Function at 0x180052d90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xcd8
mov rax, qword [0x180279b80]
xor rax, rsp
mov qword [rsp + 0xcc0], rax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], 0
mov r9d, Ordinal_50
lea r8, [rsp + 0xa38]
xor edx, edx
mov rcx, qword [rsp + 0xcf0]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov r8, qword [rsp + 0xcf0]
mov rdx, qword [rsp + 0xa40]
lea rcx, [rsp + 0x6b0]
call fcn.180053230
lea rcx, [rsp + 0x320]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x388
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x338]
add rax, 0x10
mov rdx, qword [rsp + 0xcf0]
mov rcx, rax
call fcn.180053280
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x338]
add rax, 0x10
cmp rax, qword [rsp + 0x38]
je 0x18005314a
mov rax, qword [rsp + 0x38]
add rax, 0x30
mov rdx, qword [rsp + 0xcf0]
mov rcx, rax
call fcn.180053280
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
add rax, 0x40
mov rdx, qword [rsp + 0xcf0]
mov rcx, rax
call fcn.180053280
mov qword [rsp + 0x70], rax
mov r8, qword [rsp + 0xcf0]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.1800532e0
lea rcx, [rsp + 0x80]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x40
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0xbc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov r8, qword [rsp + 0xcf0]
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.180053330
lea rcx, [rsp + 0xaa0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x108
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0xaf0]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
xor edx, edx
mov rax, qword [rsp + 0x48]
mov ecx, 0x10000
div rcx
mov rax, rdx
test rax, rax
je 0x180052f4b
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
jmp 0x180052f25
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
jmp 0x180052f79
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
movsxd rax, dword [rsp + 0x34]
mov qword [rsp + 0x68], rax
xor edx, edx
mov rax, qword [rsp + 0xcf8]
mov ecx, 0x1000
div rcx
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
ja 0x180052fe7
imul eax, dword [rsp + 0x34], 0x1000
cdqe
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov r9d, Ordinal_50
lea r8, [rsp + 0xa68]
mov rdx, rax
mov rcx, qword [rsp + 0xcf0]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp qword [rsp + 0xa70], 0
je 0x180052fe5
mov byte [rsp + 0x30], 1
jmp 0x180052fe7
jmp 0x180052f6f
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x18005300c
mov rdx, qword [rsp + 0xcf0]
mov rcx, qword [rsp + 0x38]
call fcn.180053280
mov qword [rsp + 0x38], rax
jmp 0x180052e59
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xcf8]
add rcx, rax
mov rax, rcx
add rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
add rcx, 0x40
mov r8, qword [rsp + 0xcf0]
mov rdx, rax
call fcn.180053380
lea rax, [rsp + 0xbb0]
lea rcx, [rsp + 0xaa0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x108
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0xaf0]
add rax, qword [rsp + 0x60]
add rax, qword [rsp + 0xcf8]
mov dword [rsp + 0xc00], eax
movsxd rax, dword [rsp + 0xbc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
lea rcx, [rsp + 0xa98]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov r8d, 0x108
mov rdx, rax
mov rcx, qword [rsp + 0xcf0]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rsp + 0x100]
lea rcx, [rsp + 0xbb0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x108
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0xbc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov r8, qword [rsp + 0xcf0]
lea rdx, [rsp + 0x100]
mov rcx, rax
call fcn.1800533c0
movsxd rax, dword [rsp + 0xbc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
lea rcx, [rsp + 0xa98]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0xa98]
mov r8d, 0x108
mov rdx, rax
mov rcx, qword [rsp + 0xcf0]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
jmp 0x18005314a
cmp qword [rsp + 0x50], 0
je 0x180053184
mov eax, dword [rsp + 0xd08]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xd00]
mov r8, qword [rsp + 0xcf8]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xcf0]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
jmp 0x180053186
xor eax, eax
mov rcx, qword [rsp + 0xcc0]
xor rcx, rsp
call fcn.1801be920
add rsp, 0xcd8
pop rdi
pop rsi
ret