Function at 0x10004a220
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x100347ae0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov eax, dword [0x1000d5e38]
mov r14d, 0x8000
mov r12, qword [rcx + 0x10]
mov r13d, 0xfffffff
mov qword [rsp + 0x80], rdx
lea r11, [0x100000000]
mov edx, dword [r12 + 5]
and rdx, r13
mov qword [rsp + 0x98], rcx
lea rsi, [rax + rdx - 1]
mov rcx, rax
xor edx, edx
mov r15d, 0x269ec3
mov rax, rsi
div rcx
mov eax, dword [0x1000d5e38]
sub rsi, rdx
mov eax, dword [0x1000d5e38]
mov eax, dword [0x100172988]
mov r10d, dword [0x100172988]
test eax, eax
je 0x10004a345
mov edi, dword [0x100172988]
xor r8d, r8d
xor eax, eax
dec edi
inc rdi
mov r9, rdi
je 0x10004a2ff
mov rcx, qword [0x100346e50]
imul rcx, rcx, 0x343fd
shl rax, 0x10
shr r9, 0x10
add rcx, r15
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
test r9, r9
jne 0x10004a2d4
mov qword [0x100346e50], rcx
xor edx, edx
div rdi
test r10, r10
je 0x10004a33a
inc r8
mov ecx, 0xffff349a
mov eax, 0xcb65
lock cmpxchg dword [r11 + rdx*4 + 0x349c90], ecx
je 0x10004a5dd
lea rax, [rdx + 1]
xor edx, edx
mov ecx, dword [0x100172988]
div rcx
cmp r8, r10
jb 0x10004a309
xor ebx, ebx
test rbx, rbx
jne 0x10004a466
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov ebp, eax
mov rcx, qword [0x100348890]
inc rdi
mov r9, rcx
mov r8, rcx
xor eax, eax
test rcx, rcx
je 0x10004a398
mov rcx, qword [0x100346e50]
imul rcx, rcx, 0x343fd
shl rax, 0x10
shr r9, 0x10
add rcx, r15
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
test r9, r9
jne 0x10004a36d
mov qword [0x100346e50], rcx
mov r9d, 0x40
xor edx, edx
div r8
mov rcx, rdx
mov r8d, 0x3000
mov rdx, rsi
shl rcx, 0x10
add rcx, qword [0x1003475b0]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov rbx, rax
je 0x10004a400
lea r9, [0x1002af874]
and qword [rsp + 0x28], 0
mov rdx, rax
mov rcx, rax
mov r8d, esi
and qword [rsp + 0x20], 0
or rcx, 3
call qword [sym.imp.ntdll.dll_RtlInstallFunctionTableCallback]
test al, al
jne 0x10004a414
xor edx, edx
mov rcx, rbx
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp rdi, 0x11
jb 0x10004a34f
xor ebx, ebx
cmp rbx, 0x10000
jb 0x10004a422
test bl, 3
je 0x10004a444
test rbx, rbx
je 0x10004a442
mov rcx, rbx
or rcx, 3
call qword [sym.imp.ntdll.dll_RtlDeleteFunctionTable]
xor edx, edx
mov rcx, rbx
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ebx, ebx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [0x100000000]
test rbx, rbx
je 0x10004a29d
mov rcx, rsi
mov rdi, rbx
xor eax, eax
rep stosb byte [rdi], al
mov eax, 0x449603dc
mov edx, dword [r12 + 1]
mov r8d, dword [0x1000d5e38]
mov r14d, dword [r12 + 5]
and r14, r13
lea r15, [0x100000000]
mov qword [rsp + 0xa0], r14
and edx, 7
lea rbp, [rdx + r12 + 9]
sub r8, r14
mov qword [rsp + 0x90], rbp
xor eax, eax
mov esi, ebp
sub esi, r15d
