Function at 0x180003f40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1800810c0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, r8
mov r15, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
xor ecx, ecx
mov rax, qword [r14 + 0x30]
cmp rax, qword [r14 + 0x38]
je 0x180003f8e
mov qword [r14 + 0x38], rax
mov qword [r14 + 0x48], 0x13
xorps xmm0, xmm0
mov rax, qword [r14]
mov qword [rbp + 0x158], rax
movdqu xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rcx
mov ecx, 8
call fcn.18000a524
mov rcx, rax
mov qword [rbp + 0x120], rax
add rax, 8
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x158]
mov qword [rcx], rax
lea rax, [rcx + 8]
mov qword [rbp + 0x128], rax
xor edx, edx
mov r8d, 0x148
lea rcx, [rbp - 0x30]
call fcn.18001f2a0
mov rbx, qword [r14]
lea rax, [rbx + 5]
cmp rbx, rax
jae 0x180004207
nop word [rax + rax]
xor eax, eax
mov qword [rbp + 0x138], rax
mov dword [rbp + 0x140], eax
xor edx, edx
mov r8d, 2
lea rcx, [rbp + 0x138]
call fcn.1800074e0
test eax, eax
js 0x180004353
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf
mov r8, rbx
xor edx, edx
lea rcx, [rbp + 0x138]
call fcn.1800073e0
shr eax, 0x1f
not al
test al, 1
je 0x180004353
movzx r9d, byte [rbp - 0x28]
add qword [r14 + 0x48], r9
mov rdx, qword [r14 + 0x38]
mov r8, rbx
lea rcx, [r14 + 0x30]
call fcn.180005680
movzx eax, byte [rbp - 0x10]
shr al, 7
test al, 1
je 0x1800041f0
cmp byte [rbp + 0xe0], 0x20
jne 0x1800040d1
movsxd rax, dword [rbp + 0xd8]
movzx ecx, byte [rbp - 0x28]
add rax, rbx
add rcx, rax
mov qword [rbp + 0x150], rcx
mov rdx, qword [rbp + 0x128]
cmp rdx, qword [rbp + 0x130]
je 0x180004112
mov qword [rdx], rcx
add qword [rbp + 0x128], 8
jmp 0x1800041f0
cmp byte [rbp + 0xf8], 0x20
jne 0x18000412a
movsxd rax, dword [rbp + 0xf0]
movzx ecx, byte [rbp - 0x28]
add rax, rbx
add rcx, rax
mov qword [rbp + 0x150], rcx
mov rdx, qword [rbp + 0x128]
cmp rdx, qword [rbp + 0x130]
je 0x180004112
mov qword [rdx], rcx
add qword [rbp + 0x128], 8
jmp 0x1800041f0
lea r8, [rbp + 0x150]
lea rcx, [rbp + 0x120]
call fcn.1800058c0
jmp 0x1800041f0
mov eax, dword [rbp + 0x2c]
cmp eax, 0x1d
jne 0x180004190
cmp dword [rbp + 0x38], 1
jne 0x1800042c4
movsxd rax, dword [rbp + 0xf0]
movzx ecx, byte [rbp - 0x28]
add rax, rbx
add rcx, rax
mov qword [rbp + 0x150], rcx
mov rdx, qword [rbp + 0x128]
cmp rdx, qword [rbp + 0x130]
je 0x180004176
mov qword [rdx], rcx
add qword [rbp + 0x128], 8
add qword [r14 + 0x48], 4
jmp 0x1800041f0
lea r8, [rbp + 0x150]
lea rcx, [rbp + 0x120]
call fcn.1800058c0
add qword [r14 + 0x48], 4
jmp 0x1800041f0
cmp eax, 0x65
jne 0x1800042c4
cmp dword [rbp + 0x38], 1
jne 0x1800042c4
movsxd rax, dword [rbp + 0xf0]
movzx ecx, byte [rbp - 0x28]
add rax, rbx
add rcx, rax
mov qword [rbp + 0x150], rcx
mov rdx, qword [rbp + 0x128]
cmp rdx, qword [rbp + 0x130]
je 0x1800041d8
mov qword [rdx], rcx
add qword [rbp + 0x128], 8
jmp 0x1800041eb
lea r8, [rbp + 0x150]
lea rcx, [rbp + 0x120]
call fcn.1800058c0
add qword [r14 + 0x48], 3
movzx eax, byte [rbp - 0x28]
add rbx, rax
mov rax, qword [r14]
add rax, 5
cmp rbx, rax
jb 0x180004010
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rax
mov rdi, qword [rdi]
mov rsi, qword [r14 + 0x48]
lea rbx, [rdi + 0x28]
mov qword [rbp + 0x150], rbx
mov rcx, rbx
call fcn.180009ce0
test eax, eax
jne 0x180004a7f
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x180004a69
mov qword [rsp + 0x20], 0x7fffffff
mov r9, rsi
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x160]
mov rcx, rdi
call fcn.180002b90
nop
mov rcx, rbx
call fcn.180009d08
nop
cmp byte [rbp + 0x180], 0
jne 0x18000435f
mov byte [rbp + 0x138], 0
movzx eax, byte [rbp + 0x160]
mov byte [rbp + 0x140], al
xor eax, eax
mov dword [rbp + 0x141], eax
mov word [rbp + 0x145], ax
mov byte [rbp + 0x147], al
movups xmm0, xmmword [rbp + 0x138]
movups xmmword [r15], xmm0
mov byte [r15 + 0x10], al
jmp 0x1800042e2
mov byte [rbp + 0x138], 4
mov qword [rbp + 0x140], rbx
movups xmm0, xmmword [rbp + 0x138]
movups xmmword [r15], xmm0
mov byte [r15 + 0x10], 0
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x180004326
mov rdx, qword [rbp + 0x130]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004321
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004a79
call fcn.18000a438
mov rax, r15
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.18000a0a0
mov rbx, qword [rsp + 0x308]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov byte [rbp + 0x138], 1
jmp 0x1800042cb
lea r12, [r14 + 0x10]
lea rax, [rbp + 0x160]
mov edi, 0xffffffff
cmp r12, rax
je 0x1800043f8
mov rcx, r12
call fcn.180002520
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x168]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x160], xmm0
mov qword [r12], rax
mov rbx, qword [r12 + 8]
mov qword [r12 + 8], rcx
test rbx, rbx
je 0x1800043d5
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1800043d5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1800043d5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbp + 0x170]
mov qword [r12 + 0x10], rax
mov rax, qword [rbp + 0x178]
mov qword [r12 + 0x18], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x170], xmm0
mov rsi, qword [r14]
mov rbx, qword [r14 + 0x20]
mov r15, qword [r14 + 0x38]
mov rdx, qword [r14 + 0x30]
mov rax, r15
sub rax, rdx
add rax, rsi
cmp rsi, rax
jae 0x18000460d
nop dword [rax]
xor eax, eax
mov qword [rbp + 0x138], rax
mov dword [rbp + 0x140], eax
xor edx, edx
mov r8d, 2
lea rcx, [rbp + 0x138]
call fcn.1800074e0
test eax, eax
js 0x1800046ec
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x138]
call fcn.1800073e0
shr eax, 0x1f
not al
test al, 1
je 0x1800046ec
movzx eax, byte [rbp - 0x10]
shr al, 7
test al, 1
je 0x180004523
cmp byte [rbp + 0xe0], 0x20
jne 0x1800044d4
movzx eax, byte [rbp - 0x28]
test al, al
je 0x1800044aa
mov r8d, eax
mov rdx, rsi
mov rcx, rbx
call fcn.18001ec00
movzx eax, byte [rbp - 0x28]
movzx eax, al
lea rcx, [rax + rsi]
add rcx, qword [rbp + 0xd8]
sub rcx, rax
sub rcx, rbx
movzx eax, byte [rbp + 0xe1]
mov dword [rax + rbx], ecx
movzx ecx, byte [rbp - 0x28]
add rbx, rcx
jmp 0x1800045e7
cmp byte [rbp + 0xf8], 0x20
jne 0x180004523
movzx eax, byte [rbp - 0x28]
test al, al
je 0x1800044f7
mov r8d, eax
mov rdx, rsi
mov rcx, rbx
call fcn.18001ec00
movzx eax, byte [rbp - 0x28]
movzx ecx, al
mov rdx, qword [rbp + 0xf0]
add rdx, rcx
add rdx, rsi
sub rdx, rcx
sub rdx, rbx
movzx eax, byte [rbp + 0xf9]
mov dword [rax + rbx], edx
movzx ecx, byte [rbp - 0x28]
add rbx, rcx
jmp 0x1800045e7
mov eax, dword [rbp + 0x2c]
cmp eax, 0x1d
jne 0x18000457d
cmp dword [rbp + 0x38], 1
jne 0x1800045c7
movzx edx, byte [rbp - 0x28]
add rdx, qword [rbp + 0xf0]
add rdx, rsi
mov r8, rdx
sub r8, rbx
sub r8, 6
mov rax, qword [r14]
sub rax, qword [r14 + 0x30]
add rax, qword [r14 + 0x38]
cmp rdx, rax
cmovb r8, qword [rbp + 0xf0]
mov byte [rbx], 0xf
movzx eax, byte [rbp - 0x1c]
add al, 0x10
mov byte [rbx + 1], al
mov dword [rbx + 2], r8d
add rbx, 6
movzx ecx, byte [rbp - 0x28]
jmp 0x1800045e7
cmp eax, 0x65
jne 0x1800045c7
cmp dword [rbp + 0x38], 1
jne 0x1800045c7
movzx r8d, byte [rbp - 0x28]
add r8, qword [rbp + 0xf0]
add r8, rsi
mov rcx, r8
sub rcx, rbx
sub rcx, 5
mov rax, qword [r14]
sub rax, qword [r14 + 0x30]
add rax, qword [r14 + 0x38]
cmp r8, rax
cmovb rcx, qword [rbp + 0xf0]
mov byte [rbx], 0xe9
mov dword [rbx + 1], ecx
add rbx, 5
movzx ecx, byte [rbp - 0x28]
jmp 0x1800045e7
movzx ecx, byte [rbp - 0x28]
test cl, cl
je 0x1800045e1
mov r8d, ecx
mov rdx, rsi
mov rcx, rbx
call fcn.18001ec00
movzx ecx, byte [rbp - 0x28]
movzx eax, cl
add rbx, rax
movzx eax, cl
add rsi, rax
mov r15, qword [r14 + 0x38]
mov rdx, qword [r14 + 0x30]
mov rcx, qword [r14]
mov rax, r15
sub rax, rdx
add rax, rcx
cmp rsi, rax
jb 0x180004420
mov rsi, rcx
mov rcx, qword [r14 + 0x48]
mov rbx, qword [r14 + 0x20]
add rcx, 0xffffffffffffffed
add rbx, rcx
mov qword [rbp - 0x40], rbx
sub r15, rdx
add r15, rsi
xor esi, esi
mov dword [rbp + 0x150], esi
lea r9, [rbp + 0x150]
mov edx, 5
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800047cb
mov byte [rbp + 0x138], 5
mov eax, dword [rbp + 0x139]
mov dword [rbp + 0x139], eax
movzx eax, word [rbp + 0x13d]
mov word [rbp + 0x13d], ax
movzx eax, byte [rbp + 0x13f]
mov byte [rbp + 0x13f], al
mov qword [rbp + 0x140], rbx
movups xmm0, xmmword [rbp + 0x138]
mov r15, qword [rsp + 0x38]
movups xmmword [r15], xmm0
mov byte [r15 + 0x10], sil
cmp byte [rbp + 0x180], sil
je 0x1800042e2
lea rcx, [rbp + 0x160]
call fcn.180002520
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x1800046e7
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1800046e7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1800046e7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
jmp 0x1800042e2
mov rcx, qword [r12]
test rcx, rcx
je 0x180004756
mov rdx, qword [r12 + 0x10]
test rdx, rdx
je 0x180004756
mov r8, qword [r12 + 0x18]
test r8, r8
je 0x180004756
call fcn.1800029f0
xor eax, eax
mov qword [r12 + 0x10], rax
mov qword [r12 + 0x18], rax
mov qword [r12], rax
mov rbx, qword [r12 + 8]
mov qword [r12 + 8], rax
test rbx, rbx
je 0x180004756
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x180004756
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x180004756
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov byte [rbp + 0x138], 1
mov qword [rbp + 0x140], rsi
movups xmm0, xmmword [rbp + 0x138]
mov r15, qword [rsp + 0x38]
movups xmmword [r15], xmm0
mov byte [r15 + 0x10], 0
cmp byte [rbp + 0x180], 0
je 0x1800042e2
lea rcx, [rbp + 0x160]
call fcn.180002520
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x1800047c6
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1800047c6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1800047c6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
jmp 0x1800042e2
mov byte [rbp + 0x158], 0xe9
sub r15d, ebx
sub r15d, 5
mov dword [rbp + 0x159], r15d
mov eax, dword [rbp + 0x158]
mov dword [rbx], eax
movzx eax, byte [rbp + 0x15c]
mov byte [rbx + 4], al
test rbx, rbx
je 0x180004819
mov dword [rbp + 0x158], esi
lea r9, [rbp + 0x158]
mov r8d, dword [rbp + 0x150]
mov edx, 5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rbp - 0x40]
lea rdx, [rax + 5]
lea r9, [rax + 0xb]
mov qword [rsp + 0x20], 6
mov r8, qword [r14 + 8]
lea rcx, [rbp + 0x138]
call fcn.1800034f0
cmp byte [rbp + 0x148], sil
jne 0x1800048ad
movups xmm0, xmmword [rbp + 0x138]
mov r15, qword [rsp + 0x38]
movups xmmword [r15], xmm0
mov byte [r15 + 0x10], sil
cmp byte [rbp + 0x180], 0
je 0x1800042e2
lea rcx, [rbp + 0x160]
call fcn.180002520
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x1800048a8
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1800048a8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1800048a8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
jmp 0x1800042e2
mov byte [rbp + 0x198], sil
lea rax, [0x18007cec8]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], r14
lea rax, [rbp - 0x80]
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x138], r14
lea rax, [rbp - 0x40]
mov qword [rbp + 0x140], rax
lea rax, [rbp + 0x188]
mov qword [rbp + 0x148], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__private:_class_std::expected_void__struct_safetyhook::InlineHook::Error____cdecl_safetyhook::InlineHook::e9_hook_class_std::shared_ptr_class_safetyhook::Allocator__const____ptr64____ptr64::_2::_lambda_1___void___.0
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rbp + 0x138]
movups xmmword [rsp + 0x48], xmm0
movsd xmm1, qword [rbp + 0x148]
movsd qword [rsp + 0x58], xmm1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.180004fb0
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18000494a
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rsp + 0x78], rsi
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x180004963
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov r15, qword [rsp + 0x38]
cmp byte [rbp + 0x198], 0
je 0x1800049d3
movups xmm0, xmmword [rbp + 0x188]
movups xmmword [r15], xmm0
mov byte [r15 + 0x10], 0
cmp byte [rbp + 0x180], 0
je 0x1800042e2
lea rcx, [rbp + 0x160]
call fcn.180002520
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x1800049ce
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1800049ce
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1800049ce
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
jmp 0x1800042e2
mov byte [r15 + 0x10], 1
cmp byte [rbp + 0x180], 0
je 0x180004a21
lea rcx, [rbp + 0x160]
call fcn.180002520
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x180004a21
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x180004a21
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x180004a21
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x180004326
mov rdx, qword [rbp + 0x130]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004321
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004a79
jmp 0x180004321
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call fcn.180009a24
nop
call fcn.18001276c
nop
mov ecx, 5
call fcn.180009a24
int3