Function at 0x180001cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xc8
mov rax, qword [0x18010bb00]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov qword [rbp - 1], r8
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x180001ccc
test rdx, rdx
je 0x180001ccc
mov rdi, rcx
mov qword [rbp - 0x69], 0
lea rax, [rbp - 0x69]
and rdi, 0xffffffffffff0000
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x39]
mov rdx, rdi
mov qword [rsp + 0x20], 0x30
xor r8d, r8d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
mov r8d, 0x80000000
test eax, eax
js 0x180001a4e
cmp qword [rbp - 0x69], 0
je 0x180001a4e
cmp dword [rbp - 0x19], 0x10000
je 0x180001a50
mov rdx, qword [rbp - 0x39]
mov rax, rbx
sub rax, rdx
mov rcx, rdx
sub rcx, rbx
lea rdi, [rdx - 1]
and rdi, 0xffffffffffff0000
cmp rbx, rdx
cmovb rax, rcx
cmp rax, r8
ja 0x180001a4e
lea rax, [rbp - 0x69]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x39]
mov rdx, rdi
mov qword [rsp + 0x20], 0x30
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
mov r8d, 0x80000000
test eax, eax
jns 0x1800019e4
xor edi, edi
xor r15b, r15b
mov rax, rbx
sub rax, rsi
mov r14, rsi
sub r14, rbx
cmp rbx, rsi
cmovae r14, rax
cmp r14, r8
jbe 0x180001a72
test rdi, rdi
sete r15b
mov qword [rbp - 0x69], rdi
lea r9, [rbp + 0xf]
neg rdi
mov dword [rsp + 0x28], 0x40
lea rdx, [rbp - 0x69]
mov qword [rbp + 0xf], 0x60
sbb r8d, r8d
mov dword [rsp + 0x20], 0x3000
and r8d, 0xc
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
xor edi, edi
test eax, eax
cmovns rdi, qword [rbp - 0x69]
test rdi, rdi
je 0x180001ccc
test r15b, r15b
mov qword [rsp + 0x108], r12
mov ecx, 0xe
mov qword [rsp + 0xc0], r13
mov r13d, 5
mov qword [rdi + 0x10], rbx
mov eax, r13d
mov r9, rdi
cmovne eax, ecx
mov rcx, rbx
mov dword [rdi + 0x1c], eax
sub r9, rbx
mov r8d, eax
mov edx, eax
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rcx + r9 + 0x40], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x180001b00
lea r12, [rdi + 0x20]
mov rcx, rbx
mov rdx, r12
call fcn.180001620
movzx eax, al
mov dword [rdi + 0x18], eax
test eax, eax
je 0x180001cc0
lea rcx, [rax + rdi]
add rax, rbx
mov word [rcx + 0x20], 0x25ff
lea r8, [rbp + 0x17]
xor edx, edx
mov qword [rcx + 0x26], rax
mov dword [rcx + 0x22], edx
mov eax, 0xe
mov dword [rbp - 9], edx
test r15b, r15b
mov r9d, 0x40
mov qword [rbp - 0x61], rbx
cmovne r13, rax
lea rdx, [rbp - 0x61]
lea rax, [rbp - 9]
mov qword [rbp + 0x17], r13
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x180001cc0
call fcn.1800015c0
mov eax, 0x80000000
cmp r14, rax
jbe 0x180001bcd
test r15b, r15b
je 0x180001bae
mov word [rbx], 0x25ff
mov dword [rbx + 2], 0
mov qword [rbx + 6], rsi
jmp 0x180001bd8
mov byte [rbx], 0xe9
mov eax, edi
sub eax, ebx
sub eax, 5
mov dword [rbx + 1], eax
mov word [rdi], 0x25ff
mov dword [rdi + 2], 0
mov qword [rdi + 6], rsi
jmp 0x180001bd8
sub esi, ebx
mov byte [rbx], 0xe9
sub esi, 5
mov dword [rbx + 1], esi
mov rax, qword [rbp - 1]
test rax, rax
je 0x180001be4
mov qword [rax], r12
mov r9d, dword [rbp - 9]
lea rax, [rbp - 9]
lea r8, [rbp - 1]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x61]
mov qword [rbp - 1], r13
mov rcx, 0xffffffffffffffff
mov qword [rbp - 0x61], rbx
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov rax, qword gs:[0x30]
lea rcx, [0x180001810]
mov edx, dword [rax + 0x40]
mov dword [rbp - 0x59], edx
mov rax, qword gs:[0x30]
mov edx, dword [rax + 0x48]
mov dword [rbp - 0x55], edx
lea rdx, [rbp - 0x59]
mov qword [rbp - 0x51], rbx
mov qword [rbp - 0x49], r12
mov eax, dword [rdi + 0x18]
mov qword [rbp - 0x41], rax
call fcn.1800013b0
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFlushInstructionCache]
mov rax, qword gs:[0x30]
lea rdx, [rbp - 1]
mov ecx, dword [rax + 0x40]
mov dword [rbp - 1], ecx
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
mov dword [rbp + 3], ecx
lea rcx, [0x1800014b0]
mov dword [rbp + 7], 1
call fcn.1800013b0
mov al, 1
mov r12, qword [rsp + 0x108]
mov r13, qword [rsp + 0xc0]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.180066c80
add rsp, 0xc8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, rdi
call fcn.180001360
xor al, al
jmp 0x180001c94
xor al, al
jmp 0x180001ca4
jmp 0x180001960