Function at 0x180001a30
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xc8
mov rax, qword [0x18135e6d8]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0xf], r8
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x180001a20
test rdx, rdx
je 0x180001a20
mov rdi, rcx
mov qword [rbp - 0x69], 0
xor r8d, r8d
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x39]
and rdi, 0xffffffffffff0000
mov qword [rsp + 0x20], 0x30
mov rdx, rdi
lea rcx, [r8 - 1]
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
mov r8d, 0x80000000
test eax, eax
js 0x1800017a8
cmp qword [rbp - 0x69], 0
je 0x1800017a8
cmp dword [rbp - 0x19], 0x10000
je 0x1800017aa
mov rdx, qword [rbp - 0x39]
mov rax, rbx
sub rax, rdx
mov rcx, rdx
sub rcx, rbx
lea rdi, [rdx - 1]
and rdi, 0xffffffffffff0000
cmp rbx, rdx
cmovb rax, rcx
cmp rax, r8
ja 0x1800017a8
xor r8d, r8d
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x39]
mov rdx, rdi
mov qword [rsp + 0x20], 0x30
lea rcx, [r8 - 1]
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
mov r8d, 0x80000000
test eax, eax
jns 0x180001741
xor edi, edi
xor r15b, r15b
mov rax, rbx
sub rax, rsi
mov r14, rsi
sub r14, rbx
cmp rbx, rsi
cmovae r14, rax
cmp r14, r8
jbe 0x1800017cc
test rdi, rdi
sete r15b
mov qword [rbp - 0x69], rdi
lea r9, [rbp + 0x17]
neg rdi
mov dword [rsp + 0x28], 0x40
lea rdx, [rbp - 0x69]
mov qword [rbp + 0x17], 0x60
sbb r8d, r8d
mov dword [rsp + 0x20], 0x3000
and r8d, 0xc
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
xor edi, edi
test eax, eax
cmovns rdi, qword [rbp - 0x69]
test rdi, rdi
je 0x180001a20
test r15b, r15b
mov qword [rsp + 0x108], r12
mov qword [rsp + 0xc0], r13
mov eax, recv
mov r13d, 5
mov qword [rdi + 0x10], rbx
mov ecx, r13d
mov r9, rdi
cmovne ecx, eax
mov rdx, rbx
mov dword [rdi + 0x1c], ecx
sub r9, rbx
mov r8d, ecx
movzx eax, byte [rdx]
mov byte [r9 + rdx + 0x40], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x180001850
lea r12, [rdi + 0x20]
mov rcx, rbx
mov rdx, r12
call fcn.180001390
movzx eax, al
mov dword [rdi + 0x18], eax
test eax, eax
je 0x180001a14
lea rcx, [rax + rdi]
mov qword [rbp - 0x61], rbx
add rax, rbx
lea r8, [rbp - 1]
mov qword [rcx + 0x26], rax
mov edx, 0x25ff
mov word [rcx + 0x20], dx
mov eax, recv
xor edx, edx
mov dword [rcx + 0x22], edx
test r15b, r15b
mov dword [rbp - 9], edx
mov rcx, 0xffffffffffffffff
cmovne r13, rax
lea rax, [rbp - 9]
lea r9d, [rdx + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x61]
mov qword [rbp - 1], r13
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x180001a14
call fcn.180001330
mov eax, 0x80000000
cmp r14, rax
jbe 0x180001924
test r15b, r15b
je 0x180001902
mov eax, 0x25ff
mov dword [rbx + 2], 0
mov word [rbx], ax
mov qword [rbx + 6], rsi
jmp 0x18000192f
mov byte [rbx], 0xe9
mov eax, edi
sub eax, ebx
sub eax, 5
mov dword [rbx + 1], eax
mov eax, 0x25ff
mov word [rdi], ax
mov dword [rdi + 2], 0
mov qword [rdi + 6], rsi
jmp 0x18000192f
sub esi, ebx
mov byte [rbx], 0xe9
sub esi, 5
mov dword [rbx + 1], esi
mov rax, qword [rbp + 0xf]
test rax, rax
je 0x18000193b
mov qword [rax], r12
mov r9d, dword [rbp - 9]
lea rax, [rbp - 9]
lea r8, [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x61]
mov qword [rbp + 0xf], r13
mov rcx, 0xffffffffffffffff
mov qword [rbp - 0x61], rbx
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov rax, qword gs:[0x30]
lea rcx, [0x180001570]
mov edx, dword [rax + 0x40]
mov dword [rbp - 0x59], edx
mov rax, qword gs:[0x30]
mov edx, dword [rax + 0x48]
mov dword [rbp - 0x55], edx
lea rdx, [rbp - 0x59]
mov qword [rbp - 0x51], rbx
mov qword [rbp - 0x49], r12
mov eax, dword [rdi + 0x18]
mov qword [rbp - 0x41], rax
call fcn.180001120
xor edx, edx
xor r8d, r8d
lea rcx, [rdx - 1]
call qword [sym.imp.ntdll.dll_NtFlushInstructionCache]
mov rax, qword gs:[0x30]
lea rdx, [rbp - 1]
mov ecx, dword [rax + 0x40]
mov dword [rbp - 1], ecx
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x48]
mov dword [rbp + 3], ecx
lea rcx, [0x180001220]
mov dword [rbp + 7], 1
call fcn.180001120
mov al, 1
mov r12, qword [rsp + 0x108]
mov r13, qword [rsp + 0xc0]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1800055f0
add rsp, 0xc8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, rdi
call fcn.1800010d0
xor al, al
jmp 0x1800019e8
xor al, al
jmp 0x1800019f8
jmp 0x1800016c0