Function at 0x7ffbf1d29d78
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x7ffbf1d68270]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor esi, esi
mov r15, rcx
mov qword [rsp + 0x90], rcx
mov ecx, esi
mov dword [rsp + 0x28], ecx
cmp dword [r15 + 0xc], esi
jne 0x7ffbf1d2a56d
mov r14d, dword [r15]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
sub r14d, 1
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x58], r14d
movsxd rax, r14d
mov dword [rsp + 0x48], esi
js 0x7ffbf1d2a56d
add rax, rax
lea r13, [0x7ffbf1ca0000]
lea r12, [r15 + rax*8 + 0x24]
mov qword [rsp + 0x78], r12
mov ebp, dword [r12 - 8]
mov edi, dword [r12 - 0xc]
movsxd rax, r14d
add rax, rax
and ebp, 0xfffffff
and edi, 0xfffffff
lea rcx, [r15 + rax*8 + 0x18]
add rbp, r13
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x88], rbp
mov eax, 0xf1b13d1a
mov r13, qword [rsp + 0x30]
cmp rbp, r13
jb 0x7ffbf1d29e5a
mov rdx, qword [rsp + 0x38]
lea rax, [rdi + rbp]
add rdx, r13
cmp rax, rdx
jbe 0x7ffbf1d29f01
cmp dword [rsp + 0x48], esi
je 0x7ffbf1d29e7c
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x48], esi
cmp dword [rsp + 0x44], esi
je 0x7ffbf1d29e93
lea rcx, [0x7ffbf1d69020]
mov dword [rsp + 0x44], esi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rax, [rdi + rbp + 0xfff]
mov rcx, rbp
mov dword [rsp + 0x40], esi
and rcx, 0xfffffffffffff000
and rax, 0xfffffffffffff000
sub rax, rcx
mov qword [rsp + 0x30], rcx
lea rcx, [0x7ffbf1d69020]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov dword [rsp + 0x44], 1
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r13, qword [rsp + 0x30]
cmp eax, esi
je 0x7ffbf1d2a528
mov dword [rsp + 0x48], 1
cmp rbp, rsi
je 0x7ffbf1d2a528
test byte [r12], 1
je 0x7ffbf1d2a4f1
mov r10d, dword [r12 - 8]
mov rdx, qword [r15 + 0x10]
mov r9, rdi
and r10d, 0xfffffff
mov rbx, rbp
and r9d, 7
mov al, sil
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x50], rbx
je 0x7ffbf1d2a44c
xor r11d, r11d
xor ecx, ecx
mov esi, r10d
and dword [rsp + 0x24], r11d
not esi
mov dword [rsp + 0x2c], r11d
mov dword [rsp + 0x20], ecx
test r9d, r9d
jle 0x7ffbf1d29fb9
mov r14d, dword [rsp + 0x24]
lea edi, [rcx + 0x38]
cmp ecx, 4
movzx r8d, byte [rbx]
jge 0x7ffbf1d29f88
lea ecx, [rdi - 0x20]
shl r8d, cl
or r14d, r8d
jmp 0x7ffbf1d29f90
mov ecx, edi
shl r8d, cl
or r11d, r8d
mov ecx, dword [rsp + 0x20]
inc rbx
sub edi, 8
inc ecx
cmp ecx, r9d
mov dword [rsp + 0x20], ecx
jl 0x7ffbf1d29f74
mov dword [rsp + 0x24], r14d
mov r14d, dword [rsp + 0x58]
mov dword [rsp + 0x2c], r11d
mov qword [rsp + 0x50], rbx
mov r9d, dword [rsp + 0x9c]
movzx ebx, word [rsp + 0x9a]
movzx r11d, word [rsp + 0x9e]
mov edi, dword [rsp + 0x9c]
mov ecx, edx
mov r8d, edx
xor ecx, esi
sub edi, ecx
xor edi, r10d
movzx r10d, dx
sub r8d, edi
mov ecx, edi
ror r8d, 9
imul r8d, r11d
rol ecx, 8
add r8d, ecx
mov ecx, r9d
xor ecx, edx
xor esi, r8d
mov r8d, r9d
xor ecx, esi
xor edi, ecx
sub r8d, edi
mov ecx, edi
ror r8d, 0xd
imul r8d, ebx
ror ecx, 4
xor r8d, ecx
xor esi, r8d
mov r8d, esi
mov ecx, esi
sub r8d, r9d
movzx r9d, r9w
ror r8d, 3
imul r8d, r10d
ror ecx, 5
sub r8d, ecx
xor edi, r8d
mov r8d, r9d
xor r8d, edi
mov ecx, edi
shr ecx, 1
imul r8d, r11d
xor r8d, ecx
mov ecx, r10d
xor esi, r8d
xor ecx, esi
mov r8d, esi
ror r8d, 3
imul ecx, r9d
sub ecx, r8d
mov r8d, dword [rsp + 0x9c]
xor edi, ecx
xor r8d, edi
mov ecx, edi
shr ecx, 0xc
rol r8d, 1
imul r8d, ebx
sub r8d, ecx
xor esi, r8d
mov ecx, esi
sub ecx, r10d
xor ecx, dword [rsp + 0x9c]
xor edi, ecx
mov ecx, edi
not ecx
ror ecx, 2
add ecx, r11d
imul ecx, ebx
xor esi, ecx
mov ecx, esi
sub ecx, edx
sub ecx, r9d
xor edi, ecx
xor r9d, edi
mov ecx, edi
ror ecx, 9
imul r9d, ebx
add ecx, r9d
xor esi, ecx
mov ecx, esi
xor esi, dword [rsp + 0x2c]
ror ecx, 8
xor ecx, r10d
xor r10d, r10d
mov r9d, esi
imul ecx, ebx
xor ecx, dword [rsp + 0x24]
xor edi, ecx
mov rcx, qword [rsp + 0x68]
mov r8d, edi
test ecx, ecx
jle 0x7ffbf1d2a11b
mov r13, rbp
cmp r10d, 4
jge 0x7ffbf1d2a0fb
rol r8d, 8
mov byte [r13], r8b
inc r13
xor al, r8b
jmp 0x7ffbf1d2a109
rol r9d, 8
mov byte [r13], r9b
inc r13
xor al, r9b
inc r10d
cmp r10d, ecx
jl 0x7ffbf1d2a0e5
mov qword [rsp + 0x60], r13
mov r13, qword [rsp + 0x30]
lea r8d, [rcx - 4]
test r8d, r8d
jle 0x7ffbf1d2a42e
mov ecx, 4
sub ecx, r8d
shl ecx, 3
shr esi, cl
shl esi, cl
mov rbx, qword [rsp + 0x50]
mov r11, qword [rsp + 0x70]
mov rcx, r11
shr rcx, 3
mov qword [rsp + 0x80], rcx
test rcx, rcx
je 0x7ffbf1d2a3b1
mov ecx, dword [rsp + 0x9c]
mov r13, qword [rsp + 0x60]
mov r11d, dword [rsp + 0x2c]
mov r15, qword [rsp + 0x80]
mov r14d, dword [rsp + 0x24]
movzx ebp, word [rsp + 0x9a]
xor ecx, edx
mov dword [rsp + 0x68], ecx
movzx ecx, word [rsp + 0x9c]
mov r12d, dword [rsp + 0x68]
mov dword [rsp + 0x50], ecx
movzx ecx, dx
mov dword [rsp + 0x20], ecx
movzx ecx, byte [rbx + 1]
movzx r10d, byte [rbx]
movzx r9d, byte [rbx + 4]
mov r8d, dword [rsp + 0x9c]
shl r10d, 8
shl r9d, 8
or r10d, ecx
movzx ecx, byte [rbx + 2]
add rbx, 8
shl r10d, 8
or r10d, ecx
movzx ecx, byte [rbx - 5]
shl r10d, 8
or r10d, ecx
movzx ecx, byte [rbx - 3]
or r9d, ecx
movzx ecx, byte [rbx - 2]
shl r9d, 8
or r9d, ecx
movzx ecx, byte [rbx - 1]
shl r9d, 8
or r9d, ecx
mov ecx, edx
xor esi, r9d
xor ecx, esi
sub r8d, ecx
movzx ecx, word [rsp + 0x9e]
xor r8d, r10d
xor edi, r8d
mov r8d, edx
sub r8d, edi
ror r8d, 9
imul r8d, ecx
mov ecx, edi
rol ecx, 8
add r8d, ecx
mov ecx, r12d
xor esi, r8d
mov r8d, dword [rsp + 0x9c]
xor ecx, esi
xor edi, ecx
sub r8d, edi
mov ecx, edi
ror r8d, 0xd
imul r8d, ebp
ror ecx, 4
xor r8d, ecx
xor esi, r8d
mov r8d, esi
mov ecx, esi
sub r8d, dword [rsp + 0x9c]
ror r8d, 3
imul r8d, dword [rsp + 0x20]
ror ecx, 5
sub r8d, ecx
movzx ecx, word [rsp + 0x9e]
xor edi, r8d
movzx r8d, word [rsp + 0x9c]
xor r8d, edi
imul r8d, ecx
mov ecx, edi
shr ecx, 1
xor r8d, ecx
mov ecx, dword [rsp + 0x20]
xor esi, r8d
xor ecx, esi
mov r8d, esi
ror r8d, 3
imul ecx, dword [rsp + 0x50]
sub ecx, r8d
mov r8d, dword [rsp + 0x9c]
xor edi, ecx
xor r8d, edi
mov ecx, edi
rol r8d, 1
shr ecx, 0xc
imul r8d, ebp
sub r8d, ecx
xor esi, r8d
mov ecx, esi
sub ecx, dword [rsp + 0x20]
xor ecx, dword [rsp + 0x9c]
movzx r8d, word [rsp + 0x9e]
xor edi, ecx
mov ecx, edi
not ecx
ror ecx, 2
add ecx, r8d
movzx r8d, word [rsp + 0x9c]
imul ecx, ebp
xor esi, ecx
mov ecx, esi
sub ecx, edx
sub ecx, r8d
xor edi, ecx
movzx ecx, word [rsp + 0x9c]
xor ecx, edi
mov r8d, edi
ror r8d, 9
imul ecx, ebp
add r8d, ecx
xor esi, r8d
mov ecx, esi
xor esi, r11d
mov r11d, r9d
ror ecx, 8
mov byte [r13 + 7], sil
xor ecx, dword [rsp + 0x20]
imul ecx, ebp
xor ecx, r14d
mov r14d, r10d
xor edi, ecx
xor al, dil
mov byte [r13 + 3], dil
ror edi, 8
xor al, sil
ror esi, 8
mov byte [r13 + 2], dil
xor al, dil
ror edi, 8
mov byte [r13 + 6], sil
xor al, sil
ror esi, 8
mov byte [r13 + 1], dil
xor al, dil
ror edi, 8
mov byte [r13 + 5], sil
xor al, sil
ror esi, 8
mov byte [r13], dil
mov cl, sil
mov byte [r13 + 4], sil
add r13, 8
xor cl, dil
xor al, cl
ror edi, 8
ror esi, 8
sub r15, 1
jne 0x7ffbf1d2a19d
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x30]
mov r14d, dword [rsp + 0x58]
mov r15, qword [rsp + 0x90]
mov r11, qword [rsp + 0x70]
and dword [r12], 0xfffffffe
xor esi, esi
cmp al, byte [r12 - 4]
jne 0x7ffbf1d2a51e
bt dword [r12 - 0xc], 0x1c
lea r13, [0x7ffbf1ca0000]
jb 0x7ffbf1d2a4f8
mov rax, qword [0x7ffbf1cf0238]
mov rbx, r13
sub rbx, rax
je 0x7ffbf1d2a4e8
mov rcx, qword [0x7ffbf1cac1e8]
sub ebp, r13d
mov r8d, esi
lea r9d, [rcx - 1]
lea edi, [r11 + rbp]
lea r11, [0x7ffbf1cac1e8]
cmp r9d, esi
jl 0x7ffbf1d2a46c
lea eax, [r9 + r8]
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
mov r10d, dword [r11 + rdx*4 + 4]
and r10d, 0xfffffff
cmp ebp, r10d
jae 0x7ffbf1d2a461
lea r9d, [rax - 1]
jmp 0x7ffbf1d2a467
xor esi, esi
test r8d, r8d
jns 0x7ffbf1d2a137
neg r8d
shl r8d, 3
mov ecx, r8d
shr edi, cl
shl edi, cl
jmp 0x7ffbf1d2a137
mov ecx, r10d
mov dword [rsp + 0x24], r10d
xor edi, edi
not ecx
mov dword [rsp + 0x2c], ecx
jmp 0x7ffbf1d2a13c
jbe 0x7ffbf1d2a471
lea r8d, [rax + 1]
cmp r9d, r8d
jge 0x7ffbf1d2a40b
movsxd r10, r8d
jmp 0x7ffbf1d2a4e1
movsxd r10, eax
jmp 0x7ffbf1d2a4e1
mov edx, dword [r11 + r10*4 + 4]
mov eax, edx
and eax, 0xfffffff
cmp eax, edi
jae 0x7ffbf1d2a4e8
mov r9, rdx
mov r8d, edx
shl edx, 2
sar edx, 0x1e
and r9d, 0xfffffff
sar r8d, 0x1e
and edx, 3
add r9, r13
and r8d, 3
sub edx, 1
mov r11, rsi
je 0x7ffbf1d2a4b9
sub edx, 1
je 0x7ffbf1d2a4bc
cmp edx, 1
jne 0x7ffbf1d2a4bc
mov r11, rbx
sub r8d, 2
je 0x7ffbf1d2a4cd
cmp r8d, 1
jne 0x7ffbf1d2a4d7
add qword [r9], r11
jmp 0x7ffbf1d2a4d0
add dword [r9], r11d
mov rcx, qword [0x7ffbf1cac1e8]
inc r10
lea r11, [0x7ffbf1cac1e8]
mov eax, ecx
cmp r10, rax
jb 0x7ffbf1d2a476
bts dword [r12 - 0xc], 0x1c
jmp 0x7ffbf1d2a4f8
lea r13, [0x7ffbf1ca0000]
mov eax, 0x9e33b083
dec r14d
sub r12, 0x10
cmp r14d, esi
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x78], r12
jge 0x7ffbf1d29e05
mov r13, qword [rsp + 0x30]
jmp 0x7ffbf1d2a530
mov dword [rsp + 0x28], 0x80004005
jmp 0x7ffbf1d2a530
mov dword [rsp + 0x28], 0x8007000e
cmp dword [rsp + 0x48], esi
je 0x7ffbf1d2a552
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x48], esi
cmp dword [rsp + 0x44], esi
je 0x7ffbf1d2a569
lea rcx, [0x7ffbf1d69020]
mov dword [rsp + 0x44], esi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [rsp + 0x28]
inc dword [r15 + 0xc]
mov eax, ecx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.7ffbf1d2cc34
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret