Function at 0x1400013a0
Capabilities:
Access peb ldr_data
Encrypt data using rc4 ksa
Execute anti-debugging instructions
Get ntdll base address
Get system information on windows
Send icmp echo request
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0x310], rax
movsxd r14, ecx
mov r13d, 1
xor r12d, r12d
mov rsi, rdx
cmp r14d, r13d
jle 0x14000149a
cmp r14, r13
jbe 0x1400014bd
mov ebx, r13d
lea edi, [r13 + 1]
lea r8, str.__check
nop word [rax + rax]
mov rdx, qword [rsi + rbx*8]
mov rax, r12
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x140001488
cmp rax, 8
jne 0x140001420
cmp edi, r14d
jge 0x140001488
mov rdx, qword [rsi + rbx*8 + 8]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
mov r8, 0xffffffffffffffff
mov qword [rbp + 0xf8], r12
nop dword [rax]
inc r8
cmp byte [rdx + r8], r12b
jne 0x140001460
lea rcx, [rbp + 0xe0]
call fcn.1400024a0
lea rcx, [rbp + 0xe0]
call fcn.140001010
lea r8, str.__check
add edi, 2
add rbx, 2
cmp rbx, r14
jl 0x140001410
jmp 0x1400014bd
mov dword [0x140024f20], r13d
mov dword [0x140024f1c], r13d
mov dword [0x140024f18], r13d
mov dword [0x140024f14], r13d
mov dword [0x140024f10], r13d
lea rcx, str.Al_Khaser___by_Lord_Noteworthy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 0x64
mov dword [rsp + 0x28], r13d
mov r8d, edx
mov dword [rsp + 0x20], 0x384
mov r9d, 0x384
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str._al_khaser_version_0.82_
call fcn.140002610
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, 0x16
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Initialisation
lea rcx, str._n___________________________s___________________________n
call fcn.140002cf0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ebx, r12d
lea rsi, [0x1400241fc]
mov dword [rbp + 0x60], ebx
nop word [rax + rax]
mov r15d, dword [rsi + 4]
xor al, al
test dword [rsi - 4], 0xfffffffd
mov r12d, dword [rsi]
jne 0x140001627
xor r14b, r14b
lea rbx, [0x1400247b8]
xor edi, edi
lea rcx, [0x140024888]
nop dword [rax]
test rdi, rdi
je 0x1400015b8
cmp dword [rbx - 8], r12d
jne 0x1400015b8
movzx r14d, r13b
call qword [rbx]
lea rcx, [0x140024888]
inc rdi
add rbx, 0x10
cmp rbx, rcx
jl 0x1400015a0
test r14b, r14b
jne 0x1400015d2
lea rcx, str.ERROR:_Minimum_version_value_was_invalid._n
jmp 0x14000161d
test al, al
je 0x140001622
test r15d, r15d
jne 0x1400015e1
movzx eax, r13b
jmp 0x140001624
xor dil, dil
lea rbx, [0x1400247b8]
xor al, al
nop dword [rax]
cmp dword [rbx - 8], r15d
jne 0x140001608
movzx edi, r13b
call qword [rbx]
test al, al
lea rcx, [0x140024888]
sete al
add rbx, 0x10
cmp rbx, rcx
jl 0x1400015f0
test dil, dil
jne 0x140001624
lea rcx, str.ERROR:_Removed_version_value_was_invalid._n
call fcn.1400025a0
xor al, al
mov ebx, dword [rbp + 0x60]
mov rcx, qword [rsi - 0x14]
mov byte [rsi + 9], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000163e
mov byte [rsi + 8], al
jmp 0x140001658
mov rdx, qword [rsi - 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsi + 0xc], rax
setne al
mov byte [rsi + 8], al
inc ebx
add rsi, 0x30
mov dword [rbp + 0x60], ebx
cmp ebx, 0x1f
jb 0x140001570
xor r12d, r12d
lea rcx, [rbp + 0x102]
xor edx, edx
mov word [rbp + 0x100], r12w
mov r8d, 0x206
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x100]
call fcn.140003510
test eax, eax
je 0x1400016ac
lea rdx, [rbp + 0x100]
lea rcx, str._n___You_are_running:__s_n
call fcn.140002cf0
mov esi, r12d
lea rbx, [0x140024204]
mov edi, r12d
nop dword [rax]
cmp byte [rbx + 1], r12b
je 0x1400016e1
cmp byte [rbx], r12b
jne 0x1400016e1
mov r8, qword [rbx - 0x14]
lea rcx, str.___Warning:_API__s__s_was_expected_to_exist_but_was_not_found._n
mov rdx, qword [rbx - 0x1c]
call fcn.1400025a0
inc esi
inc edi
add rbx, 0x30
cmp edi, 0x1f
jb 0x1400016c0
test esi, esi
jne 0x1400016fc
lea rcx, str.___All_APIs_present_and_accounted_for._n
call fcn.1400025a0
call fcn.140003450
test eax, eax
je 0x140001711
lea rcx, str.Process_is_running_under_WOW64_n_n
call fcn.140002610
cmp dword [0x140024f20], r12d
je 0x14000181d
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rbp + 0xb4]
lea r8, [rbp + 0x60]
xorps xmm0, xmm0
lea rdx, [0x1400027c0]
mov ecx, 4
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x14000181d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x60]
lea r8, [rbp + 0xe0]
mov rcx, rax
mov r9d, 0x18
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x14000181d
mov rdi, r12
cmp dword [rbp + 0xe8], edi
jbe 0x14000181d
mov rbx, qword [rbp + 0xe0]
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rbp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jb 0x14000180c
mov eax, dword [rbp + 0xa4]
test al, 0x10
jne 0x1400017e2
test al, 0x20
jne 0x1400017e2
test al, al
js 0x1400017e2
test al, 0x40
je 0x14000180c
mov rdx, qword [0x140025ee8]
cmp rdx, qword [0x140025ef0]
mov qword [rbp + 0x68], rbx
je 0x140001803
mov qword [rdx], rbx
add qword [0x140025ee8], 8
jmp 0x14000180c
lea r8, [rbp + 0x68]
call fcn.1400029a0
mov eax, dword [rbp + 0xe8]
add rdi, rsi
add rbx, rsi
cmp rdi, rax
jb 0x1400017b0
cmp dword [0x140024f1c], r12d
je 0x140001eff
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, 0x16
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Timing_attacks
lea rcx, str._n___________________________s___________________________n
call fcn.140002cf0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r15d, 0xa
lea rcx, str._n___Delay_value_is_set_to__u_minutes_..._n
mov edx, r15d
call fcn.1400025a0
lea rdx, str.Performing_a_sleep___in_a_loop_...
lea rcx, str.____s
call fcn.140002cf0
lea ebx, [r15 + 0x33]
nop
lea rcx, [0x140008ae8]
call fcn.140002cf0
sub rbx, r13
jne 0x1400018b0
mov ebx, 0x3e8
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, r13
jne 0x1400018c6
lea rdx, str.Performing_a_sleep___in_a_loop_...
xor ecx, ecx
call fcn.140002e40
lea rdx, str.Delaying_execution_using_SetTimer_...
lea rcx, str.____s
call fcn.140002cf0
mov ebx, 0x3a
nop word [rax + rax]
lea rcx, [0x140008ae8]
call fcn.140002cf0
sub rbx, r13
jne 0x140001900
lea r9, [0x140005410]
xor edx, edx
xor ecx, ecx
mov r8d, 0x2710
call qword [sym.imp.USER32.dll_SetTimer]
mov rbx, rax
test rax, rax
jne 0x140001935
mov ecx, r13d
jmp 0x1400019ad
xor r9d, r9d
lea rcx, [rbp + 0x80]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
mov ecx, r12d
cmp dword [0x140025ed8], ecx
sete cl
test ecx, eax
je 0x14000199f
nop word [rax + rax]
lea rcx, [rbp + 0x80]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x80]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp + 0x80]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
mov ecx, r12d
cmp dword [0x140025ed8], ecx
sete cl
test ecx, eax
jne 0x140001960
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov ecx, r12d
lea rdx, str.Delaying_execution_using_SetTimer_...
call fcn.140002e40
lea rdx, str.Delaying_execution_using_timeSetEvent_...
lea rcx, str.____s
call fcn.140002cf0
mov esi, 0x36
mov ebx, esi
lea rcx, [0x140008ae8]
call fcn.140002cf0
sub rbx, r13
jne 0x1400019d3
lea edx, [rbx + 8]
lea rcx, [rbp + 0x60]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
mov rax, qword [rbp + 0x60]
lea r8, [0x140005410]
mov ebx, dword [rbp + 0x64]
test eax, eax
mov ecx, r12d
mov dword [rsp + 0x20], r12d
cmovne ecx, eax
cmp ecx, ebx
cmovb ebx, ecx
xor r9d, r9d
mov edx, ebx
mov ecx, 0x2710
call qword [sym.imp.WINMM.dll_timeSetEvent]
test eax, eax
jne 0x140001a30
mov ecx, r13d
jmp 0x140001a43
mov ecx, eax
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, r12d
lea rdx, str.Delaying_execution_using_timeSetEvent_...
call fcn.140002e40
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
lea rcx, str.____s
call fcn.140002cf0
mov r14d, 0x2f
mov ebx, r14d
nop dword [rax + rax]
lea rcx, [0x140008ae8]
call fcn.140002cf0
sub rbx, r13
jne 0x140001a70
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
jne 0x140001aa8
lea rcx, str.CreateEvent
call fcn.140002fe0
mov ecx, r13d
jmp 0x140001ab9
mov edx, 0x2710
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, r12d
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
call fcn.140002e40
lea rdx, str.Delaying_execution_using_WaitForMultipleObjects_...
lea rcx, str.____s
call fcn.140002cf0
mov ebx, 0x2c
nop dword [rax]
lea rcx, [0x140008ae8]
call fcn.140002cf0
sub rbx, r13
jne 0x140001ae0
mov ebx, r12d
lea rdi, [rbp + 0x68]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi], rax
test rax, rax
je 0x140001b3f
inc ebx
add rdi, 8
cmp ebx, 2
jb 0x140001b00
xor r8d, r8d
lea rdx, [rbp + 0x68]
mov r9d, 0x2710
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, r12d
jmp 0x140001b4e
lea rcx, str.CreateEvent
call fcn.140002fe0
mov ecx, r13d
lea rdx, str.Delaying_execution_using_WaitForMultipleObjects_...
call fcn.140002e40
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
lea rcx, str.____s
call fcn.140002cf0
nop dword [rax]
lea rcx, [0x140008ae8]
call fcn.140002cf0
sub rsi, r13
jne 0x140001b70
movsd xmm0, qword [str.Data_Buffer]
mov eax, dword [0x1400095c8]
movsd qword [rbp + 0xe0], xmm0
xorps xmm0, xmm0
mov dword [rbp + 0xe8], eax
xor eax, eax
movups xmmword [rbp + 0xec], xmm0
mov dword [rbp + 0xfc], eax
call qword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001be3
lea rcx, str._tUnable_to_open_handle._n
call fcn.1400025a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.IcmpCreatefile_returned_error:__u_n
call fcn.1400025a0
mov ecx, r13d
jmp 0x140001c57
mov ecx, 0x50
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
mov rcx, rbx
test rax, rax
jne 0x140001c10
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
lea rcx, str._tUnable_to_allocate_memory_n
call fcn.1400025a0
mov ecx, r13d
jmp 0x140001c57
mov dword [rsp + 0x38], 0x2710
lea r8, [rbp + 0xe0]
mov dword [rsp + 0x30], 0x50
mov r9d, 0x20
mov qword [rsp + 0x28], rdi
mov edx, 0xffffffff
mov qword [rsp + 0x20], r12
call qword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, r12d
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
call fcn.140002e40
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
lea rcx, str.____s
call fcn.140002cf0
nop word [rax + rax]
lea rcx, [0x140008ae8]
call fcn.140002cf0
sub r14, r13
jne 0x140001c80
xor r8d, r8d
mov qword [rbp + 0x68], 0xfffffffffa0a1f00
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov rdi, rax
test rax, rax
jne 0x140001cb4
mov ebx, r13d
jmp 0x140001d03
mov dword [rsp + 0x28], r12d
lea rdx, [rbp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
jne 0x140001cda
mov ebx, r13d
jmp 0x140001cf1
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ebx, r12d
cmovne ebx, r13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
mov ecx, ebx
call fcn.140002e40
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
lea rcx, str.____s
call fcn.140002cf0
mov ebx, 0x2d
nop dword [rax]
lea rcx, [0x140008ae8]
call fcn.140002cf0
sub rbx, r13
jne 0x140001d30
xor r9d, r9d
mov qword [rbp + 0x68], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140025ed0], rax
test rax, rax
jne 0x140001d66
mov ebx, r12d
jmp 0x140001de1
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov rdi, rax
test rax, rax
jne 0x140001d79
mov ebx, r13d
jmp 0x140001de1
mov dword [rsp + 0x30], r12d
lea r8, [0x140005420]
mov dword [rsp + 0x28], r12d
lea rcx, [rbp + 0x68]
mov r9d, 0xdeadbeef
mov dword [rsp + 0x20], 0x2710
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x140001dae
mov ebx, r13d
jmp 0x140001dc9
mov rcx, qword [0x140025ed0]
mov edx, 0x186a0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ebx, r12d
cmovne ebx, r12d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov rcx, qword [0x140025ed0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
mov ecx, ebx
call fcn.140002e40
lea rdx, str.Checking_RDTSC_Locky_trick
lea rcx, str.____s
call fcn.140002cf0
mov ebx, 0x44
nop word [rax + rax]
lea rcx, [0x140008ae8]
call fcn.140002cf0
sub rbx, r13
jne 0x140001e10
mov esi, r12d
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
rdtsc
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
rdtsc
shl rdx, 0x20
or rax, rdx
xor edx, edx
sub eax, ebx
sub ebx, edi
div ebx
cmp eax, r15d
jae 0x140001e69
inc esi
cmp esi, r15d
jb 0x140001e24
jmp 0x140001e6c
mov r13d, r12d
lea rdx, str.Checking_RDTSC_Locky_trick
mov ecx, r13d
call fcn.140002e40
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
lea rcx, str.____s
call fcn.140002cf0
mov ebx, 0x32
lea rcx, [0x140008ae8]
call fcn.140002cf0
sub rbx, 1
jne 0x140001e93
mov r8, r12
nop dword [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rbp + 0x68], eax
mov dword [rbp + 0x6c], ebx
mov dword [rbp + 0x70], ecx
mov dword [rbp + 0x74], edx
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rdi
add r8, rax
sub r15, 1
jne 0x140001eb0
lea rax, [r8 - 0xa]
mov ecx, r12d
cmp rax, 0x2705
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
seta cl
call fcn.140002e40
cmp dword [0x140024f14], r12d
je 0x14000215d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, 0x16
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Analysis_tools
lea rcx, str._n___________________________s___________________________n
call fcn.140002cf0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.ollydbg.exe
mov qword [rsp + 0x40], rax
lea rax, str.ProcessHacker.exe
mov qword [rsp + 0x48], rax
lea rax, str.tcpview.exe
mov qword [rsp + 0x50], rax
lea rax, str.autoruns.exe
mov qword [rsp + 0x58], rax
lea rax, str.autorunsc.exe
mov qword [rsp + 0x60], rax
lea rax, str.filemon.exe
mov qword [rsp + 0x68], rax
lea rax, str.procmon.exe
mov qword [rsp + 0x70], rax
lea rax, str.regmon.exe
mov qword [rsp + 0x78], rax
lea rax, str.procexp.exe
mov qword [rbp - 0x80], rax
lea rax, str.idaq.exe
mov qword [rbp - 0x78], rax
lea rax, str.idaq64.exe
mov qword [rbp - 0x70], rax
lea rax, str.ImmunityDebugger.exe
mov qword [rbp - 0x68], rax
lea rax, str.Wireshark.exe
mov qword [rbp - 0x60], rax
lea rax, str.dumpcap.exe
mov qword [rbp - 0x58], rax
lea rax, str.HookExplorer.exe
mov qword [rbp - 0x50], rax
lea rax, str.ImportREC.exe
mov qword [rbp - 0x48], rax
lea rax, str.PETools.exe
mov qword [rbp - 0x40], rax
lea rax, str.LordPE.exe
mov qword [rbp - 0x38], rax
lea rax, str.SysInspector.exe
mov qword [rbp - 0x30], rax
lea rax, str.proc_analyzer.exe
mov qword [rbp - 0x28], rax
lea rax, str.sysAnalyzer.exe
mov qword [rbp - 0x20], rax
lea rax, str.sniff_hit.exe
mov qword [rbp - 0x18], rax
lea rax, str.windbg.exe
mov qword [rbp - 0x10], rax
lea rax, str.joeboxcontrol.exe
mov qword [rbp - 8], rax
lea rax, str.joeboxserver.exe
mov qword [rbp], rax
mov qword [rbp + 8], rax
lea rax, str.ResourceHacker.exe
mov qword [rbp + 0x10], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x18], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x20], rax
lea rax, str.Fiddler.exe
mov qword [rbp + 0x28], rax
lea rax, str.httpdebugger.exe
mov qword [rbp + 0x30], rax
lea rax, str.cheatengine_i386.exe
mov esi, 0x24
mov qword [rbp + 0x38], rax
lea rdi, [rsp + 0x40]
lea rax, str.cheatengine_x86_64.exe
mov qword [rbp + 0x40], rax
lea rax, str.cheatengine_x86_64_SSE4_AVX2.exe
mov qword [rbp + 0x48], rax
lea rax, str.frida_helper_32.exe
mov qword [rbp + 0x50], rax
lea rax, str.frida_helper_64.exe
mov qword [rbp + 0x58], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0x100], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x102]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_process_of_malware_analysis_tool:__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x100]
call fcn.140002670
mov rcx, qword [rdi]
call fcn.140005300
test eax, eax
lea rdx, [rbp + 0x100]
mov ecx, r12d
setne cl
call fcn.140002ef0
lea rdi, [rdi + 8]
sub rsi, 1
jne 0x140002100
cmp dword [0x140024f10], r12d
je 0x1400021c5
lea rcx, str.Begin_AntiDisassmConstantCondition_n
call fcn.140002610
call fcn.140005450
lea rcx, str.Begin_AntiDisassmAsmJmpSameTarget_n
call fcn.140002610
call fcn.140005458
lea rcx, str.Begin_AntiDisassmImpossibleDiasassm_n
call fcn.140002610
call fcn.14000545f
lea rcx, str.Begin_AntiDisassmFunctionPointer_n
call fcn.140002610
mov ecx, 2
call fcn.140005473
lea rcx, str.Begin_AntiDisassmReturnPointerAbuse_n
call fcn.140002610
mov ecx, 0x29a
call fcn.14000549e
cmp dword [0x140024f18], r12d
je 0x14000228f
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, 0x16
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Anti_Dumping
lea rcx, str._n___________________________s___________________________n
call fcn.140002cf0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.___Erasing_PE_header_from_memory_n
call fcn.140002610
xor ecx, ecx
mov dword [rbp + 0x60], r12d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rbp + 0x60]
mov edx, 0x1000
mov rcx, rax
mov r8d, 4
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rbx, qword gs:[0x60]
lea rcx, str.___Increasing_SizeOfImage_in_PE_Header_to:_0x100000_n
call fcn.140002610
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x30]
add eax, 0x100000
mov dword [rcx + 0x40], eax
lea rcx, str._n_nAnalysis_done__I_hope_you_didnt_get_red_flags_:_
call fcn.140002610
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.1400054d0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret