Function at 0x7ffbf1d440b8
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x7ffbf1d68270]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea r11, [0x7ffbf1ca0000]
lea r13, [rcx + 0x18]
mov qword [rsp + 0x40], rdx
lea rsi, [0x7ffbf1ca0000]
mov eax, 0xfffffff
mov r14, qword [r13]
mov qword [rsp + 0x48], rcx
mov r12d, dword [r14 + 5]
mov edx, dword [r14 + 1]
and rdx, rax
and r12, rax
mov qword [rsp + 0x60], r13
mov eax, dword [0x7ffbf1cb6330]
lea rbp, [rax + rdx - 1]
mov rcx, rax
xor edx, edx
mov rax, rbp
add r12, rsi
div rcx
sub rbp, rdx
mov r15d, 0x8000
mov eax, dword [0x7ffbf1cb6330]
mov eax, dword [0x7ffbf1cb6330]
mov r10d, dword [0x7ffbf1d46a58]
mov eax, dword [0x7ffbf1d46a58]
test eax, eax
je 0x7ffbf1d441ea
mov edi, dword [0x7ffbf1d46a58]
xor r8d, r8d
xor eax, eax
dec edi
inc rdi
mov r9, rdi
je 0x7ffbf1d441a4
mov rcx, qword [0x7ffbf1d6a520]
imul rcx, rcx, 0x343fd
shl rax, 0x10
shr r9, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
test r9, r9
jne 0x7ffbf1d44175
mov qword [0x7ffbf1d6a520], rcx
xor edx, edx
div rdi
test r10, r10
je 0x7ffbf1d441df
mov ecx, 0xffff3cd2
mov eax, 0xc32d
inc r8
lock cmpxchg dword [r11 + rdx*4 + 0xcb084], ecx
je 0x7ffbf1d4444e
mov ecx, dword [0x7ffbf1d46a58]
lea rax, [rdx + 1]
xor edx, edx
div rcx
cmp r8, r10
jb 0x7ffbf1d441ae
xor ebx, ebx
test rbx, rbx
jne 0x7ffbf1d4430f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor edi, edi
inc rdi
mov rcx, qword [0x7ffbf1d690d0]
mov r8, rcx
xor eax, eax
test rcx, rcx
mov r9, rcx
je 0x7ffbf1d44241
mov rcx, qword [0x7ffbf1d6a520]
imul rcx, rcx, 0x343fd
shl rax, 0x10
shr r9, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
test r9, r9
jne 0x7ffbf1d44212
mov qword [0x7ffbf1d6a520], rcx
xor edx, edx
mov r9d, 0x40
div r8
mov r8d, 0x3000
mov rcx, rdx
mov rdx, rbp
shl rcx, 0x10
add rcx, qword [0x7ffbf1d68290]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x7ffbf1d442a9
and qword [rsp + 0x28], 0
lea r9, [0x7ffbf1d42740]
mov r8d, ebp
mov rcx, rax
and qword [rsp + 0x20], 0
mov rdx, rax
or rcx, 3
call qword [sym.imp.ntdll.dll_RtlInstallFunctionTableCallback]
test al, al
jne 0x7ffbf1d442bd
mov r8d, r15d
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp rdi, 0x11
jb 0x7ffbf1d441f4
xor ebx, ebx
cmp qword [0x7ffbf1d690c8], rbx
ja 0x7ffbf1d442cb
test bl, 3
je 0x7ffbf1d442ed
test rbx, rbx
je 0x7ffbf1d442eb
mov rcx, rbx
or rcx, 3
call qword [sym.imp.ntdll.dll_RtlDeleteFunctionTable]
mov r8d, r15d
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ebx, ebx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [0x7ffbf1ca0000]
test rbx, rbx
je 0x7ffbf1d4413e
mov rdi, rbx
mov rcx, rbp
xor eax, eax
rep stosb byte [rdi], al
mov eax, 0x167fb8a0
mov r9d, r12d
add qword [r13], 9
mov r14d, dword [r14 + 1]
and r14d, 0xfffffff
lea rsi, [0x7ffbf1ca0000]
mov r10d, dword [0x7ffbf1cb6330]
mov qword [rsp + 0x50], r14
sub r10, r14
xor edi, edi
sub r9d, esi
inc r10
mov r8, r10
je 0x7ffbf1d44380
