Function at 0x1800b6930
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x20
xor esi, esi
cmp byte [0x1802577ed], sil
je 0x1800b698a
mov dword [rbp + 0x20], 0xffff96af
mov eax, dword [rbp + 0x20]
mov dword [rbp + 0x28], eax
mov rcx, qword [0x180257708]
mov rax, qword [rcx]
lea r9, [0x18021d0a0]
lea r8, str.__s_
lea rdx, [rbp + 0x28]
call qword [rax + 0xb8]
lea r9, str.Cancelled
jmp 0x1800b6cef
mov byte [0x1802577e8], 1
mov rbx, rsi
mov edi, 1
xor eax, eax
lock cmpxchg dword [0x1802563d8], edi
je 0x1800b69c6
cmp rbx, 0x20
jae 0x1800b69af
xor ecx, ecx
jmp 0x1800b69b1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1802563d8], edi
jne 0x1800b69a5
cmp qword [0x1802563e0], rsi
je 0x1800b6a4b
xor ecx, ecx
call fcn.1800a04a0
test eax, eax
jne 0x1800b6a4b
mov rcx, qword [0x18026a010]
mov qword [0x18026a010], rsi
test rcx, rcx
je 0x1800b6a09
nop dword [rax]
mov rbx, qword [rcx]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
test rbx, rbx
jne 0x1800b69f0
mov r8, qword [0x18026a000]
xor edx, edx
mov rcx, qword [0x1802563e0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1802563e0]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov qword [0x1802563e0], rsi
mov qword [0x18026a000], rsi
mov qword [0x18026a008], rsi
mov eax, esi
xchg dword [0x1802563d8], eax
jmp 0x1800b6a6f
mov eax, esi
xchg dword [0x1802563d8], eax
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.MH_failed_to_unload_all_hooks_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r8, qword [0x1802691f0]
mov edx, 0xfffffffc
mov rcx, qword [0x180257b08]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov rdi, qword [0x180252620]
mov rbx, qword [0x180252618]
cmp rbx, rdi
je 0x1800b6af2
nop dword [rax + rax]
cmp byte [rbx + 0x58], sil
je 0x1800b6ae9
lea r9, [rbp + 0x20]
mov r8d, 0x40
mov rdx, qword [rbx + 0x48]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rbx + 0x48]
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x50]
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rbp + 0x28]
mov r8d, dword [rbp + 0x20]
mov rdx, qword [rbx + 0x48]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx + 0x58], sil
add rbx, 0x60
cmp rbx, rdi
jne 0x1800b6aa0
mov rcx, qword [0x1802577b8]
mov rax, qword [rcx]
lea rdx, [0x1802527d8]
call qword [rax + 0x28]
mov rcx, qword [0x180252148]
mov rax, qword [rcx]
cmp rax, rcx
je 0x1800b6b2d
mov r8, qword [rax + 0x10]
test r8, r8
je 0x1800b6b25
mov edx, dword [rax + 0x18]
mov dword [r8 + 0x28], edx
mov rax, qword [rax]
cmp rax, rcx
jne 0x1800b6b15
cmp byte [0x180266991], sil
je 0x1800b6b4f
mov rcx, qword [0x1802577c8]
mov rax, qword [rcx]
mov byte [0x180266991], sil
xor edx, edx
call qword [rax + 0x1a0]
mov dword [rbp + 0x20], 0xffffffff
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.18017fdd0
mov dword [rbp + 0x20], 0xffffffff
mov dl, 1
lea rcx, [rbp + 0x20]
call fcn.18017fdd0
mov rcx, qword [0x180257750]
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
test eax, eax
je 0x1800b6bb2
mov rbx, qword [0x1802580c0]
test rbx, rbx
je 0x1800b6bb2
mov rcx, qword [0x180257750]
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rax, qword [rbx]
mov rdx, qword [rax + 0x7f8]
mov rcx, rbx
call rdx
lea rdx, str.cl_wpn_sway_interp
call fcn.1801a1e90
test rax, rax
je 0x1800b6bd0
lea rcx, [rax + 0x30]
mov rax, qword [rcx]
xorps xmm1, xmm1
call qword [rax + 8]
lea rdx, str.cl_wpn_sway_scale
call fcn.1801a1e90
test rax, rax
je 0x1800b6bee
lea rcx, [rax + 0x30]
mov rax, qword [rcx]
xorps xmm1, xmm1
call qword [rax + 8]
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x180266560]
call fcn.180171df0
mov rcx, qword [0x1802527f0]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [0x1802527f0]
mov rax, qword [rcx]
call qword [rax + 0xc8]
mov qword [0x1802527f0], rsi
mov rcx, qword [0x1802527f8]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [0x1802527f8]
mov rax, qword [rcx]
call qword [rax + 0xc8]
mov qword [0x1802527f8], rsi
mov rcx, qword [0x180252800]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [0x180252800]
mov rax, qword [rcx]
call qword [rax + 0xc8]
mov qword [0x180252800], rsi
mov rcx, qword [0x1802527b0]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [0x1802527b0]
mov rax, qword [rcx]
call qword [rax + 0xc8]
mov qword [0x1802527b0], rsi
mov rcx, qword [0x1802527a8]
mov rax, qword [rcx]
call qword [rax + 0x68]
mov rcx, qword [0x1802527a8]
mov rax, qword [rcx]
call qword [rax + 0x190]
mov qword [0x1802527a8], rsi
mov dword [rbp + 0x20], 0xffff96af
mov eax, dword [rbp + 0x20]
mov dword [rbp + 0x28], eax
mov rcx, qword [0x180257708]
mov rax, qword [rcx]
lea r9, [0x18021d0a0]
lea r8, str.__s_
lea rdx, [rbp + 0x28]
call qword [rax + 0xb8]
lea r9, str.Unloaded
mov rcx, qword [0x180257708]
mov rax, qword [rcx]
mov dword [rbp + 0x20], 0xffffffff
lea r8, [0x18022c684]
lea rdx, [rbp + 0x20]
call qword [rax + 0xb8]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret