Function at 0x18001921b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, qword [0x180044008]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, ecx
imul rax, rax, 0x38
add rax, qword [0x180045c78]
mov qword [rsp + 0x38], rax
lea r14, [rsp + 0x6c]
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
and al, 1
mov byte [rsp + 0x2f], al
mov ebx, edx
and bl, 1
lea eax, [rbx + rbx]
shl bl, 2
or bl, al
test edx, edx
mov eax, 0x5fa019d9
mov ebp, 0x68de2d7c
cmove ebp, eax
mov eax, 0x67b34c3
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r13d, 0x52f4172e
cmp eax, 0x52f4172d
jg 0x180019305
cmp eax, 0xef6572ff
jle 0x180019343
cmp eax, 0x286ac2f7
jg 0x1800193a3
cmp eax, 0xef657300
je 0x1800193f9
cmp eax, 0x67b34c3
jne 0x1800192bb
cmp byte [rsp + 0x2f], 0
mov eax, 0xef657300
mov ecx, 0x9e14fc24
cmove eax, ecx
mov r12d, 5
mov r15, qword [rsp + 0x60]
jmp 0x1800192bb
cmp eax, 0x68de2d7b
jg 0x18001937b
cmp eax, 0x52f4172e
je 0x1800194b3
cmp eax, 0x5f1c2e3d
je 0x180019412
cmp eax, 0x5fa019d9
jne 0x1800192bb
mov rax, qword [rsp + 0x40]
test byte [rax], 1
mov eax, 0xacfe3eee
mov ecx, 0x700bf4c8
cmove eax, ecx
jmp 0x1800192bb
cmp eax, 0x9e14fc24
je 0x180019421
cmp eax, 0xacfe3eee
je 0x180019454
cmp eax, 0xdcd93c6f
jne 0x1800192bb
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov word [rax], 0xf9eb
mov eax, 0x52f4172e
jmp 0x1800192bb
cmp eax, 0x68de2d7c
je 0x18001946b
cmp eax, 0x700bf4c8
je 0x18001949e
cmp eax, 0x70d64082
jne 0x1800192bb
mov eax, ebp
jmp 0x1800192bb
cmp eax, 0x3b43ac81
jne 0x1800194bd
mov r8d, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov r9, r14
call rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
and al, 0xf9
or al, bl
mov rcx, qword [rsp + 0x40]
mov byte [rcx], al
mov eax, 0x286ac2f8
xor edi, edi
jmp 0x1800192bb
mov r15, qword [rsp + 0x60]
add r15, 0xfffffffffffffffb
mov eax, 0x9e14fc24
mov r12d, 7
jmp 0x1800192bb
mov eax, 0x286ac2f8
mov edi, 0xa
jmp 0x1800192bb
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x30], r15
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov r8d, 0x40
mov r9, r14
call rsi
test eax, eax
mov eax, 0x70d64082
mov ecx, 0x5f1c2e3d
cmove eax, ecx
jmp 0x1800192bb
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rax + 0x18]
mov eax, dword [rax + 0x1b]
mov dword [rcx + 3], eax
mov dword [rcx], edx
jmp 0x1800194b3
mov rax, qword [rsp + 0x30]
mov byte [rax], 0xe9
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 8]
mov rdx, qword [rsp + 0x30]
sub ecx, edx
add ecx, 0xfffffffb
mov dword [rax + 1], ecx
mov rax, qword [rsp + 0x40]
test byte [rax], 1
mov eax, 0xdcd93c6f
cmove eax, r13d
jmp 0x1800192bb
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov dl, byte [rax + 0x1c]
mov byte [rcx + 4], dl
mov eax, dword [rax + 0x18]
mov dword [rcx], eax
mov eax, 0x3b43ac81
jmp 0x1800192bb
cmp eax, 0x286ac2f8
jne 0x1800192bb
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18001e3c0
mov eax, edi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret