Function at 0x180003750
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push rbx
push r12
sub rsp, 0xb8
mov rax, qword [0x180034018]
xor rax, rsp
mov qword [rsp + 0x98], rax
movzx r12d, dl
mov rbx, rcx
test dl, dl
jne 0x180003781
cmp byte [rcx + 0x2d], dl
jne 0x180003b4c
cmp byte [rcx + 0x2e], 0
je 0x1800037d1
test r12b, r12b
jne 0x1800037d1
cmp dword [rbx + 0x28], 2
mov r8d, 5
mov rcx, qword [rcx + 8]
jne 0x1800037b2
add rcx, 0xfffffffffffffffb
lea rdx, [rbx + 0x3e]
call fcn.18000ea30
mov byte [rbx + 0x2d], 1
jmp 0x180003b4c
cmp byte [rbx + 0x2c], 0
mov edx, 0xe
cmovne r8, rdx
lea rdx, [rbx + 0x3e]
call fcn.18000ea30
mov byte [rbx + 0x2d], 1
jmp 0x180003b4c
mov qword [rsp + 0xe8], rdi
mov rdi, qword [rcx + 8]
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xa0], r15
mov r15, qword [rcx + 0x10]
sub r15, rdi
sub r15, 5
mov rax, r15
cqo
xor rax, rdx
sub rax, rdx
cmp rax, 0x7fffffff
setge cl
xor r13d, r13d
mov byte [rbx + 0x2c], cl
cmp rax, 0x7fffffff
jl 0x180003a04
cmp byte [rbx + 0x2f], r13b
jne 0x180003987
mov byte [rbx + 0x2f], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r13 + 0x30]
mov rdx, rdi
mov rcx, rax
lea r8, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x180003987
mov qword [rsp + 0xd8], rbp
lea rcx, [rsp + 0x58]
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xa8], r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsxd rsi, dword [rsp + 0x80]
mov r14d, r13d
mov rbp, qword [rsp + 0x30]
sub rbp, rsi
nop word [rax + rax]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
mov rdi, rax
test rax, rax
jne 0x180003915
inc r14d
sub rbp, rsi
cmp r14d, 0x100
jl 0x180003890
test rax, rax
jne 0x180003915
mov rbp, qword [rsp + 0x40]
mov r14d, r13d
add rbp, rsi
add rbp, qword [rsp + 0x30]
nop dword [rax + rax]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
mov rdi, rax
test rax, rax
jne 0x180003915
inc r14d
add rbp, rsi
cmp r14d, 0x100
jl 0x1800038e0
jmp 0x18000396f
mov rdx, qword [rbx + 8]
mov rax, rdi
sub rax, rdx
lea rcx, [rdx + 5]
sub rdx, rdi
cmp rcx, rdi
cmovbe rdx, rax
add rdx, 5
cmp rdx, 0x7ffffff0
ja 0x18000396f
mov r8, rsi
mov edx, 0xcc
mov rcx, rdi
call fcn.18000ee40
mov word [rdi], 0x25ff
mov dword [rdi + 2], r13d
mov rax, qword [rbx + 0x10]
mov qword [rdi + 6], rax
mov r15, qword [rbx + 0x18]
mov qword [rbx + 0x10], r15
sub r15, qword [rbx + 8]
sub r15, 5
mov byte [rbx + 0x2c], r13b
mov r14, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
cmp byte [rbx + 0x2c], r13b
je 0x180003a04
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x20]
mov edx, 0xe
lea r8d, [rdx + 0x32]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x180023198]
mov rcx, qword [rbx + 8]
mov dword [rsp + 0x88], eax
movzx eax, word [0x18002319c]
mov word [rsp + 0x8c], ax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x8e], rax
mov eax, dword [rsp + 0x90]
movsd xmm0, qword [rsp + 0x88]
mov qword [rbx], rcx
mov dword [rbx + 0x28], r13d
mov byte [rbx + 0x2d], 1
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
movzx eax, word [rsp + 0x94]
mov word [rcx + 0xc], ax
jmp 0x180003b34
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x20]
mov edx, 0xa
sub rcx, 5
lea r8d, [rdx + 0x36]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test r12b, r12b
jne 0x180003a2f
cmp byte [rbx + 0x2e], r13b
jne 0x180003b18
mov rdx, qword [rbx + 8]
mov rax, r13
movzx r8d, byte [rdx - 5]
cmp r8b, 0x90
sete al
cmp byte [rdx - 4], 0x90
lea rcx, [rax + 1]
cmovne rcx, rax
cmp byte [rdx - 3], 0x90
lea rax, [rcx + 1]
cmovne rax, rcx
cmp byte [rdx - 2], 0x90
lea rcx, [rax + 1]
cmovne rcx, rax
cmp byte [rdx - 1], 0x90
lea rax, [rcx + 1]
cmovne rax, rcx
cmp rax, 5
jne 0x180003aac
cmp byte [rdx], 0x8b
jne 0x180003aac
cmp byte [rdx + 1], 0xff
jne 0x180003aac
mov dword [rbx + 0x28], 2
lea rax, [rdx + 2]
mov qword [rbx], rax
mov byte [rbx + 0x2d], 1
mov byte [rdx - 5], 0xe9
mov eax, dword [rbx + 0x10]
sub eax, dword [rbx + 8]
mov dword [rdx - 4], eax
mov eax, 0xf9eb
mov word [rdx], ax
jmp 0x180003b14
cmp r8b, 0xe9
jne 0x180003ae1
mov eax, 0xf9eb
cmp word [rdx], ax
jne 0x180003ae1
cmp dword [rbx + 0x28], r13d
jne 0x180003b14
movsxd rax, dword [rdx - 4]
add rax, rdx
mov dword [rbx + 0x28], 2
mov qword [rbx], rax
mov eax, dword [rbx + 0x10]
sub eax, edx
mov byte [rbx + 0x2d], 1
mov dword [rdx - 4], eax
jmp 0x180003b14
cmp byte [rdx], 0xe9
mov eax, dword [rbx + 0x28]
jne 0x180003b0c
test eax, eax
jne 0x180003b14
movsxd rax, dword [rdx + 1]
lea rcx, [rdx + 5]
add rcx, rax
mov dword [rbx + 0x28], 1
mov qword [rbx], rcx
mov byte [rbx + 0x2d], 1
mov dword [rdx + 1], r15d
jmp 0x180003b14
test eax, eax
je 0x180003b14
mov dword [rbx + 0x28], r13d
mov byte [rbx + 0x2e], 1
cmp dword [rbx + 0x28], r13d
jne 0x180003b34
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov dword [rbx + 0x28], r13d
mov byte [rbx + 0x2d], 1
mov byte [rax], 0xe9
mov dword [rax + 1], r15d
mov rdi, qword [rsp + 0xe8]
mov r13, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.18000db30
add rsp, 0xb8
pop r12
pop rbx
ret