Function at 0x18002b440
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x30
cmp dword [rcx + 0x10], 0
mov rbx, rcx
mov rbp, rcx
jne 0x18002b464
mov rax, qword [rcx]
cmp byte [rax + 8], 3
ja 0x18002b464
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x50], rdi
test rax, rax
je 0x18002b482
cmp dword [rax + 0x10], 0
jne 0x18002b482
cmp dword [rbx + 0x10], 1
jne 0x18002b5f9
mov rdi, qword [rbx + 0x40]
call qword [0x18002f7b8]
mov r8, rax
mov rdx, rdi
mov eax, dword [0x180045d10]
dec eax
movsxd rcx, eax
mov rax, qword [r8]
mov rcx, qword [rax + rcx*8]
add rcx, 0x370
call qword [0x18002f818]
test rax, rax
je 0x18002b5a6
mov rdi, qword [rax]
test rdi, rdi
je 0x18002b5a6
movzx eax, byte [rbx + 0x14]
test al, 2
je 0x18002b559
movzx eax, byte [rdi + 0x14]
mov rcx, rdi
test al, 2
je 0x18002b517
call fcn.18002b390
test rax, rax
je 0x18002b4ef
mov rcx, rax
call fcn.18002ae10
cmp rbx, rdi
je 0x18002b505
mov rcx, rbx
call fcn.18002ad50
mov rcx, rbx
call qword [0x18002f6f0]
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
and al, 0xee
or al, 2
mov byte [rdi + 0x14], al
call fcn.18002b390
test rax, rax
je 0x18002b530
mov rcx, rax
call fcn.18002ae10
cmp rbx, rdi
je 0x18002b546
mov rcx, rbx
call fcn.18002ad50
mov rcx, rbx
call qword [0x18002f6f0]
mov rax, rdi
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
movzx ecx, byte [rdi + 0x14]
test cl, 2
jne 0x18002b569
and al, 0x11
or al, cl
mov byte [rdi + 0x14], al
mov rcx, rdi
call fcn.18002b390
test rax, rax
je 0x18002b57e
mov rcx, rax
call fcn.18002ae10
cmp rbx, rdi
je 0x18002b505
mov rcx, rbx
call fcn.18002ad50
mov rcx, rbx
call qword [0x18002f6f0]
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x18002b5b8
cmp dword [rax + 0x10], 1
jne 0x18002b5b8
inc dword [rax + 0x18]
mov rdi, qword [rbx + 0x40]
call qword [0x18002f7b8]
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov r8, rax
mov dword [rsp + 0x28], select
mov eax, dword [0x180045d10]
dec eax
movsxd rcx, eax
mov rax, qword [r8]
lea r8, [rsp + 0x20]
mov rcx, qword [rax + rcx*8]
add rcx, 0x370
call qword [0x18002f630]
call qword [0x18002f7b8]
mov rdx, rax
mov r8, rbx
mov eax, dword [0x180045d10]
dec eax
movsxd rcx, eax
mov rax, qword [rdx]
mov rdx, qword [rbx]
mov rcx, qword [rax + rcx*8]
add rcx, 0x340
call fcn.18000a630
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x18002b651
cmp dword [rax + 0x10], 0
jne 0x18002b651
mov rdx, qword [rax]
test byte [rdx + 9], 4
je 0x18002b651
mov rdx, qword [rdx]
mov rcx, rbx
call fcn.18002adb0
mov rcx, rax
call fcn.18002ae10
cmp dword [rbx + 0x10], 0
jne 0x18002b776
mov rdi, qword [rbx + 0x30]
test rdi, rdi
je 0x18002b762
mov qword [rsp + 0x48], rsi
call qword [0x18002f7b8]
mov rdx, rax
mov eax, dword [0x180045d10]
dec eax
movsxd rcx, eax
mov rax, qword [rdx]
mov rdx, qword [rax + rcx*8]
mov ecx, dword [rdx + 0x360]
mov r8, qword [rdx + 0x368]
dec ecx
test r8, r8
je 0x18002b6cf
nop dword [rax]
mov rax, rdi
shr rax, cl
test al, 1
je 0x18002b6b0
mov r8, qword [r8 + 8]
jmp 0x18002b6b3
mov r8, qword [r8]
test r8, r8
je 0x18002b6cf
mov eax, ecx
dec ecx
test eax, eax
jne 0x18002b6a0
test r8, r8
je 0x18002b6cf
mov rsi, qword [r8 + 8]
add rsi, 8
jmp 0x18002b73e
mov ecx, 0x40
call qword [0x18002f6e0]
mov r8, qword [0x18002f450]
xor r9d, r9d
mov rdi, rax
xor edx, edx
mov rax, qword [rbx + 0x30]
lea rsi, [rdi + 8]
mov rcx, qword [rax + 0x30]
mov qword [rdi], rcx
mov rcx, rsi
call qword [0x18002f738]
call qword [0x18002f7b8]
mov rdx, rax
mov r8, rdi
mov eax, dword [0x180045d10]
dec eax
movsxd rcx, eax
mov rax, qword [rdx]
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rax + rcx*8]
add rcx, 0x358
call fcn.18000a630
mov rax, qword [rbx + 0x30]
lea rcx, [0x18002c820]
mov qword [rax + 0x30], rcx
mov rdx, qword [rbx + 0x38]
lea r8, [rsp + 0x20]
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], select
call qword [0x18002f630]
mov rsi, qword [rsp + 0x48]
mov rax, qword [rbx]
cmp byte [rax + 8], 0xa
jne 0x18002b776
mov rcx, rbx
call fcn.18002b320
mov rbp, rax
movsxd r9, dword [0x180045d00]
mov r10, qword [rbx]
mov rdx, qword [rbx + 8]
dec rdx
lea ecx, [r9 - 1]
add rdx, r10
not ecx
movsxd rcx, ecx
and rdx, rcx
mov r8, rcx
and r8, r10
and rcx, r10
sub rdx, r8
mov r8d, 2
add rdx, r9
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [rsp + 0x50]
mov rax, rbp
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret