Function at 0x7ffbf1d41a6c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x7ffbf1d68270]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea r11, [0x7ffbf1ca0000]
mov eax, dword [0x7ffbf1cb6330]
mov r14d, 0x8000
mov r15, rcx
mov r13, rdx
mov r12, qword [rcx + 0x10]
mov qword [rsp + 0x40], rdx
mov edx, dword [r12 + 1]
and edx, 0xfffffff
lea rsi, [rax + rdx - 1]
xor edx, edx
mov qword [rsp + 0x50], rcx
mov rcx, rax
mov rax, rsi
div rcx
mov eax, dword [0x7ffbf1cb6330]
sub rsi, rdx
mov eax, dword [0x7ffbf1cb6330]
mov r10d, dword [0x7ffbf1d46a58]
mov eax, dword [0x7ffbf1d46a58]
test eax, eax
je 0x7ffbf1d41b86
mov edi, dword [0x7ffbf1d46a58]
xor r8d, r8d
xor eax, eax
dec edi
inc rdi
mov r9, rdi
je 0x7ffbf1d41b40
mov rcx, qword [0x7ffbf1d6a520]
imul rcx, rcx, 0x343fd
shl rax, 0x10
shr r9, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
test r9, r9
jne 0x7ffbf1d41b11
mov qword [0x7ffbf1d6a520], rcx
xor edx, edx
div rdi
test r10, r10
je 0x7ffbf1d41b7b
mov ecx, 0xffff3cd2
inc r8
mov eax, 0xc32d
lock cmpxchg dword [r11 + rdx*4 + 0xcb084], ecx
je 0x7ffbf1d41df1
lea rax, [rdx + 1]
mov ecx, dword [0x7ffbf1d46a58]
xor edx, edx
div rcx
cmp r8, r10
jb 0x7ffbf1d41b4a
xor ebx, ebx
test rbx, rbx
jne 0x7ffbf1d41cab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
xor edi, edi
inc rdi
mov rcx, qword [0x7ffbf1d690d0]
mov r8, rcx
mov r9, rcx
xor eax, eax
test rcx, rcx
je 0x7ffbf1d41bdd
mov rcx, qword [0x7ffbf1d6a520]
imul rcx, rcx, 0x343fd
shl rax, 0x10
shr r9, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
test r9, r9
jne 0x7ffbf1d41bae
mov qword [0x7ffbf1d6a520], rcx
xor edx, edx
div r8
mov r9d, 0x40
mov rcx, rdx
mov rdx, rsi
shl rcx, 0x10
mov r8d, 0x3000
add rcx, qword [0x7ffbf1d68290]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov rbx, rax
je 0x7ffbf1d41c45
lea r9, [0x7ffbf1d42740]
mov r8d, esi
mov rcx, rax
mov rdx, rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or rcx, 3
call qword [sym.imp.ntdll.dll_RtlInstallFunctionTableCallback]
test al, al
jne 0x7ffbf1d41c59
mov rcx, rbx
mov r8d, r14d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp rdi, 0x11
jb 0x7ffbf1d41b90
xor ebx, ebx
cmp qword [0x7ffbf1d690c8], rbx
ja 0x7ffbf1d41c67
test bl, 3
je 0x7ffbf1d41c89
test rbx, rbx
je 0x7ffbf1d41c87
mov rcx, rbx
or rcx, 3
call qword [sym.imp.ntdll.dll_RtlDeleteFunctionTable]
mov rcx, rbx
mov r8d, r14d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ebx, ebx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
lea r11, [0x7ffbf1ca0000]
je 0x7ffbf1d41ada
mov rcx, rsi
mov rdi, rbx
xor eax, eax
rep stosb byte [rdi], al
mov eax, 0xc6f13ffe
mov edx, dword [r12 + 5]
lea rsi, [0x7ffbf1ca0000]
mov r10d, dword [0x7ffbf1cb6330]
and edx, 7
xor edi, edi
lea rbp, [rdx + r12 + 9]
mov r12d, dword [r12 + 1]
mov r9d, ebp
mov qword [rsp + 0x48], rbp
and r12d, 0xfffffff
sub r10, r12
sub r9d, esi
inc r10
mov qword [rsp + 0x60], r12
mov r8, r10
je 0x7ffbf1d41d2a
mov rdx, qword [0x7ffbf1d6a520]
imul rdx, rdx, 0x343fd
shl rdi, 0x10
shr r8, 0x10
add rdx, 0x269ec3
mov rcx, rdx
shr rcx, 0x10
movzx eax, cx
or rdi, rax
test r8, r8
jne 0x7ffbf1d41cfb
mov qword [0x7ffbf1d6a520], rdx
mov rax, rdi
mov ecx, r9d
xor edx, edx
div r10
lea r14, [rdx + rbx]
mov rdx, r12
mov r8, r14
mov qword [rsp + 0x58], r14
mov eax, 0xf87a9595
xor dl, dl
test r12, r12
je 0x7ffbf1d41fc3
lea rbx, [r12 - 1]
lea rcx, [rsp + 0x34]
mov eax, dword [r12 + rbp]
mov dword [rcx], eax
movzx eax, word [r12 + rbp + 4]
mov word [rcx + 4], ax
mov al, byte [rsp + 0x36]
or al, 1
mov r13b, byte [rsp + 0x34]
mov sil, byte [rsp + 0x35]
mov r10b, byte [rsp + 0x38]
or r10b, 1
mov byte [rsp + 0x32], al
mov al, byte [rsp + 0x39]
or r13b, 1
or al, 1
test rbx, rbx
mov byte [rsp + 0x30], r10b
je 0x7ffbf1d41f25
lea r11, [rbx + rbp]
mov r12b, byte [rsp + 0x32]
mov r15, r14
sub r15, rbp
mov bpl, r10b
mov r14b, al
test bl, 1
mov cl, byte [r11]
movzx r8d, cl
je 0x7ffbf1d41e57
xor cl, byte [rsp + 0x37]
and cl, 1
movzx r9d, byte [rsp + 0x37]
je 0x7ffbf1d41e08
movzx edi, r12b
mov eax, r9d
shr eax, 1
shr edi, 1
xor edi, eax
mov eax, r8d
btc eax, 8
sar eax, 1
xor edi, eax
jmp 0x7ffbf1d41e10
mov ecx, dword [0x7ffbf1cb6330]
imul rcx, rdx
lea rbx, [rcx + r11 + 0xae000]
jmp 0x7ffbf1d41b7d
mov edi, r8d
xor edi, r9d
shr edi, 1
movzx r10d, byte [r11 - 1]
mov eax, r10d
xor eax, edi
test al, 1
je 0x7ffbf1d41e49
test cl, cl
je 0x7ffbf1d41e3b
btc r8d, 8
shr r9d, 1
movzx ecx, r12b
shr ecx, 1
sar r8d, 1
xor ecx, r9d
xor ecx, r8d
jmp 0x7ffbf1d41e43
mov ecx, r8d
xor ecx, r9d
shr ecx, 1
movzx eax, r14b
jmp 0x7ffbf1d41ebc
test cl, cl
je 0x7ffbf1d41eea
movzx ecx, r12b
jmp 0x7ffbf1d41ed5
xor cl, sil
movzx r9d, sil
and cl, 1
je 0x7ffbf1d41e7d
mov eax, r9d
movzx edi, r13b
shr eax, 1
shr edi, 1
xor edi, eax
mov eax, r8d
btc eax, 8
sar eax, 1
xor edi, eax
jmp 0x7ffbf1d41e85
mov edi, r8d
xor edi, r9d
shr edi, 1
movzx r10d, byte [r11 - 1]
mov eax, r10d
xor eax, edi
test al, 1
je 0x7ffbf1d41ecd
test cl, cl
je 0x7ffbf1d41eb0
movzx ecx, r13b
btc r8d, 8
shr r9d, 1
shr ecx, 1
sar r8d, 1
xor ecx, r9d
xor ecx, r8d
jmp 0x7ffbf1d41eb8
mov ecx, r8d
xor ecx, r9d
shr ecx, 1
movzx eax, bpl
shr eax, 1
xor r10d, ecx
btc eax, 7
sar r10d, 1
xor eax, r10d
jmp 0x7ffbf1d41ef9
test cl, cl
je 0x7ffbf1d41eea
movzx ecx, r13b
btc r8d, 8
shr ecx, 1
shr r9d, 1
sar r8d, 1
xor ecx, r9d
xor ecx, r8d
jmp 0x7ffbf1d41ef2
mov ecx, r8d
xor ecx, r9d
shr ecx, 1
mov eax, r10d
xor eax, ecx
sar eax, 1
mov byte [r11 + r15], al
xor dl, al
dec r11
sub rbx, 1
jne 0x7ffbf1d41db8
mov r10b, byte [rsp + 0x30]
mov r14, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov r12, qword [rsp + 0x60]
mov r15, qword [rsp + 0x50]
movzx r8d, sil
movzx ecx, byte [rbp]
mov r9b, byte [rbp]
xor r9b, sil
and r9b, 1
je 0x7ffbf1d41f53
movzx edi, r13b
mov eax, r8d
shr eax, 1
shr edi, 1
xor edi, eax
mov eax, ecx
btc eax, 8
sar eax, 1
xor edi, eax
jmp 0x7ffbf1d41f5a
mov edi, ecx
xor edi, r8d
shr edi, 1
test dil, 1
je 0x7ffbf1d41f8e
test r9b, r9b
je 0x7ffbf1d41f7b
btc ecx, 8
movzx edi, r13b
shr r8d, 1
shr edi, 1
sar ecx, 1
xor edi, r8d
xor edi, ecx
jmp 0x7ffbf1d41f82
mov edi, ecx
xor edi, r8d
shr edi, 1
movzx eax, r10b
xor eax, edi
btc eax, 8
jmp 0x7ffbf1d41fb0
test r9b, r9b
je 0x7ffbf1d41fa9
btc ecx, 8
movzx eax, r13b
shr r8d, 1
shr eax, 1
sar ecx, 1
xor eax, r8d
xor eax, ecx
jmp 0x7ffbf1d41fb0
mov eax, ecx
xor eax, r8d
shr eax, 1
sar eax, 1
mov r13, qword [rsp + 0x40]
mov byte [r14], al
xor dl, al
lea rsi, [0x7ffbf1ca0000]
cmp dl, byte [r12 + rbp + 6]
je 0x7ffbf1d42084
call fcn.7ffbf1d47140
lea r14, [fcn.7ffbf1cb7480]
mov r11, rax
mov r10d, 0xffff
lea rdi, [r15 + 0x18]
mov rax, 0xfffffffffffff000
and rdi, 0xfffffffffffffff8
and r11, rax
lea r9, [rdi + 0xfff]
mov qword [r15 + 0x10], r14
and r9, rax
mov rax, qword [0x7ffbf1d6a520]
xor r8d, r8d
imul rax, rax, 0x343fd
shl r8, 0x10
shr r10, 0x10
add rax, 0x269ec3
mov rcx, rax
shr rcx, 0x10
movzx edx, cx
or r8, rdx
test r10, r10
jne 0x7ffbf1d4200d
mov qword [0x7ffbf1d6a520], rax
mov qword [r13 + 0x98], r11
movabs rax, 0x8000800080008001
mul r8
shr rdx, 0xf
imul rdx, rdx, 0xffff
sub r8, rdx
inc r8
mov qword [r13 + 0xb0], r8
mov qword [rsp + 0x40], r10
jmp 0x7ffbf1d4207a
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
add rdi, 8
cmp rdi, r9
jb 0x7ffbf1d4206e
jmp 0x7ffbf1d4218e
mov rax, qword [0x7ffbf1cf0238]
mov rbx, rbp
sub rbx, r14
sub rsi, rax
jne 0x7ffbf1d4209f
test rbx, rbx
je 0x7ffbf1d42183
lea r10, [0x7ffbf1ca0000]
lea r13, [0x7ffbf1ca0000]
mov r11, r14
sub r11, rbp
sub ebp, r13d
mov rcx, qword [0x7ffbf1cac1e8]
xor edi, edi
lea r8d, [rcx - 1]
add r12d, ebp
test r8d, r8d
js 0x7ffbf1d420fb
lea eax, [rdi + r8]
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
mov r9d, dword [r10 + rdx*4 + 0xc1ec]
and r9d, 0xfffffff
cmp ebp, r9d
jae 0x7ffbf1d420f1
lea r8d, [rax - 1]
jmp 0x7ffbf1d420f6
jbe 0x7ffbf1d42100
lea edi, [rax + 1]
cmp r8d, edi
jge 0x7ffbf1d420cb
movsxd r9, edi
jmp 0x7ffbf1d4217c
movsxd r9, eax
jmp 0x7ffbf1d4217c
mov edi, 0xfffffff
mov edx, dword [r10 + r9*4 + 0xc1ec]
mov eax, edx
and eax, edi
cmp eax, r12d
jae 0x7ffbf1d42183
mov r10, rdx
xor r8d, r8d
and r10, rdi
mov edi, edx
sar edx, 0x1e
shl edi, 2
add r10, r13
and edx, 3
sar edi, 0x1e
and edi, 3
sub edi, 1
je 0x7ffbf1d42151
sub edi, 1
je 0x7ffbf1d4214c
cmp edi, 1
jne 0x7ffbf1d42157
mov r8, rsi
jmp 0x7ffbf1d42157
mov r8, rbx
jmp 0x7ffbf1d42157
mov r8, rsi
sub r8, rbx
sub edx, 2
je 0x7ffbf1d42167
cmp edx, 1
jne 0x7ffbf1d42172
add qword [r10 + r11], r8
jmp 0x7ffbf1d4216b
add dword [r10 + r11], r8d
mov rcx, qword [0x7ffbf1cac1e8]
lea r10, [0x7ffbf1ca0000]
inc r9
mov eax, ecx
cmp r9, rax
jb 0x7ffbf1d42105
mov eax, dword [0x7ffbf1cb6330]
mov eax, 0x87084601
mov qword [r15 + 0x10], r14
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.7ffbf1d2cc34
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret