Function at 0x18001b800
Capabilities:
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Patch process command line

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x18012c100]
xor rax, rsp
mov qword [rbp + 0x78], rax
xor edi, edi
cmp byte [0x180133024], dil
je 0x18001c132
lea rdx, str.FF_______32_C0_48_____________48_____________0F_____________48__________5F_C3
call fcn.18000ffb0
mov rbx, rax
lea rdx, str.B0_03_0F___________________00_44______________________00
call fcn.18000ffb0
mov r13, rax
lea rdx, str.80_______00_0F___________________00_74____F3_______________
call fcn.18000ffb0
mov r15, rax
lea rdx, str.8B_______85____0F_84_____________83____01_0F_84_____________83____02_74___
call fcn.18000ffb0
mov r12, rax
lea rdx, str.F7_______F7_FF_FF_FF_0F_______C3
call fcn.18000ffb0
mov r14, rax
test rbx, rbx
je 0x18001c0cf
test r13, r13
je 0x18001c0cf
test r15, r15
je 0x18001c0cf
test r12, r12
je 0x18001c0cf
test rax, rax
je 0x18001c0cf
mov rax, rbx
sub rax, qword [0x180133070]
mov qword [rbp + 0x70], rax
lea rsi, [0x18012ce30]
mov rax, rsi
cmp qword [0x18012ce48], 0xf
cmova rax, qword [0x18012ce30]
mov qword [rsp + 0x58], rax
call fcn.1800167e0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
lea rcx, str.Intro_Skip:_Caution:_Address_is_:s:x
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 0x29
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x60], xmm1
movsd xmm0, qword [rsp + 0x50]
movsd qword [rsp + 0x70], xmm0
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, qword [rax + 0x1d8]
call fcn.180039f70
lea r9, [rbp + 0x70]
mov edx, 2
mov r8d, 0x40
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov word [rbx + 2], 0x3b0
lea r9, [rbp + 0x70]
mov r8d, dword [rbp + 0x70]
mov edx, 2
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, r12
sub rax, qword [0x180133070]
mov qword [rsp + 0x58], rax
mov rax, rsi
cmp qword [0x18012ce48], 0xf
cmova rax, qword [0x18012ce30]
mov qword [rbp + 0x70], rax
call fcn.1800167e0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
lea rcx, str.Intro_Skip:_Network_Check:_Address_is_:s:x
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 0x2f
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x60], xmm1
movsd xmm0, qword [rsp + 0x50]
movsd qword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, qword [rax + 0x1d8]
call fcn.180039f70
mov ecx, dword [0x1801322d0]
mov rax, qword gs:[0x58]
mov edx, 0x10
mov rax, qword [rax + rcx*8]
add rax, rdx
mov qword [rsp + 0x60], rax
mov edi, 0xffffffff
mov eax, dword [rax]
cmp dword [0x180133f78], eax
jle 0x18001bb20
lea rcx, [0x180133f78]
call fcn.180068448
cmp dword [0x180133f78], edi
jne 0x18001bb20
mov qword [0x1801338a0], 0x102
xorps xmm0, xmm0
movdqa xmmword [0x180133850], xmm0
xorps xmm1, xmm1
movdqa xmmword [0x180133860], xmm1
movdqa xmmword [0x180133870], xmm0
movdqa xmmword [0x180133880], xmm1
movdqa xmmword [0x180133890], xmm0
movups xmmword [0x1801338b8], xmm1
movups xmmword [0x1801338c8], xmm1
movups xmmword [0x1801338d8], xmm1
mov qword [0x1801338a8], rbx
mov qword [0x1801338b0], rbx
mov dword [0x1801338e8], edi
mov dword [0x1801338ec], ebx
mov qword [0x1801338f0], rbx
movups xmmword [0x1801338f8], xmm0
mov qword [0x1801338f8], rbx
movdqa xmmword [0x180133900], xmm1
mov qword [0x180133910], rbx
mov qword [0x180133918], rbx
lea rcx, [0x180098550]
call fcn.180068854
lea rcx, [0x180133f78]
call fcn.1800683dc
lea r8, [0x18001c160]
mov rdx, r12
lea rcx, [rbp - 0x60]
call fcn.1800026c0
lea rdx, [rbp - 0x60]
lea rcx, [0x180133850]
call fcn.180002c70
mov rax, qword [rbp + 0x40]
mov qword [0x1801338f0], rax
lea rdx, [rbp + 0x48]
lea rcx, [0x1801338f8]
call fcn.180001630
mov rax, qword [rbp + 0x68]
mov qword [0x180133918], rax
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x68], rbx
lea rcx, [rbp + 0x48]
call fcn.1800016e0
mov rbx, qword [rbp + 0x50]
test rbx, rbx
je 0x18001bbad
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18001bbad
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x18001bbad
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
lea rcx, [rbp - 0x60]
call fcn.180002e50
mov rax, r14
sub rax, qword [0x180133070]
mov qword [rsp + 0x58], rax
mov rax, rsi
cmp qword [0x18012ce48], 0xf
cmova rax, qword [0x18012ce30]
mov qword [rbp + 0x70], rax
call fcn.1800167e0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
lea rcx, str.Intro_Skip:_Network_Dialog:_Address_is_:s:x
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x30
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rsp + 0x40]
movaps xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp - 0x70], xmm0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
lea rdx, [rbp - 0x80]
mov rcx, qword [rax + 0x1d8]
call fcn.180039f70
mov r12, qword [rsp + 0x60]
mov eax, dword [r12]
cmp dword [0x180133400], eax
jle 0x18001bd27
lea rcx, [0x180133400]
call fcn.180068448
cmp dword [0x180133400], 0xffffffff
jne 0x18001bd27
mov qword [0x180133380], 0x102
xorps xmm0, xmm0
movdqa xmmword [0x180133330], xmm0
xorps xmm1, xmm1
movdqa xmmword [0x180133340], xmm1
movdqa xmmword [0x180133350], xmm0
movdqa xmmword [0x180133360], xmm1
movdqa xmmword [0x180133370], xmm0
movups xmmword [0x180133398], xmm1
movups xmmword [0x1801333a8], xmm1
movups xmmword [0x1801333b8], xmm1
mov qword [0x180133388], rbx
mov qword [0x180133390], rbx
mov dword [0x1801333c8], edi
mov dword [0x1801333cc], ebx
mov qword [0x1801333d0], rbx
movups xmmword [0x1801333d8], xmm0
mov qword [0x1801333d8], rbx
movdqa xmmword [0x1801333e0], xmm1
mov qword [0x1801333f0], rbx
mov qword [0x1801333f8], rbx
lea rcx, [0x1800984e0]
call fcn.180068854
lea rcx, [0x180133400]
call fcn.1800683dc
lea rdx, [r14 + 0xa]
lea r8, [0x18001c1a0]
lea rcx, [rbp - 0x60]
call fcn.1800026c0
lea rdx, [rbp - 0x60]
lea rcx, [0x180133330]
call fcn.180002c70
mov rax, qword [rbp + 0x40]
mov qword [0x1801333d0], rax
lea rdx, [rbp + 0x48]
lea rcx, [0x1801333d8]
call fcn.180001630
mov rax, qword [rbp + 0x68]
mov qword [0x1801333f8], rax
xor r14d, r14d
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x68], r14
lea rcx, [rbp + 0x48]
call fcn.1800016e0
mov rbx, qword [rbp + 0x50]
test rbx, rbx
je 0x18001bdb8
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18001bdb8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x18001bdb8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
lea rcx, [rbp - 0x60]
call fcn.180002e50
mov ecx, dword [0x180133000]
sub ecx, 1
je 0x18001bdee
sub ecx, 1
je 0x18001bde2
cmp ecx, 1
jne 0x18001bdf8
mov dword [0x180133000], 8
jmp 0x18001bdf8
mov dword [0x180133000], 5
jmp 0x18001bdf8
mov dword [0x180133000], 4
mov rax, r15
sub rax, qword [0x180133070]
mov qword [rsp + 0x60], rax
mov rax, rsi
cmp qword [0x18012ce48], 0xf
cmova rax, qword [0x18012ce30]
mov qword [rsp + 0x58], rax
call fcn.1800167e0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
lea rcx, str.Intro_Skip:_Opening_Movie:_Address_is_:s:x
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x2f
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rsp + 0x40]
movaps xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp - 0x70], xmm0
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
lea rdx, [rbp - 0x80]
mov rcx, qword [rax + 0x1d8]
call fcn.180039f70
cmp dword [0x180133000], 4
jne 0x18001bece
lea r9, [rbp + 0x70]
mov edx, 1
mov r8d, 0x40
lea rcx, [r15 + 0xd]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [r15 + 0xd], 0x1a
lea r9, [rbp + 0x70]
mov r8d, dword [rbp + 0x70]
mov edx, 1
lea rcx, [r15 + 0xd]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, r13
sub rax, qword [0x180133070]
mov qword [rsp + 0x60], rax
cmp qword [0x18012ce48], 0xf
cmova rsi, qword [0x18012ce30]
mov qword [rsp + 0x58], rsi
call fcn.1800167e0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
lea rcx, str.Intro_Skip:_Logo_Skip:_Address_is_:s:x
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x2b
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rsp + 0x40]
movaps xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp - 0x70], xmm0
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
lea rdx, [rbp - 0x80]
mov rcx, qword [rax + 0x1d8]
call fcn.180039f70
mov eax, dword [r12]
cmp dword [0x180134134], eax
jle 0x18001c038
lea rcx, [0x180134134]
call fcn.180068448
cmp dword [0x180134134], 0xffffffff
jne 0x18001c038
mov qword [0x1801341a0], 0x102
xorps xmm0, xmm0
movdqa xmmword [0x180134150], xmm0
xorps xmm1, xmm1
movdqa xmmword [0x180134160], xmm1
movdqa xmmword [0x180134170], xmm0
movdqa xmmword [0x180134180], xmm1
movdqa xmmword [0x180134190], xmm0
movups xmmword [0x1801341b8], xmm1
movups xmmword [0x1801341c8], xmm1
movups xmmword [0x1801341d8], xmm1
mov qword [0x1801341a8], r14
mov qword [0x1801341b0], r14
mov dword [0x1801341e8], edi
mov dword [0x1801341ec], r14d
mov qword [0x1801341f0], r14
movups xmmword [0x1801341f8], xmm0
mov qword [0x1801341f8], r14
movdqa xmmword [0x180134200], xmm1
mov qword [0x180134210], r14
mov qword [0x180134218], r14
lea rcx, [0x180098470]
call fcn.180068854
lea rcx, [0x180134134]
call fcn.1800683dc
lea rdx, [r13 + 2]
lea r8, [0x18001c1c0]
lea rcx, [rbp - 0x60]
call fcn.1800026c0
lea rdx, [rbp - 0x60]
lea rcx, [0x180134150]
call fcn.180002c70
mov rax, qword [rbp + 0x40]
mov qword [0x1801341f0], rax
lea rdx, [rbp + 0x48]
lea rcx, [0x1801341f8]
call fcn.180001630
mov rax, qword [rbp + 0x68]
mov qword [0x180134218], rax
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x68], r14
lea rcx, [rbp + 0x48]
call fcn.1800016e0
mov rbx, qword [rbp + 0x50]
test rbx, rbx
je 0x18001c0c4
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18001c0c4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x18001c0c4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
lea rcx, [rbp - 0x60]
call fcn.180002e50
jmp 0x18001c132
call fcn.1800167e0
lea rcx, str.Intro_Skip:_Pattern_scan_failed.
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x20
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rsp + 0x40]
movaps xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp - 0x70], xmm0
lea r9, [rsp + 0x30]
mov r8d, 4
lea rdx, [rbp - 0x80]
mov rcx, qword [rax + 0x1d8]
call fcn.180013ed0
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.180068380
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret