Function at 0x14000cf20
Capabilities:
Access peb ldr_data
Check for debugger via api
Contain obfuscated stackstrings
Encode data using xor
Execute command
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rbp + 0x98], rax
call fcn.1400e6358
call fcn.1400e6300
call fcn.1400e636e
call fcn.1400e6300
call fcn.1400e632c
call fcn.1400e6316
call fcn.1400e632c
call fcn.1400e6316
call fcn.1400e6342
lea rcx, str.main
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
call fcn.140013440
mov rcx, qword [0x1404b7170]
test rcx, rcx
jne 0x14000d164
xor r9d, r9d
mov edi, 0x9bc5a608
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r12, qword [rax]
mov rsi, r12
nop word [rax + rax]
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test r9d, r9d
je 0x14000d01d
psrldq xmm0, 8
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
mov edx, 0x811c9dc5
cmp rcx, r8
je 0x14000d014
nop
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0x1000193
add rcx, 2
cmp rcx, r8
jne 0x14000d000
cmp edx, r9d
jne 0x14000d145
mov r10, qword [rsi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
shr r15, 0x20
mov ebx, ecx
add rbx, r10
cmp rbx, r10
je 0x14000d145
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14000d145
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
lea rax, [r14 + r8*4]
mov eax, dword [rax + r10]
add rax, r10
mov edx, 0x811c9dc5
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14000d096
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x14000d080
cmp edx, edi
je 0x14000d0a4
test r8d, r8d
jne 0x14000d060
jmp 0x14000d145
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r8*2]
mov ecx, dword [rcx + rax*4]
add rcx, r10
cmp rcx, rbx
jbe 0x14000d15d
lea rax, [rbx + r15]
cmp rcx, rax
jae 0x14000d15d
mov r9d, 0x811c9dc5
mov dword [rbp + 0x10], r9d
mov edx, r9d
mov dword [rbp + 0x14], edx
movzx eax, byte [rcx]
cmp al, 0x2e
je 0x14000d10b
nop dword [rax + rax]
movsx eax, al
xor eax, r9d
imul r9d, eax, 0x1000193
inc rcx
movzx eax, byte [rcx]
cmp al, 0x2e
jne 0x14000d0f0
mov dword [rbp + 0x10], r9d
inc rcx
movzx eax, byte [rcx]
test al, al
je 0x14000d139
nop word [rax + rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x14000d120
mov dword [rbp + 0x14], edx
mov rsi, qword [r12]
mov rdi, qword [rbp + 0x10]
shr rdi, 0x20
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r12
je 0x14000d15b
cmp qword [rax + 0x30], 0
jne 0x14000cfd0
xor ecx, ecx
mov qword [0x1404b7170], rcx
call rcx
mov rcx, rax
call fcn.140006710
call fcn.140009e90
call fcn.140006d30
call fcn.1400064a0
call fcn.140003ee0
call fcn.140002ae0
call fcn.140009310
call fcn.140007800
call fcn.14000aa10
call fcn.14000a4d0
call fcn.1400062e0
call fcn.140004950
call fcn.1400046a0
call fcn.140008310
test al, al
je 0x14000d1f2
mov dword [rsp + 0x3a], 0x3f203f
mov dword [rsp + 0x30], 0x63616c62
mov dword [rsp + 0x34], 0x73696c6b
mov word [rsp + 0x38], 0x2074
mov byte [rsp + 0x3e], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003b00
call fcn.140008ce0
test al, al
je 0x14000d23a
mov dword [rsp + 0x3a], 0x3f203f
mov dword [rsp + 0x30], 0x63616c62
mov dword [rsp + 0x34], 0x73696c6b
mov word [rsp + 0x38], 0x2074
mov byte [rsp + 0x3e], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003b00
call fcn.140007b20
test eax, eax
je 0x14000d282
mov dword [rsp + 0x3a], 0x3f203f
mov dword [rsp + 0x30], 0x63616c62
mov dword [rsp + 0x34], 0x73696c6b
mov word [rsp + 0x38], 0x2074
mov byte [rsp + 0x3e], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003b00
call fcn.140009c40
test al, al
je 0x14000d2ca
mov dword [rsp + 0x3a], 0x3f203f
mov dword [rsp + 0x30], 0x63616c62
mov dword [rsp + 0x34], 0x73696c6b
mov word [rsp + 0x38], 0x2074
mov byte [rsp + 0x3e], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003b00
call fcn.140007340
test eax, eax
je 0x14000d312
mov dword [rsp + 0x3a], 0x3f203f
mov dword [rsp + 0x30], 0x63616c62
mov dword [rsp + 0x34], 0x73696c6b
mov word [rsp + 0x38], 0x2074
mov byte [rsp + 0x3e], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003b00
call fcn.14000a990
test al, al
je 0x14000d35a
mov dword [rsp + 0x3a], 0x3f203f
mov dword [rsp + 0x30], 0x63616c62
mov dword [rsp + 0x34], 0x73696c6b
mov word [rsp + 0x38], 0x2074
mov byte [rsp + 0x3e], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003b00
call fcn.140007f00
test eax, eax
je 0x14000d3a2
mov dword [rsp + 0x3a], 0x3f203f
mov dword [rsp + 0x30], 0x63616c62
mov dword [rsp + 0x34], 0x73696c6b
mov word [rsp + 0x38], 0x2074
mov byte [rsp + 0x3e], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003b00
call fcn.14000b910
test al, al
jne 0x14000d977
call fcn.14000c290
test al, al
jne 0x14000d977
call fcn.14000c5b0
test al, al
jne 0x14000d977
call fcn.14000bb90
test al, al
jne 0x14000d977
call fcn.14000c8c0
test al, al
jne 0x14000d977
call fcn.14000bdb0
test al, al
jne 0x14000d977
call fcn.14000c080
test al, al
jne 0x14000d977
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0x10], 0
jne 0x14000d977
call fcn.14000aed0
test eax, eax
jne 0x14000d977
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000d977
mov qword [rbp + 0x10], 0
lea rcx, [0x140105ff8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x10]
mov edx, 0x1e
call rbx
test eax, eax
jne 0x14000d48f
cmp qword [rbp + 0x10], 0
jne 0x14000d977
call fcn.14000b270
test eax, eax
jne 0x14000d977
call fcn.14000b5f0
test eax, eax
jne 0x14000d977
call fcn.14000b8f0
test eax, eax
jne 0x14000d977
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x88], xmm1
mov r8d, 3
lea rdx, [0x140106098]
lea rcx, [rbp + 0x78]
call fcn.1400029e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x68], xmm1
mov r8d, 0x2b
lea rdx, str.rnefkerXXY5d1NYSz22idcvKvOzfpZhiLXutULjnxnk
lea rcx, [rbp + 0x58]
call fcn.1400029e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
mov r8d, 0x20
lea rdx, str.cb4bde512b3d93f95fab7e79a1cdd32d
lea rcx, [rbp + 0x38]
call fcn.1400029e0
nop
lea rax, [rsp + 0x40]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.14000e9d0
mov rdi, rax
lea rax, [rbp + 0x18]
mov qword [rbp - 0x70], rax
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x18]
call fcn.14000e9d0
mov rbx, rax
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x60]
call fcn.14000e9d0
nop
mov r9b, 1
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.Sentinal.dll_s_init]
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movdqa xmm1, xmmword [0x1401257b0]
movdqu xmmword [rbp + 0x28], xmm1
mov byte [rbp + 0x18], 0
lea rdx, str.Enter_ur_Authentication_Token_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000f510
lea rdx, [rbp + 0x18]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000f7d0
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x60]
call fcn.14000e9d0
mov rcx, rax
call qword [sym.imp.Sentinal.dll_s_token]
mov ebx, 1
test al, al
je 0x14000d5f4
lea rdx, str.Succesfully_logged_in_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000f510
mov dword [0x140481450], ebx
jmp 0x14000d662
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rcx, [rsp + 0x40]
call qword [sym.imp.Sentinal.dll_s_get_response]
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14000d615
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call fcn.140010440
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000d662
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d65c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d65c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4a04
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x14000d6a0
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d69b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d69b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4a04
cmp dword [0x140481450], 0
je 0x14000d886
lea rcx, [rsp + 0x40]
call fcn.14000cd00
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000d6f7
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d6f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d6f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4a04
mov r15d, 7
lea rdi, str.Universal_External
lea rsi, str.discord.gg_universal
lea r14, [0x14011a078]
lea rcx, [0x1401060f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n_n_n______________________________________________________________________n____________________________________________________________________n______________________________________________________________________n________________________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000f510
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r15w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140105f95]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000f510
lea rdx, [0x14010621c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000f510
lea rdx, str._n_n_n_n_n_n_n________________________________________________1__Load_Xuaa_n________________________________________________2__Enable_RPC_n________________________________________________3__Disable_RPC_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000f510
lea rdx, [rbp + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rbp + 0x10]
cmp eax, 1
jne 0x14000d7d5
lea rcx, [0x1401060f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400706d0
jmp 0x14000d712
cmp eax, 2
jne 0x14000d833
lea rcx, [0x1401060f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
lea rdx, [rsp + 0x60]
call fcn.1400750e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x40], r14
lea rcx, [rbp - 0x60]
jmp 0x14000d847
cmp eax, 3
jne 0x14000d85e
lea rcx, [0x1401060f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call fcn.1400757d0
lea rcx, [0x1401060f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14000d712
lea rdx, str.Wrong_Number.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000f510
lea rdx, [0x14000f6e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000d712
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x14000d8c5
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d8bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d8bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4a04
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x14000d904
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d8fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d8fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4a04
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x14000d945
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d940
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d940
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4a04
xor eax, eax
mov rcx, qword [rbp + 0x98]
xor rcx, rsp
call fcn.1400e4640
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3