Function at 0x180001860
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rcx
test rcx, rcx
jne 0x180001876
xor eax, eax
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 0x40], rbx
mov r8d, 0x3000
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r13
movsxd r13, dword [rcx + 0x3c]
xor ecx, ecx
add r13, rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
lea r9d, [rcx + 0x40]
mov edx, dword [r13 + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, 0x1000
mov rdx, rbp
mov rcx, rax
mov rdi, rax
call fcn.1800321a0
movzx r14d, word [r13 + 0x14]
xor r15d, r15d
add r14, r13
mov esi, r15d
cmp r15w, word [r13 + 6]
jae 0x180001910
mov ebx, r15d
nop dword [rax]
mov eax, dword [r14 + rbx + 0x28]
test eax, eax
je 0x180001901
mov edx, dword [r14 + rbx + 0x2c]
mov r8d, eax
mov ecx, dword [r14 + rbx + 0x24]
add rdx, rbp
add rcx, rdi
call fcn.1800321a0
movzx eax, word [r13 + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jl 0x1800018e0
mov rbx, rdi
sub rbx, qword [r13 + 0x30]
je 0x18000199b
mov r10d, dword [r13 + 0xb0]
add r10, rdi
cmp dword [r10], r15d
je 0x18000199b
mov esi, 0xf000
mov ebp, 0xa000
nop word [rax + rax]
mov r11d, dword [r10 + 4]
lea r9, [r10 + 8]
sub r11, 8
mov r8d, r15d
shr r11, 1
je 0x18000198f
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r9]
movzx eax, dx
and ax, si
cmp ax, bp
jne 0x180001980
mov ecx, dword [r10]
and edx, 0xfff
lea rax, [rdi + rdx]
add qword [rcx + rax], rbx
inc r8d
add r9, 2
movsxd rax, r8d
cmp rax, r11
jb 0x180001960
mov eax, dword [r10 + 4]
add r10, rax
cmp dword [r10], r15d
jne 0x180001940
cmp dword [r13 + 0x94], r15d
je 0x180001a27
mov r14d, dword [r13 + 0x90]
add r14, rdi
cmp dword [r14 + 0xc], r15d
je 0x180001a27
nop dword [rax + rax]
mov ecx, dword [r14 + 0xc]
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r8d, dword [r14]
mov rbp, rax
mov edx, dword [r14 + 0x10]
lea rcx, [r8 + rdi]
test rcx, rcx
lea rsi, [rdx + rdi]
cmovne edx, r8d
mov rcx, qword [rdx + rdi]
lea rbx, [rdx + rdi]
test rcx, rcx
je 0x180001a1d
jns 0x1800019fa
movzx edx, cx
jmp 0x180001a01
lea rdx, [rdi + 2]
add rdx, rcx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rbx, 8
mov qword [rsi], rax
add rsi, 8
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1800019f3
add r14, 0x14
cmp dword [r14 + 0xc], r15d
jne 0x1800019c0
cmp dword [r13 + 0xd4], r15d
je 0x180001a69
mov eax, dword [r13 + 0xd0]
mov rbx, qword [rax + rdi + 0x18]
test rbx, rbx
je 0x180001a69
mov rax, qword [rbx]
test rax, rax
je 0x180001a69
nop dword [rax]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x180001a50
mov eax, dword [r13 + 0x28]
mov r13, qword [rsp + 0x58]
test eax, eax
je 0x180001a85
xor r8d, r8d
add rax, rdi
mov rcx, rdi
lea edx, [r8 + 1]
call rax
test rdi, rdi
je 0x180001afb
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi + 0x8c], r15d
je 0x180001afb
mov esi, dword [rax + rdi + 0x88]
add rsi, rdi
mov ebp, dword [rsi + 0x18]
test ebp, ebp
je 0x180001afb
cmp dword [rsi + 0x14], r15d
je 0x180001afb
mov ebx, dword [rsi + 0x20]
mov r14d, dword [rsi + 0x24]
add rbx, rdi
add r14, rdi
test ebp, ebp
je 0x180001afb
mov ecx, dword [rbx]
lea rdx, [0x18005b418]
add rcx, rdi
call fcn.1800320c0
test eax, eax
je 0x180001ae3
inc r15d
add rbx, 4
cmp r15d, ebp
jb 0x180001ac0
jmp 0x180001afb
mov ecx, dword [rsi + 0x1c]
movsxd rax, r15d
add rcx, rdi
movzx edx, word [r14 + rax*2]
mov eax, dword [rcx + rdx*4]
add rax, rdi
je 0x180001afb
call rax
mov r15, qword [rsp + 0x20]
mov rax, rdi
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret