Function at 0x180004080
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
call fcn.18004cb80
test al, al
jne 0x1800040a4
mov eax, 7
jmp 0x1800045ae
call fcn.180049880
lea r13, [0x1800f4f48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1800040d9
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800040c0
xor edi, edi
mov r12d, edi
mov r14d, edi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000414b
movsxd rbx, dword [rax + 0x3c]
add rbx, rax
movzx eax, word [rbx + 0x14]
lea rbp, [rbx + 0x18]
add rbp, rax
mov esi, edi
nop dword [rax]
nop word [rax + rax]
mov rdx, rbp
lea rcx, str..il2cpp
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800043a7
mov eax, esi
lea rbp, [rax*4 + 3]
movzx ecx, word [rbx + 0x14]
add rcx, rbx
add rbp, rax
lea rbp, [rcx + rbp*8]
inc esi
movzx eax, word [rbx + 6]
cmp esi, eax
jbe 0x180004110
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800041cb
movsxd rbx, dword [rax + 0x3c]
add rbx, rax
movzx eax, word [rbx + 0x14]
lea r15, [rbx + 0x18]
add r15, rax
mov ebp, edi
nop dword [rax]
nop dword [rax + rax]
mov rdx, r15
lea rcx, [0x1800e1988]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1800043c2
mov eax, ebp
lea r15, [rax*4 + 3]
movzx ecx, word [rbx + 0x14]
add rcx, rbx
add r15, rax
lea r15, [rcx + r15*8]
inc ebp
movzx eax, word [rbx + 6]
cmp ebp, eax
jbe 0x180004190
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
test r14, r14
je 0x1800045a9
test r12, r12
je 0x1800045a9
test rdx, rdx
je 0x1800045a9
test rcx, rcx
je 0x1800045a9
lea r9, [rsp + 0x40]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r11d, edi
mov r9, rdi
test r14, r14
je 0x180004273
lea rbx, [0x1800f4f80]
mov r10, rsi
sub r10, rbx
nop dword [rax]
nop word [rax + rax]
lea r8, str.x_xx_xxxxx_xx_xxxx
mov rdx, rbx
mov al, 0x78
nop dword [rax]
cmp al, 0x78
jne 0x180004251
lea rcx, [r10 + rdx]
movzx eax, byte [rdx]
cmp byte [rcx + r9], al
jne 0x18000426b
inc r8
inc rdx
movzx eax, byte [r8]
test al, al
jne 0x180004240
test r11d, r11d
je 0x1800043f1
inc r11d
inc r9
cmp r9, r14
jb 0x180004230
mov r11d, edi
mov r9, rdi
mov rbx, rdi
test r14, r14
je 0x1800042d3
lea rbp, [0x1800f4fc0]
mov r10, rsi
sub r10, rbp
nop
lea r8, str.x_xxxx_xxxxxxxxxx_xxxxxxxxxxxxxxx
mov rdx, rbp
mov al, 0x78
nop dword [rax]
cmp al, 0x78
jne 0x1800042b1
lea rcx, [r10 + rdx]
movzx eax, byte [rdx]
cmp byte [rcx + r9], al
jne 0x1800042cb
inc r8
inc rdx
movzx eax, byte [r8]
test al, al
jne 0x1800042a0
test r11d, r11d
je 0x180004400
inc r11d
inc r9
cmp r9, r14
jb 0x180004290
mov r11d, edi
mov r9, rdi
mov rbp, rdi
test r14, r14
je 0x180004333
lea r15, [0x1800f5008]
mov r10, rsi
sub r10, r15
nop
lea r8, str.xxxx____x____xxxx____x____xxxx
mov rdx, r15
mov al, 0x78
nop dword [rax]
cmp al, 0x78
jne 0x180004311
lea rcx, [r10 + rdx]
movzx eax, byte [rdx]
cmp byte [rcx + r9], al
jne 0x18000432b
inc r8
inc rdx
movzx eax, byte [r8]
test al, al
jne 0x180004300
test r11d, r11d
je 0x18000440f
inc r11d
inc r9
cmp r9, r14
jb 0x1800042f0
mov r10d, edi
mov r9, rdi
mov r15, rdi
test r14, r14
je 0x180004393
lea r11, [0x1800f5048]
sub rsi, r11
nop dword [rax + rax]
lea r8, str.xx_xxxxxxxx_xxx_x
mov rdx, r11
mov al, 0x78
nop dword [rax]
cmp al, 0x78
jne 0x180004371
lea rcx, [rsi + rdx]
movzx eax, byte [rdx]
cmp byte [rcx + r9], al
jne 0x18000438b
inc r8
inc rdx
movzx eax, byte [r8]
test al, al
jne 0x180004360
test r10d, r10d
je 0x180004429
inc r10d
inc r9
cmp r9, r14
jb 0x180004350
mov rsi, rdi
test rbx, rbx
jne 0x180004432
lea eax, [rbx + 0xc]
jmp 0x1800045ae
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [rbp + 0xc]
add rsi, rax
mov r12, rsi
mov r14d, dword [rbp + 0x10]
jmp 0x180004153
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov eax, dword [r15 + 0xc]
add rcx, rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov edx, dword [r15 + 0x10]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x40], edi
jmp 0x1800041d5
lea rbx, [r12 + r9]
mov r11d, edi
mov r9, rdi
jmp 0x180004281
lea rbp, [r12 + r9]
mov r11d, edi
mov r9, rdi
jmp 0x1800042e1
movsxd r15, dword [rsi + r9 + 0x1e]
add r15, r12
add r9, 0x22
add r15, r9
mov r10d, edi
mov r9, rdi
jmp 0x180004341
lea rsi, [r12 + r9]
jmp 0x180004396
test rbp, rbp
jne 0x18000443f
lea eax, [rbp + 0xd]
jmp 0x1800045ae
test r15, r15
jne 0x18000444d
lea eax, [r15 + 0xb]
jmp 0x1800045ae
test rsi, rsi
jne 0x18000445a
lea eax, [rsi + 0xa]
jmp 0x1800045ae
mov ecx, 0x80
call fcn.1800d2570
mov qword [rsp + 0xa0], rax
lea r9, [0x1800e1ed8]
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call fcn.18000a190
nop
mov qword [0x180110538], rax
mov ecx, 0x80
call fcn.1800d2570
mov qword [rsp + 0xa8], rax
lea r9, [0x1800f505c]
mov r8d, 2
mov rdx, rbp
mov rcx, rax
call fcn.18000a190
nop
mov qword [0x180110540], rax
mov ecx, 0x80
call fcn.1800d2570
mov qword [rsp + 0xb0], rax
lea rdx, [rbp + 5]
lea r9, [0x1800f505c]
mov r8d, 2
mov rcx, rax
call fcn.18000a190
nop
mov qword [0x180110548], rax
mov ecx, 0x80
call fcn.1800d2570
mov qword [rsp + 0xb8], rax
lea r9, [0x1800f5060]
mov r8d, 3
mov rdx, rsi
mov rcx, rax
call fcn.18000a190
nop
mov qword [0x180110530], rax
mov rcx, qword [0x180110538]
call fcn.18000a390
mov rcx, qword [0x180110540]
call fcn.18000a390
mov rcx, qword [0x180110548]
call fcn.18000a390
mov rcx, qword [0x180110530]
call fcn.18000a390
mov qword [0x180110d28], r15
mov dword [r15], edi
mov dword [rsp + 0xa0], edi
lea r9, [rsp + 0xa0]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r8, [0x1800045c0]
lea rdx, [fcn.180004630]
lea rcx, [0x180004640]
call fcn.180006090
mov ecx, 8
test al, al
cmove edi, ecx
mov eax, edi
jmp 0x1800045ae
mov eax, 2
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret