Function at 0x100465560
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push r14
sub rsp, 0x28
mov rdi, rdx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1004ae178], eax
je 0x100465589
mov eax, 0x10dd
add rsp, 0x28
pop r14
pop rdi
ret
mov eax, dword [0x1004adf68]
test eax, eax
jne 0x1004657ba
test rdi, rdi
jne 0x1004655a7
lea eax, [rdi + 0x57]
add rsp, 0x28
pop r14
pop rdi
ret
test r14, r14
je 0x1004655c3
cmp qword [r14], 0
jne 0x1004655d0
mov dword [0x1004adf68], 6
mov qword [0x1004ae598], r14
mov eax, 6
add rsp, 0x28
pop r14
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x10046577c
mov rbx, qword [r14]
mov qword [rsp + 0x20], r15
test rbx, rbx
je 0x10046567f
cmp byte [rbx], 0xff
jne 0x100465634
cmp byte [rbx + 1], 0x25
jne 0x100465634
movsxd r15, dword [rbx + 2]
lea rdx, [rbx + 6]
add rdx, r15
mov rcx, rbx
call fcn.100464480
test al, al
je 0x100465634
mov rbx, qword [r15 + rbx + 6]
cmp byte [rbx], 0xeb
jne 0x10046567f
movsx rax, byte [rbx + 1]
add rbx, 2
add rbx, rax
movzx eax, byte [rbx]
cmp al, 0xff
jne 0x100465670
cmp byte [rbx + 1], 0x25
jne 0x10046567f
movsxd r15, dword [rbx + 2]
lea rdx, [rbx + 6]
add rdx, r15
mov rcx, rbx
call fcn.100464480
test al, al
je 0x10046567f
mov rbx, qword [r15 + rbx + 6]
jmp 0x10046567f
cmp al, 0xe9
jne 0x10046567f
movsxd rax, dword [rbx + 1]
add rbx, 5
add rbx, rax
cmp byte [rdi], 0xff
jne 0x1004656a6
cmp byte [rdi + 1], 0x25
jne 0x1004656a6
movsxd r15, dword [rdi + 2]
lea rdx, [rdi + 6]
add rdx, r15
mov rcx, rdi
call fcn.100464480
test al, al
je 0x1004656a6
mov rdi, qword [r15 + rdi + 6]
cmp byte [rdi], 0xeb
jne 0x1004656f1
movsx rax, byte [rdi + 1]
add rdi, 2
add rdi, rax
movzx eax, byte [rdi]
cmp al, 0xff
jne 0x1004656e2
cmp byte [rdi + 1], 0x25
jne 0x1004656f1
movsxd r15, dword [rdi + 2]
lea rdx, [rdi + 6]
add rdx, r15
mov rcx, rdi
call fcn.100464480
test al, al
je 0x1004656f1
mov rdi, qword [r15 + rdi + 6]
jmp 0x1004656f1
cmp al, 0xe9
jne 0x1004656f1
movsxd rax, dword [rdi + 1]
add rdi, 5
add rdi, rax
movzx eax, byte [rbx + 0x3e]
mov rbp, qword [rbx + 0x48]
mov r15, qword [rsp + 0x20]
sub rbp, rax
test al, al
je 0x100465713
mov edx, eax
cmp rax, 0x1e
ja 0x100465713
cmp qword [rbx + 0x50], rdi
je 0x100465723
cmp dword [0x1004aa01c], 0
mov ebx, 9
jne 0x100465789
jmp 0x100465783
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
mov r8d, 0x40
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10046574d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100465783
mov dword [rsi + 8], 1
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x20], rbx
mov qword [rsi + 0x18], rbp
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x28], eax
mov rax, qword [0x1004ae5b0]
mov qword [rsi], rax
xor eax, eax
mov qword [0x1004ae5b0], rsi
jmp 0x1004657ab
xor esi, esi
mov ebx, 8
mov dword [0x1004adf68], ebx
test rsi, rsi
je 0x1004657a2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [0x1004ae598], r14
mov eax, ebx
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x28
pop r14
pop rdi
ret