Function at 0x1401c2f80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, qword [rsp + 0xb8]
xor r13d, r13d
mov rdi, rdx
mov rbx, r8
mov rdx, rcx
mov ecx, dword [rsp + 0xb0]
mov dword [r12], r13d
cmp ecx, 3
jne 0x1401c31da
test rbx, rbx
je 0x1401c31d0
cmp r9, 0x1000
jb 0x1401c31d0
mov rdi, rbx
mov ebp, r13d
and edi, 0xfff
and rbx, 0xfffffffffffff000
add rdi, 0xfff
mov esi, r13d
add rdi, r9
shr rdi, 0xc
test rdi, rdi
jne 0x1401c3013
mov r15d, 0xc000000d
jmp 0x1401c329d
mov r15, rdi
mov dword [rsp + 0x28], 4
mov r14, 0xffffffffffffffff
shl r15, 4
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], r15
xor r8d, r8d
mov qword [rsp + 0xb8], r13
lea rdx, [rsp + 0xb8]
mov dword [rsp + 0x20], 0x1000
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x1401c31c5
mov r13, qword [rsp + 0xb8]
test r13, r13
je 0x1401c31c5
lfence
test rdi, rdi
je 0x1401c30a6
mov rax, qword [rsp + 0xb8]
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
mov qword ds:[rax], rbx
lea rax, [rax + 0x10]
add rbx, 0x1000
sub rcx, 1
jne 0x1401c3090
mov rcx, qword [rsp + 0x88]
xor edx, edx
mov qword [rsp + 0x28], rsi
mov r9, r13
mov qword [rsp + 0x20], r15
lea r8d, [rdx + 4]
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
mov ebx, eax
mov r15d, eax
test eax, eax
js 0x1401c3128
mov rbp, rdi
test rdi, rdi
je 0x1401c3128
lea r8, [r13 + 8]
nop dword [rax]
mov eax, dword [r8]
lea r8, [r8 + 0x10]
bt rax, 0x1e
mov rdx, rsi
lea rsi, [rsi + 1]
cmovb rsi, rdx
sub rdi, 1
jne 0x1401c30e0
mov r9d, 0x8000
mov qword [rsp + 0x40], r13
lea r8, [rsp + 0xb8]
mov qword [rsp + 0xb8], rdi
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
jmp 0x1401c3159
mov r9d, 0x8000
mov qword [rsp + 0x40], r13
lea r8, [rsp + 0xb8]
mov qword [rsp + 0xb8], rsi
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
test ebx, ebx
js 0x1401c329d
mov rcx, rbp
xorps xmm0, xmm0
sub rcx, rsi
js 0x1401c316b
cvtsi2ss xmm0, rcx
jmp 0x1401c3180
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
xorps xmm1, xmm1
test rbp, rbp
js 0x1401c319c
cvtsi2ss xmm1, rbp
divss xmm0, xmm1
movss dword [r12], xmm0
jmp 0x1401c329d
mov rax, rbp
and ebp, 1
shr rax, 1
or rax, rbp
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
movss dword [r12], xmm0
jmp 0x1401c329d
mov r15d, 0xc000009a
jmp 0x1401c329d
mov eax, 0xc000000d
jmp 0x1401c32a0
cmp byte [rsp + 0xa8], r13b
lea r8, [fcn.14016e060]
mov rax, qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
cmovne rax, r8
mov r8, rdi
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9, rbx
call fcn.1401c1cc0
mov r8, r12
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1401c2c20
mov r15d, eax
test rbx, rbx
je 0x1401c329d
mov rdx, qword [rbx + 0x30]
mov r14, 0xffffffffffffffff
test rdx, rdx
je 0x1401c324a
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov qword [rbx + 0x30], r13
mov r8, qword [rbx + 0xb0]
xor edx, edx
mov rcx, qword [0x1402bfe50]
test r8, r8
jne 0x1401c3266
mov r8, qword [rbx + 0x90]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x1401c328b
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x1401c328b
call fcn.14013d2a0
mov rcx, qword [0x1402bfe50]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, r15d
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret