Function at 0x180004f00
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Get system information on windows
Hide thread from debugger
Print debug messages
Read file on windows
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xa50
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x9f0], rax
lea rcx, str.InitPatcher
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBegin]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x8e0]
call sub.VCRUNTIME140.dll_memset
lea rcx, str.VA_X64.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov r8d, 0x104
lea rdx, [rbp + 0x8e0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dl, 1
lea rcx, [rbp + 0x180]
call fcn.180009ae0
xor esi, esi
mov qword [rbp + 0x188], rsi
movabs rcx, 0x3fffffffffffffff
mov qword [rbp + 0x1d8], rcx
mov qword [rbp + 0x1e0], 0x10
mov byte [rbp + 0x1d1], 1
lea rax, [rbp + 0x190]
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x238], rcx
mov qword [rbp + 0x240], 0x10
mov byte [rbp + 0x231], 1
lea rax, [rbp + 0x1f0]
mov qword [rbp + 0x248], rax
lea rcx, [rbp + 0x1f0]
call fcn.18000ae00
nop
lea rax, vtable.CryptoPP::Weak1::MD5.0
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x10], rsi
lea r8, [0x180023db4]
lea rdx, [rbp + 0x8e0]
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov r14d, 1
mov rdi, qword [rbp + 0x10]
test rdi, rdi
je 0x1800050ec
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x4e0]
call sub.VCRUNTIME140.dll_memset
mov r9, rdi
mov r8d, 0x400
mov edx, r14d
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
je 0x1800050a4
nop word [rax + rax]
movsxd r8, eax
lea rdx, [rbp + 0x4e0]
lea rcx, [rbp + 0x180]
call fcn.180017220
mov r9, qword [rbp + 0x10]
mov r8d, 0x400
mov rdx, r14
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
jne 0x180005070
mov rax, qword [rbp + 0x180]
mov rdi, qword [rax + 0x78]
mov rdx, qword [rax + 0x40]
lea rax, [method.CryptoPP::Weak1::MD5.virtual_64]
cmp rdx, rax
jne 0x1800050c6
mov eax, 0x10
jmp 0x1800050cf
lea rcx, [rbp + 0x180]
call rdx
mov r8d, eax
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x180]
call rdi
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], 0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], 0xf
movzx eax, word [0x180023d7c]
mov byte [rbp + 0x18], al
mov byte [rbp + 0x19], 0
mov ecx, 0x20
call fcn.180008610
mov rdi, rax
mov qword [rbp], rax
xor edx, edx
mov rcx, rax
call fcn.180009ae0
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov qword [rdi], rax
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.0
mov qword [rdi + 8], rax
lea rax, [rbp + 0x80]
mov qword [rdi + 0x18], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
mov rdx, rdi
lea rcx, [rbp + 0x3d0]
call fcn.1800040d0
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x1800051dc
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800051d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800051d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000864c
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x18000522a
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005225
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005225
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000864c
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rax, qword [rbp + 0x3d0]
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 0x10
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x3d0]
call qword [rax + 0x30]
mov rax, qword [rbp + 0x3d0]
mov byte [rsp + 0x20], 1
mov r9d, 0xffffffff
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x3d0]
call qword [rax + 0x30]
movabs rax, 0x2b312cc66bc0dac0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x21298af5264e8cf3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x52c15e88a42ab7e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0xccfda493862788b8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs r13, 0xb364b5b893a75627
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs r12, 0x25edddd585fa94a4
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rbx, 0x1d7015f45ff39c83
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
movabs r15, 0x171dbfc1600bb5c0
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
movabs rax, 0x13f71aca911284d5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
movabs rax, 0x89cb96d7c566b1fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x4a0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x4a8], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x480]
vmovdqa ymmword [rbp + 0x140], ymm1
vmovdqa xmm0, xmmword [rbp + 0x160]
vxorps xmm0, xmm0, xmmword [rbp + 0x4a0]
vmovdqa xmmword [rbp + 0x160], xmm0
lea rax, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rax, qword [rbp + 0x80]
lea rdi, [rbp + 0x140]
sub rdi, rax
vzeroupper
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x180005402
inc rax
test ecx, ecx
jne 0x1800053f0
test edx, edx
je 0x180005889
mov ecx, 0x100
call fcn.18000893c
mov rdi, rax
movabs rax, 0x5c5079952a80f5d5
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xa0], rcx
movabs rax, 0x724b9fb51362c6b3
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xa8], rcx
movabs rax, 0x61b23aa4fe7bf7a7
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xb0], rcx
movabs rax, 0xe0a3c2dde414de88
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xd60cd6ccf2f77654
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x76cda4b9ebb5b4d6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x293f70fc8bd1d48c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x757b1274b4af5a0e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x8c64cfac75142545
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xec783280cbdf86b2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x5276ff024ceaa04f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x46f8c32f51dcbac2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x66dca150f2c3014f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x17f828ade7d7cdec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xb6e10306ef71a5c1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0xbba1c60312df56b6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x37af484c4c462b3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0x33d7abd1f68eca70
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0x75f97683887fa606
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0x7d2da727188fd9fe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x4e0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x4e8], rax
movabs rax, 0x13f71aca911284d5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4f0], rax
movabs rax, 0x89cb96d7c566b1fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4f8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x500], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x508], rax
movabs rax, 0x131f048ee4a1a4f9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x510], rax
movabs rax, 0x414d4a2bf5f9012e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x518], rax
movabs rax, 0xfe01998c1978416b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x520], rax
movabs rax, 0xd94a1cb9e5efb788
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x528], rax
movabs rax, 0x7256df2246b7927d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x530], rax
movabs rax, 0x66d8e30f71fc9ae2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x538], rax
movabs rax, 0x46fc8170d2e3216f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x540], rax
movabs rax, 0x37d8088dc7f7edcc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x548], rax
movabs rax, 0x96c12326cf5185e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x550], rax
movabs rax, 0x9b81e62332ff7696
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x558], rax
movabs rax, 0x235ad4a4e4e44293
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x560], rax
movabs rax, 0x47b6fbf1d6aeea50
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x568], rax
movabs rax, 0x449056faca5fce65
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x570], rax
movabs rax, 0x7d2df90746e0b88a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x578], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x4e0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x500]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x520]
vmovdqa ymmword [rbp + 0xe0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x540]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x560]
vmovdqa ymmword [rbp + 0x120], ymm1
lea r8, [rbp + 0xa0]
mov edx, 0x100
mov rcx, rdi
vzeroupper
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x180004430]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x180005cc2
lea rcx, str.VA_X64.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
mov qword [rbp + 0x3a0], rsi
mov qword [rbp + 0x260], 6
mov qword [rbp + 0x270], rsi
mov qword [rbp + 0x278], rsi
mov qword [rbp + 0x280], rsi
mov dword [rbp + 0x288], esi
mov qword [rbp + 0x3b8], rsi
mov qword [rbp + 0x3c0], rsi
mov qword [rbp + 0x250], rsi
mov qword [rbp + 0x258], rax
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x480]
test rax, rax
je 0x180005922
call rax
jmp 0x180005928
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rbp + 0x480]
cmp ax, 9
je 0x18000593b
cmp ax, 6
jne 0x180005942
mov dword [rbp + 0x270], r14d
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000596d
lea rcx, [rbp + 0x4e0]
call rax
mov eax, dword [rbp + 0x4e4]
mov dword [rbp + 0x268], eax
mov eax, dword [rbp + 0x4e8]
mov dword [rbp + 0x26c], eax
lea rdx, [rbp + 0x274]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0x270], 0
je 0x1800059b9
mov eax, dword [rbp + 0x278]
cmp dword [rbp + 0x274], 0
cmovne eax, r14d
mov dword [rbp + 0x278], eax
mov eax, dword [rbp + 0x484]
mov dword [rbp + 0x27c], eax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtSetInformationThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180005a27
xor r9d, r9d
xor r8d, r8d
mov edx, 0x11
mov rcx, 0xfffffffffffffffe
call rdi
mov edx, 0x11
mov rcx, 0xfffffffffffffffe
mov r9d, 8
mov r8d, r9d
call rdi
mov ecx, dword [rbp + 0x254]
test eax, eax
cmove ecx, r14d
mov dword [rbp + 0x254], ecx
lea rcx, [rbp + 0x250]
call fcn.180001910
test eax, eax
je 0x180005a49
lea rcx, str.initialize_error.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x180005c47
lea rcx, [rbp + 0x250]
call fcn.180002030
cmp eax, 1
jne 0x180005a8c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov rdi, rsi
mov r15d, 0xffffffff
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov byte [rbx + rdi], al
inc rdi
cmp rdi, r15
jb 0x180005a71
movabs r15, 0x171dbfc1600bb5c0
lea rdx, [0x180005db0]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x180004950]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movabs rax, 0x18002d740
mov qword [0x18002ddf0], rax
movabs rax, 0x224f35b668d3afbb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x273d87f5403b85e0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x33b55feaa426a493
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xcd88b695fd4689ce
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0xb36485fcb3e11007
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x1d7015f45ff39c83
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
movabs rax, 0x13f71aca911284d5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
movabs rax, 0x89cb96d7c566b1fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x4a0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x4a8], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x480]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqa xmm0, xmmword [rbp + 0x60]
vxorps xmm0, xmm0, xmmword [rbp + 0x4a0]
vmovdqa xmmword [rbp + 0x60], xmm0
lea rdx, [rbp + 0x40]
mov rcx, rbx
vzeroupper
call fcn.1800029c0
mov rdi, rax
test rax, rax
jne 0x180005c04
lea rcx, str._Rs_Find_Error__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rdi - 0x10]
mov qword [0x18002dd50], rcx
mov dword [rbp + 8], esi
lea r9, [rbp + 8]
mov r8d, 0x40
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [0x18002dd50]
mov byte [rcx], 0xcc
lea r9, [rbp + 8]
mov r8d, dword [rbp + 8]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
nop
mov rdx, qword [rbp + 0x280]
test rdx, rdx
je 0x180005c69
mov r9d, 0x8000
xor r8d, r8d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rbp + 0x390]
test rcx, rcx
je 0x180005cc2
mov rdx, qword [rbp + 0x3a0]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005cab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005cab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000864c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
mov qword [rbp + 0x3a0], rsi
lea rcx, [rbp + 0x3d0]
call fcn.180003e20
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x180005d14
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005d0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005d0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000864c
nop
mov rcx, qword [rbp + 0x240]
cmp qword [rbp + 0x238], rcx
cmovb rcx, qword [rbp + 0x238]
lea rax, [rbp + 0x1f0]
mov rdi, qword [rbp + 0x248]
mov byte [rbp + 0x231], 0
cmp rdi, rax
jne 0x180005d48
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, qword [rbp + 0x1e0]
cmp qword [rbp + 0x1d8], rcx
cmovb rcx, qword [rbp + 0x1d8]
lea rax, [rbp + 0x190]
mov rdi, qword [rbp + 0x1e8]
cmp rdi, rax
jne 0x180005d75
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, qword [rbp + 0x9f0]
xor rcx, rsp
call fcn.1800085f0
lea r11, [rsp + 0xa50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret