Function at 0x500001b80
Capabilities:
Allocate or change rwx memory
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov dword [rsp + 0x30], 0xec8b4855
xor edi, edi
mov dword [rsp + 0x34], 0x55415756
movabs rsi, 0x200000000
mov dword [rsp + 0x38], 0x18ec8348
mov dword [rsp + 0x3c], 0xe04d8948
mov dword [rsp + 0x40], 0xd8558948
mov dword [rsp + 0x44], 0x49f88b49
mov word [rsp + 0x48], 0xf18b
nop
xorps xmm0, xmm0
lea r8, [rbp - 0x20]
mov r9d, 0x30
mov rdx, rdi
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
lea rcx, [r9 - 0x31]
movups xmmword [rbp], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rbx, qword [rbp - 0x20]
mov r11, qword [rbp - 8]
test rbx, rbx
je 0x500001c7f
cmp dword [rbp], 0x1000
jne 0x500001c7f
cmp dword [rbp + 4], 0x40
jne 0x500001c7f
lea r10, [r11 - 0x1a]
xor r8d, r8d
test r10, r10
je 0x500001c7f
lea rax, [rsp + 0x30]
mov r9, rbx
sub r9, rax
nop dword [rax]
xor eax, eax
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x30]
add rcx, rax
lea rdx, [r9 + rcx]
movzx ecx, byte [rcx]
cmp byte [rdx + r8], cl
jne 0x500001c74
cmp rax, 0x19
je 0x500001cad
inc rax
cmp rax, 0x1a
jb 0x500001c50
inc rbx
inc r8
cmp r8, r10
jb 0x500001c40
add rdi, r11
cmp rdi, rsi
jb 0x500001be0
xor r9d, r9d
lea r8, [0x5000063b0]
lea rdx, [0x5000063b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test rbx, rbx
je 0x500001c8b
mov rcx, rbx
cmp byte [rcx], 0x48
jne 0x500001cc6
cmp byte [rcx + 1], 0x8b
jne 0x500001cc6
cmp byte [rcx + 2], 0x87
je 0x500001cd9
inc rcx
mov rax, rcx
sub rax, rbx
cmp rax, 0x200
jb 0x500001cb5
jmp 0x500001cdc
mov rbx, rcx
xor ecx, ecx
mov edx, 0x1000
mov r8d, edx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, qword [0x500008038]
mov r9d, 0xe
mov r8, rax
mov qword [rsp + 0x5a], rcx
mov eax, dword [0x5000081e8]
mov rdx, rbx
mov dword [rsp + 0x53], eax
mov dword [rbp - 0x71], 0x48368b48
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rax
lea rax, [rcx + 0x10]
mov qword [rbp - 0x79], rax
lea rcx, [r9 - 0xf]
mov dword [rbp - 0x61], 0xa
lea rax, [rbx + 0xe]
mov qword [rbp - 0x45], rax
mov dword [rbp - 0x51], 0x48d04589
mov word [rsp + 0x50], 0x8b48
mov byte [rsp + 0x52], 0x87
mov word [rsp + 0x57], 0x4856
mov byte [rsp + 0x59], 0xbe
movaps xmm0, xmmword [rsp + 0x50]
mov dword [rsp + 0x62], 0x48368b48
mov dword [rsp + 0x66], 0x840ff739
mov dword [rsp + 0x6a], 0x3f
mov word [rsp + 0x6e], 0xbe48
mov dword [rsp + 0x78], 0x48368b48
mov dword [rsp + 0x7c], 0xf01fe83
mov dword [rbp - 0x80], 0x2885
mov word [rbp - 0x7c], 0x4800
mov byte [rbp - 0x7a], 0xbe
mov dword [rbp - 0x6d], 0x840fc639
mov dword [rbp - 0x69], 8
mov dword [rbp - 0x65], 0xe9c68b48
mov qword [rbp - 0x5d], 0x100b848
mov dword [rbp - 0x55], 0x485e0000
mov qword [rbp - 0x4d], 0x25ffce8b
movups xmmword [r8], xmm0
mov qword [rsp + 0x20], 0
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [r8 + 0x10], xmm1
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [r8 + 0x20], xmm0
movaps xmm1, xmmword [rbp - 0x80]
movups xmmword [r8 + 0x30], xmm1
movaps xmm0, xmmword [rbp - 0x70]
movups xmmword [r8 + 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x60]
movups xmmword [r8 + 0x50], xmm1
movaps xmm0, xmmword [rbp - 0x50]
movups xmmword [r8 + 0x60], xmm0
movzx eax, word [rbp - 0x40]
mov word [r8 + 0x70], ax
movzx eax, byte [rbp - 0x3e]
mov byte [r8 + 0x72], al
mov qword [rbp - 0x2a], r8
lea r8, [rbp - 0x30]
mov dword [rbp - 0x30], 0x25ff
mov word [rbp - 0x2c], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret