Function at 0x7ff7aa5d5a10
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Contain obfuscated stackstrings
Create thread
Encode data using xor
Execute command
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x7ff7aa74f840]
xor rax, rsp
mov qword [rbp + 0x10], rax
lea rdx, [rbp - 0x7f]
mov dword [rbp - 0x80], 0x626f5245
xor ecx, ecx
mov dword [rbp - 0x7c], 0x786f6c
call qword [sym.imp.user32.dll_FindWindowA]
test rax, rax
jne 0x7ff7aa5d5bc4
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x130], rsi
call fcn.7ff7aa5d61b0
movzx edx, byte [rax]
lea rdi, [rax + 1]
xor byte [rdi], dl
xor byte [rax + 2], dl
xor byte [rdi + 2], dl
lea rdx, [rsp + 0x30]
mov byte [rdi + 3], 0
call fcn.7ff7aa5d6160
movzx edx, byte [rax]
lea rsi, [rax + 1]
xor byte [rsi], dl
xor byte [rax + 2], dl
xor byte [rax + 3], dl
xor byte [rax + 4], dl
xor byte [rax + 5], dl
xor byte [rax + 6], dl
xor byte [rax + 7], dl
xor byte [rax + 8], dl
xor byte [rax + 9], dl
xor byte [rax + 0xa], dl
xor byte [rax + 0xb], dl
xor byte [rax + 0xc], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0xe], dl
xor byte [rax + 0xf], dl
xor byte [rax + 0x10], dl
xor byte [rax + 0x11], dl
xor byte [rax + 0x12], dl
xor byte [rax + 0x13], dl
xor byte [rax + 0x14], dl
xor byte [rax + 0x15], dl
xor byte [rax + 0x16], dl
xor byte [rax + 0x17], dl
xor byte [rax + 0x18], dl
xor byte [rax + 0x19], dl
xor byte [rax + 0x1a], dl
xor byte [rax + 0x1b], dl
xor byte [rax + 0x1c], dl
xor byte [rax + 0x1d], dl
xor byte [rax + 0x1e], dl
xor byte [rax + 0x1f], dl
xor byte [rax + 0x20], dl
xor byte [rsi + 0x20], dl
mov byte [rsi + 0x21], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov ebx, dword [rcx + r11 + 0x88]
add rbx, r11
cmp rbx, r11
je 0x7ff7aa5d5b87
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x7ff7aa5d5b87
mov r10d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0xc2978c10
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r11
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x7ff7aa5d5b82
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x7ff7aa5d5b60
cmp r8d, 0xcb2ce51b
je 0x7ff7aa5d5b8c
test r9d, r9d
jne 0x7ff7aa5d5b40
mov rax, qword [rax]
jmp 0x7ff7aa5d5b10
mov ecx, dword [rbx + 0x24]
mov r8, rdi
add rcx, r11
mov rdx, rsi
movzx r10d, word [rcx + r9*2]
mov r9d, 0x30
mov ecx, dword [rbx + 0x1c]
add rcx, r11
mov eax, dword [rcx + r10*4]
xor ecx, ecx
add rax, r11
call rax
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll_exit]
mov rsi, qword [rsp + 0x130]
lea rcx, [0x7ff7aa716c08]
call qword [sym.imp.ucrtbase.dll_getenv]
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x60], rax
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], 0
jne 0x7ff7aa5d5be0
mov qword [rsp + 0x68], rcx
call fcn.7ff7aa6d6b34
movaps xmm0, xmmword [rsp + 0x60]
lea r8, [rsp + 0x60]
mov edx, eax
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rbp - 0x10]
call fcn.7ff7aa5642c0
lea rax, [rsp + 0x61]
mov dword [rsp + 0x60], 0x6c656369
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x61]
mov rax, rbx
mov dword [rsp + 0x64], 0x762d7865
mov word [rsp + 0x68], 0x33
inc rax
cmp byte [rcx + rax], 0
jne 0x7ff7aa5d5c36
mov qword [rbp - 0x78], rax
call fcn.7ff7aa6d6b34
movaps xmm0, xmmword [rbp - 0x80]
lea r8, [rbp - 0x80]
mov edx, eax
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rsp + 0x30]
call fcn.7ff7aa5642c0
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.7ff7aa564890
lea rcx, [rsp + 0x30]
call fcn.7ff7aa56d880
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x80]
call fcn.7ff7aa5650d0
lea rdi, [0x7ff7aa74f8d8]
movsd xmm0, qword [rax]
mov ecx, dword [rax + 8]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x60]
mov dword [rbp - 0x80], ecx
mov qword [rbp - 0x78], rdi
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
test eax, eax
je 0x7ff7aa5d60b6
cmp eax, 1
setne al
test al, al
jne 0x7ff7aa5d5ce3
cmp qword [rbp - 0x58], 7
lea rcx, [rbp - 0x70]
cmova rcx, qword [rbp - 0x70]
call fcn.7ff7aa6d6d94
shr rax, 0x20
test eax, eax
jne 0x7ff7aa5d6133
lea rax, [rsp + 0x61]
mov dword [rsp + 0x60], 0x6e6f6331
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x61]
mov rax, rbx
mov dword [rsp + 0x64], 0x73676966
mov byte [rsp + 0x68], 0
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x7ff7aa5d5d10
mov qword [rbp - 0x78], rax
call fcn.7ff7aa6d6b34
movaps xmm0, xmmword [rbp - 0x80]
lea r8, [rbp - 0x80]
mov edx, eax
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rsp + 0x30]
call fcn.7ff7aa5642c0
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x30]
call fcn.7ff7aa564890
lea rcx, [rsp + 0x30]
call fcn.7ff7aa56d880
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x80]
call fcn.7ff7aa5650d0
movsd xmm0, qword [rax]
mov ecx, dword [rax + 8]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x60]
mov dword [rbp - 0x80], ecx
mov qword [rbp - 0x78], rdi
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
test eax, eax
je 0x7ff7aa5d60bf
cmp eax, 1
setne al
test al, al
jne 0x7ff7aa5d5db6
cmp qword [rbp - 0x18], 7
lea rcx, [rbp - 0x30]
cmova rcx, qword [rbp - 0x30]
call fcn.7ff7aa6d6d94
shr rax, 0x20
test eax, eax
jne 0x7ff7aa5d6146
lea rax, [rbp - 0x7f]
mov dword [rbp - 0x80], 0x6e69620d
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x7f]
mov byte [rbp - 0x7c], 0
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x7ff7aa5d5dd0
mov qword [rsp + 0x68], rbx
call fcn.7ff7aa6d6b34
movaps xmm0, xmmword [rsp + 0x60]
lea r8, [rsp + 0x60]
mov edx, eax
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x30]
call fcn.7ff7aa5642c0
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.7ff7aa564890
lea rcx, [rsp + 0x30]
call fcn.7ff7aa56d880
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x80]
call fcn.7ff7aa5650d0
movsd xmm0, qword [rax]
mov ecx, dword [rax + 8]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x60]
mov dword [rbp - 0x80], ecx
mov qword [rbp - 0x78], rdi
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
test eax, eax
je 0x7ff7aa5d60c8
cmp eax, 1
setne al
test al, al
jne 0x7ff7aa5d5e7a
cmp qword [rbp - 0x38], 7
lea rcx, [rbp - 0x50]
cmova rcx, qword [rbp - 0x50]
call fcn.7ff7aa6d6d94
shr rax, 0x20
test eax, eax
jne 0x7ff7aa5d60f6
lea rcx, [0x7ff7aa7eab80]
call fcn.7ff7aa5665a0
test al, al
je 0x7ff7aa5d60ed
call qword [sym.imp.kernel32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.user32.dll_ShowWindow]
lea rdx, [rbp - 0x7f]
mov dword [rbp - 0x80], 0x626f5260
xor ecx, ecx
mov dword [rbp - 0x7c], 0x786f6c
call qword [sym.imp.user32.dll_FindWindowA]
mov rcx, rax
call qword [sym.imp.user32.dll_SetForegroundWindow]
mov ecx, 1
call qword [sym.imp.kernel32.dll_Sleep]
lea rdx, [rbp - 0x7f]
mov dword [rbp - 0x80], 0x626f5241
xor ecx, ecx
mov dword [rbp - 0x7c], 0x786f6c
call qword [sym.imp.user32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.user32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x7ff7aa5d5ec2
mov ecx, 1
call fcn.7ff7aa6d76d0
lea rcx, [rsp + 0x68]
xor edi, edi
mov qword [rsp + 0x28], rcx
lea r8, [0x7ff7aa5d6280]
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov r9, rax
xor edx, edx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x7ff7aa5d60dd
cmp dword [rsp + 0x68], edi
je 0x7ff7aa5d60d1
movaps xmm0, xmmword [rsp + 0x60]
lea rcx, [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
call qword [sym.imp.msvcp140.dll__Thrd_detach]
test eax, eax
jne 0x7ff7aa5d60d1
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
call fcn.7ff7aa5c5a00
xor ecx, ecx
mov qword [rsp + 0x60], rdi
mov rbx, rax
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rsp + 0x60]
xor edx, edx
lea r9, [0x7ff7aa6f5e80]
mov qword [rsp + 0x20], rax
mov r8d, 1
lea rcx, [0x7ff7aa6f5e90]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x7ff7aa5d5fb8
mov rcx, qword [rsp + 0x60]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rdx, rbx
call fcn.7ff7aa5c5d90
test al, al
je 0x7ff7aa5d6026
nop word [rax + rax]
lea rdx, [rbp - 0x7f]
mov dword [rbp - 0x80], 0x626f5262
xor ecx, ecx
mov dword [rbp - 0x7c], 0x786f6c
call qword [sym.imp.user32.dll_FindWindowA]
test rax, rax
je 0x7ff7aa5d60ed
lea rdx, [rsp + 0x61]
mov dword [rsp + 0x60], 0x626f5273
xor ecx, ecx
mov dword [rsp + 0x64], 0x786f6c
call qword [sym.imp.user32.dll_FindWindowA]
mov r8, rbx
lea rcx, [0x7ff7aa7eaa18]
mov rdx, rax
call fcn.7ff7aa5c6c00
test al, al
jne 0x7ff7aa5d5fd0
movdqa xmm0, xmmword [0x7ff7aa72edd0]
lea r9, [rsp + 0x61]
mov r8d, 0x5a
mov dword [rsp + 0x70], 0x6c726576
lea rdx, [0x7ff7aa722900]
mov word [rsp + 0x74], 0x7961
mov ecx, 1
mov byte [rsp + 0x76], dil
movdqu xmmword [rsp + 0x60], xmm0
call fcn.7ff7aa5d5840
lea rcx, [0x7ff7aa7228f4]
call qword [sym.imp.ucrtbase.dll_system]
lea rcx, [rbp - 0x50]
call fcn.7ff7aa56d880
lea rcx, [rbp - 0x30]
call fcn.7ff7aa56d880
lea rcx, [rbp - 0x70]
call fcn.7ff7aa56d880
lea rcx, [rbp - 0x10]
call fcn.7ff7aa56d880
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.7ff7aa6d76b0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
test ecx, ecx
jne 0x7ff7aa5d6109
jmp 0x7ff7aa5d5cc4
test ecx, ecx
jne 0x7ff7aa5d6117
jmp 0x7ff7aa5d5d97
test ecx, ecx
jne 0x7ff7aa5d6125
jmp 0x7ff7aa5d5e5b
mov ecx, 1
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rsp + 0x68], edi
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll_exit]
int3
lea r8, [rbp - 0x50]
mov edx, eax
lea rcx, [0x7ff7aa7167d8]
call fcn.7ff7aa565000
int3
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x80]
call fcn.7ff7aa565070
int3
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x80]
call fcn.7ff7aa565070
int3
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x80]
call fcn.7ff7aa565070
int3
lea r8, [rbp - 0x70]
mov edx, eax
lea rcx, [0x7ff7aa7167d8]
call fcn.7ff7aa565000
int3
lea r8, [rbp - 0x30]
mov edx, eax
lea rcx, [0x7ff7aa7167d8]
call fcn.7ff7aa565000
int3