mov rdx, qword [0x7ffbf1d6a520]
imul rdx, rdx, 0x343fd
shl rdi, 0x10
shr r8, 0x10
add rdx, 0x269ec3
mov rcx, rdx
shr rcx, 0x10
movzx eax, cx
or rdi, rax
test r8, r8
jne 0x7ffbf1d44351
mov qword [0x7ffbf1d6a520], rdx
xor edx, edx
mov ecx, r9d
mov rax, rdi
div r10
lea r15, [rdx + rbx]
mov rdx, r14
mov r8, r15
mov qword [rsp + 0x68], r15
mov eax, 0xf16a0f27
xor dl, dl
test r14, r14
je 0x7ffbf1d44609
lea rcx, [rsp + 0x34]
lea rbx, [r14 - 1]
mov eax, dword [r14 + r12]
mov dword [rcx], eax
movzx eax, word [r14 + r12 + 4]
mov word [rcx + 4], ax
mov r8b, byte [rsp + 0x38]
mov al, byte [rsp + 0x36]
mov bpl, byte [rsp + 0x35]
mov sil, byte [rsp + 0x34]
or al, 1
or r8b, 1
mov byte [rsp + 0x32], al
mov al, byte [rsp + 0x39]
mov byte [rsp + 0x30], r8b
or al, 1
mov byte [rsp + 0x31], al
or sil, 1
test rbx, rbx
je 0x7ffbf1d44597
lea r11, [rbx + r12]
mov r14b, byte [rsp + 0x31]
mov r13b, byte [rsp + 0x32]
mov rax, r15
sub rax, r12
mov qword [rsp + 0x58], rax
test bl, 1
mov cl, byte [r11]
movzx r8d, cl
je 0x7ffbf1d444c9
xor cl, byte [rsp + 0x37]
movzx r9d, byte [rsp + 0x37]
and cl, 1
je 0x7ffbf1d44465
mov eax, r9d
movzx edi, r13b
shr eax, 1
shr edi, 1
xor edi, eax
mov eax, r8d
btc eax, 8
sar eax, 1
xor edi, eax
jmp 0x7ffbf1d4446d
mov ecx, dword [0x7ffbf1cb6330]
imul rcx, rdx
lea rbx, [rcx + r11 + 0xae000]
jmp 0x7ffbf1d441e1
mov edi, r8d
xor edi, r9d
shr edi, 1
movzx r10d, byte [r11 - 1]
mov eax, r10d
xor eax, edi
test al, 1
je 0x7ffbf1d444b8
test cl, cl
je 0x7ffbf1d44498
movzx ecx, r13b
btc r8d, 8
shr r9d, 1
shr ecx, 1
sar r8d, 1
xor ecx, r9d
xor ecx, r8d
jmp 0x7ffbf1d444a0
mov ecx, r8d
xor ecx, r9d
shr ecx, 1
movzx eax, r14b
xor r10d, ecx
shr eax, 1
sar r10d, 1
btc eax, 7
xor eax, r10d
jmp 0x7ffbf1d44570
test cl, cl
je 0x7ffbf1d44561
movzx ecx, r13b
jmp 0x7ffbf1d4454c
xor cl, bpl
and cl, 1
movzx r9d, bpl
je 0x7ffbf1d444ef
movzx edi, sil
mov eax, r9d
shr eax, 1
shr edi, 1
xor edi, eax
mov eax, r8d
btc eax, 8
sar eax, 1
xor edi, eax
jmp 0x7ffbf1d444f7
mov edi, r8d
xor edi, r9d
shr edi, 1
movzx r10d, byte [r11 - 1]
mov eax, r10d
xor eax, edi
test al, 1
je 0x7ffbf1d44544
test cl, cl
je 0x7ffbf1d44522
btc r8d, 8
movzx ecx, sil
shr r9d, 1
shr ecx, 1
sar r8d, 1
xor ecx, r9d
xor ecx, r8d
jmp 0x7ffbf1d4452a
mov ecx, r8d
xor ecx, r9d
shr ecx, 1
movzx r8d, byte [rsp + 0x30]
mov eax, r8d
xor r10d, ecx
sar r10d, 1
shr eax, 1
btc eax, 7
xor eax, r10d
jmp 0x7ffbf1d44575
test cl, cl
je 0x7ffbf1d44561
movzx ecx, sil
btc r8d, 8
shr ecx, 1
shr r9d, 1
sar r8d, 1
xor ecx, r9d
xor ecx, r8d
jmp 0x7ffbf1d44569
mov ecx, r8d
xor ecx, r9d
shr ecx, 1
mov eax, r10d
xor eax, ecx
sar eax, 1
mov r8b, byte [rsp + 0x30]
xor dl, al
mov rcx, qword [rsp + 0x58]
mov byte [r11 + rcx], al
dec r11
sub rbx, 1
jne 0x7ffbf1d44415
mov r13, qword [rsp + 0x60]
mov r14, qword [rsp + 0x50]
movzx ecx, byte [r12]
movzx eax, bpl
mov dil, byte [r12]
xor ecx, eax
xor dil, bpl
shr ecx, 1
and dil, 1
je 0x7ffbf1d445bf
movzx eax, sil
btc eax, 8
sar eax, 1
xor eax, ecx
jmp 0x7ffbf1d445c1
mov eax, ecx
test al, 1
je 0x7ffbf1d445e6
test dil, dil
je 0x7ffbf1d445d8
movzx edi, sil
btc edi, 8
sar edi, 1
xor edi, ecx
jmp 0x7ffbf1d445da
mov edi, ecx
movzx eax, r8b
xor eax, edi
btc eax, 8
jmp 0x7ffbf1d445fb
test dil, dil
je 0x7ffbf1d445f9
movzx eax, sil
btc eax, 8
sar eax, 1
xor eax, ecx
jmp 0x7ffbf1d445fb
mov eax, ecx
lea rsi, [0x7ffbf1ca0000]
sar eax, 1
mov byte [r15], al
xor dl, al
cmp dl, byte [r14 + r12 + 6]
je 0x7ffbf1d446d0
call fcn.7ffbf1d47140
and r13, 0xfffffffffffffff8
mov r9d, 0xffff
lea r15, [fcn.7ffbf1cb7480]
mov r10, rax
mov rax, 0xfffffffffffff000
lea r8, [r13 + 0xfff]
mov r11, qword [rsp + 0x48]
mov qword [r11 + 0x10], r15
and r10, rax
and r8, rax
mov rax, qword [0x7ffbf1d6a520]
xor edi, edi
imul rax, rax, 0x343fd
shl rdi, 0x10
shr r9, 0x10
add rax, 0x269ec3
mov rcx, rax
shr rcx, 0x10
movzx edx, cx
or rdi, rdx
test r9, r9
jne 0x7ffbf1d44653
mov qword [0x7ffbf1d6a520], rax
movabs rax, 0x8000800080008001
mul rdi
mov rax, qword [rsp + 0x40]
shr rdx, 0xf
imul rdx, rdx, 0xffff
sub rdi, rdx
inc rdi
mov qword [rax + 0x98], r10
mov qword [rax + 0xb0], rdi
mov qword [rsp + 0x40], r9
jmp 0x7ffbf1d446c6
mov rax, qword [rsp + 0x40]
mov qword [r13], rax
add r13, 8
cmp r13, r8
jb 0x7ffbf1d446b9
jmp 0x7ffbf1d447ef
mov rax, qword [0x7ffbf1cf0238]
mov rbx, r12
sub rbx, r15
sub rsi, rax
jne 0x7ffbf1d446eb
test rbx, rbx
je 0x7ffbf1d447df
mov r11, r15
lea r13, [0x7ffbf1ca0000]
mov rcx, qword [0x7ffbf1cac1e8]
lea r8d, [rcx - 1]
lea rax, [0x7ffbf1ca0000]
sub r11, r12
sub r12d, eax
xor edi, edi
lea ebp, [r12 + r14]
test r8d, r8d
js 0x7ffbf1d44748
lea eax, [rdi + r8]
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
mov r9d, dword [r13 + rdx*4 + 0xc1ec]
and r9d, 0xfffffff
cmp r12d, r9d
jae 0x7ffbf1d4473e
lea r8d, [rax - 1]
jmp 0x7ffbf1d44743
jbe 0x7ffbf1d447a5
lea edi, [rax + 1]
cmp r8d, edi
jge 0x7ffbf1d44718
movsxd r9, edi
mov eax, ecx
cmp r9, rax
jae 0x7ffbf1d447df
lea r15, [0x7ffbf1ca0000]
mov edx, dword [r13 + r9*4 + 0xc1ec]
mov eax, edx
and eax, 0xfffffff
cmp eax, ebp
jae 0x7ffbf1d447da
mov edi, edx
mov r10, rdx
sar edx, 0x1e
shl edi, 2
and r10d, 0xfffffff
and edx, 3
sar edi, 0x1e
add r10, r15
xor r8d, r8d
and edi, 3
sub edi, 1
je 0x7ffbf1d447af
sub edi, 1
je 0x7ffbf1d447aa
cmp edi, 1
jne 0x7ffbf1d447b5
mov r8, rsi
jmp 0x7ffbf1d447b5
movsxd r9, eax
jmp 0x7ffbf1d4474b
mov r8, rbx
jmp 0x7ffbf1d447b5
mov r8, rsi
sub r8, rbx
sub edx, 2
je 0x7ffbf1d447c5
cmp edx, 1
jne 0x7ffbf1d447d0
add qword [r10 + r11], r8
jmp 0x7ffbf1d447c9
add dword [r10 + r11], r8d
mov rcx, qword [0x7ffbf1cac1e8]
mov eax, ecx
inc r9
cmp r9, rax
jb 0x7ffbf1d4475d
mov r15, qword [rsp + 0x68]
mov eax, dword [0x7ffbf1cb6330]
mov eax, 0xcf4bd2aa
mov r11, qword [rsp + 0x48]
mov qword [r11 + 0x10], r15
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.7ffbf1d2cc34
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret