Function at 0x1401c5700
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, qword [rsp + 0xb8]
xor r13d, r13d
mov rdi, rdx
mov rbx, r8
mov rdx, rcx
mov ecx, dword [rsp + 0xb0]
mov dword [r12], r13d
cmp ecx, 3
jne 0x1401c595a
test rbx, rbx
je 0x1401c5950
cmp r9, 0x1000
jb 0x1401c5950
mov rdi, rbx
mov ebp, r13d
and edi, 0xfff
and rbx, 0xfffffffffffff000
add rdi, 0xfff
mov esi, r13d
add rdi, r9
shr rdi, 0xc
test rdi, rdi
jne 0x1401c5793
mov r15d, 0xc000000d
jmp 0x1401c5a1d
mov r15, rdi
mov dword [rsp + 0x28], 4
mov r14, 0xffffffffffffffff
shl r15, 4
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], r15
xor r8d, r8d
mov qword [rsp + 0xb8], r13
lea rdx, [rsp + 0xb8]
mov dword [rsp + 0x20], 0x1000
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x1401c5945
mov r13, qword [rsp + 0xb8]
test r13, r13
je 0x1401c5945
lfence
test rdi, rdi
je 0x1401c5826
mov rax, qword [rsp + 0xb8]
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
mov qword ds:[rax], rbx
lea rax, [rax + 0x10]
add rbx, 0x1000
sub rcx, 1
jne 0x1401c5810
mov rcx, qword [rsp + 0x88]
xor edx, edx
mov qword [rsp + 0x28], rsi
mov r9, r13
mov qword [rsp + 0x20], r15
lea r8d, [rdx + 4]
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
mov ebx, eax
mov r15d, eax
test eax, eax
js 0x1401c58a8
mov rbp, rdi
test rdi, rdi
je 0x1401c58a8
lea r8, [r13 + 8]
nop dword [rax]
mov eax, dword [r8]
lea r8, [r8 + 0x10]
bt rax, 0x1e
mov rdx, rsi
lea rsi, [rsi + 1]
cmovb rsi, rdx
sub rdi, 1
jne 0x1401c5860
mov r9d, 0x8000
mov qword [rsp + 0x40], r13
lea r8, [rsp + 0xb8]
mov qword [rsp + 0xb8], rdi
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
jmp 0x1401c58d9
mov r9d, 0x8000
mov qword [rsp + 0x40], r13
lea r8, [rsp + 0xb8]
mov qword [rsp + 0xb8], rsi
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
test ebx, ebx
js 0x1401c5a1d
mov rcx, rbp
xorps xmm0, xmm0
sub rcx, rsi
js 0x1401c58eb
cvtsi2ss xmm0, rcx
jmp 0x1401c5900
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
xorps xmm1, xmm1
test rbp, rbp
js 0x1401c591c
cvtsi2ss xmm1, rbp
divss xmm0, xmm1
movss dword [r12], xmm0
jmp 0x1401c5a1d
mov rax, rbp
and ebp, 1
shr rax, 1
or rax, rbp
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
movss dword [r12], xmm0
jmp 0x1401c5a1d
mov r15d, 0xc000009a
jmp 0x1401c5a1d
mov eax, 0xc000000d
jmp 0x1401c5a20
cmp byte [rsp + 0xa8], r13b
lea r8, [fcn.140175080]
mov rax, qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
cmovne rax, r8
mov r8, rdi
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9, rbx
call fcn.1401c4380
mov r8, r12
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1401c53a0
mov r15d, eax
test rbx, rbx
je 0x1401c5a1d
mov rdx, qword [rbx + 0x30]
mov r14, 0xffffffffffffffff
test rdx, rdx
je 0x1401c59ca
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov qword [rbx + 0x30], r13
mov r8, qword [rbx + 0xb0]
xor edx, edx
mov rcx, qword [0x1402c5110]
test r8, r8
jne 0x1401c59e6
mov r8, qword [rbx + 0x90]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x1401c5a0b
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x1401c5a0b
call fcn.14013fb00
mov rcx, qword [0x1402c5110]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, r15d
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret