Function at 0x180001f30
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x100
mov rax, qword [0x180018020]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor edi, edi
mov rbx, rdx
mov r12, rcx
mov qword [rsp + 0x38], rcx
test rdx, rdx
jne 0x180001f68
lea eax, [rdx + 0x57]
jmp 0x180002300
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x18001a8f0], eax
je 0x180001f80
mov eax, 0x10dd
jmp 0x180002300
mov eax, dword [0x18001a8f4]
test eax, eax
jne 0x180002300
test r12, r12
je 0x180001fad
mov rcx, qword [r12]
test rcx, rcx
jne 0x180001fb7
mov dword [0x18001a8f4], 6
mov qword [0x18001a8f8], r12
mov eax, 6
jmp 0x180002300
mov qword [rsp + 0x130], rbp
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0xe8], r14
mov r12, rdi
mov r13, rdi
mov qword [rsp + 0xe0], r15
call fcn.1800010c0
mov rcx, rbx
mov r14, rax
call fcn.1800010c0
mov qword [rsp + 0x40], rax
cmp rax, r14
jne 0x180002010
cmp dword [0x18001a8e8], edi
jne 0x1800022ca
jmp 0x18000228d
mov ecx, 0x30
call fcn.180006198
mov r13, rax
test rax, rax
jne 0x18000202a
lea edi, [rax + 8]
jmp 0x18000228d
mov rcx, r14
call fcn.1800015f0
mov r12, rax
test rax, rax
jne 0x180002042
lea edi, [rax + 8]
jmp 0x18000228d
add rax, 0x40
xor ecx, ecx
mov rsi, r14
mov r15, r12
mov dword [rsp + 0x20], edi
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
test r15, r15
lea r8, [rsp + 0x90]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x24]
cmovne r8, r15
lea rcx, [0x18001e370]
mov rbp, rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x24], edi
test rsi, rsi
jne 0x1800020bc
lea ecx, [rsi + 0xd]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, rdi
jmp 0x1800020d7
movzx eax, byte [rsi]
mov r9, rsi
shl rax, 4
add rax, rcx
lea rcx, [rsp + 0x50]
mov rdx, rax
call qword [rax + 8]
mov rsi, rax
mov rdx, qword [rsp + 0x30]
movsxd rax, dword [rsp + 0x24]
mov ebx, esi
sub rax, rbp
sub ebx, r14d
inc rdx
add rax, rsi
mov qword [rsp + 0x30], rdx
add r15, rax
movzx eax, bl
and al, 7
movzx ecx, r15b
sub cl, r12b
shl cl, 3
xor cl, al
mov eax, dword [rsp + 0x20]
inc eax
mov byte [rdx - 1], cl
mov dword [rsp + 0x20], eax
cmp eax, 8
jae 0x180002178
movzx eax, byte [rbp]
cmp al, 0xeb
je 0x180002178
cmp al, 0xe9
je 0x180002178
cmp al, 0xe0
je 0x180002178
cmp al, 0xc2
je 0x180002178
cmp al, 0xc3
je 0x180002178
cmp al, 0xcc
je 0x180002178
cmp al, 0xf3
jne 0x180002140
cmp byte [rbp + 1], 0xc3
je 0x180002178
cmp al, 0xff
jne 0x18000214a
cmp byte [rbp + 1], 0x25
je 0x180002178
cmp al, 0x26
je 0x180002162
cmp al, 0x2e
je 0x180002162
cmp al, 0x36
je 0x180002162
cmp al, 0x3e
je 0x180002162
cmp al, 0x64
je 0x180002162
cmp al, 0x65
jne 0x18000216e
cmp byte [rbp + 1], 0xff
jne 0x18000216e
cmp byte [rbp + 2], 0x25
je 0x180002178
cmp ebx, 5
jae 0x1800021a6
jmp 0x18000205a
cmp ebx, 5
jae 0x1800021a6
nop dword [rax]
mov rcx, rsi
call fcn.180001160
test eax, eax
je 0x18000219d
cdqe
add rsi, rax
mov ebx, esi
sub ebx, r14d
cmp ebx, 5
jb 0x180002180
jmp 0x1800021a6
cmp ebx, 5
jb 0x18000227f
cmp dword [rsp + 0x20], 8
ja 0x18000227f
lea rsi, [r12 + 0x1e]
cmp r15, rsi
jbe 0x1800021bc
int3
lea rcx, [r12 + 0x20]
sub r15b, r12b
mov r8, rbx
mov rdx, r14
mov byte [r12 + 0x3e], bl
mov byte [rsi], r15b
call fcn.180006740
cmp rbx, 0x19
jbe 0x1800021e7
mov edi, 6
jmp 0x18000228d
movzx r8d, byte [rsi]
lea rax, [rbx + r14]
mov rdx, rsi
mov qword [r12 + 0x48], rax
mov rax, qword [rsp + 0x40]
add r8, r12
mov qword [r12 + 0x50], rax
lea rcx, [r8 + 6]
mov eax, r12d
sub eax, ecx
mov word [r8], 0x25ff
lea rcx, [r8 + 6]
add eax, 0x48
mov dword [r8 + 2], eax
call fcn.180001080
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov rdx, rbx
mov rcx, r14
mov dword [rsp + 0x28], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18000224c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x18000228d
mov rax, qword [rsp + 0x38]
mov dword [r13 + 8], edi
mov qword [r13 + 0x20], r12
mov qword [r13 + 0x10], rax
mov qword [r13 + 0x18], r14
mov eax, dword [rsp + 0x28]
mov dword [r13 + 0x28], eax
mov rax, qword [0x18001a908]
mov qword [0x18001a908], r13
mov qword [r13], rax
xor eax, eax
jmp 0x1800022d8
cmp dword [0x18001a8e8], 0
mov edi, 9
jne 0x180002293
mov dword [0x18001a8f4], edi
test r12, r12
je 0x1800022bd
xor edx, edx
mov rbx, r12
mov rcx, r12
lea r8d, [rdx + 0x60]
and rbx, 0xffffffffffff0000
call fcn.180007210
mov rax, qword [rbx + 0x10]
mov qword [r12 + 0x48], rax
mov qword [rbx + 0x10], r12
test r13, r13
je 0x1800022ca
mov rcx, r13
call fcn.180006190
mov rax, qword [rsp + 0x38]
mov qword [0x18001a8f8], rax
mov eax, edi
mov r14, qword [rsp + 0xe8]
mov r13, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xf8]
mov rbp, qword [rsp + 0x130]
mov r15, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180006170
add rsp, 0x100
pop r12
pop rdi
pop rbx
ret