Function at 0x1800480e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [0x180361380]
test rcx, rcx
je 0x180048366
mov rax, qword [0x1803613a8]
mov qword [rsp + 0x38], rsi
mov rsi, qword [0x1803613a0]
sub rax, rsi
jne 0x18004813e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.WriteExeProtected:NewBytes_Zero
call fcn.18000b990
lea rdx, [0x18000bb70]
mov rcx, rax
mov rsi, qword [rsp + 0x38]
add rsp, 0x48
jmp qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x60], rbx
xor ebx, ebx
mov qword [rsp + 0x40], rbp
mov ebp, ebx
mov qword [rsp + 0x30], rdi
xor dil, dil
test rax, rax
je 0x1800482bc
mov qword [rsp + 0x28], r14
mov r14d, ebx
mov qword [rsp + 0x20], r15
lea r15d, [rbx + 1]
nop
mov edx, ebp
call fcn.180134850
cmp byte [r14 + rsi], al
lea r14, [r14 + 1]
mov rdx, qword [0x1803613a8]
mov rsi, qword [0x1803613a0]
mov rcx, rdx
movzx edi, dil
cmovne edi, r15d
inc ebp
movsxd rax, ebp
sub rcx, rsi
cmp rax, rcx
jae 0x1800481ae
mov rcx, qword [0x180361380]
jmp 0x180048170
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
test dil, dil
je 0x1800482b5
mov rax, qword [0x180361388]
cmp rax, qword [0x180361390]
je 0x1800481d8
mov qword [0x180361390], rax
mov edi, ebx
test rcx, rcx
je 0x18004823c
nop
mov rcx, qword [0x180361380]
mov edx, edi
call fcn.180134850
mov rdx, qword [0x180361390]
cmp rdx, qword [0x180361398]
mov byte [rsp + 0x50], al
je 0x18004820d
mov byte [rdx], al
inc qword [0x180361390]
jmp 0x18004821e
lea r8, [rsp + 0x50]
lea rcx, [0x180361388]
call fcn.18005ea70
mov rdx, qword [0x1803613a8]
inc edi
mov rsi, qword [0x1803613a0]
mov rcx, rdx
sub rcx, rsi
movsxd rax, edi
cmp rax, rcx
jb 0x1800481e0
mov rcx, qword [0x180361380]
lea r9, [rsp + 0x58]
sub rdx, rsi
mov dword [rsp + 0x58], ebx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r10, qword [0x1803613a8]
mov rdx, qword [0x1803613a0]
cmp r10, rdx
je 0x1800482a6
mov rdi, rbx
movzx r8d, byte [rdi + rdx]
mov edx, ebx
mov rcx, qword [0x180361380]
call fcn.180134b10
mov r10, qword [0x1803613a8]
lea rdi, [rdi + 1]
mov rdx, qword [0x1803613a0]
inc ebx
mov rcx, r10
movsxd rax, ebx
sub rcx, rdx
cmp rax, rcx
jb 0x180048271
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
jmp 0x18004833f
mov rcx, qword [0x180361380]
mov rdx, qword [0x180361390]
lea r9, [rsp + 0x50]
sub rdx, qword [0x180361388]
mov r8d, 0x40
mov dword [rsp + 0x50], ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r10, qword [0x180361390]
mov rdx, qword [0x180361388]
cmp r10, rdx
je 0x180048335
mov rdi, rbx
nop word [rax + rax]
movzx r8d, byte [rdi + rdx]
mov edx, ebx
mov rcx, qword [0x180361380]
call fcn.180134b10
mov r10, qword [0x180361390]
lea rdi, [rdi + 1]
mov rdx, qword [0x180361388]
inc ebx
mov rcx, r10
movsxd rax, ebx
sub rcx, rdx
cmp rax, rcx
jb 0x180048300
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rcx, qword [0x180361380]
sub r10, rdx
mov rdx, r10
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x48
ret