax, dword [r13 + 0x720]
and eax, 0x8100080f
or eax, 0x100080f
mov dword [r13 + 0x720], eax
and dword [r13 + 0x724], 0xffffffc0
lea rcx, [r13 + 0x728]
lea edx, [r11 + 0x10]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x730]
lea edx, [r11 + 0x11]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x738]
lea edx, [r11 + 0x12]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x740]
lea edx, [r11 + 0x13]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x748]
lea edx, [r11 + 0x14]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x750]
lea edx, [r11 + 0x15]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x758]
lea edx, [r11 + 0x16]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x760]
lea edx, [r11 + 0x17]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x768]
lea edx, [r11 + 0x18]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x770]
lea edx, [r11 + 0x19]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x778]
lea edx, [r11 + 0x1a]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x780]
lea edx, [r11 + 0x1b]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x788]
lea edx, [r11 + 0x1c]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x790]
lea edx, [r11 + 0x1d]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x798]
lea edx, [r11 + 0x1e]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x7a0]
lea edx, [r11 + 0x1f]
mov r9d, 0x100
lea r8d, [r11 + 0x20]
call fcn.180003850
lea rcx, [r13 + 0x7a8]
lea edx, [r11 + 8]
call fcn.1800038a0
lea rcx, [r13 + 0x7b0]
lea edx, [r11 + 9]
call fcn.1800038a0
lea rcx, [r13 + 0x7b8]
lea edx, [r11 + 0xa]
call fcn.1800038a0
lea rcx, [r13 + 0x7c0]
lea edx, [r11 + 0xb]
call fcn.1800038a0
lea rcx, [r13 + 0x7c8]
lea edx, [r11 + 0xc]
call fcn.1800038a0
lea rcx, [r13 + 0x7d0]
lea edx, [r11 + 0xd]
call fcn.1800038a0
lea rcx, [r13 + 0x7d8]
lea edx, [r11 + 0xe]
call fcn.1800038a0
lea rcx, [r13 + 0x7e0]
lea edx, [r11 + 0xf]
call fcn.1800038a0
lea rcx, [r13 + 0x7e8]
lea edx, [r11 + 0x10]
call fcn.1800038a0
lea rcx, [r13 + 0x7f0]
lea edx, [r11 + 0x11]
call fcn.1800038a0
lea rcx, [r13 + 0x7f8]
lea edx, [r11 + 0x12]
call fcn.1800038a0
lea rcx, [r13 + 0x800]
lea edx, [r11 + 0x13]
call fcn.1800038a0
lea rcx, [r13 + 0x808]
lea edx, [r11 + 0x14]
call fcn.1800038a0
lea rcx, [r13 + 0x810]
lea edx, [r11 + 0x15]
call fcn.1800038a0
lea rcx, [r13 + 0x818]
lea edx, [r11 + 0x16]
call fcn.1800038a0
lea rcx, [r13 + 0x820]
lea edx, [r11 + 0x17]
call fcn.1800038a0
lea rcx, [r13 + 0x828]
lea edx, [r11 + 0x18]
call fcn.1800038a0
lea rcx, [r13 + 0x830]
lea edx, [r11 + 0x19]
call fcn.1800038a0
lea rcx, [r13 + 0x838]
lea edx, [r11 + 0x1a]
call fcn.1800038a0
lea rcx, [r13 + 0x840]
lea edx, [r11 + 0x1b]
call fcn.1800038a0
lea rcx, [r13 + 0x848]
lea edx, [r11 + 0x1c]
call fcn.1800038a0
lea rcx, [r13 + 0x850]
lea edx, [r11 + 0x1d]
call fcn.1800038a0
lea rcx, [r13 + 0x858]
lea edx, [r11 + 0x1e]
call fcn.1800038a0
lea rcx, [r13 + 0x860]
lea edx, [r11 + 0x1f]
call fcn.1800038a0
lea rcx, [r13 + 0x868]
xor edx, edx
call fcn.1800038d0
lea rcx, [r13 + 0x870]
lea edx, [r11 + 1]
call fcn.1800038d0
lea rcx, [r13 + 0x878]
lea edx, [r11 + 2]
call fcn.1800038d0
lea rcx, [r13 + 0x880]
lea edx, [r11 + 3]
call fcn.1800038d0
lea rcx, [r13 + 0x888]
lea edx, [r11 + 4]
call fcn.1800038d0
lea rcx, [r13 + 0x890]
lea edx, [r11 + 5]
call fcn.1800038d0
lea rcx, [r13 + 0x898]
lea edx, [r11 + 6]
call fcn.1800038d0
lea rcx, [r13 + 0x8a0]
lea edx, [r11 + 7]
call fcn.1800038d0
mov ecx, 2
lea r8, [r13 + 0x8b0]
nop dword [rax]
lea eax, [rcx - 2]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 - 8], rax
lea eax, [rcx - 1]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8], rax
movsxd rax, ecx
lea rdx, [r13 + 0x628]
lea rdx, [rdx + rax*8]
mov qword [r8 + 8], rdx
lea eax, [rcx + 1]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x10], rax
lea eax, [rcx + 2]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x18], rax
lea eax, [rcx + 3]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x20], rax
lea eax, [rcx + 4]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x28], rax
lea eax, [rcx + 5]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x30], rax
lea eax, [rcx + 6]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x38], rax
lea eax, [rcx + 7]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x40], rax
lea eax, [rcx + 8]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x48], rax
lea eax, [rcx + 9]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x50], rax
lea eax, [rcx + 0xa]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x58], rax
lea eax, [rcx + 0xb]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x60], rax
lea eax, [rcx + 0xc]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x68], rax
lea eax, [rcx + 0xd]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x70], rax
lea eax, [rcx + 0xe]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x78], rax
lea eax, [rcx + 0xf]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x80], rax
lea eax, [rcx + 0x10]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x88], rax
lea eax, [rcx + 0x11]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x90], rax
lea eax, [rcx + 0x12]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x98], rax
lea eax, [rcx + 0x13]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0xa0], rax
lea eax, [rcx + 0x14]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0xa8], rax
lea eax, [rcx + 0x15]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0xb0], rax
lea eax, [rcx + 0x16]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0xb8], rax
lea eax, [rcx + 0x17]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0xc0], rax
lea eax, [rcx + 0x18]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0xc8], rax
lea eax, [rcx + 0x19]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0xd0], rax
lea eax, [rcx + 0x1a]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0xd8], rax
lea eax, [rcx + 0x1b]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0xe0], rax
lea eax, [rcx + 0x1c]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0xe8], rax
lea eax, [rcx + 0x1d]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0xf0], rax
lea eax, [rcx + 0x1e]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0xf8], rax
lea eax, [rcx + 0x1f]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x100], rax
lea eax, [rcx + 0x20]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x108], rax
lea eax, [rcx + 0x21]
movsxd rdx, eax
lea rax, [r13 + 0x628]
lea rax, [rax + rdx*8]
mov qword [r8 + 0x110], rax
add ecx, 0x24
lea r8, [r8 + 0x120]
lea eax, [rcx - 2]
cmp eax, 0x48
jl 0x180006be0
mov qword [r13 + 0xae8], r11
mov qword [r13 + 0xaf0], r11
mov byte [r13 + 0xaf8], r11b
mov dword [r13 + 0xb00], r11d
mov dword [r13 + 0xb04], 1
mov dword [r13 + 0xb08], 2
mov dword [r13 + 0xb0c], 3
mov dword [r13 + 0xb10], 4
mov dword [r13 + 0xb14], 5
mov byte [r13 + 0xb18], r11b
mov dword [r13 + 0xb1c], 2
mov qword [r13 + 0x50], r13
mov rax, r13
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx]
mov rdx, qword [rbx + 0x38]
call qword [rax + 8]
mov edx, 0xe
lea rcx, [rsp + 0x60]
call fcn.1800033d0
lea rdx, [0x18014dc20]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edx, 0x16
lea rcx, [rsp + 0x40]
call fcn.1800033d0
lea rdx, [0x18014dc20]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3