Function at 0x140018e70
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
mov edi, r8d
mov r13, rdx
mov rsi, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x100], rax
test r8d, r8d
jne 0x140018ea6
mov edi, dword [rsi + 0x10]
test edi, edi
je 0x14001916f
test r9b, r9b
jne 0x14001917a
xor r12d, r12d
mov ebx, edi
mov rax, qword [rsi]
add r12, qword [rax + 0x40]
mov r14, qword [rax]
lea r15, [rsp + 0x98]
mov qword [r15 - 0x38], r14
mov qword [r15 - 0x30], r12
mov qword [r15 - 0x28], rbx
xor eax, eax
mov qword [r15 - 0x20], rax
mov qword [r15 - 0x10], rax
mov qword [r15 - 8], 0x20
mov qword [r15 - 0x18], r15
mov byte [r15 + 0x20], 1
mov qword [r15 + 0x28], r14
mov qword [r15 + 0x38], rax
mov qword [r15 + 0x40], 2
lea rax, [rsp + 0xe0]
mov qword [rax - 0x18], rax
mov eax, dword [0x14005fd2c]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001912e
mov edi, dword [0x14005fd28]
lea rax, [rbx + r12]
dec rax
xor edx, edx
div rdi
mov rbx, rax
mov rax, r12
xor edx, edx
div rdi
sub rbx, rax
inc rbx
je 0x140018fd6
mov rsi, rax
imul rsi, rdi
xor r12d, r12d
mov rcx, qword [r14]
test rcx, rcx
je 0x14001921d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov r8, rdi
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140019215
mov ebp, dword [rsp + 0x30]
mov rax, qword [rsp + 0xd0]
cmp rax, qword [rsp + 0xd8]
je 0x140019293
mov rcx, qword [rsp + 0xc8]
shl rax, 4
mov dword [rcx + rax], ebp
mov qword [rcx + rax + 8], rsi
inc qword [rsp + 0xd0]
inc r12
add rsi, rdi
cmp r12, rbx
jne 0x140018f65
mov rax, qword [rsp + 0x60]
mov qword [r13], rax
mov rax, qword [rsp + 0x68]
mov qword [r13 + 8], rax
mov rax, qword [rsp + 0x70]
mov qword [r13 + 0x10], rax
mov eax, dword [rsp + 0x78]
mov dword [r13 + 0x18], eax
mov eax, dword [rsp + 0x7c]
mov dword [r13 + 0x1c], eax
mov rax, qword [rsp + 0x88]
mov qword [r13 + 0x28], rax
mov rcx, qword [rsp + 0x90]
mov qword [r13 + 0x30], rcx
mov rcx, qword [rsp + 0x80]
cmp rcx, r15
jne 0x14001922f
lea rcx, [r13 + 0x38]
mov qword [r13 + 0x20], rcx
test rax, rax
lea rsi, [rsp + 0xe0]
jg 0x1400192ba
mov al, byte [rsp + 0xb8]
mov byte [r13 + 0x58], al
mov rax, qword [rsp + 0xc0]
mov qword [r13 + 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [r13 + 0x70], rax
mov rcx, qword [rsp + 0xd8]
mov qword [r13 + 0x78], rcx
mov rcx, qword [rsp + 0xc8]
cmp rcx, rsi
jne 0x140019260
lea rdx, [r13 + 0x80]
mov qword [r13 + 0x68], rdx
test rax, rax
jle 0x1400190c4
shl rax, 4
add rax, rcx
xor edx, edx
lea rbp, [rcx + rdx]
add rbp, 0x10
mov ebx, dword [rbp - 0x10]
mov dword [r13 + rdx + 0x80], ebx
mov rbx, qword [rbp - 8]
mov qword [r13 + rdx + 0x88], rbx
add rdx, 0x10
cmp rbp, rax
jb 0x14001909c
mov qword [rsp + 0xd0], 0
mov byte [rsp + 0xb8], 0
lea rcx, [rsp + 0xc0]
call fcn.140018880
mov rcx, qword [rsp + 0xc8]
cmp rcx, rsi
jne 0x14001927d
mov rcx, qword [rsp + 0x80]
cmp rcx, r15
jne 0x140019288
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140027a90
mov rax, r13
add rsp, 0x108
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x14005fd2c]
call fcn.14002687c
cmp dword [0x14005fd2c], 0xffffffff
jne 0x140018f36
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov dword [0x14005fd28], eax
lea rcx, [0x14005fd2c]
call fcn.14002681c
jmp 0x140018f36
int3
mov rbp, qword [rsi]
mov rcx, qword [rbp]
mov rbx, qword [rbp + 0x40]
movsx r12, r9b
lea r14, [rbx + r12]
call fcn.140020d40
mov ecx, eax
mov rax, rbx
xor edx, edx
div rcx
mov rbx, rax
mov rax, r14
xor edx, edx
div rcx
cmp rbx, rax
je 0x140018eba
mov rcx, qword [rbp]
mov rdx, r14
call fcn.1400303c0
test al, al
jne 0x140018eba
mov rax, qword [rsi]
mov rax, qword [rax]
mov qword [r13], rax
xor ecx, ecx
mov qword [r13 + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [r13 + 8], xmm0
mov qword [r13 + 0x18], rcx
mov qword [r13 + 0x30], 0x20
lea rdx, [r13 + 0x38]
mov qword [r13 + 0x20], rdx
mov byte [r13 + 0x58], 0
mov qword [r13 + 0x60], rax
mov qword [r13 + 0x70], rcx
mov qword [r13 + 0x78], 2
lea rax, [r13 + 0x80]
mov qword [r13 + 0x68], rax
jmp 0x140019107
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0xc0]
call fcn.140018880
jmp 0x140018fd6
mov qword [r13 + 0x20], rcx
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x90], 0x20
mov qword [rsp + 0x88], 0
lea rsi, [rsp + 0xe0]
jmp 0x140019043
mov qword [r13 + 0x68], rcx
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd8], 2
jmp 0x1400190c4
call qword [sym.imp.mozglue.dll_free]
jmp 0x1400190f6
call qword [sym.imp.mozglue.dll_free]
jmp 0x140019107
mov edx, 1
lea rcx, [rsp + 0xc8]
call fcn.140030dc0
test al, al
je 0x14001921d
mov rax, qword [rsp + 0xd0]
jmp 0x140018faf
lea rdx, [rsp + 0x60]
add rax, rdx
add rax, 0x38
lea r8, [rsp + 0x99]
cmp rax, r8
cmova r8, rax
sub r8, rdx
add r8, 0xffffffffffffffc8
mov rdx, r15
call sub.ntdll.dll_memcpy
jmp 0x140019043