Function at 0x180005470
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x98]
lea esi, [r8 - 0x790]
mov edi, dword [rsp + 0x90]
lea r14d, [r8 + 0x52]
mov r15d, r8d
mov rbx, rdx
mov r13d, ecx
lea r8d, [rcx - 0x670]
lea edx, [rax - 0x8c6]
xor edi, 0xf1e
lea ebp, [rax - 0x5d]
xor r13d, 0x1e0
lea eax, [r8 + 0x6ee]
cmp esi, eax
je 0x180005784
mov eax, r14d
xor eax, 0xc6
cmp r15d, eax
je 0x1800055d9
xor edx, 0x95b
cmp esi, edx
je 0x1800055c3
mov eax, dword [0x18022f030]
sub dword [0x18022f0c8], eax
cmp dword [rbx + 0x64], 0x3b7e
jb 0x180005526
mov rdx, qword [section..data]
mov eax, dword [rbx + 0xf4]
mov ecx, dword [rdx + 0x14]
lea ecx, [rax + rcx*2]
add dword [rdx + 4], ecx
jmp 0x180005539
mov rcx, qword [section..data]
mov eax, dword [rcx + 0xfc]
mov dword [rcx + 0xf0], eax
mov rax, qword [section..data]
xor r14d, 0x16f
mov ecx, dword [rax + 0x24]
mov eax, esi
add dword [rbx + 0xf0], ecx
xor eax, 0x8ea
cmp r14d, eax
je 0x1800055d9
mov rax, qword [section..data]
add ebp, 0xf2
cmp dword [rax + 0x28], 0x13298
jae 0x180005580
mov eax, dword [rbx + 0x64]
add eax, 0x19d7
mov dword [0x18022f04c], eax
mov rax, qword [section..data]
add r8d, 0x6b8
mov ecx, dword [rbx + 0x144]
xor r14d, 0xe4b
xor esi, 0x6ee
sub edi, 0x36
cmp dword [rax + 0x10c], ecx
je 0x1800055d9
mov edx, dword [0x18022f0c4]
add edx, dword [0x18022f06c]
xor edx, 0xac8
sub dword [rbx + 0x3c], edx
jmp 0x1800055d9
mov eax, dword [rbx + 0x100]
and eax, edi
cmp edi, eax
je 0x1800055d9
mov eax, r8d
xor eax, esi
sub eax, ebp
imul ebp, eax
lea eax, [r15 + 0x94]
cmp r8d, eax
je 0x18000571d
mov rax, qword [section..data]
add edi, 0x1b1
xor edi, 0x4d
add dword [rax + 0x3c], 0x236e8
mov edx, dword [0x18022f048]
xor edx, dword [rbx + 0x3c]
xor edx, 0x27eeb6
mov dword [rbx + 0x3c], edx
mov rax, qword [section..data]
mov ecx, dword [rax + 0x168]
sub ecx, dword [rbx + 0x1c]
xor ecx, 0x12c6ed
sub edx, ecx
mov dword [rbx + 0x3c], edx
mov rax, qword [section..data]
cmp dword [rax + 0x38], 0x164a
jae 0x180005653
mov eax, dword [rbx + 0x16c]
xor eax, dword [rbx + 0x78]
xor eax, 0xffa6
add dword [0x18022f0ec], eax
jmp 0x180005682
mov r8d, dword [rax + 0x48]
xor ecx, ecx
mov edx, dword [rax + 0x3c]
add r8d, 0x11e677
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rcx, [rax + 0x1000]
mov rax, qword [section..data]
mov qword [rax + 0xe8], rcx
lea ecx, [r13 - 0x103]
xor r14d, 0xe2
mov dword [rsp + 0x30], ecx
lea eax, [rsi + 0x302]
xor ebp, 0xa4
lea r8d, [r13 + 0xd9]
sub ebp, 0x26f
xor r15d, 0xd2
lea r9d, [r14 - 0x42]
mov dword [rsp + 0x28], ebp
mov rdx, rbx
mov dword [rsp + 0x20], eax
mov ecx, r15d
add edi, 0xffffff1e
call fcn.1800015b0
mov ecx, dword [0x18022f0b4]
cmp dword [0x18022f108], ecx
ja 0x1800056f3
add ecx, dword [0x18022f17c]
xor ecx, dword [0x18022f048]
mov dword [0x18022f11c], ecx
jmp 0x18000570a
mov eax, dword [rbx + 0x120]
add eax, dword [0x18022f144]
xor eax, 0xba2e8beb
mov dword [rbx + 0x84], eax
lea rax, [0x180246980]
mov qword [rbx + 0xc8], rax
jmp 0x180005822
mov r12d, dword [0x18022f178]
cmp r12d, 0x68d
jne 0x180005822
add r13d, esi
or r13d, esi
mov edx, dword [0x18022f110]
mov ecx, r13d
or edx, r14d
imul edx, dword [0x18022f0b0]
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
mov eax, dword [rbx + 0x28]
add r12d, 3
mov rcx, qword [section..data]
imul eax, r15d
sub dword [rcx + 0x114], eax
mov eax, dword [rbx + 0x110]
or eax, ebp
add dword [rbx + 0x8c], eax
cmp r12d, 0x68d
je 0x180005737
jmp 0x180005822
lea eax, [rdx - 0x824]
cmp dword [rbx + 0xb4], eax
jbe 0x180005819
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, dword [rbx + 0xf4]
sub ecx, 0x7e2
and ecx, 0x8ea
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [0x18022f0f4]
mov eax, esi
or rcx, rax
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [section..data]
mov r9d, dword [0x18022f0c0]
mov r8d, dword [rbx + 0xe4]
or r9d, dword [0x18022f104]
or r8d, 0x6b8
mov edx, dword [rax + 0x48]
xor r9d, 0x790
mov ecx, dword [rbx + 0x8c]
add edx, 0x869
and r8d, dword [rbx + 0x134]
and ecx, edi
mov dword [rsp + 0x20], edx
lea rdx, [0x18022f010]
call fcn.180005ae8
jmp 0x180005822
lea ecx, [rsi + rbp]
xor dword [0x18022f060], ecx
lea r11, [rsp + 0x40]
xor edi, 0xd2
mov rbx, qword [r11 + 0x30]
mov eax, edi
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret