Function at 0x180021a54
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, qword [0x180046008]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, ecx
imul rax, rax, 0x38
add rax, qword [0x1800474c8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
and al, 1
mov byte [rsp + 0x2f], al
mov r15d, edx
and r15b, 1
lea ebp, [r15 + r15]
shl r15b, 2
test edx, edx
mov eax, 0xd75914cb
mov esi, 0xbe24c12a
cmove esi, eax
mov eax, 0x24a6ad2d
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, eax
cmp eax, 0x20624d24
jg 0x180021b6e
cmp ecx, 0xd75914ca
jg 0x180021bbe
cmp ecx, 0xabb3f525
jle 0x180021c2a
cmp ecx, 0xabb3f526
je 0x180021c6c
mov eax, ecx
cmp ecx, 0xbe24c12a
jne 0x180021af0
mov rax, qword [rsp + 0x30]
mov byte [rax], 0xe9
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 8]
mov rdx, qword [rsp + 0x30]
movabs rbx, 0xa96191e56cada582
sub ecx, ebx
sub ecx, edx
add ecx, ebx
add ecx, 0xfffffffb
mov dword [rax + 1], ecx
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
not al
or al, 0xfe
cmp al, 0xff
mov eax, 0x21235876
mov ecx, 0x92a099a
cmove eax, ecx
jmp 0x180021af0
cmp ecx, 0x4acee437
jg 0x180021be9
cmp ecx, 0x20624d25
je 0x180021c86
cmp ecx, 0x21235876
je 0x180021c95
mov eax, ecx
cmp ecx, 0x24a6ad2d
jne 0x180021af0
cmp byte [rsp + 0x2f], 0
mov eax, 0x62a151f8
mov ecx, 0x91194161
cmove eax, ecx
mov r14d, 5
mov r13, qword [rsp + 0x60]
jmp 0x180021af0
cmp ecx, 0xd75914cb
je 0x180021cac
cmp ecx, 0xfa448b35
je 0x180021ccc
mov eax, ecx
cmp ecx, 0x92a099a
je 0x180021d5b
jmp 0x180021af0
cmp ecx, 0x4acee438
je 0x180021d46
mov eax, esi
cmp ecx, 0x53db924d
je 0x180021af0
mov eax, ecx
cmp ecx, 0x62a151f8
jne 0x180021af0
mov r13, qword [rsp + 0x60]
add r13, 0xfffffffffffffffb
mov eax, 0x91194161
mov r14d, 7
jmp 0x180021af0
cmp ecx, 0x91194161
jne 0x180021d65
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x30], r13
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov r8d, 0x40
lea r9, [rsp + 0x6c]
call r12
test eax, eax
mov eax, 0x53db924d
mov ecx, 0x20624d25
cmove eax, ecx
jmp 0x180021af0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov dl, byte [rax + 0x1c]
mov byte [rcx + 4], dl
mov eax, dword [rax + 0x18]
mov dword [rcx], eax
jmp 0x180021d5b
mov eax, 0x976ae61d
mov edi, 0xa
jmp 0x180021af0
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov word [rax], 0xf9eb
mov eax, 0x92a099a
jmp 0x180021af0
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov ecx, eax
xor cl, 0xfe
test cl, al
mov eax, 0x4acee438
mov ecx, 0xabb3f526
cmove eax, ecx
jmp 0x180021af0
mov r8d, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x6c]
call r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov ecx, eax
not cl
or cl, 6
mov edx, ebp
not dl
mov ebx, ecx
and bl, 0x16
and al, 0xe9
or al, bl
or cl, dl
and dl, 0x16
mov ebx, ebp
and bl, 1
or bl, dl
xor bl, al
not cl
or cl, bl
mov eax, ecx
and al, r15b
xor cl, r15b
or cl, al
mov rax, qword [rsp + 0x40]
mov byte [rax], cl
mov eax, 0x976ae61d
xor edi, edi
jmp 0x180021af0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rax + 0x18]
mov eax, dword [rax + 0x1b]
mov dword [rcx + 3], eax
mov dword [rcx], edx
mov eax, 0xfa448b35
jmp 0x180021af0
mov eax, ecx
cmp ecx, 0x976ae61d
jne 0x180021af0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180026fa0
mov eax, edi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret