Function at 0x180023db0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rdi
push r13
sub rsp, 0x40
mov rax, qword [0x1800a8040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r13, rcx
xor ebp, ebp
mov ecx, pe_nt_image_headers64
call fcn.180064330
mov rdi, rax
test rax, rax
je 0x18002447e
cmp dword [0x1800d7db0], ebp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x38], r14
jne 0x180023e0c
lea rcx, [0x1800d7dc0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1800d7db0], 1
lea rcx, [0x1800d7dc0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [r13]
xorps xmm0, xmm0
mov rcx, qword [rax]
mov rax, qword [r13 + 8]
mov qword [rdi + 8], rax
xor eax, eax
mov qword [rdi], rcx
mov qword [rdi + 0x18], rbp
mov dword [rdi + 0x10], ebp
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
mov qword [rdi + 0x70], rax
mov rdx, qword [rdi]
mov qword [rdi + 0x78], rbp
movzx eax, byte [rdx]
cmp al, 0xff
jne 0x180023e6e
cmp byte [rdx + 1], 0x25
jne 0x180023eaf
movsxd rcx, dword [rdx + 2]
mov rcx, qword [rcx + rdx + 6]
jmp 0x180023ea7
cmp al, 0x48
jne 0x180023e89
cmp byte [rdx + 1], 0xff
jne 0x180023eaf
cmp byte [rdx + 2], 0x25
jne 0x180023eaf
movsxd rcx, dword [rdx + 3]
mov rcx, qword [rcx + rdx + 7]
jmp 0x180023ea7
cmp al, 0xe9
jne 0x180023e97
movsxd rcx, dword [rdx + 1]
add rdx, 5
jmp 0x180023ea4
cmp al, 0xeb
jne 0x180023eaf
movsx rcx, byte [rdx + 1]
add rdx, 2
add rcx, rdx
call fcn.180022ce0
mov rdx, rax
mov r8, qword [rdi + 8]
mov qword [rdi], rdx
movzx eax, byte [r8]
cmp al, 0xff
jne 0x180023ed9
cmp byte [r8 + 1], 0x25
jne 0x180023f34
movsxd rcx, dword [r8 + 2]
mov rcx, qword [rcx + r8 + 6]
call fcn.180022ce0
mov qword [rdi + 8], rax
jmp 0x180023f38
cmp al, 0x48
jne 0x180023eff
cmp byte [r8 + 1], 0xff
jne 0x180023f34
cmp byte [r8 + 2], 0x25
jne 0x180023f34
movsxd rcx, dword [r8 + 3]
mov rcx, qword [rcx + r8 + 7]
call fcn.180022ce0
mov qword [rdi + 8], rax
jmp 0x180023f38
cmp al, 0xe9
jne 0x180023f19
movsxd rcx, dword [r8 + 1]
add rcx, 5
add rcx, r8
call fcn.180022ce0
mov qword [rdi + 8], rax
jmp 0x180023f38
cmp al, 0xeb
jne 0x180023f34
movsx rcx, byte [r8 + 1]
add rcx, 2
add rcx, r8
call fcn.180022ce0
mov qword [rdi + 8], rax
jmp 0x180023f38
mov qword [rdi + 8], r8
lea r8, [rdi + 0x20]
mov qword [rsp + 0x68], rbx
mov rcx, rdx
call fcn.180023600
mov rcx, qword [rdi]
mov edx, 0x102
mov dword [rdi + 0x10], eax
call fcn.180023930
mov rcx, qword [rdi]
mov edx, 0x103
mov dword [rdi + 0x78], eax
call fcn.180023930
cmp dword [rdi + 0x10], 5
mov dword [rdi + 0x7c], eax
jb 0x18002402e
cmp dword [rdi + 0x78], ebp
je 0x180023f83
test eax, eax
jne 0x18002402e
mov r10, qword [rdi]
mov eax, 0x80000000
mov rsi, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x28]
add rsi, r10
cmp rsi, rax
jae 0x180023fa2
mov esi, 1
jmp 0x180023fa9
sub rsi, 0x7fff0000
lea rbx, [r10 + rcx]
cmp rbx, 0xffffffff80000000
jae 0x180023fbf
add rbx, 0x7ff80000
jmp 0x180023fc6
mov rbx, 0xfffffffffff80000
mov rdx, rbx
mov rcx, rsi
call fcn.180023230
mov r9, rax
test rax, rax
jne 0x180024001
mov r8, rbx
mov rdx, rsi
mov rcx, r10
call fcn.180022d40
mov rdx, rbx
mov qword [0x1800d7db8], rax
mov rcx, rsi
call fcn.180023230
mov r9, rax
test rax, rax
je 0x18002402a
mov qword [r9 + 0x78], rbp
mov rax, qword [0x1800d7da0]
mov qword [r9 + 0x80], rax
mov rax, qword [0x1800d7da0]
test rax, rax
je 0x180024023
mov qword [rax + 0x78], r9
mov qword [0x1800d7da0], r9
mov qword [rdi + 0x18], r9
cmp qword [0x1800d7da8], rbp
mov esi, 0x100000
jne 0x180024070
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.ZwQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800d7da8], rax
test rax, rax
je 0x180024458
nop dword [rax]
mov ecx, esi
call fcn.180064330
mov rbx, rax
test rax, rax
je 0x180024458
xor r9d, r9d
mov r8d, esi
mov rdx, rax
lea ecx, [r9 + 5]
call qword [0x1800d7da8]
cmp eax, 0xc0000004
jne 0x1800240a9
mov rcx, rbx
call fcn.18005ed80
add esi, esi
jmp 0x180024070
test eax, eax
js 0x180024450
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x30], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov rsi, rbx
cmp qword [rbx + 0x50], rcx
je 0x1800240dc
mov eax, dword [rbx]
test eax, eax
je 0x1800240d9
add rbx, rax
jne 0x1800240c6
jmp 0x1800240dc
mov rbx, rbp
mov r8, rbx
mov rcx, rdi
call fcn.180023380
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r15, rsi
mov r12, rax
cmp qword [rdi + 0x18], rbp
je 0x180024437
mov edx, dword [rdi + 0x10]
lea r9, [rsp + 0x24]
mov rcx, qword [rdi]
mov r8d, 0x40
mov dword [rsp + 0x24], ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800243b1
mov rcx, qword [rdi + 0x18]
lea r9, [rsp + 0x20]
mov edx, 0x88
lea r8d, [rdx - 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18002438b
mov r8, qword [rdi + 0x18]
mov r9d, ebp
mov eax, dword [rdi + 0x10]
add r8, 0x38
test eax, eax
je 0x180024181
nop word [rax + rax]
mov rax, qword [rdi]
mov edx, r9d
inc r9d
movzx ecx, byte [rdx + rax]
mov byte [rdx + r8], cl
mov rax, qword [rdi + 0x18]
mov byte [rdx + rax + 0x58], cl
mov eax, dword [rdi + 0x10]
cmp r9d, eax
jb 0x180024160
cmp dword [rdi + 0x78], ebp
jne 0x180024190
cmp dword [rdi + 0x7c], ebp
jne 0x180024190
add r8, rax
jmp 0x18002419e
mov rdx, qword [rdi]
mov rcx, r8
call fcn.180023b30
mov r8, rax
mov edx, dword [rdi + 0x10]
lea r9, [r8 + 5]
add rdx, qword [rdi]
mov rax, r9
sub rax, rdx
mov rcx, rdx
sub rcx, r9
cmp r9, rdx
cmovbe rax, rcx
cmp rax, 0x7fff0000
ja 0x1800241d0
sub edx, r9d
mov byte [r8], 0xe9
mov dword [r8 + 1], edx
jmp 0x1800241de
mov word [r8], 0x25ff
mov dword [r8 + 2], ebp
mov qword [r8 + 6], rdx
mov r9, qword [rdi + 0x18]
mov r8d, ebp
lea r10, [r9 + 0x38]
sub r10, qword [rdi]
cmp dword [rdi + 0x30], ebp
jbe 0x180024226
nop dword [rax]
nop word [rax + rax]
mov edx, r8d
inc r8d
lea rax, [rdx + 2]
add rdx, rdx
add rax, rax
mov ecx, dword [rdi + rax*8 + 0x20]
mov eax, dword [rdi + rdx*8 + 0x38]
sub ecx, r10d
mov dword [rax + r9 + 0x38], ecx
cmp r8d, dword [rdi + 0x30]
jb 0x180024200
mov rdx, qword [rdi + 8]
mov r8, qword [rdi]
mov rcx, rdx
sub rcx, r8
mov rax, r8
sub rax, rdx
cmp rdx, r8
cmovae rax, rcx
mov rcx, rdx
cmp rax, 0x7fff0000
jbe 0x1800242f2
mov rsi, qword [rdi + 0x18]
lea r8, [rsi + 0x1d]
sub rcx, r8
mov rax, r8
sub rax, rdx
cmp r8, rdx
cmovbe rax, rcx
cmp rax, 0x7fff0000
ja 0x18002427f
sub edx, r8d
mov byte [rsi + 0x18], 0xe9
mov dword [rsi + 0x19], edx
add rsi, 0x1d
jmp 0x180024290
mov word [rsi + 0x18], 0x25ff
mov dword [rsi + 0x1a], ebp
mov qword [rsi + 0x1e], rdx
add rsi, 0x26
mov rbx, qword [rdi + 0x18]
sub rsi, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsi - 0x18]
lea rdx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x18]
add r8, 0x18
mov rcx, r8
lea r9, [rdx + 5]
sub rcx, r9
mov rax, r9
sub rax, r8
cmp r9, r8
cmovbe rax, rcx
cmp rax, 0x7fff0000
ja 0x1800242e4
sub r8d, r9d
mov byte [rdx], 0xe9
mov dword [rdx + 1], r8d
jmp 0x180024329
mov word [rdx], 0x25ff
mov dword [rdx + 2], ebp
mov qword [rdx + 6], r8
jmp 0x180024329
lea r9, [r8 + 5]
sub rcx, r9
mov rax, r9
sub rax, rdx
cmp r9, rdx
cmovbe rax, rcx
cmp rax, 0x7fff0000
ja 0x18002431b
sub edx, r9d
mov byte [r8], 0xe9
mov dword [r8 + 1], edx
jmp 0x180024329
mov word [r8], 0x25ff
mov dword [r8 + 2], ebp
mov qword [r8 + 6], rdx
mov rcx, qword [rdi + 0x18]
mov eax, dword [rdi + 0x10]
mov dword [rcx + 8], eax
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 8]
mov qword [rcx + 0x10], rax
mov rcx, qword [rdi + 0x18]
cmp qword [rcx], rbp
je 0x18002435d
mov rax, qword [r13]
add rcx, 0x38
mov qword [rax], rcx
mov rdx, qword [rdi + 0x18]
mov rcx, r12
mov r8d, dword [rdi + 0x10]
add rdx, 0x38
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rcx, qword [rdi + 0x18]
mov edx, 0x88
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rdi + 0x10]
mov rcx, r12
mov rdx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [rdi + 0x10]
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rdi + 0x18]
cmp qword [rcx], rbp
je 0x1800243c1
mov ebp, 1
jmp 0x180024437
mov r8, qword [rcx + 0x78]
test r8, r8
je 0x1800243d8
mov rax, qword [rcx + 0x80]
mov qword [r8 + 0x80], rax
mov r8, qword [rcx + 0x80]
test r8, r8
je 0x1800243ec
mov rax, qword [rcx + 0x78]
mov qword [r8 + 0x78], rax
cmp qword [0x1800d7da0], rcx
jne 0x180024403
mov rax, qword [rcx + 0x80]
mov qword [0x1800d7da0], rax
mov qword [rcx + 0x80], rbp
mov qword [rcx + 0x78], rbp
mov rax, qword [0x1800d7db8]
mov qword [rcx + 0x80], rax
mov rax, qword [0x1800d7db8]
test rax, rax
je 0x18002442c
mov qword [rax + 0x78], rcx
mov qword [0x1800d7db8], rcx
mov qword [rdi + 0x18], rbp
call fcn.1800232c0
mov rcx, r15
call fcn.18005ed80
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x78]
jmp 0x180024458
mov rcx, rbx
call fcn.18005ed80
mov rcx, rdi
call fcn.18005ed80
lea rcx, [0x1800d7dc0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14, qword [rsp + 0x38]
mov eax, ebp
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18002b710
add rsp, 0x40
pop r13
pop rdi
pop rbp
ret