Function at 0x180001730
Capabilities:
Allocate or change rwx memory
Compress data via winapi
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rsi, r9
mov ebp, r8d
mov r13, rdx
mov r14, rcx
test r8d, r8d
jne 0x1800017bc
mov ebx, dword [rdx]
lea rcx, str.ntdll.dll
mov qword [rsp + 0x30], r15
mov rdi, r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlDecompressBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001836
lea rcx, [r13 + 8]
lea r8, [rsp + 0x30]
mov r9, rax
mov edx, ebx
call fcn.1800055f0
test eax, eax
je 0x180001836
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rcx, rbx
call fcn.180004f10
jmp 0x18000181f
cmp r8d, 9
jne 0x18000197e
mov eax, dword [rdx]
mov ebx, dword [rdx + 4]
lea rcx, str.ntdll.dll
mov qword [rsp + 0x30], r15
mov rdi, r15
lea r12, [rax + rdx + 8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlDecompressBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001836
lea r8, [rsp + 0x30]
mov r9, rax
mov edx, ebx
mov rcx, r12
call fcn.1800055f0
test eax, eax
je 0x180001836
mov rbx, qword [rsp + 0x30]
mov edx, eax
mov rcx, rbx
call fcn.180004fe0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rdi, rdi
je 0x18000197e
mov r12d, r15d
test ebp, ebp
je 0x18000184b
cmp ebp, 9
jne 0x180001854
movsxd rax, dword [rdi + 0x3c]
mov r12d, dword [rax + rdi + 0x50]
mov ecx, dword [r13 + 4]
mov eax, dword [r13]
xor edx, edx
lea ebx, [rcx + rax + 0xf]
mov r9d, 0x3000
mov rcx, r14
and ebx, 0xfffffff8
mov dword [rsp + 0x20], 0x40
lea r8d, [rbx + r12]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180001965
lea r15, [rbx + rax]
mov r8d, ebp
mov rcx, rdi
mov rdx, r15
call fcn.180004c40
mov r9, rbx
mov rbx, qword [rsp + 0x30]
mov r8, r13
mov rcx, r14
mov rdx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000194c
mov r9d, r12d
mov r8, rdi
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000194c
cmp dword [rsi], 0
jbe 0x180001968
nop dword [rax]
mov ecx, dword [rsi]
xor eax, eax
test ebp, ebp
jne 0x180001903
movsxd rax, dword [rdi + 0x3c]
lea rax, [rax + rdi + 0x78]
jmp 0x180001914
cmp ebp, 9
jne 0x180001914
movsxd rax, dword [rdi + 0x3c]
lea rax, [rax + rdi + 0x88]
mov edx, dword [rax]
test edx, edx
je 0x180001936
cmp dword [rax + 4], 0
je 0x180001936
sub ecx, dword [rdx + rdi + 0x10]
cmp ecx, dword [rdx + rdi + 0x14]
jae 0x180001936
mov eax, dword [rdx + rdi + 0x1c]
add rax, rdi
mov edx, dword [rax + rcx*4]
jmp 0x180001938
xor edx, edx
mov eax, edx
add rsi, 0x10
add rax, r15
mov qword [rsi - 8], rax
cmp dword [rsi], 0
ja 0x1800018f0
jmp 0x180001968
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor ebx, ebx
jmp 0x180001968
mov rbx, rax
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbx
jmp 0x180001981
mov rax, r15
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret