Function at 0x180001470
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
sub rsp, 0x900
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x878], 0xfffffffffffffffe
mov qword [rbp + 0x868], rdx
mov qword [rbp + 0x860], rcx
mov rax, qword [0x18004a588]
mov qword [rbp + 0x852], rax
mov eax, dword [0x18004a590]
mov dword [rbp + 0x85a], eax
mov ax, word [0x18004a594]
mov word [rbp + 0x85e], ax
lea rax, [rbp + 0x852]
mov qword [rbp + 0x848], rax
lea rax, [rbp + 0x852]
add rax, 6
mov qword [rbp + 0x840], rax
mov qword [rbp + 0x838], 0xc
mov qword [rbp + 0x830], 0xe
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor eax, eax
mov edx, eax
mov r8d, 0x80
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x828], rax
cmp qword [rbp + 0x828], 0
jne 0x180001543
mov qword [rbp + 0x870], 0
jmp 0x180001bfb
mov qword [rbp + 0x820], 0
mov qword [rbp + 0x818], 0
lea rcx, [rbp + 0x800]
xor eax, eax
mov edx, eax
call fcn.180001130
mov dword [rbp + 0x7fc], eax
mov eax, dword [rbp + 0x7fc]
and eax, 0x80000000
cmp eax, 0
je 0x1800015bc
mov rax, qword [rbp + 0x828]
mov qword [rbp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov rcx, rax
xor eax, eax
mov r8d, eax
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov qword [rbp + 0x870], 0
jmp 0x180001bfb
mov rax, qword [rbp + 0x860]
mov qword [rbp + 0x278], rax
lea rcx, [rbp + 0x260]
call fcn.180004550
mov rax, qword [rbp + 0x860]
add rax, qword [rbp + 0x820]
mov qword [rbp + 0x278], rax
mov rcx, qword [rbp + 0x820]
xor eax, eax
cmp rcx, qword [rbp + 0x838]
mov byte [rbp + 0x57], al
jae 0x18000165c
mov rdx, qword [rbp + 0x278]
mov rax, qword [rbp + 0x838]
lea r8, [rdx + rax + 0x10]
mov rax, rsp
lea rcx, [rbp + 0x280]
mov qword [rax + 0x20], rcx
mov byte [rax + 0x30], 1
mov byte [rax + 0x28], 5
lea rcx, [rbp + 0x800]
lea r9, [rbp + 0x690]
call fcn.180017730
mov dword [rbp + 0x50], eax
jmp 0x180001648
mov eax, dword [rbp + 0x50]
mov dword [rbp + 0x7fc], eax
cmp eax, 0x80200000
setne al
mov byte [rbp + 0x57], al
mov al, byte [rbp + 0x57]
test al, 1
jne 0x18000166c
jmp 0x180001774
mov eax, dword [rbp + 0x7fc]
and eax, 0x80000000
cmp eax, 0
je 0x18000169a
movzx eax, byte [rbp + 0x698]
add rax, qword [rbp + 0x820]
mov qword [rbp + 0x820], rax
jmp 0x1800015d6
mov qword [rbp + 0x258], 0
mov rax, qword [rbp + 0x258]
movzx ecx, byte [rbp + 0x6a9]
cmp rax, rcx
jae 0x18000175a
lea rax, [rbp + 0x280]
imul rcx, qword [rbp + 0x258], 0x68
add rax, rcx
cmp dword [rax + 4], 2
jne 0x180001743
lea rax, [rbp + 0x280]
imul rcx, qword [rbp + 0x258], 0x68
add rax, rcx
cmp dword [rax + 0x30], 0xc5
jne 0x180001743
cmp byte [rbp + 0x328], 0
je 0x180001743
lea rcx, [rbp + 0x240]
mov qword [rbp + 0x48], rcx
lea rdx, [rbp + 0x278]
lea r8, [rbp + 0x820]
lea r9, [rbp + 0x258]
call fcn.1800045c0
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x260]
call fcn.180004590
jmp 0x18000173e
jmp 0x18000175a
mov rax, qword [rbp + 0x258]
add rax, 1
mov qword [rbp + 0x258], rax
jmp 0x1800016a5
movzx eax, byte [rbp + 0x698]
add rax, qword [rbp + 0x820]
mov qword [rbp + 0x820], rax
jmp 0x1800015d6
mov rcx, qword [rbp + 0x828]
mov rdx, qword [rbp + 0x860]
mov r8, qword [rbp + 0x820]
call fcn.180027150
mov rax, qword [rbp + 0x840]
mov rcx, qword [rbp + 0x848]
sub rax, rcx
sub rax, 6
mov ecx, eax
mov rax, qword [rbp + 0x848]
mov dword [rax + 2], ecx
mov rcx, qword [rbp + 0x860]
add rcx, qword [rbp + 0x820]
mov rax, qword [rbp + 0x840]
mov qword [rax], rcx
mov rcx, qword [rbp + 0x828]
add rcx, qword [rbp + 0x820]
mov rdx, qword [rbp + 0x848]
mov r8, qword [rbp + 0x830]
call fcn.180027150
mov qword [rbp + 0x238], 0
mov rax, qword [rbp + 0x238]
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x260]
call fcn.180004600
mov rcx, rax
mov rax, qword [rbp + 0x40]
cmp rax, rcx
jae 0x180001b2f
mov rdx, qword [rbp + 0x238]
lea rcx, [rbp + 0x260]
call fcn.180004640
mov rdx, rax
lea rcx, [rbp + 0x220]
mov qword [rbp + 0x30], rcx
call fcn.180004670
mov rcx, qword [rbp + 0x30]
call fcn.1800046b0
mov rdx, qword [rax]
mov rax, rsp
lea rcx, [rbp + 0x280]
mov qword [rax + 0x20], rcx
mov byte [rax + 0x30], 1
mov byte [rax + 0x28], 5
lea rcx, [rbp + 0x800]
mov r8d, 0x10
lea r9, [rbp + 0x690]
call fcn.180017730
mov dword [rbp + 0x3c], eax
jmp 0x180001883
mov eax, dword [rbp + 0x3c]
mov dword [rbp + 0x7fc], eax
mov eax, dword [rbp + 0x7fc]
and eax, 0x80000000
cmp eax, 0
je 0x1800018f6
mov rax, qword [rbp + 0x828]
mov qword [rbp + 0x20], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov qword [rbp + 0x28], rax
jmp 0x1800018bd
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor r8d, r8d
mov r9d, 0x8000
call rax
jmp 0x1800018dc
mov qword [rbp + 0x870], 0
mov dword [rbp + 0x21c], 1
jmp 0x180001bea
lea rcx, [rbp + 0x220]
mov qword [rbp], rcx
call fcn.1800046b0
mov rcx, qword [rbp]
mov rax, qword [rax]
mov qword [rbp - 8], rax
call fcn.1800046c0
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp]
mov rax, qword [rax]
imul rax, rax, 0x68
mov rax, qword [rbp + rax + 0x2c8]
add rdx, rax
movzx eax, byte [rbp + 0x698]
mov rax, qword [rax + rdx]
mov qword [rbp + 0x210], rax
mov rax, qword [rbp + 0x828]
mov rdx, qword [rbp + 0x820]
add rax, rdx
mov rdx, qword [rbp + 0x830]
add rax, rdx
mov rdx, qword [rbp + 0x238]
lea rax, [rax + rdx*8]
mov qword [rbp + 0x208], rax
mov rdx, qword [rbp + 0x210]
mov rax, qword [rbp + 0x208]
mov qword [rax], rdx
mov rax, qword [rbp + 0x828]
mov qword [rbp + 8], rax
call fcn.1800046d0
mov rcx, qword [rbp]
mov rdx, rax
mov rax, qword [rbp + 8]
mov rdx, qword [rdx]
add rax, rdx
mov qword [rbp + 0x200], rax
mov rax, qword [rbp + 0x208]
mov rdx, qword [rbp + 0x200]
sub rax, rdx
movzx edx, byte [rbp + 0x698]
sub rax, rdx
mov qword [rbp + 0x1f8], rax
mov rax, qword [rbp + 0x1f8]
mov qword [rbp + 0x10], rax
call fcn.1800046c0
mov rcx, qword [rbp + 0x10]
mov rax, qword [rax]
imul rax, rax, 0x68
mov qword [rbp + rax + 0x2c8], rcx
mov r8b, byte [rbp + 0x6a8]
lea rcx, [rbp + 0x690]
lea rdx, [rbp + 0x280]
lea r9, [rbp + 0x68]
call fcn.18001b6f0
mov dword [rbp + 0x1c], eax
jmp 0x180001a13
mov eax, dword [rbp + 0x1c]
mov dword [rbp + 0x7fc], eax
mov eax, dword [rbp + 0x7fc]
and eax, 0x80000000
cmp eax, 0
je 0x180001a86
mov rax, qword [rbp + 0x828]
mov qword [rbp - 0x18], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov qword [rbp - 0x10], rax
jmp 0x180001a4d
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor r8d, r8d
mov r9d, 0x8000
call rax
jmp 0x180001a6c
mov qword [rbp + 0x870], 0
mov dword [rbp + 0x21c], 1
jmp 0x180001bea
lea r8, [rbp + 0x698]
mov rdx, qword [rbp + 0x200]
lea rcx, [rbp + 0x68]
call fcn.18001bab0
mov dword [rbp - 0x1c], eax
jmp 0x180001aa5
mov eax, dword [rbp - 0x1c]
mov dword [rbp + 0x7fc], eax
mov eax, dword [rbp + 0x7fc]
and eax, 0x80000000
cmp eax, 0
je 0x180001b18
mov rax, qword [rbp + 0x828]
mov qword [rbp - 0x30], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov qword [rbp - 0x28], rax
jmp 0x180001adf
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor r8d, r8d
mov r9d, 0x8000
call rax
jmp 0x180001afe
mov qword [rbp + 0x870], 0
mov dword [rbp + 0x21c], 1
jmp 0x180001bea
mov rax, qword [rbp + 0x238]
add rax, 1
mov qword [rbp + 0x238], rax
jmp 0x1800017f3
mov rax, qword [rbp + 0x868]
mov qword [0x1800d1002], rax
lea r8, section..data
mov r9, qword [rbp + 0x820]
mov rcx, qword [rbp + 0x860]
mov rax, rsp
mov qword [rax + 0x20], 0
mov rdx, r9
call fcn.180001220
mov dword [rbp - 0x34], eax
jmp 0x180001b6d
mov eax, dword [rbp - 0x34]
mov dword [rbp + 0x64], eax
cmp eax, 0
je 0x180001bd2
mov rax, qword [rbp + 0x828]
mov qword [rbp - 0x48], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov qword [rbp - 0x40], rax
jmp 0x180001b99
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x40]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor r8d, r8d
mov r9d, 0x8000
call rax
jmp 0x180001bb8
mov qword [rbp + 0x870], 0
mov dword [rbp + 0x21c], 1
jmp 0x180001bea
mov rax, qword [rbp + 0x828]
mov qword [rbp + 0x870], rax
mov dword [rbp + 0x21c], 1
lea rcx, [rbp + 0x260]
call fcn.1800046e0
jmp 0x180001bfb
mov rax, qword [rbp + 0x870]
add rsp, 0x900
pop rbp
ret