Function at 0x180002f80
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push rbp
push rsi
push r14
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xc8
mov rax, qword [0x1800810c0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rax, qword [rdx + 8]
mov rsi, r9
mov r10, r8
mov qword [rbp - 0x69], r8
mov r14, rdx
mov r15, rcx
cmp qword [rdx], rax
jne 0x180002ff1
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, r10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x180002fe3
mov qword [r15], rax
mov byte [r15 + 8], 1
jmp 0x180003308
mov byte [r15], 0
mov byte [r15 + 8], 0
jmp 0x180003308
xorps xmm0, xmm0
mov qword [rsp + 0x108], rbx
mov qword [rsp + 0xc0], rdi
lea rcx, [rbp - 0x29]
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0xb0], r13
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [r14]
mov rdx, qword [rbp - 0x21]
mov r8, qword [rbp - 0x19]
mov rbx, r8
mov rcx, qword [rax]
mov rax, rcx
mov r12, rcx
sub rax, rdx
sub r12, rsi
cmp rax, rsi
mov rax, r8
cmovbe r12, rdx
sub rax, rcx
cmp rax, rsi
jbe 0x18000305d
lea rbx, [rcx + rsi]
mov eax, dword [rbp - 1]
cmp r12, rdx
cmovb r12, rdx
cmp r8, rbx
cmovb rbx, r8
lea r13, [rax - 1]
mov qword [rbp - 0x61], rbx
not r13
lea rbx, [rax - 1]
add rbx, rcx
and rbx, r13
mov rdi, rbx
cmp rbx, r12
jbe 0x1800031b9
mov qword [rbp + 7], rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r14 + 8]
mov r8, qword [r14]
mov qword [rbp + 0xf], rdi
cmp r8, r9
je 0x1800030d8
mov rdx, qword [r8]
mov rax, rdi
sub rax, rdx
mov rcx, rdx
sub rcx, rdi
cmp rdi, rdx
cmovbe rax, rcx
cmp rax, rsi
ja 0x1800031b9
add r8, 8
cmp r8, r9
jne 0x1800030b0
xorps xmm0, xmm0
lea rdx, [rbp - 0x59]
mov r8d, 0x30
mov rcx, rdi
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800031b9
mov ecx, dword [rbp - 0x35]
mov eax, ecx
and al, 0x70
neg al
sbb dl, dl
and dl, 4
test cl, 0x66
setne al
and cl, 0x44
or dl, al
neg cl
sbb al, al
and al, 2
or dl, al
cmp dword [rbp - 0x39], 0x10000
mov byte [rbp - 0x19], dl
sete byte [rbp - 0x18]
mov rax, qword [rbp - 0x19]
shr rax, 8
test al, al
je 0x1800031a6
mov r9, qword [r14 + 8]
mov rcx, qword [r14]
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], rdi
cmp rcx, r9
je 0x180003184
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rcx]
mov rax, rdi
sub rax, r8
mov rdx, r8
sub rdx, rdi
cmp rdi, r8
cmovbe rax, rdx
cmp rax, rsi
ja 0x1800031a6
add rcx, 8
cmp rcx, r9
jne 0x180003160
mov rdx, qword [rbp - 0x69]
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180003325
mov rdi, qword [rbp - 0x51]
dec rdi
and rdi, r13
cmp rdi, r12
ja 0x1800030a0
mov rdi, qword [rbp - 0x61]
cmp rbx, rdi
jae 0x1800032df
mov qword [rbp + 0x17], rsi
nop word [rax + rax]
mov r9, qword [r14 + 8]
mov r8, qword [r14]
mov qword [rbp + 0xf], rbx
cmp r8, r9
je 0x180003208
mov rdx, qword [r8]
mov rax, rbx
sub rax, rdx
mov rcx, rdx
sub rcx, rbx
cmp rbx, rdx
cmovbe rax, rcx
cmp rax, rsi
ja 0x1800032df
add r8, 8
cmp r8, r9
jne 0x1800031e0
xorps xmm0, xmm0
lea rdx, [rbp - 0x59]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800032df
mov ecx, dword [rbp - 0x35]
mov eax, ecx
and al, 0x70
neg al
sbb dl, dl
and dl, 4
test cl, 0x66
setne al
and cl, 0x44
or dl, al
neg cl
sbb al, al
and al, 2
or dl, al
cmp dword [rbp - 0x39], 0x10000
mov byte [rbp - 0x19], dl
sete byte [rbp - 0x18]
mov rax, qword [rbp - 0x19]
shr rax, 8
test al, al
je 0x1800032d2
mov r9, qword [r14 + 8]
mov r8, qword [r14]
mov qword [rbp + 0xf], rsi
mov qword [rbp + 7], rbx
cmp r8, r9
je 0x1800032b4
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [r8]
mov rax, rbx
sub rax, rdx
mov rcx, rdx
sub rcx, rbx
cmp rbx, rdx
cmovbe rax, rcx
cmp rax, rsi
ja 0x1800032d2
add r8, 8
cmp r8, r9
jne 0x180003290
mov rdx, qword [rbp - 0x69]
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180003325
add rbx, qword [rbp - 0x41]
cmp rbx, rdi
jb 0x1800031d0
mov byte [r15], 1
mov byte [r15 + 8], 0
mov r12, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x108]
mov r13, qword [rsp + 0xb0]
mov rax, r15
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.18000a0a0
add rsp, 0xc8
pop r15
pop r14
pop rsi
pop rbp
ret
mov qword [r15], rax
mov byte [r15 + 8], 1
jmp 0x1800032e8