Function at 0x18006dc40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180101010]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r9
mov rbx, r8
mov rdi, rdx
test rdx, rdx
je 0x18006df89
test rbx, rbx
je 0x18006df89
mov rax, r9
mov rcx, rbx
sub rax, rbx
sub rcx, r9
cmp rbx, r9
mov edx, 0x80000000
mov r8, rdi
cmovb rcx, rax
cmp rcx, rdx
jb 0x18006de8a
lea r13, [rdi + 0x58]
mov rax, rbx
sub rax, r13
mov rcx, r13
sub rcx, rbx
cmp rbx, r13
cmovb rax, rcx
cmp rax, rdx
mov rdx, rbx
jb 0x18006ddc1
mov r9d, 0xe
call fcn.18006d980
movzx r14d, al
test al, al
je 0x18006df89
lea rcx, [rdi + 0x30]
mov r8d, r14d
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
xor esi, esi
mov qword [rbp - 0x1a], r15
lea rax, [rbp - 0x28]
mov dword [rbp - 0x1e], esi
mov r12d, 0x25ff
mov qword [rbp - 0x40], 0xe
lea r8, [rbp - 0x40]
mov word [rbp - 0x20], r12w
lea r9d, [rsi + 0x40]
mov qword [rbp - 0x10], rbx
lea rcx, [rsi - 1]
mov dword [rbp - 0x28], esi
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
test eax, eax
mov r9d, esi
cmovns r9d, dword [rbp - 0x28]
test r9d, r9d
je 0x18006df89
movsd xmm0, qword [rbp - 0x20]
lea r8, [rbp - 0x38]
mov eax, dword [rbp - 0x18]
lea rdx, [rbp - 0x20]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [rbp - 0x14]
mov word [rbx + 0xc], ax
mov qword [rbp - 0x38], 0xe
mov qword [rbp - 0x20], rbx
lea rax, [rbp - 0x30]
mov dword [rbp - 0x30], esi
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
lea r8, [rbx + r14]
lea rdx, [rdi + r14]
mov rcx, r8
sub rcx, rdx
mov rax, rdx
sub rax, r8
cmp rdx, r8
cmovb rax, rcx
mov ecx, 0x80000000
cmp rax, rcx
jae 0x18006df6a
sub r8d, edx
mov byte [rdx], 0xe9
lea eax, [r8 - 5]
mov dword [rdx + 1], eax
jmp 0x18006df75
mov r9d, 5
call fcn.18006d980
movzx r14d, al
test al, al
je 0x18006df89
mov qword [rbp - 0x1a], r15
lea rcx, [rdi + 0x30]
mov eax, dword [rbp - 0x18]
mov r12d, 0x25ff
xor esi, esi
mov word [rbp - 0x20], r12w
mov dword [rbp - 0x1e], esi
mov r8d, r14d
movsd xmm0, qword [rbp - 0x20]
mov rdx, rbx
movsd qword [r13], xmm0
mov dword [r13 + 8], eax
movzx eax, word [rbp - 0x14]
mov word [r13 + 0xc], ax
call sub.VCRUNTIME140.dll_memcpy
mov eax, edi
mov byte [rbp - 0x30], 0xe9
sub eax, ebx
mov qword [rbp - 0x20], 5
add eax, 0x53
mov qword [rbp - 0x38], rbx
mov dword [rbp - 0x2f], eax
lea r9d, [rsi + 0x40]
lea rax, [rbp - 0x28]
mov dword [rbp - 0x28], esi
lea r8, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x38]
lea rcx, [rsi - 1]
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
test eax, eax
mov r9d, esi
cmovns r9d, dword [rbp - 0x28]
test r9d, r9d
je 0x18006df89
mov eax, dword [rbp - 0x30]
lea r8, [rbp - 0x10]
mov dword [rbx], eax
lea rdx, [rbp - 0x40]
movzx eax, byte [rbp - 0x2c]
mov byte [rbx + 4], al
mov qword [rbp - 0x10], 5
mov qword [rbp - 0x40], rbx
jmp 0x18006dd6d
mov r9d, 5
mov rdx, rbx
call fcn.18006d980
movzx r14d, al
test al, al
je 0x18006df89
lea rcx, [rdi + 0x30]
mov r8d, r14d
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
xor esi, esi
mov byte [rbp - 0x30], 0xe9
lea rax, [rbp - 0x28]
mov qword [rbp - 0x20], 5
sub r15d, ebx
mov qword [rbp - 0x38], rbx
sub r15d, 5
mov dword [rbp - 0x28], esi
lea r9d, [rsi + 0x40]
mov dword [rbp - 0x2f], r15d
lea rcx, [rsi - 1]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
test eax, eax
mov r9d, esi
cmovns r9d, dword [rbp - 0x28]
test r9d, r9d
je 0x18006df89
mov eax, dword [rbp - 0x30]
lea r8, [rbp - 0x10]
mov dword [rbx], eax
lea rdx, [rbp - 0x40]
movzx eax, byte [rbp - 0x2c]
lea rcx, [rsi - 1]
mov byte [rbx + 4], al
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x10], 5
mov qword [rbp - 0x40], rbx
mov dword [rbp - 0x30], esi
call qword [sym.imp.ntdll.dll_ZwProtectVirtualMemory]
lea r8, [r14 + rbx]
lea rdx, [rdi + r14]
mov rcx, r8
sub rcx, rdx
mov rax, rdx
sub rax, r8
cmp rdx, r8
cmovb rax, rcx
mov ecx, 0x80000000
cmp rax, rcx
jb 0x18006ddaf
mov r12d, 0x25ff
mov word [rdx], r12w
mov dword [rdx + 2], esi
mov qword [rdx + 6], r8
mov eax, 0x66
mov rcx, rdi
mov byte [rax + rcx], r14b
mov al, 1
mov qword [rdi + 0x50], rbx
jmp 0x18006df8b
xor al, al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18006e830
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret