Function at 0x1400f9c80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x28
xor edi, edi
mov rbp, r9
mov r12, r8
mov r15, rdx
mov r14, rcx
test r8, r8
je 0x1400f9ca8
mov qword [r8], rdi
test rbp, rbp
je 0x1400f9cb0
mov qword [r9], rdi
mov rbx, qword [rsp + 0x80]
test rbx, rbx
je 0x1400f9cc0
mov qword [rbx], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140312860], eax
je 0x1400f9ce1
mov eax, 0x10dd
add rsp, 0x28
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [0x140312878]
test eax, eax
jne 0x1400fa040
test r14, r14
jne 0x1400f9d06
lea eax, [r14 + 6]
add rsp, 0x28
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
mov rsi, qword [r14]
test rsi, rsi
jne 0x1400f9d2c
mov dword [0x140312878], 6
lea eax, [rsi + 6]
mov qword [0x140312880], r14
jmp 0x1400fa03b
movzx eax, byte [rsi]
mov r14, rdi
mov qword [rsp + 0x20], r13
mov r13, rdi
cmp al, 0xff
jne 0x1400f9d73
cmp byte [rsi + 1], 0x25
jne 0x1400f9d73
movsxd rax, dword [rsi + 2]
mov rcx, rsi
add rax, 6
add rax, rsi
mov rdx, rax
mov qword [rsp + 0x80], rax
call fcn.1400f9bd0
test al, al
je 0x1400f9d93
mov rsi, qword [rsp + 0x80]
mov rsi, qword [rsi]
jmp 0x1400f9d93
cmp al, 0xeb
jne 0x1400f9d93
movsx rax, byte [rsi + 1]
add rsi, 2
add rsi, rax
cmp byte [rsi], 0xe9
jne 0x1400f9d93
movsxd rax, dword [rsi + 1]
add rsi, 5
add rsi, rax
test r15, r15
jne 0x1400f9d9d
mov r15, rdi
jmp 0x1400f9dfc
movzx eax, byte [r15]
cmp al, 0xff
jne 0x1400f9ddb
cmp byte [r15 + 1], 0x25
jne 0x1400f9ddb
movsxd rax, dword [r15 + 2]
mov rcx, r15
add rax, 6
add rax, r15
mov rdx, rax
mov qword [rsp + 0x80], rax
call fcn.1400f9bd0
test al, al
je 0x1400f9dfc
mov r15, qword [rsp + 0x80]
mov r15, qword [r15]
jmp 0x1400f9dfc
cmp al, 0xeb
jne 0x1400f9dfc
movsx rax, byte [r15 + 1]
add r15, 2
add r15, rax
cmp byte [r15], 0xe9
jne 0x1400f9dfc
movsxd rax, dword [r15 + 1]
add r15, 5
add r15, rax
cmp r15, rsi
jne 0x1400f9e12
cmp dword [0x140312864], edi
jne 0x1400f9fe7
jmp 0x1400f9f97
test rbp, rbp
je 0x1400f9e1b
mov qword [rbp], rsi
test rbx, rbx
je 0x1400f9e23
mov qword [rbx], r15
mov ecx, gethostbyname
call fcn.1400dba80
mov r13, rax
test rax, rax
jne 0x1400f9e3d
lea edi, [rax + 8]
jmp 0x1400f9f97
mov rcx, rsi
call fcn.1400f9800
mov r14, rax
test rax, rax
jne 0x1400f9e55
lea edi, [rax + 8]
jmp 0x1400f9f97
test r12, r12
je 0x1400f9e5e
mov qword [r12], r14
mov ebp, dword [rsp + 0x88]
mov r12, rsi
mov ebx, edi
nop word [rax + rax]
cmp ebx, 5
jl 0x1400f9e79
test ebp, ebp
jle 0x1400f9ec3
mov qword [rsp + 0x78], r12
mov dword [rsp + 0x80], edi
cmp ebx, 5
jl 0x1400f9e8c
dec ebp
movsxd rcx, ebx
lea r9, [rsp + 0x80]
add rcx, r14
xor r8d, r8d
mov rdx, r12
call fcn.140102190
mov r12, rax
cmp dword [rsp + 0x80], edi
jne 0x1400f9ec3
mov rcx, qword [rsp + 0x78]
mov ebx, eax
sub ebx, esi
call fcn.1400f9ad0
test eax, eax
je 0x1400f9e70
cmp ebx, 5
jge 0x1400f9edf
cmp dword [0x140312864], 0
mov edi, 9
jne 0x1400f9f9d
jmp 0x1400f9f97
movsxd r12, ebx
cmp r12, 0x1a
jbe 0x1400f9ef2
mov edi, 6
jmp 0x1400f9f97
lea r8, [r12 + r14]
mov qword [r14 + 0x28], r15
lea rax, [r12 + rsi]
mov byte [r14 + 0x1f], bl
mov qword [r14 + 0x20], rax
lea rcx, [r8 + 6]
mov eax, r14d
mov word [r8], 0x25ff
sub eax, ecx
lea rdx, [r14 + 0x1f]
add eax, 0x20
lea rcx, [r8 + 6]
mov dword [r8 + 2], eax
call fcn.1400f9b90
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], edi
mov r8d, 0x40
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400f9f8f
mov rcx, rsi
call fcn.1400f9b30
mov rbx, rax
test rax, rax
je 0x1400fa005
mov ebp, 0x6544
cmp word [rax + 0x1c], bp
je 0x1400fa005
mov edx, 0x40
mov dword [rsp + 0x80], edi
mov r8d, edx
lea r9, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400f9ff7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x140312878], edi
test r14, r14
je 0x1400f9fd5
mov rcx, r14
and rcx, 0xffffffffffff0000
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x30], rax
mov rax, qword [rcx + 0x10]
mov qword [r14 + 0x20], rax
mov qword [rcx + 0x10], r14
test r13, r13
je 0x1400f9fe7
mov edx, gethostbyname
mov rcx, r13
call fcn.1401139ac
mov rax, qword [rsp + 0x60]
mov qword [0x140312880], rax
mov eax, edi
jmp 0x1400fa036
mov dword [rbx + 0x1c], 0x6f746544
mov dword [rbx + 0x20], 0x21737275
mov rax, qword [rsp + 0x60]
mov qword [r13 + 0x10], rax
mov dword [r13 + 8], edi
mov qword [r13 + 0x20], r14
mov qword [r13 + 0x18], rsi
mov eax, dword [rsp + 0x70]
mov dword [r13 + 0x28], eax
mov rax, qword [0x140312890]
mov qword [r13], rax
xor eax, eax
mov qword [0x140312890], r13
mov r13, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x68]
add rsp, 0x28
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret