Function at 0x1800180a0
Capabilities:
Create thread
Enumerate process modules
Get system information on windows
Inject thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [0x180038040]
xor rax, rsp
mov qword [rbp + 0x4a8], rax
mov r13, rdx
mov qword [rbp - 0x70], rdx
xor r15d, r15d
mov dword [rsp + 0x50], r15d
mov r8d, ecx
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov qword [rbp - 0x78], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x180018a3b
mov dword [rsp + 0x48], r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x58]
cmp ax, 9
je 0x18001813e
cmp ax, 6
je 0x18001813e
mov eax, dword [rsp + 0x48]
jmp 0x18001815f
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x18001815a
cmp dword [rsp + 0x48], 0
mov eax, r15d
jne 0x18001815f
mov eax, 1
test eax, eax
setne dil
mov byte [rsp + 0x40], dil
lea rcx, str.LunaHook64
lea rsi, str.LunaHook32
test eax, eax
cmovne rsi, rcx
cmp qword [r13 + 0x10], 0
je 0x1800181fe
lea r8, [0x18002d394]
mov rdx, r13
lea rcx, [rbp + 0x488]
call fcn.180011740
nop
mov dword [rsp + 0x50], 1
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1800181b0
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.18000fcb0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x468], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x478], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rax, [rbp + 0x468]
mov ebx, 0x403
jmp 0x1800183ff
mov ecx, 0x208
call fcn.18001f204
mov rdi, rax
mov qword [rbp + 0x468], rax
lea rbx, [rax + 0x208]
mov qword [rbp + 0x478], rbx
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.msvcrt.dll_memset
mov qword [rbp + 0x470], rbx
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rbx, 0xffffffffffffffff
test eax, eax
je 0x18001828f
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x180018270
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.180003570
mov byte [rsp + 0x78], 1
jmp 0x180018294
mov byte [rsp + 0x78], 0
test rdi, rdi
je 0x1800182a7
mov edx, 0x208
mov rcx, rdi
call fcn.18001f240
nop
mov dword [rsp + 0x50], 0x44
cmp byte [rsp + 0x78], 0
je 0x180018a8a
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x448], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbp + 0x458], xmm1
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r15w
mov dword [rsp + 0x50], 0x4c
nop
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1800182f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x400], xmm0
mov qword [rbp + 0x410], r15
mov qword [rbp + 0x418], r15
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp + 0x400]
call fcn.180003570
nop
mov dword [rsp + 0x50], 0x1dc
lea rdi, [rbp + 0x448]
mov r15, qword [rbp + 0x448]
cmp qword [rbp + 0x460], 7
cmova rdi, r15
mov rsi, qword [rbp + 0x458]
lea rbx, [rdi + rsi*2]
mov rdx, rbx
mov rcx, rdi
call fcn.180019e60
cmp rax, rbx
je 0x18001839b
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x180018371
cmp cx, 0x2f
jne 0x18001837a
add rax, 2
cmp rax, rbx
jne 0x180018362
cmp rax, rbx
je 0x18001839b
nop
lea rdx, [rbx - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x18001839b
cmp cx, 0x2f
je 0x18001839b
mov rbx, rdx
cmp rax, rdx
jne 0x180018380
sub rbx, rdi
sar rbx, 1
cmp rsi, rbx
jb 0x180018a90
mov qword [rbp + 0x458], rbx
lea rax, [rbp + 0x448]
cmp qword [rbp + 0x460], 7
cmova rax, r15
xor r15d, r15d
mov word [rax + rbx*2], r15w
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x448]
call fcn.180015e50
mov rdx, rax
lea rcx, [rbp + 0x420]
call fcn.180006840
lea rax, [rbp + 0x420]
mov ebx, 0x3fc
movzx edi, byte [rsp + 0x40]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x3e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x3f0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
test bl, 0x20
je 0x180018473
and ebx, 0xffffffdf
mov rdx, qword [rbp + 0x438]
cmp rdx, 7
jbe 0x180018473
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x420]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001846d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a96
call fcn.18001f240
nop
test bl, 0x10
je 0x1800184d9
and ebx, 0xffffffef
mov rdx, qword [rbp + 0x418]
cmp rdx, 7
jbe 0x1800184c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800184bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a9c
call fcn.18001f240
movdqa xmm0, xmmword [0x18002d000]
movdqu xmmword [rbp + 0x410], xmm0
mov word [rbp + 0x400], r15w
test bl, 8
je 0x18001853f
and ebx, 0xfffffff7
mov rdx, qword [rbp + 0x460]
cmp rdx, 7
jbe 0x180018527
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x448]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018522
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018aa2
call fcn.18001f240
movdqa xmm0, xmmword [0x18002d000]
movdqu xmmword [rbp + 0x458], xmm0
mov word [rbp + 0x448], r15w
test bl, 4
je 0x1800185a4
and ebx, 0xfffffffb
cmp byte [rsp + 0x78], 0
je 0x1800185a4
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x180018590
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001858b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018aa8
call fcn.18001f240
movdqa xmm0, xmmword [0x18002d000]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r15w
test bl, 2
je 0x1800185f3
and ebx, 0xfffffffd
mov rdx, qword [rbp + 0x480]
cmp rdx, 7
jbe 0x1800185f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x468]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800185ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018aae
call fcn.18001f240
nop
test bl, 1
je 0x180018656
mov rdx, qword [rbp + 0x4a0]
cmp rdx, 7
jbe 0x18001863e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x488]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018639
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018ab4
call fcn.18001f240
movdqa xmm0, xmmword [0x18002d000]
movdqu xmmword [rbp + 0x498], xmm0
mov word [rbp + 0x488], r15w
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x420]
call fcn.180006840
mov rcx, rax
call fcn.180016070
mov rcx, r14
cmp dil, 1
jne 0x180018820
xor dil, dil
mov r8, qword [rbp + 0x3f0]
lea r8, [r8*2 + 2]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x1800187a5
mov rcx, qword [rbp + 0x3f0]
lea r9, [rcx*2 + 2]
lea r8, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 7
cmova r8, qword [rbp + 0x3e0]
mov qword [rsp + 0x20], r15
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rsi
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
mov qword [rsp + 0x48], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180018732
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dil, 1
jmp 0x18001877b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x18001877b
xorps xmm0, xmm0
movups xmmword [rbp + 0x400], xmm0
mov qword [rbp + 0x410], r15
mov qword [rbp + 0x418], r15
lea r8d, [rax + 0x32]
lea rdx, str.architecture_mismatch:_only_x64_can_inject_this_process
lea rcx, [rbp + 0x400]
call fcn.180003570
lea rcx, [rbp + 0x400]
call fcn.180016070
xor dil, dil
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18001878f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov rdx, qword [rbp + 0x3f8]
cmp rdx, 7
jbe 0x1800187eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800187e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a84
call fcn.18001f240
mov qword [rbp + 0x3f0], r15
mov qword [rbp + 0x3f8], 7
mov word [rbp + 0x3e0], r15w
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, r13
call fcn.180001680
movzx eax, dil
jmp 0x180018a59
mov qword [rbp + 0x420], r14
mov qword [rbp + 0x428], r15
lea rdx, str.kernel32.dll
call fcn.180017190
mov rdx, rax
lea r8, [0x18002d340]
mov rcx, r14
call fcn.180017520
mov qword [rbp + 0x430], rax
mov dword [rbp + 0x438], r15d
mov dword [rbp + 0x43c], 0xffffffff
mov ecx, dword [0x1800396d0]
mov dword [rbp + 0x440], ecx
test rax, rax
jne 0x180018911
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov ecx, 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800188f1
mov dword [rbp - 0x60], 0x438
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp - 0x5c]
call sub.msvcrt.dll_memset
lea rdx, [rbp - 0x60]
mov rcx, rbx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x1800188e8
nop
lea rdx, str.kernel32.dll
lea rcx, [rbp - 0x30]
call sub.msvcrt.dll__wcsicmp
mov rcx, rbx
test eax, eax
je 0x180018983
lea rdx, [rbp - 0x60]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1800188c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, r15
lea r8, [0x18002d340]
mov rcx, r14
call fcn.1800179b0
mov qword [rbp + 0x430], rax
mov dword [rbp + 0x440], r15d
mov dword [rbp + 0x438], 1
lea rdx, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 7
cmova rdx, qword [rbp + 0x3e0]
lea rcx, [rbp + 0x420]
call fcn.180011a00
nop
mov rbx, qword [rbp + 0x428]
test rax, rax
je 0x180018992
test rbx, rbx
je 0x18001897f
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x180018972
cmp dword [rbx], 0
je 0x180018972
mov r9d, 0x4000
mov r8, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, 0x20
mov rcx, rbx
call fcn.18001f240
mov bl, 1
jmp 0x1800189c8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x38]
jmp 0x1800188f4
test rbx, rbx
je 0x1800189c6
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x1800189b9
cmp dword [rbx], 0
je 0x1800189b9
mov r9d, 0x4000
mov r8, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, 0x20
mov rcx, rbx
call fcn.18001f240
xor bl, bl
mov rdx, qword [rbp + 0x3f8]
cmp rdx, 7
jbe 0x180018a0a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018a05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a84
call fcn.18001f240
mov qword [rbp + 0x3f0], r15
mov qword [rbp + 0x3f8], 7
mov word [rbp + 0x3e0], r15w
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, r13
call fcn.180001680
movzx eax, bl
jmp 0x180018a59
lea rax, [r14 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180018a4f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, r13
call fcn.180001680
xor al, al
mov rcx, qword [rbp + 0x4a8]
xor rcx, rsp
call fcn.18001f6d0
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call fcn.1800233e0
nop
call fcn.180011240
nop
call fcn.18000fc90
nop
call fcn.1800233e0
nop
call fcn.1800233e0
nop
call fcn.1800233e0
nop
call fcn.1800233e0
nop
call fcn.1800233e0
nop
call fcn.1800233e0
int3