Function at 0x18002c3c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ecx, ecx
mov edx, 0x10000
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
mov qword [rsp + 0x68], rax
mov qword [0x18006c538], rax
lea rdx, section..0Qdj_7m
lea rdi, [rax + 0x1000]
lea r15, [rax + 0x2000]
mov qword [0x18006c530], rdi
lea r13, [rax + 0x3000]
mov qword [0x18006c520], r15
lea r14, [rax + 0x4000]
mov qword [0x18006c510], r13
lea rbp, [rax + 0x5000]
mov qword [0x18006c508], r14
lea rsi, [rax + 0x6000]
mov qword [0x18006c528], rbp
add rax, 0x7000
mov qword [0x18006c518], rsi
cmp byte [rdx], 0xe9
mov qword [0x18006c500], rax
mov rax, rdx
jne 0x18002c475
mov eax, dword [rdx + 1]
add eax, 5
cdqe
add rax, rdx
xor r12d, r12d
cmp dword [rax], 0xdeadc0de
mov ebx, r12d
je 0x18002c48f
inc rbx
cmp dword [rbx + rax], 0xdeadc0de
jne 0x18002c483
add rbx, 4
mov r8, rbx
call fcn.1800376b0
cmp rbx, 4
jb 0x18002c4d6
mov rcx, qword [rsp + 0x68]
mov edx, 4
sub rdx, rcx
nop
mov eax, dword [rcx]
cmp eax, 0x80000
je 0x18002c4c4
cmp eax, 0x1ffff0
jne 0x18002c4ca
mov dword [rcx], eax
jmp 0x18002c4ca
mov dword [rcx], 0x40000
inc rcx
lea rax, [rdx + rcx]
cmp rax, rbx
jbe 0x18002c4b0
lea rdx, [0x180071300]
cmp byte [rdx], 0xe9
mov rax, rdx
jne 0x18002c4f0
mov eax, dword [rdx + 1]
add eax, 5
cdqe
add rax, rdx
cmp dword [rax], 0xdeadc0de
mov rbx, r12
je 0x18002c50c
nop dword [rax + rax]
inc rbx
cmp dword [rbx + rax], 0xdeadc0de
jne 0x18002c500
add rbx, 4
mov rcx, rdi
mov r8, rbx
call fcn.1800376b0
cmp rbx, 4
jb 0x18002c556
mov ecx, 4
sub rcx, rdi
nop dword [rax]
mov eax, dword [rdi]
cmp eax, 0x80000
je 0x18002c544
cmp eax, 0x1ffff0
jne 0x18002c54a
mov dword [rdi], eax
jmp 0x18002c54a
mov dword [rdi], 0x40000
inc rdi
lea rax, [rcx + rdi]
cmp rax, rbx
jbe 0x18002c530
lea rdx, [0x1800715c0]
cmp byte [rdx], 0xe9
mov rax, rdx
jne 0x18002c570
mov eax, dword [rdx + 1]
add eax, 5
cdqe
add rax, rdx
cmp dword [rax], 0xdeadc0de
mov rbx, r12
je 0x18002c58c
nop dword [rax + rax]
inc rbx
cmp dword [rbx + rax], 0xdeadc0de
jne 0x18002c580
add rbx, 4
mov rcx, r15
mov r8, rbx
call fcn.1800376b0
mov edi, 4
cmp rbx, rdi
jb 0x18002c5d9
mov ecx, edi
sub rcx, r15
nop word [rax + rax]
mov eax, dword [r15]
cmp eax, 0x80000
je 0x18002c5c6
cmp eax, 0x1ffff0
jne 0x18002c5cd
mov dword [r15], eax
jmp 0x18002c5cd
mov dword [r15], 0x40000
inc r15
lea rax, [rcx + r15]
cmp rax, rbx
jbe 0x18002c5b0
mov r9d, 0x1ffff0
mov r8d, 0x40000
mov rcx, r13
call fcn.18002c7d0
lea rdx, section..0Qdj_7m
cmp byte [rdx], 0xe9
mov rax, rdx
jne 0x18002c607
mov eax, dword [rdx + 1]
add eax, 5
cdqe
add rax, rdx
cmp dword [rax], 0xdeadc0de
mov rbx, r12
je 0x18002c61e
inc rbx
cmp dword [rbx + rax], 0xdeadc0de
jne 0x18002c612
add rbx, 4
mov rcx, r14
mov r8, rbx
call fcn.1800376b0
cmp rbx, 4
jb 0x18002c66d
mov rcx, rdi
sub rcx, r14
nop dword [rax]
mov eax, dword [r14]
cmp eax, 0x80000
je 0x18002c65a
cmp eax, 0x1ffff0
jne 0x18002c661
mov dword [r14], 0x1fff0
jmp 0x18002c661
mov dword [r14], 0x10000
inc r14
lea rax, [r14 + rcx]
cmp rax, rbx
jbe 0x18002c640
lea rdx, [0x180071300]
cmp byte [rdx], 0xe9
mov rax, rdx
jne 0x18002c687
mov eax, dword [rdx + 1]
add eax, 5
cdqe
add rax, rdx
cmp dword [rax], 0xdeadc0de
mov rbx, r12
je 0x18002c69e
inc rbx
cmp dword [rbx + rax], 0xdeadc0de
jne 0x18002c692
add rbx, 4
mov rcx, rbp
mov r8, rbx
call fcn.1800376b0
cmp rbx, 4
jb 0x18002c6ed
mov rcx, rdi
sub rcx, rbp
nop dword [rax]
mov eax, dword [rbp]
cmp eax, 0x80000
je 0x18002c6da
cmp eax, 0x1ffff0
jne 0x18002c6e1
mov dword [rbp], 0x1fff0
jmp 0x18002c6e1
mov dword [rbp], 0x10000
inc rbp
lea rax, [rcx + rbp]
cmp rax, rbx
jbe 0x18002c6c0
lea rdx, [0x1800715c0]
cmp byte [rdx], 0xe9
mov rax, rdx
jne 0x18002c707
mov eax, dword [rdx + 1]
add eax, 5
cdqe
add rax, rdx
cmp dword [rax], 0xdeadc0de
je 0x18002c71d
nop
inc r12
cmp dword [r12 + rax], 0xdeadc0de
jne 0x18002c710
add r12, 4
mov rcx, rsi
mov r8, r12
call fcn.1800376b0
cmp r12, 4
jb 0x18002c75f
sub rdi, rsi
mov eax, dword [rsi]
cmp eax, 0x80000
je 0x18002c74d
cmp eax, 0x1ffff0
jne 0x18002c753
mov dword [rsi], 0x1fff0
jmp 0x18002c753
mov dword [rsi], 0x10000
inc rsi
lea rax, [rdi + rsi]
cmp rax, r12
jbe 0x18002c735
mov rcx, qword [0x18006c500]
mov r9d, 0x1fff0
mov r8d, 0x10000
call fcn.18002c7d0
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
mov edx, 0x10000
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rsp + 0x68]
mov r8d, 0x10000
mov rcx, rax
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_FlushInstructionCache]