mov dword [rsp + 0x30], esi
inc r8
mov rdi, r8
je 0x10004a4ea
mov rcx, qword [0x100346e50]
imul rcx, rcx, 0x343fd
shl rax, 0x10
shr rdi, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
test rdi, rdi
jne 0x10004a4bb
mov qword [0x100346e50], rcx
xor edx, edx
mov ecx, esi
div r8
lea r12, [rdx + rbx]
mov qword [rsp + 0x88], r12
mov rdx, r14
mov r8, r12
mov eax, 0x34bc1fe0
mov rdx, qword [r14 + rbp]
xor dil, dil
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rdx
mov eax, 0x2f2445c4
mov rax, qword [0x100037580]
mov r9d, dword [rsp + 0x7c]
mov rcx, r15
mov rbx, qword [rsp + 0x78]
and qword [rsp + 0x48], 0
and rbx, r13
and r9, r13
mov r13d, 4
add rbx, r15
sub rcx, rax
mov qword [rsp + 0x70], rcx
jne 0x10004a5f4
xor r10d, r10d
test r9, r9
je 0x10004a933
mov r11d, 0x9ffb0838
mov eax, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x48]
movzx ecx, byte [r10 + rbx]
inc r10
sub ecx, 0x6004f7c8
add r8d, ecx
add ecx, eax
imul ecx, ecx, 0x9ffb0838
ror ecx, 1
mov eax, ecx
imul eax, eax, 0x6581
rol eax, 8
ror ecx, 8
xor eax, ecx
imul rax, r11
mov qword [rsp + 0x38], rax
shr rax, 0x20
mov ecx, dword [rsp + 0x38]
lea edx, [rcx + rax*2 - 0x7fffffff]
sar ecx, 0x1f
btr ecx, 0x1f
sub edx, ecx
mov eax, edx
sar eax, 0x1f
btr eax, 0x1f
add eax, edx
add r8d, eax
cmp r10, r9
jb 0x10004a570
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x48], r8d
jmp 0x10004a933
mov ecx, dword [0x1000d5e38]
imul rcx, rdx
lea rbx, [rcx + r11 + 0x313000]
jmp 0x10004a33c
lea rax, [rbx + r9]
movsxd rcx, dword [0x10000003c]
mov r8d, dword [rcx + r15 + 0xb0]
add r8, r15
mov ecx, dword [rcx + r15 + 0xb4]
mov qword [rsp + 0x60], rax
mov eax, ebx
sub eax, r15d
mov r10d, eax
lea r12, [rax + r9]
mov r15, r12
mov r11d, eax
and r10, 0xfffffffffffff000
sub r11, r10
and r15, 0xfffffffffffff000
sub r12, r15
add rcx, r8
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x68], r12
jmp 0x10004a65b
mov eax, dword [r8]
cmp rax, r10
jae 0x10004a660
mov eax, dword [r8 + 4]
add r8, rax
cmp r8, rcx
jne 0x10004a64c
xor esi, esi
cmp r8, rcx
je 0x10004a69e
mov eax, dword [r8]
cmp rax, r10
jne 0x10004a69e
mov ecx, dword [r8 + 4]
sub rcx, 8
shr rcx, 1
je 0x10004a699
lea rdx, [r8 + 8]
movzx eax, word [rdx]
and eax, 0xfff
cmp rax, r11
jae 0x10004a699
inc rsi
add rdx, 2
cmp rsi, rcx
jne 0x10004a680
mov rcx, qword [rsp + 0x38]
mov r10d, dword [rsp + 0x48]
mov r14d, 0x9ffb0838
mov r9d, dword [rsp + 0x4c]
cmp r8, rcx
je 0x10004a893
mov eax, dword [r8]
cmp rax, r15
ja 0x10004a893
mov edx, dword [r8 + 4]
lea rax, [rdx - 8]
shr rax, 1
cmp rsi, rax
jne 0x10004a6ef
add r8, rdx
cmp r8, rcx
je 0x10004a893
mov eax, dword [r8]
cmp rax, r15
ja 0x10004a893
xor esi, esi
jmp 0x10004a6c3
mov eax, dword [r8]
cmp rax, r15
jne 0x10004a70b
movzx eax, word [r8 + rsi*2 + 8]
and eax, 0xfff
cmp rax, r12
jae 0x10004a893
mov edx, 0xf000
mov rax, rsi
inc rsi
test word [r8 + rax*2 + 8], dx
je 0x10004a6ae
xor edi, edi
movzx r11d, word [r8 + rax*2 + 8]
lea rax, [0x100000000]
mov r12d, r11d
and r12d, 0xfff
add r12d, dword [r8]
add r12, rax
mov rax, r12
sub rax, rbx
je 0x10004a7b5
mov rbp, rax
movzx ecx, byte [rdi + rbx]
inc rdi
sub ecx, 0x6004f7c8
add r10d, ecx
add ecx, r9d
imul ecx, ecx, 0x9ffb0838
ror ecx, 1
mov eax, ecx
imul eax, eax, 0x6581
rol eax, 8
ror ecx, 8
xor eax, ecx
imul rax, r14
mov qword [rsp + 0x50], rax
shr rax, 0x20
mov ecx, dword [rsp + 0x50]
lea edx, [rcx + rax*2 - 0x7fffffff]
sar ecx, 0x1f
btr ecx, 0x1f
sub edx, ecx
mov r9d, edx
sar r9d, 0x1f
btr r9d, 0x1f
add r9d, edx
add r10d, r9d
cmp rdi, rbp
jb 0x10004a748
mov dword [rsp + 0x4c], r9d
mov dword [rsp + 0x48], r10d
shr r11d, 0xc
mov rax, qword [r12]
cmp r11d, 3
mov qword [rsp + 0x50], rax
je 0x10004a7d6
sub r11d, 0xa
neg r11d
sbb edx, edx
add edx, 3
jmp 0x10004a7db
mov edx, 2
mov r11, qword [rsp + 0x70]
neg r11
sub edx, 2
je 0x10004a803
cmp edx, 1
je 0x10004a7f3
or r11, 0xffffffffffffffff
jmp 0x10004a80b
add rax, r11
mov r11d, 8
mov qword [rsp + 0x50], rax
jmp 0x10004a80b
add dword [rsp + 0x50], r11d
mov r11, r13
xor ebx, ebx
test r11, r11
je 0x10004a880
movzx ecx, byte [rsp + rbx + 0x50]
inc rbx
sub ecx, 0x6004f7c8
add r10d, ecx
add ecx, r9d
imul ecx, ecx, 0x9ffb0838
ror ecx, 1
mov eax, ecx
imul eax, eax, 0x6581
rol eax, 8
ror ecx, 8
xor eax, ecx
imul rax, r14
mov qword [rsp + 0x58], rax
mov ecx, dword [rsp + 0x58]
shr rax, 0x20
lea edx, [rcx + rax*2 - 0x7fffffff]
sar ecx, 0x1f
btr ecx, 0x1f
sub edx, ecx
mov r9d, edx
sar r9d, 0x1f
btr r9d, 0x1f
add r9d, edx
add r10d, r9d
cmp rbx, r11
jb 0x10004a812
mov dword [rsp + 0x4c], r9d
mov dword [rsp + 0x48], r10d
lea rbx, [r11 + r12]
mov rcx, qword [rsp + 0x38]
mov r12, qword [rsp + 0x68]
jmp 0x10004a6ae
mov r14, qword [rsp + 0xa0]
xor r8d, r8d
mov dil, r8b
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x90]
sub rsi, rbx
je 0x10004a927
mov r11d, 0x9ffb0838
movzx ecx, byte [rbx + r8]
inc r8
sub ecx, 0x6004f7c8
add r10d, ecx
add ecx, r9d
imul ecx, ecx, 0x9ffb0838
ror ecx, 1
mov eax, ecx
imul eax, eax, 0x6581
rol eax, 8
ror ecx, 8
xor eax, ecx
imul rax, r11
mov qword [rsp + 0x38], rax
mov ecx, dword [rsp + 0x38]
shr rax, 0x20
lea edx, [rcx + rax*2 - 0x7fffffff]
sar ecx, 0x1f
btr ecx, 0x1f
sub edx, ecx
mov r9d, edx
sar r9d, 0x1f
btr r9d, 0x1f
add r9d, edx
add r10d, r9d
cmp r8, rsi
jb 0x10004a8b9
mov dword [rsp + 0x4c], r9d
mov dword [rsp + 0x48], r10d
mov esi, dword [rsp + 0x30]
mov r12, qword [rsp + 0x88]
xor ecx, ecx
mov rax, rcx
inc rcx
and eax, 7
cmp rcx, 8
mov al, byte [rsp + rax + 0x48]
mov byte [rsp + rcx + 0xa7], al
jb 0x10004a935
mov eax, 0x5d0a7088
mov rax, qword [rsp + 0xa8]
mov r15, rbp
mov qword [rsp + 0x38], r12
mov r10, r12
mov r12, r14
and r12d, 7
je 0x10004ae13
xor r8d, r8d
xor r11d, r11d
mov ebx, esi
not ebx
xor r10d, r10d
test r12d, r12d
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x60], r11d
jle 0x10004a9c9
lea r9d, [r8 + 0x38]
movzx edx, byte [r15]
cmp r10d, r13d
jge 0x10004a9a8
lea ecx, [r9 - 0x20]
shl edx, cl
or r11d, edx
jmp 0x10004a9b0
mov ecx, r9d
shl edx, cl
or r8d, edx
inc r10d
inc r15
sub r9d, 8
cmp r10d, r12d
jl 0x10004a994
mov dword [rsp + 0x60], r11d
mov dword [rsp + 0x58], r8d
movzx r10d, word [rsp + 0xae]
mov r8d, dword [rsp + 0xac]
mov ecx, esi
movzx r9d, word [rsp + 0xaa]
movzx r11d, r8w
mov edx, r11d
xor edx, esi
rol edx, 6
rol ecx, 7
imul edx, r10d
xor ecx, edx
xor ebx, ecx
mov esi, ebx
mov ecx, eax
sub ecx, ebx
rol ecx, 1
ror esi, 3
imul ecx, r11d
add esi, ecx
xor esi, dword [rsp + 0x30]
mov ecx, esi
lea edx, [r8 + rsi]
ror edx, 2
rol ecx, 0xe
imul edx, r9d
movzx r8d, ax
sub edx, ecx
xor ebx, edx
mov ecx, ebx
sub ecx, r8d
xor ecx, dword [rsp + 0xac]
xor esi, ecx
mov ecx, esi
not ecx
ror ecx, 0xa
add ecx, r10d
imul ecx, r8d
xor ebx, ecx
mov edx, ebx
mov ecx, ebx
xor ecx, r10d
ror edx, 8
imul ecx, r11d
xor edx, ecx
xor esi, edx
mov edx, esi
mov ecx, esi
xor edx, r8d
rol edx, 6
ror ecx, 3
imul edx, r9d
add ecx, edx
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, r11d
ror edx, 0xb
imul ecx, r8d
sub ecx, edx
mov edx, eax
xor esi, ecx
mov ecx, esi
mov r8d, dword [rsp + 0xac]
ror ecx, 0xc
sub ecx, r10d
imul ecx, r11d
xor ebx, ecx
mov ecx, ebx
xor edx, ebx
rol edx, 6
rol ecx, 3
imul edx, r11d
xor ecx, edx
mov edx, r8d
mov r11d, dword [rsp + 0x58]
xor esi, ecx
mov ecx, esi
xor edx, esi
rol edx, 3
shr ecx, 0xa
imul edx, r9d
sub edx, ecx
xor ebx, edx
xor r9d, r9d
mov edx, dword [rsp + 0x60]
mov ecx, r8d
xor ecx, eax
xor ecx, edx
xor ecx, ebx
xor ebx, r11d
xor esi, ecx
mov ecx, esi
mov edx, ebx
test r12d, r12d
jle 0x10004ab13
mov r8, qword [rsp + 0x38]
cmp r9d, r13d
jge 0x10004aafa
rol ecx, 8
mov byte [r8], cl
inc r8
xor dil, cl
jmp 0x10004ab06
rol edx, 8
mov byte [r8], dl
inc r8
xor dil, dl
inc r9d
cmp r9d, r12d
jl 0x10004aae7
mov qword [rsp + 0x38], r8
lea ecx, [r12 - 4]
test ecx, ecx
jle 0x10004adfb
sub r13d, ecx
shl r13d, 3
mov ecx, r13d
shr ebx, cl
shl ebx, cl
mov r10, qword [rsp + 0x38]
mov r12, r14
shr r12, 3
test r12, r12
je 0x10004ad3d
mov r13d, dword [rsp + 0xac]
movzx ecx, ax
mov r14d, dword [rsp + 0x60]
mov dword [rsp + 0x58], ecx
movzx ecx, word [rsp + 0xae]
mov dword [rsp + 0x68], ecx
movzx ecx, r13w
mov dword [rsp + 0x30], ecx
movzx ecx, word [rsp + 0xaa]
mov dword [rsp + 0x70], ecx
mov ecx, r13d
xor ecx, eax
mov ebp, ecx
xor ebx, ebx
test ecx, ecx
jns 0x10004ab2e
neg ecx
shl ecx, 3
shr esi, cl
shl esi, cl
jmp 0x10004ab2e
mov r11d, esi
mov dword [rsp + 0x60], esi
not r11d
xor ebx, ebx
xor esi, esi
jmp 0x10004ab33