Function at 0x18009a48c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov rdi, r9
mov r14, r8
mov rbp, rdx
mov r15, rcx
test r8, r8
je 0x18009a4bf
mov qword [r8], r13
test rdi, rdi
je 0x18009a4c7
mov qword [r9], r13
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x18009a4d4
mov qword [rbx], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x18010b654], eax
je 0x18009a4ec
mov eax, 0x10dd
jmp 0x18009a737
mov eax, dword [0x18010b658]
test eax, eax
jne 0x18009a737
test r15, r15
jne 0x18009a508
lea eax, [r15 + 6]
jmp 0x18009a737
mov rcx, qword [r15]
test rcx, rcx
jne 0x18009a51e
lea ebx, [rcx + 6]
mov dword [0x18010b658], ebx
jmp 0x18009a72e
call fcn.18009a8a0
mov rcx, rbp
mov rsi, rax
call fcn.18009a8a0
mov r12, rax
test rdi, rdi
je 0x18009a539
mov qword [rdi], rsi
test rbx, rbx
je 0x18009a541
mov qword [rbx], r12
mov ecx, gethostbyname
call fcn.18009d1b8
mov rdi, rax
test rax, rax
je 0x18009a563
mov rcx, rsi
call fcn.18009a1a4
mov rbp, rax
test rax, rax
jne 0x18009a56d
mov ebx, 8
jmp 0x18009a716
test r14, r14
je 0x18009a575
mov qword [r14], rbp
mov rdx, rsi
mov ecx, r13d
mov ebx, 6
movsxd rcx, ecx
lea r9, [rsp + 0x70]
add rcx, rbp
mov dword [rsp + 0x70], r13d
xor r8d, r8d
mov r14, rdx
call fcn.18009b198
mov rdx, rax
cmp dword [rsp + 0x70], r13d
jne 0x18009a708
mov ecx, eax
mov al, byte [r14]
add al, 0x3e
sub ecx, esi
cmp al, 0x27
ja 0x18009a5c6
movabs r8, 0x8040000403
bt r8, rax
jb 0x18009a608
cmp byte [r14], 0xff
jne 0x18009a5d3
cmp byte [r14 + 1], 0x25
jmp 0x18009a5fe
mov al, byte [r14]
sub al, 0x26
cmp al, 0x3f
ja 0x18009a5ec
movabs r8, 0xc000000000010101
bt r8, rax
jb 0x18009a5f2
cmp byte [r14], 0xe3
jne 0x18009a600
cmp byte [r14 + 1], 0xff
jne 0x18009a600
cmp byte [r14 + 2], 0x25
je 0x18009a608
cmp ecx, ebx
jl 0x18009a580
cmp ecx, ebx
jl 0x18009a708
movsxd r14, ecx
cmp r14, 0x19
ja 0x18009a716
lea rdx, [r14 + rbp]
mov qword [rbp + 0x28], r12
lea r9, [rbp + 0x1f]
mov byte [r9], cl
lea rax, [r14 + rsi]
mov qword [rbp + 0x20], rax
lea rcx, [rdx + 6]
mov eax, ebp
mov word [rdx], 0x25ff
sub eax, ecx
mov r8, r9
add eax, 0x20
lea rcx, [rdx + 6]
sub r8, rcx
mov dword [rdx + 2], eax
cmp rcx, r9
cmova r8, r13
test r8, r8
je 0x18009a664
mov dl, 0xcc
call fcn.1800a02d0
mov r12d, 0x40
mov dword [rsp + 0x60], r13d
mov r8d, r12d
lea r9, [rsp + 0x60]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18009a694
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18009a716
mov rcx, rsi
call fcn.18009a41c
mov rbx, rax
test rax, rax
je 0x18009a6dc
mov r14d, 0x6544
cmp word [rax + 0x1c], r14w
je 0x18009a6dc
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], r13d
mov r8d, r12d
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18009a687
mov dword [rbx + 0x1c], 0x6f746544
mov dword [rbx + 0x20], 0x21737275
mov dword [rdi + 8], r13d
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x20], rbp
mov qword [rdi + 0x18], rsi
mov eax, dword [rsp + 0x60]
mov dword [rdi + 0x28], eax
mov rax, qword [0x18010b670]
mov qword [rdi], rax
xor eax, eax
mov qword [0x18010b670], rdi
jmp 0x18009a737
cmp dword [0x18010b650], r13d
mov ebx, 9
jne 0x18009a721
mov dword [0x18010b658], ebx
test rdi, rdi
je 0x18009a72e
mov edx, gethostbyname
mov rcx, rdi
call fcn.18009d1f4
mov eax, ebx
mov qword [0x18010b660], r15
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret