Function at 0x180019960
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1d8
mov rdi, rcx
mov rax, qword [0x180044008]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
lea rsi, [rsp + 0x170]
mov qword [rsp + 0x120], rsi
mov rax, qword [rsp + 0x120]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x128], rcx
mov qword [rsp + 0x90], rdi
mov eax, 0x9bacb044
mov qword [rsp + 0xd8], rdi
cmp eax, 0xfcd70474
jg 0x180019a24
cmp eax, 0xbfd99599
jg 0x180019a97
cmp eax, 0x97c97e34
jle 0x180019b6b
cmp eax, 0x9bacb043
jg 0x180019d0b
cmp eax, 0x97c97e35
je 0x180019e27
cmp eax, 0x9927131c
jne 0x1800199d6
mov eax, 0xa38120b4
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x78], rcx
jmp 0x1800199d6
cmp eax, 0x4079a5b3
jg 0x180019b10
cmp eax, 0x12d7fd97
jle 0x180019bdb
cmp eax, 0x2f38001f
jg 0x180019d78
cmp eax, 0x12d7fd98
je 0x180019e4c
cmp eax, 0x259d0256
jne 0x1800199d6
mov rax, qword [rsp + 0x90]
mov rcx, 0xffffffffc0000000
add rax, rcx
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x88]
cmp rax, qword [rsp + 0x130]
mov eax, 0xa38120b4
mov ecx, 0x9927131c
cmovb eax, ecx
jmp 0x18001a4d2
cmp eax, 0xef35e7dd
jle 0x180019c49
cmp eax, 0xf73c7369
jg 0x180019da5
cmp eax, 0xef35e7de
je 0x18001a10a
cmp eax, 0xf22113a3
jne 0x1800199d6
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
mov eax, 0x533a8a6d
mov ecx, 0xbfd9959a
cmovb eax, ecx
mov rsi, qword [rsp + 0x160]
jmp 0x1800199d6
cmp eax, 0x533a8a6c
jle 0x180019cb7
cmp eax, 0x77069b5a
jg 0x180019dd5
cmp eax, 0x533a8a6d
je 0x18001a126
cmp eax, 0x6f6bbcb6
jne 0x1800199d6
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
cmp rax, qword [rsp + 0xb8]
mov eax, 0xc13ac088
mov ecx, 0x1d3c291
cmovb eax, ecx
jmp 0x1800199d6
cmp eax, 0x823372db
je 0x18001a38a
cmp eax, 0x88439742
je 0x18001a3af
cmp eax, 0x90569e50
jne 0x1800199d6
mov rcx, qword [rsp + 0xa0]
mov edx, 0x1000
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
mov eax, 0x4fbf5e34
mov ecx, 0xe4cb2fb9
cmove eax, ecx
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0xe8], rcx
mov qword [rsp + 0xe0], rbx
jmp 0x1800199d6
cmp eax, 0xfcd70475
je 0x18001a3d1
cmp eax, 0x1d3c291
je 0x18001a3e8
cmp eax, 0x512790e
jne 0x1800199d6
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x118]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb0]
mov qword [rax], rcx
add rcx, 0x40
mov qword [rsp + 0x118], rcx
mov rax, rcx
sub rax, qword [rsp + 0x30]
cmp rax, 0xfc1
mov eax, 0x2f380020
mov ecx, 0x512790e
cmovb eax, ecx
jmp 0x1800199d6
cmp eax, 0xbfd9959a
je 0x18001a402
cmp eax, 0xc13ac088
je 0x18001a414
cmp eax, 0xe4cb2fb9
jne 0x1800199d6
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x148]
mov rcx, qword [rsp + 0xb8]
cmp rcx, rax
mov eax, 0x12d7fd98
mov ecx, 0x4fbf5e34
cmova eax, ecx
mov rbx, qword [rsp + 0x150]
jmp 0x1800199d6
cmp eax, 0x4079a5b4
je 0x18001a439
cmp eax, 0x4929edf1
je 0x18001a488
cmp eax, 0x4fbf5e34
jne 0x1800199d6
mov qword [rsp + 0xc0], rbx
cmp qword [rsp + 0xc0], 0
mov eax, 0x97c97e35
mov ecx, 0x88439742
cmove eax, ecx
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x110], rcx
jmp 0x1800199d6
cmp eax, 0x9bacb044
je 0x18001a4b7
cmp eax, 0xa38120b4
jne 0x1800199d6
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x90]
mov ecx, 0x40000000
add rax, rcx
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x128]
cmp rax, qword [rsp + 0x138]
mov eax, 0x4929edf1
mov ecx, 0xf90ab8fe
cmova eax, ecx
mov rcx, qword [rsp + 0x128]
mov qword [rsp + 0x100], rcx
jmp 0x1800199d6
cmp eax, 0x2f380020
je 0x18001a4e4
cmp eax, 0x3125d2bb
jne 0x1800199d6
mov eax, 0x78a1ecad
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0xd0], rcx
jmp 0x1800199d6
cmp eax, 0xf73c736a
je 0x18001a509
cmp eax, 0xf90ab8fe
jne 0x1800199d6
mov eax, 0x4929edf1
mov rcx, qword [rsp + 0x138]
mov qword [rsp + 0x100], rcx
jmp 0x1800199d6
cmp eax, 0x77069b5b
jne 0x18001a528
mov rax, qword [rsp + 0x30]
add rax, 0x40
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rax], 0
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x10], 0
mov eax, 0x512790e
jmp 0x1800199d6
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
mov eax, 0x77069b5b
mov ecx, 0xfcd70475
cmove eax, ecx
jmp 0x1800199d6
mov rdi, rsi
mov eax, dword [rsp + 0x198]
mov rbx, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0x148]
mov qword [rsp + 0x38], rax
mov rax, rsi
xor edx, edx
div qword [rsp + 0x38]
sub rsi, rdx
sub rsi, qword [rsp + 0x38]
mov ecx, 0x7cc7eacb
cmp ecx, 0x4a0f57b8
jg 0x180019ecf
cmp ecx, 0xead74da4
jle 0x180019f16
cmp ecx, 0x2b5b96d4
jg 0x180019f94
cmp ecx, 0xead74da5
je 0x180019ff6
cmp ecx, 0xf938382e
jne 0x180019e82
cmp dword [rsp + 0x1c0], 0x10000
mov ecx, 0x5d6173f9
je 0x180019e82
mov ecx, 0xead74da5
jmp 0x180019e82
cmp ecx, 0x5bf9670a
jg 0x180019f49
cmp ecx, 0x530ee5c1
jle 0x180019fce
cmp ecx, 0x530ee5c2
je 0x18001a025
cmp ecx, 0x5a077ade
jne 0x180019e82
mov rax, qword [rsp + 0x38]
mov r12, qword [rsp + 0x60]
sub r12, rax
mov ecx, 0x530ee5c2
xor r13d, r13d
mov r14, qword [rsp + 0x50]
jmp 0x180019e82
cmp ecx, 0xae2a9995
je 0x180019fb4
cmp ecx, 0xb7355d46
je 0x18001a046
cmp ecx, 0xe05c267d
jne 0x180019e82
mov ecx, 0x4a0f57b9
mov rbp, qword [rsp + 0x68]
jmp 0x180019e82
cmp ecx, 0x5bf9670b
je 0x18001a08b
cmp ecx, 0x5d6173f9
je 0x18001a0ae
cmp ecx, 0x7cc7eacb
jne 0x180019e82
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x28]
mov ecx, 0x3334458f
cmp rax, rbx
jb 0x180019e82
mov ecx, 0xb7355d46
jmp 0x180019e82
cmp ecx, 0x2b5b96d5
je 0x180019fb4
cmp ecx, 0x3334458f
jne 0x180019e82
mov ecx, 0x4a0f57b9
xor ebp, ebp
jmp 0x180019e82
mov r14, qword [rsp + 0x50]
mov ecx, 0x530ee5c2
mov r13d, 3
mov r12, qword [rsp + 0x28]
jmp 0x180019e82
cmp ecx, 0x4d56373e
jne 0x18001a0c8
mov eax, dword [rsp + 0x74]
mov ecx, 0x5bf9670b
cmp eax, 3
jl 0x180019e82
mov ecx, 0x3334458f
jmp 0x180019e82
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov ecx, 0x2b5b96d5
cmp rdx, rax
jb 0x180019e82
mov ecx, 0x5a077ade
jmp 0x180019e82
mov dword [rsp + 0x74], r13d
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0x68], r14
mov rax, qword [rsp + 0x48]
mov ecx, 0x4d56373e
jmp 0x180019e82
lea rdx, [rsp + 0x1a0]
mov qword [rsp + 0x48], rdx
mov rax, qword [rsp + 0x48]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, 0xae2a9995
test rax, rax
je 0x180019e82
mov ecx, 0xf938382e
jmp 0x180019e82
cmp dword [rsp + 0x74], 0
mov ecx, 0x7cc7eacb
je 0x18001a09c
mov ecx, 0xe05c267d
mov r15, qword [rsp + 0x68]
mov rsi, qword [rsp + 0xc8]
jmp 0x180019e82
mov r14, qword [rsp + 0x58]
mov ecx, 0x530ee5c2
mov r13d, 1
mov r12, qword [rsp + 0x28]
jmp 0x180019e82
cmp ecx, 0x4a0f57b9
jne 0x180019e82
mov qword [rsp + 0xa0], rbp
cmp qword [rsp + 0xa0], 0
mov eax, 0x90569e50
mov ecx, 0x4fbf5e34
cmove eax, ecx
mov rbx, qword [rsp + 0x150]
mov rsi, rdi
mov rdi, qword [rsp + 0xd8]
jmp 0x1800199d6
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0
mov eax, 0x3125d2bb
mov ecx, 0x1d3c291
cmove eax, ecx
jmp 0x1800199d6
mov qword [rsp + 0x168], rbx
mov ecx, dword [rsp + 0x198]
mov r14, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x158]
mov qword [rsp + 0x48], rcx
mov rax, rbx
xor edx, edx
div qword [rsp + 0x48]
sub rbx, rdx
add rbx, qword [rsp + 0x48]
lea r15d, [rcx - 1]
mov eax, 0x8b4ce899
cmp eax, 0x1d84893f
jle 0x18001a1a6
cmp eax, 0x51eb5d52
jg 0x18001a1e4
cmp eax, 0x1d848940
je 0x18001a241
cmp eax, 0x2b06e358
je 0x18001a250
cmp eax, 0x322264ab
jne 0x18001a165
mov eax, dword [rsp + 0x38]
cmp eax, 3
mov eax, 0x3f61bed
mov ecx, 0x51eb5d53
cmovl eax, ecx
jmp 0x18001a165
cmp eax, 0xf43d3be6
jg 0x18001a21e
cmp eax, 0x8b4ce899
je 0x18001a270
cmp eax, 0xd6ddbfc4
je 0x18001a294
cmp eax, 0xdad9e5c1
jne 0x18001a165
cmp dword [rsp + 0x1c0], 0x10000
mov eax, 0x67ebad49
mov ecx, 0x23de14
cmove eax, ecx
jmp 0x18001a165
cmp eax, 0x51eb5d53
je 0x18001a2d6
cmp eax, 0x67ebad49
je 0x18001a2fa
cmp eax, 0x67ee775e
jne 0x18001a165
mov rdi, qword [rsp + 0x50]
mov eax, 0x2b06e358
mov ebp, 3
mov rsi, qword [rsp + 0x28]
jmp 0x18001a165
cmp eax, 0x23de14
je 0x18001a32b
cmp eax, 0x3f61bed
jne 0x18001a344
mov eax, 0xf43d3be7
xor r12d, r12d
jmp 0x18001a165
mov eax, 0xf43d3be7
mov r12, qword [rsp + 0x68]
jmp 0x18001a165
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0x68], rdi
mov rax, qword [rsp + 0x58]
mov eax, 0x322264ab
jmp 0x18001a165
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x50], r13
mov rax, qword [rsp + 0x28]
cmp rax, r14
mov eax, 0xd6ddbfc4
mov ecx, 0x3f61bed
cmova eax, ecx
jmp 0x18001a165
lea rdx, [rsp + 0x1a0]
mov qword [rsp + 0x58], rdx
mov rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
mov eax, 0xdad9e5c1
mov ecx, 0x67ee775e
cmove eax, ecx
jmp 0x18001a165
cmp dword [rsp + 0x38], 0
mov eax, 0x1d848940
mov ecx, 0x8b4ce899
cmove eax, ecx
mov r13, qword [rsp + 0x68]
mov rbx, qword [rsp + 0xc8]
jmp 0x18001a165
mov rsi, qword [rsp + 0x1a0]
add rsi, r15
add rsi, qword [rsp + 0x1b8]
mov rax, rsi
xor edx, edx
div qword [rsp + 0x48]
xor ebp, ebp
sub rsi, rdx
mov eax, 0x2b06e358
mov rdi, qword [rsp + 0x50]
jmp 0x18001a165
mov rdi, qword [rsp + 0x60]
mov eax, 0x2b06e358
mov ebp, 1
mov rsi, qword [rsp + 0x28]
jmp 0x18001a165
cmp eax, 0xf43d3be7
jne 0x18001a165
mov qword [rsp + 0xa8], r12
cmp qword [rsp + 0xa8], 0
mov eax, 0x4079a5b4
mov ecx, 0xbfd9959a
cmove eax, ecx
mov rsi, qword [rsp + 0x160]
mov rdi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x168]
jmp 0x1800199d6
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
mov eax, 0x6f6bbcb6
mov ecx, 0xf73c736a
cmove eax, ecx
jmp 0x1800199d6
mov eax, 0xf22113a3
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rdi
jmp 0x1800199d6
mov eax, 0x78a1ecad
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0xd0], rcx
jmp 0x1800199d6
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x108], rax
mov eax, 0x823372db
jmp 0x1800199d6
mov eax, 0x97c97e35
mov qword [rsp + 0x110], rsi
jmp 0x1800199d6
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x140]
cmp rcx, rax
mov eax, 0x1d3c291
mov ecx, 0xef35e7de
cmovb eax, ecx
jmp 0x1800199d6
mov rcx, qword [rsp + 0xa8]
mov edx, 0x1000
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
mov eax, 0xbfd9959a
mov ecx, 0xf22113a3
cmove eax, ecx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0xf8], rcx
mov qword [rsp + 0xf0], rsi
jmp 0x1800199d6
mov rax, qword [rsp + 0x100]
add rax, 0xfffffffffffff001
mov qword [rsp + 0x98], rax
mov eax, 0x823372db
mov rcx, qword [0x180045c88]
mov qword [rsp + 0x108], rcx
jmp 0x1800199d6
mov rax, qword [rsp + 0x90]
cmp rax, 0x40000000
mov eax, 0xa38120b4
mov ecx, 0x259d0256
cmova eax, ecx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x78], rcx
jmp 0x1800199d6
mov rax, qword [0x180045c88]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
mov qword [0x180045c88], rax
mov eax, 0xfcd70475
jmp 0x1800199d6
mov eax, 0xe4cb2fb9
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0xe8], rdi
jmp 0x1800199d6
cmp eax, 0x78a1ecad
jne 0x1800199d6
mov rax, qword [rsp + 0x120]
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x80], rax
mov ecx, 0x866408c5
mov eax, 0xfc76293f
cmp ecx, 0xd3e74b79
jg 0x18001a56f
cmp ecx, 0x866408c5
je 0x18001a588
cmp ecx, 0x90f2f74c
jne 0x18001a555
jmp 0x18001a5c0
cmp ecx, 0xd3e74b7a
je 0x18001a59b
cmp ecx, 0xfc76293f
jne 0x18001a555
mov ecx, 0x90f2f74c
xor esi, esi
jmp 0x18001a555
cmp qword [rsp + 0x80], 0
mov ecx, 0xd3e74b7a
cmove ecx, eax
jmp 0x18001a555
mov rcx, qword [rsp + 0x80]
mov rsi, qword [rcx + 8]
mov rdx, qword [rsi]
mov qword [rcx + 8], rdx
mov rcx, qword [rsp + 0x80]
inc dword [rcx + 0x10]
mov ecx, 0x90f2f74c
jmp 0x18001a555
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.18001e300
mov rax, rsi
add rsp, 0x1d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret