Function at 0x1400499f0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd0
mov rsi, r9
mov r15, rcx
xor r14d, r14d
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov qword [rbp - 0x41], rax
test eax, eax
jg 0x140049a3d
xor al, al
jmp 0x140049e9a
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov r13, r14
mov qword [rbp + 0x5f], r14
mov qword [rbp - 0x79], r14
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r14
mov rbx, qword [rbp + 0x7f]
mov r10, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140049a6f
mov rdx, qword [rbx]
movabs r9, 0xcbf29ce484222325
mov rcx, r14
test r10, r10
je 0x140049aa3
movabs r8, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r8
inc rcx
cmp rcx, r10
jb 0x140049a90
mov r8, rbx
lea rdx, [rbp - 0x61]
call fcn.1400540b0
cmp qword [rax + 8], 0
je 0x140049b05
mov r8, rbx
lea rdx, [rbp - 0x61]
call fcn.140053880
mov r8, qword [rax]
add r8, 0x30
lea rax, [rsp + 0x38]
cmp rax, r8
je 0x140049af3
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
sub r8, rdx
sar r8, 3
lea rcx, [rsp + 0x38]
call fcn.140053b90
mov r13, qword [rbp - 0x79]
mov qword [rbp + 0x5f], r13
lea rax, [r15 + 8]
mov qword [rbp + 0x57], rax
mov r12, qword [rsp + 0x40]
jmp 0x140049cf3
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rdi, rax
mov rcx, r14
lea r14, [r15 + 8]
mov qword [rbp + 0x57], r14
movabs r15, 0x7fffffffffff
mov r12, qword [rsp + 0x40]
nop dword [rax + rax]
mov r9d, Ordinal_50
lea r8, [rbp - 0x39]
mov rdx, rcx
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x140049ca8
cmp dword [rbp - 0x19], 0x1000
jne 0x140049c97
mov eax, dword [rbp - 0x15]
bt eax, 8
jb 0x140049c97
cmp eax, 1
je 0x140049c97
cmp eax, 0x10
je 0x140049c97
mov rcx, qword [rbp - 0x21]
call fcn.14011f24c
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x21]
mov r8, rbx
mov rdx, qword [rbp - 0x39]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140049c8f
mov r8, rbx
mov rcx, qword [rbp - 0x71]
sub rcx, rdi
lea r9, [rbx + 1]
add r9, rcx
mov qword [rbp - 0x61], r9
lea r13, [rbx - 1]
add r13, rdi
mov r15, r13
lea r14, [rbx - 1]
add r14, qword [rbp - 0x71]
cmp rbx, r9
jae 0x140049c81
test rdi, rdi
je 0x140049c0b
mov rax, rsi
mov rdx, rbx
sub rdx, rsi
movzx ecx, byte [rax]
cmp cl, 0x3f
je 0x140049bfd
cmp cl, byte [rdx + rax]
jne 0x140049c55
inc rax
mov rcx, rax
sub rcx, rsi
cmp rcx, rdi
jb 0x140049bf0
mov rax, rbx
sub rax, r8
add rax, qword [rbp - 0x39]
mov qword [rbp - 0x69], rax
cmp r12, qword [rbp + 0x5f]
je 0x140049c2e
mov qword [r12], rax
add r12, 8
mov qword [rsp + 0x40], r12
jmp 0x140049c55
lea r8, [rbp - 0x69]
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.1400544e0
mov rax, qword [rbp - 0x79]
mov qword [rbp + 0x5f], rax
mov r12, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov r9, qword [rbp - 0x61]
inc rbx
cmp rbx, r14
jb 0x140049c73
add r15, 0x1000
add r14, 0x1000
cmp r15, r13
jae 0x140049c7c
mov rbx, r13
cmp rbx, r9
jb 0x140049be2
mov rbx, qword [rsp + 0x30]
movabs r15, 0x7fffffffffff
mov r14, qword [rbp + 0x57]
mov rcx, rbx
call fcn.14011f194
mov rcx, qword [rbp - 0x21]
add rcx, qword [rbp - 0x39]
cmp rcx, r15
jb 0x140049b30
mov r8, qword [rbp + 0x7f]
lea rdx, [rbp - 0x61]
call fcn.140053880
mov rcx, qword [rax]
add rcx, 0x30
lea rax, [rsp + 0x38]
cmp rcx, rax
je 0x140049ceb
mov r8, r12
mov rsi, qword [rsp + 0x38]
sub r8, rsi
sar r8, 3
mov rdx, rsi
call fcn.140053b90
mov qword [rbp + 0x57], r14
mov r13, qword [rbp + 0x5f]
mov r15, qword [rbp + 0x4f]
jmp 0x140049cf8
mov r13, qword [rbp + 0x5f]
mov r15, qword [rbp + 0x4f]
mov rsi, qword [rsp + 0x38]
lea rdi, [r15 + 0x18]
mov r15, r12
sub r15, rsi
sar r15, 3
mov rax, qword [rdi + 0x10]
sub rax, qword [rdi]
cmp r15, rax
jbe 0x140049d30
movabs rax, 0x7fffffffffffffff
cmp r15, rax
ja 0x140049eb5
mov rdx, r15
mov rcx, rdi
call fcn.140053300
mov rbx, rsi
cmp rsi, r12
je 0x140049d99
mov r14, qword [rbp + 0x4f]
mov r13, qword [rbp + 0x57]
mov qword [rsp + 0x20], 0
mov r9d, 1
lea r8, [r14 + 0x17]
mov rdx, qword [rbx]
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140049d87
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x140049d7b
movzx eax, byte [r14 + 0x17]
mov byte [rdx], al
inc qword [rdi + 8]
jmp 0x140049d87
lea r8, [r14 + 0x17]
mov rcx, rdi
call fcn.140054620
add rbx, 8
cmp rbx, r12
jne 0x140049d40
mov r13, qword [rbp + 0x5f]
cmp rsi, r12
jne 0x140049da0
xor bl, bl
jmp 0x140049e51
xor ebx, ebx
test r15, r15
je 0x140049e4f
movsxd r14, dword [rbp - 0x41]
mov rdi, rsi
mov r12, qword [rbp + 0x57]
nop word [rax + rax]
mov edx, dword [rdi]
lea rcx, [rbp - 0x61]
call fcn.140053540
mov edx, dword [rdi]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r14
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9, r14
mov r8, qword [rbp + 0x6f]
mov rdx, qword [rdi]
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rbp - 0x49]
cmp rdx, 0x10
jb 0x140049e3d
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049e38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049e85
call fcn.14011f194
inc ebx
add rdi, 8
movsxd rax, ebx
cmp rax, r15
jb 0x140049dc0
mov bl, 1
test rsi, rsi
je 0x140049e97
sub r13, rsi
and r13, 0xfffffffffffffff8
mov rax, rsi
cmp r13, 0x1000
jb 0x140049e8c
add r13, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049e8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, r13
mov rcx, rsi
call fcn.14011f194
movzx eax, bl
mov rbx, qword [rsp + 0x128]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140037ae0
nop
int3