Function at 0x18002e440
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
mov rbp, r8
mov r14, rdx
mov rsi, rcx
lea rax, vtable.CHook.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov byte [rcx + 0x10], 1
xor eax, eax
mov dword [rcx + 0x14], eax
xor r15d, r15d
xchg dword [rcx + 0x14], eax
mov qword [rcx + 0x18], r15
lea rax, vtable.CFunctionHookSpec_void____cdecl___void____ptr64__void____ptr64__void____ptr64___void__void____ptr64__void____ptr64__void____ptr64_.0
mov qword [rcx], rax
lea rbx, [rcx + 0x20]
mov qword [rsp + 0x88], rbx
mov qword [rbx + 0x38], r15
mov rcx, qword [r8 + 0x38]
test rcx, rcx
je 0x18002e4b3
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
mov qword [rbx + 0x38], rax
lea r13, vtable.CMemoryFunction.0
mov qword [rsi + 0x68], r13
mov word [rsi + 0x70], 0x100
mov qword [rsi + 0x80], 0x3a
mov ecx, 0x3a
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsi + 0x78], rax
test rax, rax
setne cl
mov byte [rsi + 0x70], cl
test rax, rax
je 0x18002e509
lea r9, [rsi + 0x88]
mov r8d, 0x40
mov rdx, qword [rsi + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, vtable.CDetourBridge.0
mov qword [rsi + 0x68], rax
mov rax, qword [rsi + 0x78]
mov dword [rax], 0x52515350
mov r12d, 0xb848
mov word [rax + 4], r12w
lea rcx, [fcn.1800317e0]
mov qword [rax + 6], rcx
mov dword [rax + 0xe], 0xbb48d0ff
mov ecx, 0x8948
mov word [rax + 0x1a], cx
mov byte [rax + 0x1c], 0x18
mov ecx, 0x595a
mov word [rax + 0x1d], cx
mov byte [rax + 0x1f], 0x5b
mov dword [rax + 0x20], 0x8ec8348
mov word [rax + 0x24], r12w
mov dword [rax + 0x2e], 0x24048948
movabs rcx, 0x8c20824448b48
mov qword [rax + 0x32], rcx
lea rcx, [0x18002eca0]
mov qword [rax + 0x26], rcx
mov qword [rax + 0x12], rsi
mov rbx, qword [rsi + 0x80]
mov rdi, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov qword [rsi + 0x90], r13
mov word [rsi + 0x98], 0x100
mov qword [rsi + 0xa8], 0x4e
mov ecx, 0x4e
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsi + 0xa0], rax
test rax, rax
setne cl
mov byte [rsi + 0x98], cl
test rax, rax
je 0x18002e600
lea r9, [rsi + 0xb0]
mov r8d, 0x40
mov rdx, qword [rsi + 0xa8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, vtable.COriginalBridge.0
mov qword [rsi + 0x90], rax
mov rax, qword [rsi + 0xa0]
mov dword [rax], 0x52515350
mov word [rax + 4], r12w
lea rcx, [fcn.1800317e0]
mov qword [rax + 6], rcx
mov dword [rax + 0xe], 0xbb48d0ff
mov r9d, 0x8948
mov word [rax + 0x1a], r9w
mov byte [rax + 0x1c], 0x18
mov word [rax + 0x1d], r12w
lea rcx, [0x180031800]
mov qword [rax + 0x1f], rcx
mov dword [rax + 0x27], 0xbb48d0ff
mov word [rax + 0x33], r9w
mov byte [rax + 0x35], 0x18
mov ecx, 0x595a
mov word [rax + 0x36], cx
mov byte [rax + 0x38], 0x5b
mov dword [rax + 0x39], 0x8ec8348
mov word [rax + 0x3d], r12w
mov dword [rax + 0x47], 0x24048948
mov byte [rax + 0x4b], 0xc2
mov ecx, 8
mov word [rax + 0x4c], cx
mov qword [rsp + 0x78], r15
cmp byte [rsi + 0x10], 0
je 0x18002e6c1
cmp byte [rsi + 0x70], 0
je 0x18002e6c1
cmp byte [rsi + 0x98], 0
je 0x18002e6c1
lea r8, [rsp + 0x78]
mov rdx, qword [rsi + 0x78]
mov rcx, r14
call fcn.1800310b0
test eax, eax
jne 0x18002e6c1
mov al, 1
jmp 0x18002e6c3
xor al, al
mov byte [rsi + 0x10], al
test al, al
cmovne r14, qword [rsp + 0x78]
mov qword [rsi + 0x60], r14
mov rax, qword [rsi + 0xa0]
lea rcx, [0x18002ed10]
mov qword [rax + 0x3f], rcx
mov qword [rax + 0x12], rsi
mov qword [rax + 0x2b], r15
mov rbx, qword [rsi + 0xa8]
mov rdi, qword [rsi + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsi + 0xa0]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x18002e733
mov rax, qword [rcx]
cmp rcx, rbp
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x38], r15
mov rax, rsi
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret