Function at 0x180028190
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rbx, rcx
xor r12d, r12d
test rcx, rcx
je 0x18002848a
mov eax, 0x5a4d
cmp ax, word [rcx]
jne 0x18002848a
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
cmp dword [rsi], 0x4550
jne 0x18002848a
mov edi, dword [rsi + 0x50]
lea r9d, [r12 + 0x40]
mov r8d, 0x1000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
test rax, rax
je 0x1800284a8
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.180035fe0
movzx edi, word [rsi + 6]
movzx ebp, word [rsi + 0x14]
mov r8d, dword [rsi + rbp + 0x24]
mov rdx, rbx
mov rcx, r13
call fcn.18003b330
mov r11, rdi
test edi, edi
jle 0x18002825e
lea rdi, [rsi + rbp + 0x2c]
mov rbp, r11
nop word [rax + rax]
mov r8d, dword [rdi - 4]
mov edx, dword [rdi]
add rdx, rbx
mov ecx, dword [rdi - 8]
add rcx, r13
call fcn.18003b330
add rdi, 0x28
sub rbp, 1
jne 0x180028240
mov eax, dword [rsi + 0x78]
add rax, r13
mov qword [rsp + 0x98], rax
mov ebp, dword [rax + 0x20]
add rbp, r13
mov qword [rsp + 0x90], rbp
mov ecx, dword [rax + 0x24]
add rcx, r13
mov qword [rsp + 0x20], rcx
mov r15d, r12d
cmp dword [rax + 0x18], r12d
jbe 0x180028492
or r14, 0xffffffffffffffff
nop word [rax + rax]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x80], rbx
mov esi, dword [rbp]
add rsi, r13
je 0x18002836c
xor eax, eax
mov rcx, r14
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
je 0x18002836c
mov ebp, dword [rbx - 0x10]
mov r12, rsi
sub r12, rbx
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ecx
or eax, edx
jge 0x180028315
mov edx, ecx
lea rcx, [rsp + 0x80]
call fcn.1800069e0
mov rbx, qword [rsp + 0x80]
cmp r12, rbp
ja 0x180028332
movsxd rbp, edi
lea r8, [r12 + rbx]
movsxd rdx, dword [rbx - 0xc]
mov r9, rbp
mov rcx, rbx
call fcn.18003462c
jmp 0x180028347
movsxd rbp, edi
movsxd rdx, dword [rbx - 0xc]
mov r9, rbp
mov r8, rsi
mov rcx, rbx
call fcn.180034594
test edi, edi
js 0x180028423
cmp edi, dword [rbx - 0xc]
jg 0x180028423
mov dword [rbx - 0x10], edi
mov byte [rbx + rbp], 0
xor r12d, r12d
mov rbp, qword [rsp + 0x90]
jmp 0x1800283be
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1800283be
cmp dword [rdx + 0x10], 0
jge 0x180028392
cmp dword [rbx - 0xc], 0
jl 0x18002842e
mov dword [rbx - 0x10], r12d
mov byte [rbx], 0
jmp 0x1800283be
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800283a9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x80], rbx
mov eax, r12d
mov rcx, qword [rsp + 0x88]
test rcx, rcx
setne al
test eax, eax
je 0x18002847f
mov rdx, rcx
mov rcx, rbx
call fcn.180036fa8
test eax, eax
je 0x180028439
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180028401
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
inc r15d
add rbp, 4
mov qword [rsp + 0x90], rbp
mov rax, qword [rsp + 0x98]
cmp r15d, dword [rax + 0x18]
jae 0x180028492
jmp 0x1800282a0
mov ecx, 0x80070057
call fcn.180002d30
int3
mov ecx, 0x80070057
call fcn.180002d30
int3
mov eax, r15d
mov rcx, qword [rsp + 0x20]
movzx edi, word [rcx + rax*2]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
dec r14d
test r14d, r14d
jg 0x180028460
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp r12w, di
je 0x180028492
movzx edx, di
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x1c]
lea rcx, [r13 + rax]
mov r12d, dword [rcx + rdx*4]
jmp 0x180028492
mov ecx, 0x80004005
call fcn.180002d30
nop
mov r13, qword [rsp + 0x80]
test r13, r13
je 0x1800284a8
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, r12d
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret