Function at 0x18004cb10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xa8
mov rbx, rcx
mov rax, qword [rcx]
lea rdx, [rbp + 0x7f]
call qword [rax + 0x30]
test eax, eax
js 0x18004d5c1
xor r15d, r15d
mov qword [rbp - 0x39], r15
mov dword [rbp + 0x67], r15d
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
lea rdx, [rbp + 0x67]
call qword [rax + 0x18]
mov rcx, qword [rbp + 0x7f]
cmp dword [rbp + 0x67], r15d
jne 0x18004cb7d
test rcx, rcx
je 0x18004cb68
mov rax, qword [rcx]
call qword [rax + select]
mov eax, 0x80004005
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rcx]
lea r8, [rbp - 0x39]
xor edx, edx
call qword [rax + 0x20]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x18004cb9c
mov rax, qword [rcx]
call qword [rax + select]
mov qword [rbp + 0x7f], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r14, rax
mov rcx, qword [rbp - 0x39]
mov qword [rbp - 1], rcx
mov qword [rbp + 7], 6
mov dword [rbp + 0xf], r15d
mov dword [rbp + 0x13], 5
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], r15
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov eax, 0x41
mov word [rbp - 0x19], ax
mov dword [rbp - 0x11], 0x28
lea rax, [rbp - 1]
mov qword [rbp - 9], rax
mov rax, qword [rbx]
lea r9, [rbp + 0x77]
lea r8, [0x1800909d8]
lea rdx, [rbp - 0x19]
mov rcx, rbx
call qword [rax + 0x50]
mov ebx, eax
test eax, eax
jns 0x18004cc2b
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rbp - 0x31], r15
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
lea r8, [rbp - 0x31]
mov edx, 2
call qword [rax + 0x50]
mov esi, eax
test eax, eax
jns 0x18004cc6a
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x18004d5bf
mov rdx, qword [rcx]
call qword [rdx + select]
jmp 0x18004d5bf
cmp qword [0x1800a4708], r15
jne 0x18004cf0c
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], r15
mov ecx, 0x20
call fcn.1800506b0
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x49], 0x1c
mov qword [rbp - 0x41], 0x1f
movups xmm0, xmmword [str.ISpatialAudioObjectGetBuffer]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1800908d8]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1800908e0]
mov dword [rax + 0x18], ecx
mov byte [rax + 0x1c], r15b
lea rax, [rbp - 0x59]
mov qword [rbp - 0x29], rax
mov rbx, qword [rbp - 0x31]
mov dword [rbp + 0x6f], r15d
lea r9, [rbp + 0x6f]
mov edx, 8
lea r8d, [rdx + 0x38]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18004cd37
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x18004cd2d
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004cd28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004d5e3
call fcn.180050b2c
mov esi, 0x80004005
jmp 0x18004cf0c
mov rax, qword [rbx]
mov rbx, qword [rax + 0x18]
mov ecx, 0x40
call fcn.1800506b0
mov rdi, rax
mov qword [rbp - 0x21], rax
mov qword [rax], r15
lea rcx, [rax + 8]
lea rdx, [rbp - 0x59]
call fcn.180006410
mov qword [rdi + 0x28], rbx
lea rax, [0x18004ca20]
mov qword [rdi + 0x30], rax
mov byte [rdi + 0x38], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x18004cdad
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004cda8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004d5e3
call fcn.180050b2c
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], setsockopt
mov byte [rbp - 0x59], 0
mov rbx, qword [0x1800a4708]
mov qword [0x1800a4708], rdi
test rbx, rbx
je 0x18004ce3b
cmp byte [rbx + 0x38], 0
je 0x18004cddf
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x18004ce1e
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x18004ce19
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18004d5e9
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
mov edx, 0x40
mov rcx, rbx
call fcn.180050b2c
cmp byte [rdi + 0x38], 0
jne 0x18004ce7a
mov r8, rdi
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x28]
call fcn.18004f030
test eax, eax
jne 0x18004ce74
mov rcx, qword [rdi + 0x28]
call fcn.18004f540
test eax, eax
jne 0x18004ce68
mov byte [rdi + 0x38], 1
jmp 0x18004ce74
mov rcx, qword [rdi + 0x28]
call fcn.18004f330
mov qword [rdi], r15
cmp byte [rdi + 0x38], 0
je 0x18004ce89
mov rax, qword [rdi]
mov qword [0x1800a40e8], rax
jmp 0x18004cf0c
mov esi, 0x80004005
mov rbx, qword [0x1800a4708]
mov qword [0x1800a4708], r15
test rbx, rbx
je 0x18004cf0c
cmp byte [rbx + 0x38], 0
je 0x18004ceb0
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x18004ceef
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x18004ceea
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18004d5ef
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
mov edx, 0x40
mov rcx, rbx
call fcn.180050b2c
cmp qword [0x1800a4710], 0
jne 0x18004d0ed
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], r15
mov ecx, 0x30
call fcn.1800506b0
mov rdx, rax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x49], 0x23
mov qword [rbp - 0x41], 0x2f
movups xmm0, xmmword [str.ISpatialAudioObjectRenderStreamStop]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x180090978]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x180090988]
mov word [rax + 0x20], cx
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
mov byte [rdx + 0x22], al
mov byte [rdx + 0x23], 0
lea r9, [0x18004c820]
mov r8d, 6
lea rdx, [rbp - 0x59]
mov rcx, qword [rbp + 0x77]
call fcn.18004dd80
mov rbx, rax
test rax, rax
je 0x18004d0e8
mov rdi, qword [0x1800a4710]
mov qword [0x1800a4710], rax
test rdi, rdi
je 0x18004d01c
cmp byte [rdi + 0x38], 0
je 0x18004cfc0
mov rcx, qword [rdi + 0x28]
call fcn.18004f330
mov byte [rdi + 0x38], 0
mov rdx, qword [rdi + 0x20]
cmp rdx, 0xf
jbe 0x18004cfff
mov rcx, qword [rdi + 8]
inc rdx
cmp rdx, 0x1000
jb 0x18004cffa
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18004d5f5
mov rcx, r8
call fcn.180050b2c
mov qword [rdi + 0x18], r15
mov qword [rdi + 0x20], setsockopt
mov byte [rdi + 8], 0
mov edx, 0x40
mov rcx, rdi
call fcn.180050b2c
cmp byte [rbx + 0x38], 0
jne 0x18004d05b
mov r8, rbx
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x28]
call fcn.18004f030
test eax, eax
jne 0x18004d055
mov rcx, qword [rbx + 0x28]
call fcn.18004f540
test eax, eax
jne 0x18004d049
mov byte [rbx + 0x38], 1
jmp 0x18004d055
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov qword [rbx], r15
cmp byte [rbx + 0x38], 0
je 0x18004d06a
mov rax, qword [rbx]
mov qword [0x1800a4108], rax
jmp 0x18004d0ed
mov rbx, qword [0x1800a4710]
mov qword [0x1800a4710], r15
test rbx, rbx
je 0x18004d0e8
cmp byte [rbx + 0x38], 0
je 0x18004d08c
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x18004d0cb
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x18004d0c6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18004d5fb
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
mov edx, 0x40
mov rcx, rbx
call fcn.180050b2c
mov esi, 0x80004005
cmp qword [0x1800a4720], 0
jne 0x18004d2d8
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], r15
mov ecx, 0x40
call fcn.1800506b0
mov rcx, rax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x49], 0x36
mov qword [rbp - 0x41], 0x3f
movups xmm0, xmmword [str.ISpatialAudioObjectRenderStreamEndUpdatingAudioObjects]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1800909a0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1800909b0]
movups xmmword [rax + 0x20], xmm0
mov eax, dword [0x1800909c0]
mov dword [rcx + 0x30], eax
movzx eax, word [0x1800909c4]
mov word [rcx + 0x34], ax
mov byte [rcx + 0x36], 0
lea r9, [0x18004c870]
mov r8d, 9
lea rdx, [rbp - 0x59]
mov rcx, qword [rbp + 0x77]
call fcn.18004dd80
mov rbx, rax
test rax, rax
je 0x18004d2d3
mov rdi, qword [0x1800a4720]
mov qword [0x1800a4720], rax
test rdi, rdi
je 0x18004d207
cmp byte [rdi + 0x38], 0
je 0x18004d1ab
mov rcx, qword [rdi + 0x28]
call fcn.18004f330
mov byte [rdi + 0x38], 0
mov rdx, qword [rdi + 0x20]
cmp rdx, 0xf
jbe 0x18004d1ea
mov rcx, qword [rdi + 8]
inc rdx
cmp rdx, 0x1000
jb 0x18004d1e5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18004d601
mov rcx, r8
call fcn.180050b2c
mov qword [rdi + 0x18], r15
mov qword [rdi + 0x20], setsockopt
mov byte [rdi + 8], 0
mov edx, 0x40
mov rcx, rdi
call fcn.180050b2c
cmp byte [rbx + 0x38], 0
jne 0x18004d246
mov r8, rbx
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x28]
call fcn.18004f030
test eax, eax
jne 0x18004d240
mov rcx, qword [rbx + 0x28]
call fcn.18004f540
test eax, eax
jne 0x18004d234
mov byte [rbx + 0x38], 1
jmp 0x18004d240
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov qword [rbx], r15
cmp byte [rbx + 0x38], 0
je 0x18004d255
mov rax, qword [rbx]
mov qword [0x1800a4100], rax
jmp 0x18004d2d8
mov rbx, qword [0x1800a4720]
mov qword [0x1800a4720], r15
test rbx, rbx
je 0x18004d2d3
cmp byte [rbx + 0x38], 0
je 0x18004d277
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x18004d2b6
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x18004d2b1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18004d607
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
mov edx, 0x40
mov rcx, rbx
call fcn.180050b2c
mov esi, 0x80004005
cmp qword [0x1800a4718], 0
jne 0x18004d586
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], r15
mov ecx, 0x40
call fcn.1800506b0
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x49], 0x38
mov qword [rbp - 0x41], 0x3f
movups xmm0, xmmword [str.ISpatialAudioObjectRenderStreamBeginUpdatingAudioObjects]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x180090938]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x180090948]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x180090958]
movsd qword [rax + 0x30], xmm0
mov byte [rax + 0x38], 0
lea rax, [rbp - 0x59]
mov qword [rbp - 0x21], rax
mov rbx, qword [rbp + 0x77]
mov dword [rbp + 0x6f], r15d
lea r9, [rbp + 0x6f]
mov edx, 8
lea r8d, [rdx + 0x38]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18004d3b1
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x18004d581
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004d57c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004d5d7
jmp 0x18004d57c
mov rax, qword [rbx]
mov rbx, qword [rax + 0x40]
mov ecx, 0x40
call fcn.1800506b0
mov rdi, rax
mov qword [rbp - 0x29], rax
mov qword [rax], r15
lea rcx, [rax + 8]
lea rdx, [rbp - 0x59]
call fcn.180006410
mov qword [rdi + 0x28], rbx
lea rax, [0x18004c990]
mov qword [rdi + 0x30], rax
mov byte [rdi + 0x38], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x18004d427
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004d422
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004d5d7
call fcn.180050b2c
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], setsockopt
mov byte [rbp - 0x59], 0
mov rbx, qword [0x1800a4718]
mov qword [0x1800a4718], rdi
test rbx, rbx
je 0x18004d4b5
cmp byte [rbx + 0x38], 0
je 0x18004d459
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x18004d498
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x18004d493
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18004d5d1
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
mov edx, 0x40
mov rcx, rbx
call fcn.180050b2c
cmp byte [rdi + 0x38], 0
jne 0x18004d4f4
mov r8, rdi
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x28]
call fcn.18004f030
test eax, eax
jne 0x18004d4ee
mov rcx, qword [rdi + 0x28]
call fcn.18004f540
test eax, eax
jne 0x18004d4e2
mov byte [rdi + 0x38], 1
jmp 0x18004d4ee
mov rcx, qword [rdi + 0x28]
call fcn.18004f330
mov qword [rdi], r15
cmp byte [rdi + 0x38], 0
je 0x18004d503
mov rax, qword [rdi]
mov qword [0x1800a40f0], rax
jmp 0x18004d586
mov rbx, qword [0x1800a4718]
mov qword [0x1800a4718], r15
test rbx, rbx
je 0x18004d581
cmp byte [rbx + 0x38], 0
je 0x18004d525
mov rcx, qword [rbx + 0x28]
call fcn.18004f330
mov byte [rbx + 0x38], 0
mov rdx, qword [rbx + 0x20]
cmp rdx, 0xf
jbe 0x18004d564
mov rcx, qword [rbx + 8]
inc rdx
cmp rdx, 0x1000
jb 0x18004d55f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18004d5dd
mov rcx, r8
call fcn.180050b2c
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], setsockopt
mov byte [rbx + 8], 0
mov edx, 0x40
mov rcx, rbx
call fcn.180050b2c
mov esi, 0x80004005
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x18004d599
mov rax, qword [rcx]
call qword [rax + select]
mov qword [rbp - 0x31], r15
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x18004d5ac
mov rax, qword [rcx]
call qword [rax + select]
mov qword [rbp + 0x77], r15
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
nop
call fcn.18005c4f8
int3