Function at 0x18004c0d0
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Get system information on windows
Link function at runtime on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x2648]
mov eax, 0x2748
call fcn.1800514e0
sub rsp, rax
mov rax, qword [0x18027ceb0]
xor rax, rsp
mov qword [rbp + 0x2630], rax
mov rsi, qword [rbp + 0x26b8]
mov r12, rcx
mov rdi, r8
lea rcx, [rsp + 0x70]
mov dword [rbp + 0x25f0], 0x804
mov dword [rbp + 0x25f4], 0xc8
mov dword [rbp + 0x25f8], 0xe6118
mov dword [rbp + 0x25fc], 0x22
mov dword [rbp + 0x2600], 0xe6690
mov qword [rbp + 0x2604], 0x2e8
mov dword [rbp + 0x260c], 0
lea rax, [0x1802985c0]
mov edx, 0x4c
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rcx + 0x80]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
dec rdx
jne 0x18004c170
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea r8, [rbp + 0x25f0]
mov edx, 0x64
mov r9d, 0x2658
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
mov rax, qword [rax + 0x50]
movups xmmword [rcx + 0x30], xmm1
movups xmmword [rcx + 0x40], xmm0
mov qword [rcx + 0x50], rax
lea rcx, [rsp + 0x70]
call fcn.18002b060
cmp byte [rbp - 0x67], 0
mov dword [rbp + 0x25d0], 0x60302814
movups xmm0, xmmword [rbp - 0x5a]
movups xmm1, xmmword [rbp - 0x4a]
mov dword [rbp + 0x25d4], 0x30c8
mov dword [rbp + 0x25d8], 0xe6118
mov dword [rbp + 0x25dc], 0x22
movups xmmword [rbp + 0x2610], xmm0
movups xmmword [rbp + 0x2620], xmm1
mov dword [rbp + 0x25e0], 0xe6690
mov qword [rbp + 0x25e4], 0x2e8
mov dword [rbp + 0x25ec], 0x306080
je 0x18004c291
mov r8d, 0x64
lea rdx, [rbp + 0x25d0]
lea rcx, [rbp + 0x2610]
lea r9d, [r8 - 0x5c]
mov qword [rsp + 0x20], rsi
call fcn.18002b350
mov eax, 0xfa000
mov ebx, edi
lea r8, [rbp - 0x5a]
cmp edi, eax
mov edx, 0x64
mov rcx, r12
cmovg ebx, eax
movsxd r14, ebx
mov r9, r14
call fcn.18002b060
sub edi, ebx
cmp edi, 0x9c4000
jbe 0x18004c2c5
mov edi, 0x9c4000
jmp 0x18004c2c9
test edi, edi
je 0x18004c2e0
movzx edx, word [rbp - 0x5c]
lea rcx, [r14 + r12]
lea r8, [rbp + 0x25d0]
mov r9d, edi
call fcn.18002b060
cmp byte [rbp - 0x66], 0
je 0x18004c317
mov rbx, qword [rbp - 0x70]
mov r8d, 0x64
mov qword [rsp + 0x20], rsi
add rbx, r12
lea r9d, [r8 + 0x1c]
mov rdx, rbx
mov rcx, rbx
call fcn.18002b3f0
mov r8, rsi
mov edx, 0x20
mov rcx, rbx
call fcn.18002b190
movsxd r14, dword [r12 + 0x3c]
mov edx, 0x108
add r14, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x18004c71f
cmp dword [r14], 0x4550
jne 0x18004c71f
movzx r10d, word [r14 + 6]
movzx eax, word [r14 + 0x14]
mov qword [rsp + 0x2788], r13
mov qword [rsp + 0x2740], r15
xor r13d, r13d
add rax, 0x18
add rax, r14
lea r15d, [r10 + r10*4]
mov edi, r13d
shl r15d, 3
mov dword [rsp + 0x30], r13d
mov r9d, r13d
sub r15d, r12d
mov qword [rsp + 0x38], rax
add r15d, eax
mov ebx, r15d
test r10, r10
jle 0x18004c3c5
mov r11d, dword [r14 + 0x98]
lea r8, [rax + 0xc]
nop dword [rax + rax]
mov ecx, dword [r8 + 4]
lea r8, [r8 + 0x28]
add ecx, dword [r8 - 0x28]
cmp ebx, ecx
cmovb ebx, ecx
cmp r11d, dword [r8 - 0x28]
cmove edi, r9d
inc r9
cmp r9, r10
jl 0x18004c3a0
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, dword [rsp + 0x44]
xor edx, edx
mov eax, ebx
div r8d
mov ecx, eax
test edx, edx
je 0x18004c3e5
inc rcx
mov rdx, r8
mov r8d, 0x1000
imul rdx, rcx
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18004c450
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Error_in_VirtualAlloc
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov r13, qword [rsp + 0x2788]
mov r15, qword [rsp + 0x2740]
mov rcx, qword [rbp + 0x2630]
xor rcx, rsp
call fcn.18004fba0
add rsp, 0x2748
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8d, r15d
mov rdx, r12
mov rcx, rax
call fcn.18004f540
cmp r13w, word [r14 + 6]
jae 0x18004c4b4
mov r15, qword [rsp + 0x38]
add r15, 0x10
nop
mov edi, dword [r15 - 4]
mov ebx, dword [r15]
mov edx, dword [r15 + 4]
add rdi, rsi
add rdx, r12
mov r8d, ebx
mov rcx, rdi
call fcn.18004f540
movzx edx, word [rbp - 0x5c]
lea r8, [rbp - 0x5a]
mov r9d, ebx
mov rcx, rdi
call fcn.18002b060
movzx eax, word [r14 + 6]
inc r13
lea r15, [r15 + 0x28]
cmp r13, rax
jl 0x18004c470
mov edi, dword [rsp + 0x30]
movsxd r13, dword [rsi + 0x3c]
mov qword [0x18028c900], rsi
add r13, rsi
test edi, edi
je 0x18004c4e7
call fcn.180047010
cmp eax, 1
jne 0x18004c4e7
movsxd rax, edi
lea rcx, [rax + rax*4]
add dword [r13 + rcx*8 + 0x114], r12d
add dword [r13 + rcx*8 + 0x11c], r12d
mov eax, dword [r13 + 0x90]
test eax, eax
jne 0x18004c50d
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
jmp 0x18004c421
mov r14, rax
test eax, eax
je 0x18004c6f8
add r14, rsi
movabs r12, 0x8000000000000000
cmp dword [r14 + 4], 0
jne 0x18004c533
cmp dword [r14 + 0xc], 0
je 0x18004c5ac
mov edx, dword [r14 + 0xc]
mov rcx, qword [0x18028ca10]
add rdx, qword [0x18028c900]
call fcn.1800422b0
mov r15, rax
test rax, rax
je 0x18004c5a3
mov eax, dword [r14]
test eax, eax
je 0x18004c55f
lea rbx, [rsi + rax]
jmp 0x18004c566
mov ebx, dword [r14 + 0x10]
add rbx, rsi
mov edi, dword [r14 + 0x10]
mov rax, qword [rbx]
add rdi, rsi
test rax, rax
je 0x18004c5a3
mov rcx, r15
test r12, rax
je 0x18004c582
movzx edx, ax
jmp 0x18004c589
lea rdx, [rax + 2]
add rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rbx, 8
add rdi, 8
mov qword [rdi - 8], rax
mov rax, qword [rbx]
test rax, rax
jne 0x18004c575
add r14, 0x14
jmp 0x18004c525
cmp byte [rbp - 0x64], 0
je 0x18004c5ca
mov ecx, dword [r13 + 0x90]
mov r8d, dword [r13 + 0x94]
xor edx, edx
add rcx, rsi
call fcn.180050a30
mov edx, dword [r13 + 0xb0]
test rdx, rdx
je 0x18004c6a9
add rdx, rsi
cmp dword [rdx], 0
je 0x18004c68b
mov ebx, 0xa000
mov r11d, 0xf000
mov r10d, 0x3000
nop word [rax + rax]
mov eax, dword [rdx + 4]
lea r8, [rdx + 8]
add rax, rdx
cmp r8, rax
jae 0x18004c67c
nop
movzx r9d, word [r8]
movzx eax, r9w
and ax, r11w
cmp ax, bx
je 0x18004c653
cmp ax, r10w
je 0x18004c653
test ax, ax
je 0x18004c66d
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Error_in_set_Reloc.
jmp 0x18004c417
mov ecx, dword [rdx]
and r9d, 0xfff
lea rax, [rsi + r9]
add rcx, rax
mov rax, rsi
sub rax, qword [r13 + 0x30]
add qword [rcx], rax
mov eax, dword [rdx + 4]
add r8, 2
add rax, rdx
cmp r8, rax
jb 0x18004c610
mov eax, dword [rdx + 4]
add rdx, rax
cmp dword [rdx], 0
jne 0x18004c600
cmp byte [rbp - 0x63], 0
je 0x18004c6a9
mov ecx, dword [r13 + 0xb0]
mov r8d, dword [r13 + 0xb4]
xor edx, edx
add rcx, rsi
call fcn.180050a30
mov rcx, qword [rbp - 0x80]
movzx edx, byte [rbp + 0x26b0]
add rcx, rsi
mov qword [0x18028ca28], rcx
mov rcx, rsi
call qword [0x18028c8c8]
mov rcx, qword [0x18028ca10]
xor r8d, r8d
cmp dword [0x18027cdd0], r8d
lea edx, [r8 + 1]
jne 0x18004c6e1
mov rcx, rsi
call qword [0x18028ca28]
mov qword [0x18028ca30], rsi
mov eax, 1
jmp 0x18004c421
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Error_in_Get_ImportDesc
jmp 0x18004c417
xor eax, eax
jmp 0x18004c431