Function at 0x1800c5280
Capabilities:
Get memory capacity
Inspect section memory permissions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1801bc0c0]
xor rax, rsp
mov qword [rbp + 0x50], rax
movabs rax, 0x67cc542463c687a4
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x20], rax
movabs rax, 0x53d50d2a98cd8fd7
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x28], rax
movabs rax, 0x686406524367a320
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x30], rax
movabs rax, 0x9c29cb0dcfb741ab
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x38], rax
movabs rsi, 0x14a9060a3587d3e3
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs r14, 0x39b14c4ffbbffab8
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
movabs r15, 0x1b0528202613d055
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
movabs r12, 0x9c29cb0dcfb741c2
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp + 0x30]
xorps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1800c5a3a
movabs rax, 0x209f26390da7ebd7
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x9917c7cdb8bc898
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
movabs rax, 0x3b461c00152bf065
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
movabs rax, 0xda6feb35fd9775f0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
movabs rax, 0x3abd30eaa8736047
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
movabs rax, 0x4710df2359f15c94
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x38], rax
movabs rax, 0xe9d02ae88405367
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x40], rax
movabs r13, 0x4710df2359f15cac
mov qword [rsp + 0x20], r13
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x48], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x1800c54f0
mov qword [rsp + 0x28], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movabs rcx, 0xfffffffec0000000
add rcx, rax
mov qword [0x1801c1020], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1801a9070]
movdqu xmmword [rsp + 0x70], xmm1
mov byte [rsp + 0x60], 0
movups xmmword [rbp - 0x80], xmm0
movdqu xmmword [rbp - 0x70], xmm1
mov byte [rbp - 0x80], 0
xor edi, edi
mov qword [rbp - 0x58], rdi
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x40], dil
movabs rax, 0x140000000
add rax, rcx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdi
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1800f2660
nop
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.1800f2840
mov edx, 0xffffffff
lea rcx, [rsp + 0x60]
call fcn.1800f2840
mov rax, qword [rbp - 0x58]
mov rcx, qword [rax]
mov byte [rcx - 4], 0xc3
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1800c55f4
mov rdx, qword [rbp - 0x48]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800c55e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c5a67
call fcn.1800fc920
mov qword [rbp - 0x58], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x80]
call fcn.1800b5e30
lea rcx, [rsp + 0x60]
call fcn.1800b5e30
movabs rax, 0x2499263a05a792a1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x20], rax
movabs rax, 0xd917c7fdb8aca98
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x28], rax
movabs rax, 0x3b3d6b00642bf06d
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x30], rax
movabs rax, 0x9c29cb35f79775f6
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp + 0x30]
xorps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x30], xmm1
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x20]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1800c56d1
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call fcn.1800c5a70
mov dword [rax + 1], 0xa0000
mov dword [rax + 0x17], 0xa001b
movabs rax, 0x24ea263903a790d7
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x9910877db87ce98
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
movabs rax, 0x3b3a081f062cf060
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
movabs rax, 0xbc6df32df78361fd
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
movabs rax, 0xe9d02ae88406756
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], r13
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x38], rax
movabs rax, 0xe9d02ae88405367
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x20], r13
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x48], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
mov rax, rbx
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x1800c5830
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, 6
lea rcx, [rsp + 0x20]
call fcn.1800b5f00
movsxd rcx, dword [rax]
add rcx, 4
add rax, rcx
mov qword [0x1801cbe50], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp - 0x20], 0x40
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov dl, 1
movabs rcx, 0x7d0000000
mov r8d, 0xe0000000
mov rax, qword [rbp - 0x18]
cmp rax, rcx
cmovae edi, r8d
movabs rcx, 0x5dc000000
cmp rax, rcx
jb 0x1800c58c0
mov edi, 0xc0000000
jmp 0x1800c5904
movabs rcx, 0x3e8000000
cmp rax, rcx
jb 0x1800c58d6
mov edi, 0x80000000
jmp 0x1800c5904
movabs rcx, 0x2ee000000
cmp rax, rcx
jb 0x1800c58ec
mov edi, 0x60000000
jmp 0x1800c5904
movabs rcx, 0x1f4000000
cmp rax, rcx
jb 0x1800c5902
mov edi, 0x40000000
jmp 0x1800c5904
xor dl, dl
mov rax, qword [0x1801cbe50]
add rax, 0x10
mov ecx, 0x14
mov r8d, 0xf1e00000
mov r9d, 0xa1400000
mov qword [rax + 8], r8
mov qword [rax], r8
mov qword [rax - 8], r9
mov qword [rax - 0x10], 0x78f00000
lea rax, [rax + 0x20]
sub rcx, 1
jne 0x1800c5920
test dl, dl
je 0x1800c5a3a
movabs rax, 0x2499263277a7e2d7
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x20], rax
movabs rax, 0xd917c7fdb8fca98
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x28], rax
movabs rax, 0x3b4710001e27f065
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x30], rax
movabs rax, 0x9c29cb34f7977486
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp + 0x30]
xorps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x30], xmm1
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x20]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800c5a10
mov qword [rsp + 0x28], rbx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.1800b5f00
mov dword [rax], edi
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1800fc900
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180102e04
int3