Function at 0x140001070
Capabilities:
Check for debugger via api
Contain obfuscated stackstrings
Create thread
Inject thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov rbx, rdx
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp eax, 1
jne 0x1400010fd
cmp dword [rsp + 0x40], eax
jne 0x1400010fd
movdqa xmm0, xmmword [0x140003350]
lea rdx, [rsp + 0x48]
lea rcx, str._____s
mov dword [rsp + 0x58], 0x63657465
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x5c], 0x646574
call fcn.140001010
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400015a8
cmp edi, 2
jge 0x14000111b
mov rdx, qword [rbx]
lea rcx, str.____Usage:__s__PID_
call fcn.140001010
mov eax, 1
jmp 0x1400015a8
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov edx, 1
mov ecx, 0x1fffff
mov r8d, eax
mov dword [0x140005620], eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x1400011f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000118f
mov dword [rsp + 0x48], 0x65636341
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x4c], 0x44207373
mov dword [rsp + 0x50], 0x65696e65
mov word [rsp + 0x54], 0x64
lea rcx, str._____s_n
call fcn.140001010
mov eax, 1
jmp 0x1400015a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1400011bb
movdqa xmm0, xmmword [0x1400033f0]
lea rdx, [rsp + 0x48]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x58], 0x7473
mov byte [rsp + 0x5a], 0
jmp 0x140001179
movdqa xmm0, xmmword [0x140003410]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0x656c64
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x48]
lea rcx, str._____s:_0x_p_n
call fcn.140001010
mov eax, 1
jmp 0x1400015a8
movdqa xmm0, xmmword [0x1400033c0]
lea rdx, [rbp - 0x48]
mov r8, rbx
mov qword [rsp + 0x160], rsi
lea rcx, str.____s:_0x_p_n
mov dword [rbp - 0x38], 0x72502065
movdqu xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x34], 0x7365636f
mov word [rbp - 0x30], 0x73
call fcn.140001010
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov rcx, rbx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x140001348
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400012cb
movdqa xmm0, xmmword [0x140003330]
lea rdx, [rsp + 0x68]
movdqa xmm1, xmmword [0x140003360]
lea rcx, str._____s_n
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rbp - 0x78], 0x65696e65
movdqu xmmword [rsp + 0x78], xmm1
mov word [rbp - 0x74], 0x64
call fcn.140001010
movdqa xmm0, xmmword [0x140003450]
lea rdx, [rsp + 0x48]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0x7250206f
mov dword [rsp + 0x5c], 0x7365636f
mov word [rsp + 0x60], 0x73
jmp 0x140001333
movdqa xmm0, xmmword [0x140003380]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0x6d206574
mov dword [rsp + 0x5c], 0x726f6d65
mov word [rsp + 0x60], 0x79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x48]
lea rcx, str._____s:_0x_p_n
call fcn.140001010
movdqa xmm0, xmmword [0x140003450]
lea rdx, [rsp + 0x68]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0x7250206f
mov dword [rsp + 0x7c], 0x7365636f
mov word [rbp - 0x80], 0x73
lea rcx, str.____s_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm0, xmmword [0x140003340]
lea rdx, [rbp - 0x68]
mov r8, rdi
mov dword [rbp - 0x58], 0x73616220
lea rcx, str.____s:_0x_p_n
mov dword [rbp - 0x54], 0x64612065
movdqu xmmword [rbp - 0x68], xmm0
mov dword [rbp - 0x50], 0x73657264
mov word [rbp - 0x4c], 0x73
call fcn.140001010
xor esi, esi
lea r8, [0x140003308]
mov rdx, rdi
mov qword [rsp + 0x20], rsi
mov rcx, rbx
lea r9d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001558
movdqa xmm0, xmmword [0x140003420]
lea rdx, [rsp + 0x68]
movdqa xmm1, xmmword [0x140003440]
lea rcx, str.____s_n
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rbp - 0x78], 0x20746567
movdqu xmmword [rsp + 0x78], xmm1
mov dword [rbp - 0x74], 0x636f7270
mov dword [rbp - 0x70], 0x737365
call fcn.140001010
lea rax, [rsp + 0x44]
mov dword [rsp + 0x44], esi
lea r9d, [rsi + 0x10]
mov qword [rsp + 0x20], rax
lea r8d, [rsi + 1]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140001445
movdqa xmm0, xmmword [0x1400033a0]
lea rdx, [rsp + 0x68]
movdqa xmm1, xmmword [0x1400033e0]
mov r8, qword [sym.imp.KERNEL32.dll_GetLastError]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rbp - 0x78], 0x736e6f
movdqu xmmword [rsp + 0x78], xmm1
jmp 0x14000158f
movdqa xmm0, xmmword [0x140003430]
lea rdx, [rbp - 8]
movdqa xmm1, xmmword [0x140003370]
lea rcx, str.____s_n
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 0x18], 0x293a20
movdqu xmmword [rbp + 8], xmm1
call fcn.140001010
mov qword [rsp + 0x38], rsi
mov r9, rdi
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], esi
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThreadEx]
mov rbx, rax
test rax, rax
jne 0x1400014e2
movdqa xmm0, xmmword [0x1400033b0]
movdqa xmm1, xmmword [0x140003390]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rbp - 0x78], 0x7373
movdqu xmmword [rsp + 0x78], xmm1
mov byte [rbp - 0x76], sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x68]
lea rcx, str._____s:_0x_p_n
call fcn.140001010
movdqa xmm0, xmmword [0x1400033d0]
lea rdx, [rbp + 0x20]
movdqa xmm1, xmmword [0x140003400]
lea rcx, str.____s:_0x_p_n
mov r8, rbx
mov word [rbp + 0x40], 0x65
movdqu xmmword [rbp + 0x20], xmm0
movdqu xmmword [rbp + 0x30], xmm1
call fcn.140001010
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movdqa xmm0, xmmword [str.Thread_finished_Failed_to_write_Alocated_memory_RemoteDebugger_Dmemory__Access_Dermisions_to_RWXFailed_to_alloca_Thread_in_proceFailed_to_changeCould_not_createGot_Handle_to_thCreated_Thread_i_memory_permissiPID_Does_not_Exin_process__handlFailed_to_GetHanSuccessfully_wroChanged_memory_pte_data_into_tarClosing_Handle_tdata_into_target_]
lea rdx, [rbp - 0x28]
lea rcx, str.____s_n
mov dword [rbp - 0x18], 0x63657865
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x14], 0x6f697475
mov word [rbp - 0x10], 0x6e
call fcn.140001010
xor eax, eax
jmp 0x1400015a0
movdqa xmm0, xmmword [0x140003330]
movdqa xmm1, xmmword [0x140003460]
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm0, xmmword [str._process_memory]
movdqu xmmword [rbp - 0x78], xmm0
movdqu xmmword [rsp + 0x78], xmm1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x68]
lea rcx, str._____s:_0x_p_n
call fcn.140001010
mov eax, 1
mov rsi, qword [rsp + 0x160]
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.1400015e0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret