Function at 0x14004e4a0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd0
mov rsi, r9
mov r13, rcx
xor edi, edi
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov qword [rbp - 0x41], rax
test eax, eax
jg 0x14004e4ec
xor al, al
jmp 0x14004eb14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov r15, rdi
mov qword [rsp + 0x30], rdi
mov qword [rbp - 0x79], rdi
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rdi
mov rbx, qword [rbp + 0x7f]
mov r8, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14004e51f
mov rdx, qword [rbx]
movabs r9, 0xcbf29ce484222325
mov rcx, rdi
test r8, r8
je 0x14004e553
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14004e540
mov r8, rbx
lea rdx, [rbp - 0x71]
call fcn.14005e940
cmp qword [rax + 8], 0
je 0x14004e5b6
mov r8, rbx
lea rdx, [rbp - 0x71]
call fcn.14005da20
mov r8, qword [rax]
add r8, 0x30
lea rax, [rsp + 0x38]
cmp rax, r8
je 0x14004e5a4
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
sub r8, rdx
sar r8, 3
lea rcx, [rsp + 0x38]
call fcn.14005dd30
mov r15, qword [rbp - 0x79]
mov qword [rsp + 0x30], r15
lea rax, [r13 + 8]
mov qword [rbp + 0x57], rax
mov rdi, qword [rsp + 0x40]
jmp 0x14004e7a3
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
mov r14, rax
mov rax, rdi
lea rbx, [r13 + 8]
mov qword [rbp + 0x57], rbx
movabs r15, 0x7fffffffffff
mov rdi, qword [rsp + 0x40]
nop dword [rax]
mov r9d, Ordinal_50
lea r8, [rbp - 0x39]
mov rdx, rax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x14004e756
cmp dword [rbp - 0x19], 0x1000
jne 0x14004e745
mov eax, dword [rbp - 0x15]
bt eax, 8
jb 0x14004e745
cmp eax, 1
je 0x14004e745
cmp eax, 0x10
je 0x14004e745
mov rcx, qword [rbp - 0x21]
call fcn.1400c0554
mov r13, rax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x21]
mov r8, r13
mov rdx, qword [rbp - 0x39]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14004e73d
mov rbx, r13
mov rdx, qword [rbp - 0x51]
mov r9, rdx
sub r9, r14
inc r9
add r9, r13
mov qword [rbp - 0x71], r9
lea r8, [r13 - 1]
add r8, r14
mov r12, r8
lea r15, [rdx - 1]
add r15, r13
cmp r13, r9
jae 0x14004e72f
nop
test r14, r14
je 0x14004e6bb
mov rax, rsi
mov rdx, rbx
sub rdx, rsi
nop
movzx ecx, byte [rax]
cmp cl, 0x3f
je 0x14004e6ad
cmp cl, byte [rdx + rax]
jne 0x14004e708
inc rax
mov rcx, rax
sub rcx, rsi
cmp rcx, r14
jb 0x14004e6a0
mov rax, rbx
sub rax, r13
add rax, qword [rbp - 0x39]
mov qword [rbp - 0x49], rax
cmp rdi, qword [rsp + 0x30]
je 0x14004e6de
mov qword [rdi], rax
add rdi, 8
mov qword [rsp + 0x40], rdi
jmp 0x14004e708
lea r8, [rbp - 0x49]
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.14005ed40
mov rax, qword [rbp - 0x79]
mov qword [rsp + 0x30], rax
mov rdi, qword [rsp + 0x40]
lea r8, [r13 - 1]
add r8, r14
mov r9, qword [rbp - 0x71]
inc rbx
cmp rbx, r15
jb 0x14004e726
add r12, 0x1000
add r15, 0x1000
cmp r12, r8
jae 0x14004e72f
mov rbx, r8
cmp rbx, r9
jb 0x14004e690
movabs r15, 0x7fffffffffff
mov rbx, qword [rbp + 0x57]
mov rcx, r13
call fcn.1400c0148
mov rax, qword [rbp - 0x39]
add rax, qword [rbp - 0x21]
cmp rax, r15
jb 0x14004e5e0
mov r8, qword [rbp + 0x7f]
lea rdx, [rbp - 0x71]
call fcn.14005da20
mov rcx, qword [rax]
add rcx, 0x30
lea rax, [rsp + 0x38]
cmp rcx, rax
je 0x14004e79a
mov r8, rdi
mov r14, qword [rsp + 0x38]
sub r8, r14
sar r8, 3
mov rdx, r14
call fcn.14005dd30
mov qword [rbp + 0x57], rbx
mov r15, qword [rsp + 0x30]
mov r13, qword [rbp + 0x4f]
jmp 0x14004e7a8
mov r15, qword [rsp + 0x30]
mov r13, qword [rbp + 0x4f]
mov r14, qword [rsp + 0x38]
lea rsi, [r13 + 0x18]
mov r12, rdi
sub r12, r14
sar r12, 3
mov qword [rbp - 0x71], r12
mov rax, qword [rsi + 0x10]
sub rax, qword [rsi]
cmp r12, rax
jbe 0x14004e7e4
movabs rax, 0x7fffffffffffffff
cmp r12, rax
ja 0x14004eb2f
mov rdx, r12
mov rcx, rsi
call fcn.14005c790
mov rbx, r14
cmp r14, rdi
je 0x14004e85a
mov r15, qword [rbp + 0x57]
mov r12d, 1
nop word [rax + rax]
mov qword [rsp + 0x20], 0
mov r9, r12
lea r8, [r13 + 0x16]
mov rdx, qword [rbx]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14004e843
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x14004e837
movzx eax, byte [r13 + 0x16]
mov byte [rdx], al
inc qword [rsi + 8]
jmp 0x14004e843
lea r8, [r13 + 0x16]
mov rcx, rsi
call fcn.14005ebc0
add rbx, 8
cmp rbx, rdi
jne 0x14004e800
mov r15, qword [rsp + 0x30]
mov r12, qword [rbp - 0x71]
cmp r14, rdi
jne 0x14004e861
xor bl, bl
jmp 0x14004ead2
xor edi, edi
test r12, r12
je 0x14004e90c
movsxd r13, dword [rbp - 0x41]
mov rbx, r14
mov edx, dword [rbx]
lea rcx, [rbp - 0x71]
call fcn.14005d0b0
mov edx, dword [rbx]
lea rax, [rbp + 0x5f]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r13
mov rax, qword [rbp + 0x57]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9, r13
mov r8, qword [rbp + 0x6f]
mov rdx, qword [rbx]
mov rax, qword [rbp + 0x57]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rbp - 0x59]
cmp rdx, 0x10
jb 0x14004e8fa
inc rdx
mov rcx, qword [rbp - 0x71]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e8f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ea5a
call fcn.1400c0148
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, r12
jb 0x14004e873
mov rax, qword [rbp + 0x7f]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x14004e91e
mov rax, qword [rax]
cmp r8, 5
jne 0x14004ead0
lea rdx, str.NpcDE
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004ead0
xor r13b, r13b
xor edi, edi
test r12, r12
je 0x14004ea77
mov r15, qword [rbp + 0x57]
mov eax, 1
nop word [rax + rax]
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [rbp + 0x77]
mov rdx, qword [r14 + rdi*8]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14004ea61
mov rbx, qword [rbp + 0x4f]
add rbx, 0x30
lea rdx, [0x1400d34b2]
mov rcx, rbx
call fcn.14005d2d0
lea rdx, [0x14004b3a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [r14 + rdi*8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x1400e1e24]
call fcn.14005d2d0
lea rdx, [0x1400d34b2]
mov rcx, rbx
call fcn.14005d2d0
lea rdx, [0x14004b3a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rsi]
movzx edx, byte [rdi + rdx]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x1400e1e28]
call fcn.14005d2d0
lea rdx, [0x1400d34b2]
mov rcx, rbx
call fcn.14005d2d0
lea rdx, [0x14004b3a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
movzx edx, byte [rbp + 0x77]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14005d2d0
mov rcx, qword [rsi]
movzx r13d, r13b
movzx eax, byte [rbp + 0x77]
cmp byte [rdi + rcx], al
mov eax, 1
cmovne r13d, eax
jmp 0x14004ea66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov eax, 1
inc rdi
cmp rdi, r12
jb 0x14004e960
mov r15, qword [rsp + 0x30]
mov rcx, qword [rbp + 0x4f]
add rcx, 0x38
lea rdx, [rbp - 0x71]
call fcn.14005c880
mov rdx, qword [rbp - 0x59]
cmp rdx, 0x10
jb 0x14004eac6
inc rdx
mov rcx, qword [rbp - 0x71]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004eac1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004eac1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c0148
test r13b, r13b
setne byte [0x140277b6e]
mov bl, 1
test r14, r14
je 0x14004eb11
sub r15, r14
and r15, 0xfffffffffffffff8
mov rax, r14
cmp r15, 0x1000
jb 0x14004eb06
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004eb06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov rcx, r14
call fcn.1400c0148
movzx eax, bl
mov rbx, qword [rsp + 0x128]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14005c770
nop
int3