Function at 0x180019a1c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1d8
mov rdi, rcx
mov rax, qword [0x180044008]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
lea rsi, [rsp + 0x170]
mov qword [rsp + 0x120], rsi
mov rax, qword [rsp + 0x120]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x128], rcx
mov qword [rsp + 0x90], rdi
mov eax, 0x9bacb044
mov qword [rsp + 0xd8], rdi
cmp eax, 0xfcd70474
jg 0x180019ae0
cmp eax, 0xbfd99599
jg 0x180019b53
cmp eax, 0x97c97e34
jle 0x180019c27
cmp eax, 0x9bacb043
jg 0x180019dc7
cmp eax, 0x97c97e35
je 0x180019ee3
cmp eax, 0x9927131c
jne 0x180019a92
mov eax, 0xa38120b4
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x78], rcx
jmp 0x180019a92
cmp eax, 0x4079a5b3
jg 0x180019bcc
cmp eax, 0x12d7fd97
jle 0x180019c97
cmp eax, 0x2f38001f
jg 0x180019e34
cmp eax, 0x12d7fd98
je 0x180019f08
cmp eax, 0x259d0256
jne 0x180019a92
mov rax, qword [rsp + 0x90]
mov rcx, 0xffffffffc0000000
add rax, rcx
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x88]
cmp rax, qword [rsp + 0x130]
mov eax, 0xa38120b4
mov ecx, 0x9927131c
cmovb eax, ecx
jmp 0x18001a58e
cmp eax, 0xef35e7dd
jle 0x180019d05
cmp eax, 0xf73c7369
jg 0x180019e61
cmp eax, 0xef35e7de
je 0x18001a1c6
cmp eax, 0xf22113a3
jne 0x180019a92
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
mov eax, 0x533a8a6d
mov ecx, 0xbfd9959a
cmovb eax, ecx
mov rsi, qword [rsp + 0x160]
jmp 0x180019a92
cmp eax, 0x533a8a6c
jle 0x180019d73
cmp eax, 0x77069b5a
jg 0x180019e91
cmp eax, 0x533a8a6d
je 0x18001a1e2
cmp eax, 0x6f6bbcb6
jne 0x180019a92
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
cmp rax, qword [rsp + 0xb8]
mov eax, 0xc13ac088
mov ecx, 0x1d3c291
cmovb eax, ecx
jmp 0x180019a92
cmp eax, 0x823372db
je 0x18001a446
cmp eax, 0x88439742
je 0x18001a46b
cmp eax, 0x90569e50
jne 0x180019a92
mov rcx, qword [rsp + 0xa0]
mov edx, 0x1000
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
mov eax, 0x4fbf5e34
mov ecx, 0xe4cb2fb9
cmove eax, ecx
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0xe8], rcx
mov qword [rsp + 0xe0], rbx
jmp 0x180019a92
cmp eax, 0xfcd70475
je 0x18001a48d
cmp eax, 0x1d3c291
je 0x18001a4a4
cmp eax, 0x512790e
jne 0x180019a92
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x118]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb0]
mov qword [rax], rcx
add rcx, 0x40
mov qword [rsp + 0x118], rcx
mov rax, rcx
sub rax, qword [rsp + 0x30]
cmp rax, 0xfc1
mov eax, 0x2f380020
mov ecx, 0x512790e
cmovb eax, ecx
jmp 0x180019a92
cmp eax, 0xbfd9959a
je 0x18001a4be
cmp eax, 0xc13ac088
je 0x18001a4d0
cmp eax, 0xe4cb2fb9
jne 0x180019a92
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x148]
mov rcx, qword [rsp + 0xb8]
cmp rcx, rax
mov eax, 0x12d7fd98
mov ecx, 0x4fbf5e34
cmova eax, ecx
mov rbx, qword [rsp + 0x150]
jmp 0x180019a92
cmp eax, 0x4079a5b4
je 0x18001a4f5
cmp eax, 0x4929edf1
je 0x18001a544
cmp eax, 0x4fbf5e34
jne 0x180019a92
mov qword [rsp + 0xc0], rbx
cmp qword [rsp + 0xc0], 0
mov eax, 0x97c97e35
mov ecx, 0x88439742
cmove eax, ecx
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x110], rcx
jmp 0x180019a92
cmp eax, 0x9bacb044
je 0x18001a573
cmp eax, 0xa38120b4
jne 0x180019a92
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x90]
mov ecx, 0x40000000
add rax, rcx
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x128]
cmp rax, qword [rsp + 0x138]
mov eax, 0x4929edf1
mov ecx, 0xf90ab8fe
cmova eax, ecx
mov rcx, qword [rsp + 0x128]
mov qword [rsp + 0x100], rcx
jmp 0x180019a92
cmp eax, 0x2f380020
je 0x18001a5a0
cmp eax, 0x3125d2bb
jne 0x180019a92
mov eax, 0x78a1ecad
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0xd0], rcx
jmp 0x180019a92
cmp eax, 0xf73c736a
je 0x18001a5c5
cmp eax, 0xf90ab8fe
jne 0x180019a92
mov eax, 0x4929edf1
mov rcx, qword [rsp + 0x138]
mov qword [rsp + 0x100], rcx
jmp 0x180019a92
cmp eax, 0x77069b5b
jne 0x18001a5e4
mov rax, qword [rsp + 0x30]
add rax, 0x40
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rax], 0
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x10], 0
mov eax, 0x512790e
jmp 0x180019a92
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
mov eax, 0x77069b5b
mov ecx, 0xfcd70475
cmove eax, ecx
jmp 0x180019a92
mov rdi, rsi
mov eax, dword [rsp + 0x198]
mov rbx, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0x148]
mov qword [rsp + 0x38], rax
mov rax, rsi
xor edx, edx
div qword [rsp + 0x38]
sub rsi, rdx
sub rsi, qword [rsp + 0x38]
mov ecx, 0x7cc7eacb
cmp ecx, 0x4a0f57b8
jg 0x180019f8b
cmp ecx, 0xead74da4
jle 0x180019fd2
cmp ecx, 0x2b5b96d4
jg 0x18001a050
cmp ecx, 0xead74da5
je 0x18001a0b2
cmp ecx, 0xf938382e
jne 0x180019f3e
cmp dword [rsp + 0x1c0], 0x10000
mov ecx, 0x5d6173f9
je 0x180019f3e
mov ecx, 0xead74da5
jmp 0x180019f3e
cmp ecx, 0x5bf9670a
jg 0x18001a005
cmp ecx, 0x530ee5c1
jle 0x18001a08a
cmp ecx, 0x530ee5c2
je 0x18001a0e1
cmp ecx, 0x5a077ade
jne 0x180019f3e
mov rax, qword [rsp + 0x38]
mov r12, qword [rsp + 0x60]
sub r12, rax
mov ecx, 0x530ee5c2
xor r13d, r13d
mov r14, qword [rsp + 0x50]
jmp 0x180019f3e
cmp ecx, 0xae2a9995
je 0x18001a070
cmp ecx, 0xb7355d46
je 0x18001a102
cmp ecx, 0xe05c267d
jne 0x180019f3e
mov ecx, 0x4a0f57b9
mov rbp, qword [rsp + 0x68]
jmp 0x180019f3e
cmp ecx, 0x5bf9670b
je 0x18001a147
cmp ecx, 0x5d6173f9
je 0x18001a16a
cmp ecx, 0x7cc7eacb
jne 0x180019f3e
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x28]
mov ecx, 0x3334458f
cmp rax, rbx
jb 0x180019f3e
mov ecx, 0xb7355d46
jmp 0x180019f3e
cmp ecx, 0x2b5b96d5
je 0x18001a070
cmp ecx, 0x3334458f
jne 0x180019f3e
mov ecx, 0x4a0f57b9
xor ebp, ebp
jmp 0x180019f3e
mov r14, qword [rsp + 0x50]
mov ecx, 0x530ee5c2
mov r13d, 3
mov r12, qword [rsp + 0x28]
jmp 0x180019f3e
cmp ecx, 0x4d56373e
jne 0x18001a184
mov eax, dword [rsp + 0x74]
mov ecx, 0x5bf9670b
cmp eax, 3
jl 0x180019f3e
mov ecx, 0x3334458f
jmp 0x180019f3e
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov ecx, 0x2b5b96d5
cmp rdx, rax
jb 0x180019f3e
mov ecx, 0x5a077ade
jmp 0x180019f3e
mov dword [rsp + 0x74], r13d
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0x68], r14
mov rax, qword [rsp + 0x48]
mov ecx, 0x4d56373e
jmp 0x180019f3e
lea rdx, [rsp + 0x1a0]
mov qword [rsp + 0x48], rdx
mov rax, qword [rsp + 0x48]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, 0xae2a9995
test rax, rax
je 0x180019f3e
mov ecx, 0xf938382e
jmp 0x180019f3e
cmp dword [rsp + 0x74], 0
mov ecx, 0x7cc7eacb
je 0x18001a158
mov ecx, 0xe05c267d
mov r15, qword [rsp + 0x68]
mov rsi, qword [rsp + 0xc8]
jmp 0x180019f3e
mov r14, qword [rsp + 0x58]
mov ecx, 0x530ee5c2
mov r13d, 1
mov r12, qword [rsp + 0x28]
jmp 0x180019f3e
cmp ecx, 0x4a0f57b9
jne 0x180019f3e
mov qword [rsp + 0xa0], rbp
cmp qword [rsp + 0xa0], 0
mov eax, 0x90569e50
mov ecx, 0x4fbf5e34
cmove eax, ecx
mov rbx, qword [rsp + 0x150]
mov rsi, rdi
mov rdi, qword [rsp + 0xd8]
jmp 0x180019a92
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0
mov eax, 0x3125d2bb
mov ecx, 0x1d3c291
cmove eax, ecx
jmp 0x180019a92
mov qword [rsp + 0x168], rbx
mov ecx, dword [rsp + 0x198]
mov r14, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x158]
mov qword [rsp + 0x48], rcx
mov rax, rbx
xor edx, edx
div qword [rsp + 0x48]
sub rbx, rdx
add rbx, qword [rsp + 0x48]
lea r15d, [rcx - 1]
mov eax, 0x8b4ce899
cmp eax, 0x1d84893f
jle 0x18001a262
cmp eax, 0x51eb5d52
jg 0x18001a2a0
cmp eax, 0x1d848940
je 0x18001a2fd
cmp eax, 0x2b06e358
je 0x18001a30c
cmp eax, 0x322264ab
jne 0x18001a221
mov eax, dword [rsp + 0x38]
cmp eax, 3
mov eax, 0x3f61bed
mov ecx, 0x51eb5d53
cmovl eax, ecx
jmp 0x18001a221
cmp eax, 0xf43d3be6
jg 0x18001a2da
cmp eax, 0x8b4ce899
je 0x18001a32c
cmp eax, 0xd6ddbfc4
je 0x18001a350
cmp eax, 0xdad9e5c1
jne 0x18001a221
cmp dword [rsp + 0x1c0], 0x10000
mov eax, 0x67ebad49
mov ecx, 0x23de14
cmove eax, ecx
jmp 0x18001a221
cmp eax, 0x51eb5d53
je 0x18001a392
cmp eax, 0x67ebad49
je 0x18001a3b6
cmp eax, 0x67ee775e
jne 0x18001a221
mov rdi, qword [rsp + 0x50]
mov eax, 0x2b06e358
mov ebp, 3
mov rsi, qword [rsp + 0x28]
jmp 0x18001a221
cmp eax, 0x23de14
je 0x18001a3e7
cmp eax, 0x3f61bed
jne 0x18001a400
mov eax, 0xf43d3be7
xor r12d, r12d
jmp 0x18001a221
mov eax, 0xf43d3be7
mov r12, qword [rsp + 0x68]
jmp 0x18001a221
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0x68], rdi
mov rax, qword [rsp + 0x58]
mov eax, 0x322264ab
jmp 0x18001a221
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x50], r13
mov rax, qword [rsp + 0x28]
cmp rax, r14
mov eax, 0xd6ddbfc4
mov ecx, 0x3f61bed
cmova eax, ecx
jmp 0x18001a221
lea rdx, [rsp + 0x1a0]
mov qword [rsp + 0x58], rdx
mov rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
mov eax, 0xdad9e5c1
mov ecx, 0x67ee775e
cmove eax, ecx
jmp 0x18001a221
cmp dword [rsp + 0x38], 0
mov eax, 0x1d848940
mov ecx, 0x8b4ce899
cmove eax, ecx
mov r13, qword [rsp + 0x68]
mov rbx, qword [rsp + 0xc8]
jmp 0x18001a221
mov rsi, qword [rsp + 0x1a0]
add rsi, r15
add rsi, qword [rsp + 0x1b8]
mov rax, rsi
xor edx, edx
div qword [rsp + 0x48]
xor ebp, ebp
sub rsi, rdx
mov eax, 0x2b06e358
mov rdi, qword [rsp + 0x50]
jmp 0x18001a221
mov rdi, qword [rsp + 0x60]
mov eax, 0x2b06e358
mov ebp, 1
mov rsi, qword [rsp + 0x28]
jmp 0x18001a221
cmp eax, 0xf43d3be7
jne 0x18001a221
mov qword [rsp + 0xa8], r12
cmp qword [rsp + 0xa8], 0
mov eax, 0x4079a5b4
mov ecx, 0xbfd9959a
cmove eax, ecx
mov rsi, qword [rsp + 0x160]
mov rdi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x168]
jmp 0x180019a92
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
mov eax, 0x6f6bbcb6
mov ecx, 0xf73c736a
cmove eax, ecx
jmp 0x180019a92
mov eax, 0xf22113a3
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rdi
jmp 0x180019a92
mov eax, 0x78a1ecad
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0xd0], rcx
jmp 0x180019a92
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x108], rax
mov eax, 0x823372db
jmp 0x180019a92
mov eax, 0x97c97e35
mov qword [rsp + 0x110], rsi
jmp 0x180019a92
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x140]
cmp rcx, rax
mov eax, 0x1d3c291
mov ecx, 0xef35e7de
cmovb eax, ecx
jmp 0x180019a92
mov rcx, qword [rsp + 0xa8]
mov edx, 0x1000
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
mov eax, 0xbfd9959a
mov ecx, 0xf22113a3
cmove eax, ecx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0xf8], rcx
mov qword [rsp + 0xf0], rsi
jmp 0x180019a92
mov rax, qword [rsp + 0x100]
add rax, 0xfffffffffffff001
mov qword [rsp + 0x98], rax
mov eax, 0x823372db
mov rcx, qword [0x180045c88]
mov qword [rsp + 0x108], rcx
jmp 0x180019a92
mov rax, qword [rsp + 0x90]
cmp rax, 0x40000000
mov eax, 0xa38120b4
mov ecx, 0x259d0256
cmova eax, ecx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x78], rcx
jmp 0x180019a92
mov rax, qword [0x180045c88]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
mov qword [0x180045c88], rax
mov eax, 0xfcd70475
jmp 0x180019a92
mov eax, 0xe4cb2fb9
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0xe8], rdi
jmp 0x180019a92
cmp eax, 0x78a1ecad
jne 0x180019a92
mov rax, qword [rsp + 0x120]
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x80], rax
mov ecx, 0x866408c5
mov eax, 0xfc76293f
cmp ecx, 0xd3e74b79
jg 0x18001a62b
cmp ecx, 0x866408c5
je 0x18001a644
cmp ecx, 0x90f2f74c
jne 0x18001a611
jmp 0x18001a67c
cmp ecx, 0xd3e74b7a
je 0x18001a657
cmp ecx, 0xfc76293f
jne 0x18001a611
mov ecx, 0x90f2f74c
xor esi, esi
jmp 0x18001a611
cmp qword [rsp + 0x80], 0
mov ecx, 0xd3e74b7a
cmove ecx, eax
jmp 0x18001a611
mov rcx, qword [rsp + 0x80]
mov rsi, qword [rcx + 8]
mov rdx, qword [rsi]
mov qword [rcx + 8], rdx
mov rcx, qword [rsp + 0x80]
inc dword [rcx + 0x10]
mov ecx, 0x90f2f74c
jmp 0x18001a611
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.18001e3c0
mov rax, rsi
add rsp, 0x1d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret