Function at 0x1802b4e90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x28
xor edi, edi
mov rbp, r9
mov r12, r8
mov r15, rdx
mov r14, rcx
test r8, r8
je 0x1802b4eb8
mov qword [r8], rdi
test rbp, rbp
je 0x1802b4ec0
mov qword [r9], rdi
mov rbx, qword [rsp + 0x80]
test rbx, rbx
je 0x1802b4ed0
mov qword [rbx], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180413cf0], eax
je 0x1802b4ef1
mov eax, 0x10dd
add rsp, 0x28
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [0x180413d08]
test eax, eax
jne 0x1802b5250
test r14, r14
jne 0x1802b4f16
lea eax, [r14 + 6]
add rsp, 0x28
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
mov rsi, qword [r14]
test rsi, rsi
jne 0x1802b4f3c
mov dword [0x180413d08], 6
lea eax, [rsi + 6]
mov qword [0x180413d10], r14
jmp 0x1802b524b
movzx eax, byte [rsi]
mov r14, rdi
mov qword [rsp + 0x20], r13
mov r13, rdi
cmp al, 0xff
jne 0x1802b4f83
cmp byte [rsi + 1], 0x25
jne 0x1802b4f83
movsxd rax, dword [rsi + 2]
mov rcx, rsi
add rax, 6
add rax, rsi
mov rdx, rax
mov qword [rsp + 0x80], rax
call fcn.1802b4de0
test al, al
je 0x1802b4fa3
mov rsi, qword [rsp + 0x80]
mov rsi, qword [rsi]
jmp 0x1802b4fa3
cmp al, 0xeb
jne 0x1802b4fa3
movsx rax, byte [rsi + 1]
add rsi, 2
add rsi, rax
cmp byte [rsi], 0xe9
jne 0x1802b4fa3
movsxd rax, dword [rsi + 1]
add rsi, 5
add rsi, rax
test r15, r15
jne 0x1802b4fad
mov r15, rdi
jmp 0x1802b500c
movzx eax, byte [r15]
cmp al, 0xff
jne 0x1802b4feb
cmp byte [r15 + 1], 0x25
jne 0x1802b4feb
movsxd rax, dword [r15 + 2]
mov rcx, r15
add rax, 6
add rax, r15
mov rdx, rax
mov qword [rsp + 0x80], rax
call fcn.1802b4de0
test al, al
je 0x1802b500c
mov r15, qword [rsp + 0x80]
mov r15, qword [r15]
jmp 0x1802b500c
cmp al, 0xeb
jne 0x1802b500c
movsx rax, byte [r15 + 1]
add r15, 2
add r15, rax
cmp byte [r15], 0xe9
jne 0x1802b500c
movsxd rax, dword [r15 + 1]
add r15, 5
add r15, rax
cmp r15, rsi
jne 0x1802b5022
cmp dword [0x180413cf4], edi
jne 0x1802b51f7
jmp 0x1802b51a7
test rbp, rbp
je 0x1802b502b
mov qword [rbp], rsi
test rbx, rbx
je 0x1802b5033
mov qword [rbx], r15
mov ecx, gethostbyname
call fcn.18011da30
mov r13, rax
test rax, rax
jne 0x1802b504d
lea edi, [rax + 8]
jmp 0x1802b51a7
mov rcx, rsi
call fcn.1802b4a10
mov r14, rax
test rax, rax
jne 0x1802b5065
lea edi, [rax + 8]
jmp 0x1802b51a7
test r12, r12
je 0x1802b506e
mov qword [r12], r14
mov ebp, dword [rsp + 0x88]
mov r12, rsi
mov ebx, edi
nop word [rax + rax]
cmp ebx, 5
jl 0x1802b5089
test ebp, ebp
jle 0x1802b50d3
mov qword [rsp + 0x78], r12
mov dword [rsp + 0x80], edi
cmp ebx, 5
jl 0x1802b509c
dec ebp
movsxd rcx, ebx
lea r9, [rsp + 0x80]
add rcx, r14
xor r8d, r8d
mov rdx, r12
call fcn.1802b7940
mov r12, rax
cmp dword [rsp + 0x80], edi
jne 0x1802b50d3
mov rcx, qword [rsp + 0x78]
mov ebx, eax
sub ebx, esi
call fcn.1802b4ce0
test eax, eax
je 0x1802b5080
cmp ebx, 5
jge 0x1802b50ef
cmp dword [0x180413cf4], 0
mov edi, 9
jne 0x1802b51ad
jmp 0x1802b51a7
movsxd r12, ebx
cmp r12, 0x1a
jbe 0x1802b5102
mov edi, 6
jmp 0x1802b51a7
lea r8, [r12 + r14]
mov qword [r14 + 0x28], r15
lea rax, [r12 + rsi]
mov byte [r14 + 0x1f], bl
mov qword [r14 + 0x20], rax
lea rcx, [r8 + 6]
mov eax, r14d
mov word [r8], 0x25ff
sub eax, ecx
lea rdx, [r14 + 0x1f]
add eax, 0x20
lea rcx, [r8 + 6]
mov dword [r8 + 2], eax
call fcn.1802b4da0
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], edi
mov r8d, 0x40
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1802b519f
mov rcx, rsi
call fcn.1802b4d40
mov rbx, rax
test rax, rax
je 0x1802b5215
mov ebp, 0x6544
cmp word [rax + 0x1c], bp
je 0x1802b5215
mov edx, 0x40
mov dword [rsp + 0x80], edi
mov r8d, edx
lea r9, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1802b5207
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x180413d08], edi
test r14, r14
je 0x1802b51e5
mov rcx, r14
and rcx, 0xffffffffffff0000
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x30], rax
mov rax, qword [rcx + 0x10]
mov qword [r14 + 0x20], rax
mov qword [rcx + 0x10], r14
test r13, r13
je 0x1802b51f7
mov edx, gethostbyname
mov rcx, r13
call fcn.1802b8d50
mov rax, qword [rsp + 0x60]
mov qword [0x180413d10], rax
mov eax, edi
jmp 0x1802b5246
mov dword [rbx + 0x1c], 0x6f746544
mov dword [rbx + 0x20], 0x21737275
mov rax, qword [rsp + 0x60]
mov qword [r13 + 0x10], rax
mov dword [r13 + 8], edi
mov qword [r13 + 0x20], r14
mov qword [r13 + 0x18], rsi
mov eax, dword [rsp + 0x70]
mov dword [r13 + 0x28], eax
mov rax, qword [0x180413d20]
mov qword [r13], rax
xor eax, eax
mov qword [0x180413d20], r13
mov r13, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x68]
add rsp, 0x28
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret