Function at 0x18000f070
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
cmp byte [0x180083adf], 0
mov rdi, rcx
jne 0x18000f09f
lea rcx, [0x180083ce8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x180083adf], 1
lea rcx, [0x180083ce8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [0x1800909e0]
movabs rsi, 0x82fa0be82fa0be83
mov rcx, qword [0x1800909d8]
xor ebx, ebx
sub rdx, rcx
mov qword [rsp + 0x80], 0
imul rdx, rsi
movsxd r8, edx
test edx, edx
jle 0x18000f101
xor eax, eax
inc rcx
cmp rdx, rax
jbe 0x18000f37d
cmp qword [rcx], rdi
je 0x18000f126
inc ebx
inc rax
add rcx, 0x2b
cmp rax, r8
jl 0x18000f0e5
xor bl, bl
lea rcx, [0x180083ce8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0x88]
movzx eax, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [0x180082d08]
lea r8, [rsp + 0x30]
mov r9d, 0x30
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [rsp + 0x54]
mov rcx, qword [0x1800909d8]
mov dword [rsp + 0x78], eax
mov rax, qword [0x1800909e0]
sub rax, rcx
movsxd rbx, ebx
imul rax, rsi
cmp rax, rbx
jbe 0x18000f37d
lea rax, [rsp + 0x78]
mov r9d, 0x40
imul r8, rbx, 0x2b
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov r8, qword [r8 + rcx + 9]
mov rcx, qword [0x180082d08]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x1800909d8]
mov rax, qword [0x1800909e0]
sub rax, rcx
imul rax, rsi
cmp rax, rbx
jbe 0x18000f37d
imul rax, rbx, 0x2b
cmp byte [rax + rcx], 2
jne 0x18000f372
imul rax, rbx, 0x2b
mov edx, dword [rax + rcx + 0x13]
test edx, edx
je 0x18000f1d4
cmp edx, 1
jne 0x18000f372
imul rax, rbx, 0x2b
lea r8, [rcx + 0x11]
mov qword [rsp + 0x20], 0
add r8, rax
mov rdx, rdi
mov r9, qword [rax + rcx + 9]
mov rcx, qword [0x180082d08]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18000f358
mov rcx, qword [0x1800909e0]
mov rdx, qword [0x1800909d8]
mov rax, rcx
sub rax, rdx
imul rax, rsi
cmp rax, rbx
jbe 0x18000f37d
imul rax, rbx, 0x2b
mov r8d, dword [rax + rdx + 0x17]
cmp r8d, 1
jne 0x18000f241
mov r9d, r8d
lea r8, [0x180081346]
jmp 0x18000f267
cmp r8d, 2
jne 0x18000f250
lea r8, [0x180081348]
jmp 0x18000f261
cmp r8d, 3
jne 0x18000f31f
lea r8, [0x180081344]
mov r9d, 2
mov rcx, qword [0x180082d08]
lea rax, [rsp + 0x80]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000f311
mov rcx, qword [0x180082d08]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rcx, qword [0x1800909d8]
mov rax, qword [0x1800909e0]
sub rax, rcx
imul rax, rsi
cmp rax, rbx
jbe 0x18000f37d
imul rax, rbx, 0x2b
mov byte [rax + rcx], 1
mov rcx, qword [0x1800909d8]
mov rax, qword [0x1800909e0]
sub rax, rcx
imul rax, rsi
cmp rax, rbx
jbe 0x18000f37d
mov r9d, dword [rsp + 0x78]
lea rax, [rsp + 0x78]
imul r8, rbx, 0x2b
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov r8, qword [r8 + rcx + 9]
mov rcx, qword [0x180082d08]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov bl, 1
jmp 0x18000f103
mov rcx, qword [0x1800909e0]
mov rdx, qword [0x1800909d8]
sub rcx, rdx
imul rcx, rsi
cmp rcx, rbx
jbe 0x18000f37d
imul r8, rbx, 0x2b
mov r8, qword [r8 + rdx + 9]
mov r9d, dword [rsp + 0x78]
lea rax, [rsp + 0x78]
mov rcx, qword [0x180082d08]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x18000f101
mov rcx, qword [0x1800909d8]
mov rax, qword [0x1800909e0]
sub rax, rcx
imul rax, rsi
cmp rax, rbx
jbe 0x18000f37d
imul r8, rbx, 0x2b
mov r8, qword [r8 + rcx + 9]
jmp 0x18000f334
call fcn.180005850
int3