Function at 0x14005e020
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp + 0xf]
mov r12, qword [rbp + 0x17]
mov dword [rbp - 0x49], 0xe92d4c10
mov dword [rbp - 0x45], 0xe28db008
mov dword [rbp - 0x41], 0xe59f010c
mov dword [rbp - 0x3d], 0xe08f0000
lea rbx, [rbp - 0x49]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400d1aa0
mov rsi, rax
mov qword [rbp - 0x29], rax
lea r15, [rax + 0x10]
mov qword [rbp - 0x19], r15
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x21], r15
mov dword [rbp - 0x39], 0xe3a00001
mov dword [rbp - 0x35], 0xe12fff1e
mov dword [rbp - 0x31], 0xe59f010c
mov dword [rbp - 0x2d], 0xe08f0000
lea rbx, [rbp - 0x39]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400d1aa0
mov rdi, rax
mov qword [rbp - 0x11], rax
lea r13, [rax + 0x10]
mov qword [rbp - 1], r13
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 9], r13
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov rbx, rax
test eax, eax
jg 0x14005e11e
xor bl, bl
jmp 0x14005e1df
lea rax, [0x14018fb30]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, r12
mov rdx, r14
lea rcx, [0x14018fb20]
call fcn.1400597e0
mov rdx, qword [0x14018fb30]
mov rax, qword [0x14018fb38]
cmp rdx, rax
jne 0x14005e159
xor bl, bl
jmp 0x14005e1df
xor r14d, r14d
sub rax, rdx
sar rax, 3
test rax, rax
je 0x14005e1dd
movsxd r12, ebx
xor ebx, ebx
nop dword [rax]
mov edx, dword [rbx + rdx]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r12
mov rcx, qword [0x14018fb28]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [0x14018fb30]
mov qword [rsp + 0x20], 0
mov r9, r12
mov r8, rdi
mov rdx, qword [rbx + rax]
mov rcx, qword [0x14018fb28]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc r14d
lea rbx, [rbx + 8]
mov rcx, qword [0x14018fb38]
mov rdx, qword [0x14018fb30]
sub rcx, rdx
sar rcx, 3
movsxd rax, r14d
cmp rax, rcx
jb 0x14005e170
mov bl, 1
test rdi, rdi
je 0x14005e21b
sub r13, rdi
mov rax, rdi
cmp r13, 0x1000
jb 0x14005e20f
add r13, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e20f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, rdi
call fcn.1400d1e00
nop
test rsi, rsi
je 0x14005e256
sub r15, rsi
mov rax, rsi
cmp r15, 0x1000
jb 0x14005e24b
add r15, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e24b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov rcx, rsi
call fcn.1400d1e00
movzx eax, bl
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret