Function at 0x140001010
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Execute anti-debugging instructions
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get ntdll base address
Send icmp echo request
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140029010]
xor rax, rsp
mov qword [rbp + 0x180], rax
lea rcx, str.Al_Khaser___by_Lord_Noteworthy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 0x64
mov dword [rsp + 0x28], 1
mov r8d, edx
mov dword [rsp + 0x20], 0x384
mov r9d, 0x384
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str._al_khaser_version_0.80_
call fcn.140001a70
lea rcx, str.Initialisation
call fcn.140001da0
xor r13d, r13d
lea rsi, [0x140041c4c]
nop dword [rax]
nop dword [rax + rax]
mov r15d, dword [rsi + 4]
xor al, al
test dword [rsi - 4], 0xfffffffd
mov r12d, dword [rsi]
jne 0x140001163
xor r14b, r14b
lea rbx, [0x140042148]
xor edi, edi
lea rcx, [0x140042218]
nop dword [rax]
test rdi, rdi
je 0x1400010f7
cmp dword [rbx - 8], r12d
jne 0x1400010f7
mov r14b, 1
call qword [rbx]
lea rcx, [0x140042218]
inc rdi
add rbx, 0x10
cmp rbx, rcx
jl 0x1400010e0
test r14b, r14b
jne 0x140001111
lea rcx, str.ERROR:_Minimum_version_value_was_invalid._n
jmp 0x14000115c
test al, al
je 0x140001161
test r15d, r15d
jne 0x14000111e
mov al, 1
jmp 0x140001163
xor dil, dil
lea rbx, [0x140042148]
xor al, al
nop word [rax + rax]
cmp dword [rbx - 8], r15d
jne 0x140001147
mov dil, 1
call qword [rbx]
test al, al
lea rcx, [0x140042218]
sete al
add rbx, 0x10
cmp rbx, rcx
jl 0x140001130
test dil, dil
jne 0x140001163
lea rcx, str.ERROR:_Removed_version_value_was_invalid._n
call fcn.140001a00
xor al, al
mov rcx, qword [rsi - 0x14]
mov byte [rsi + 9], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000117a
mov byte [rsi + 8], al
jmp 0x140001194
mov rdx, qword [rsi - 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsi + 0xc], rax
setne al
mov byte [rsi + 8], al
inc r13d
add rsi, 0x30
cmp r13d, 0x1b
jb 0x1400010b0
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.1400055d0
lea rcx, [rsp + 0x70]
call fcn.140002490
test eax, eax
je 0x1400011d6
lea rdx, [rsp + 0x70]
lea rcx, str._n___You_are_running:__s_n
call fcn.140001a70
xor r12d, r12d
lea rbx, [0x140041c54]
mov esi, r12d
mov edi, r12d
cmp byte [rbx + 1], r12b
je 0x140001207
cmp byte [rbx], r12b
jne 0x140001207
mov r8, qword [rbx - 0x14]
lea rcx, str.___Warning:_API__s__s_was_expected_to_exist_but_was_not_found._n
mov rdx, qword [rbx - 0x1c]
call fcn.140001a00
inc esi
inc edi
add rbx, 0x30
cmp edi, 0x1b
jb 0x1400011e6
test esi, esi
jne 0x140001222
lea rcx, str.___All_APIs_present_and_accounted_for._n
call fcn.140001a00
call fcn.1400023d0
test eax, eax
je 0x140001240
lea rcx, str.Process_is_running_under_WOW64_n_n
call fcn.140001a70
nop word [rax + rax]
lea rcx, str.Timing_attacks
call fcn.140001da0
mov edx, 4
lea rcx, str._n___Delay_value_is_set_to__u_minutes_..._n
call fcn.140001a00
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
lea rcx, str.____s
call fcn.140001a70
mov r14d, 0x32
mov ebx, r14d
nop dword [rax]
lea rcx, [0x140025138]
call fcn.140001a70
sub rbx, 1
jne 0x140001280
movabs r13, 0xffffffff70f2e800
lea rdx, [0x140041c30]
mov qword [rsp + 0x40], r13
mov rcx, rdx
mov eax, r12d
nop
cmp dword [rcx], 0xb
je 0x1400012cb
inc eax
add rcx, 0x30
cmp eax, 0x1b
jb 0x1400012b0
mov r15d, 1
mov ecx, r15d
jmp 0x140001319
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r12b
jne 0x1400012e6
mov r15d, 1
mov ecx, r15d
jmp 0x140001319
mov eax, r12d
mov rcx, rdx
nop dword [rax]
cmp dword [rcx], 0xb
je 0x1400013d9
inc eax
add rcx, 0x30
cmp eax, 0x1b
jb 0x1400012f0
mov rax, r12
lea rdx, [rsp + 0x40]
xor ecx, ecx
call rax
mov ecx, r12d
mov r15d, 1
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
call fcn.140001e40
lea rdx, str.Performing_a_sleep___in_a_loop_...
lea rcx, str.____s
call fcn.140001a70
mov ebx, 0x3d
nop dword [rax]
lea rcx, [0x140025138]
call fcn.140001a70
sub rbx, 1
jne 0x140001340
mov ebx, 0x3e8
nop word [rax + rax]
mov ecx, 0xf0
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, 1
jne 0x140001360
lea rdx, str.Performing_a_sleep___in_a_loop_...
xor ecx, ecx
call fcn.140001e40
lea rdx, str.Delaying_execution_using_SetTimer_...
lea rcx, str.____s
call fcn.140001a70
mov ebx, 0x3a
nop word [rax + rax]
lea rcx, [0x140025138]
call fcn.140001a70
sub rbx, 1
jne 0x1400013a0
lea r9, [0x140004500]
xor edx, edx
xor ecx, ecx
mov r8d, 0x3a980
call qword [sym.imp.USER32.dll_SetTimer]
mov rbx, rax
test rax, rax
jne 0x1400013f7
mov ecx, r15d
jmp 0x140001467
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r12b
je 0x140001304
mov rax, qword [rdx + rcx*8 + 0x28]
jmp 0x140001307
xor r9d, r9d
lea rcx, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
mov ecx, r12d
cmp dword [0x1400434d0], ecx
sete cl
test ecx, eax
je 0x140001459
nop word [rax + rax]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
mov ecx, r12d
cmp dword [0x1400434d0], ecx
sete cl
test ecx, eax
jne 0x140001420
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov ecx, r12d
lea rdx, str.Delaying_execution_using_SetTimer_...
call fcn.140001e40
lea rdx, str.Delaying_execution_using_timeSetEvent_...
lea rcx, str.____s
call fcn.140001a70
mov esi, 0x36
mov ebx, esi
nop dword [rax]
lea rcx, [0x140025138]
call fcn.140001a70
sub rbx, 1
jne 0x140001490
lea edx, [rbx + 8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
mov rax, qword [rsp + 0x40]
lea r8, [0x140004500]
mov ebx, dword [rsp + 0x44]
test eax, eax
mov ecx, r12d
mov dword [rsp + 0x20], r12d
cmovne ecx, eax
cmp ecx, ebx
cmovb ebx, ecx
xor r9d, r9d
mov edx, ebx
mov ecx, 0x3a980
call qword [sym.imp.WINMM.dll_timeSetEvent]
mov ecx, eax
test eax, eax
jne 0x1400014ed
mov ecx, r15d
jmp 0x140001508
mov eax, dword [0x1400434d0]
test eax, eax
je 0x1400014f3
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, r12d
lea rdx, str.Delaying_execution_using_timeSetEvent_...
call fcn.140001e40
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
lea rcx, str.____s
call fcn.140001a70
mov edi, 0x2f
mov ebx, edi
nop
lea rcx, [0x140025138]
call fcn.140001a70
sub rbx, 1
jne 0x140001530
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
jne 0x140001569
lea rcx, str.CreateEvent
call fcn.140001f70
mov ecx, r15d
jmp 0x14000157a
mov edx, 0x3a980
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, r12d
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
call fcn.140001e40
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
lea rcx, str.____s
call fcn.140001a70
nop dword [rax]
lea rcx, [0x140025138]
call fcn.140001a70
sub rsi, 1
jne 0x1400015a0
movsd xmm0, qword [str.Data_Buffer]
mov eax, dword [0x140025ba0]
movsd qword [rsp + 0x40], xmm0
xorps xmm0, xmm0
mov dword [rsp + 0x48], eax
xor eax, eax
movups xmmword [rsp + 0x4c], xmm0
mov dword [rsp + 0x5c], eax
call qword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000160c
lea rcx, str._tUnable_to_open_handle._n
call fcn.140001a00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.IcmpCreatefile_returned_error:__u_n
call fcn.140001a00
mov ecx, r15d
jmp 0x14000167c
mov ecx, 0x50
call fcn.14000a19c
mov rsi, rax
mov rcx, rbx
test rax, rax
jne 0x140001638
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
lea rcx, str._tUnable_to_allocate_memory_n
call fcn.140001a00
mov ecx, r15d
jmp 0x14000167c
mov dword [rsp + 0x38], 0x3a980
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], 0x50
mov r9d, 0x20
mov qword [rsp + 0x28], rsi
mov edx, 0xffffffff
mov qword [rsp + 0x20], r12
call qword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
mov rcx, rsi
call fcn.14000a1a4
mov ecx, r12d
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
call fcn.140001e40
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
lea rcx, str.____s
call fcn.140001a70
nop dword [rax + rax]
lea rcx, [0x140025138]
call fcn.140001a70
sub rdi, 1
jne 0x1400016a0
xor r8d, r8d
mov qword [rsp + 0x40], r13
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov rdi, rax
test rax, rax
jne 0x1400016d2
mov ebx, r15d
jmp 0x140001722
mov dword [rsp + 0x28], r12d
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
jne 0x1400016f9
mov ebx, r15d
jmp 0x140001710
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ebx, r12d
cmovne ebx, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
mov ecx, ebx
call fcn.140001e40
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
lea rcx, str.____s
call fcn.140001a70
mov ebx, 0x2d
nop dword [rax + rax]
lea rcx, [0x140025138]
call fcn.140001a70
sub rbx, 1
jne 0x140001750
xor r9d, r9d
mov qword [rsp + 0x40], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400434c8], rax
test rax, rax
jne 0x140001788
mov ebx, r12d
jmp 0x140001804
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov rdi, rax
test rax, rax
jne 0x14000179b
mov ebx, r15d
jmp 0x140001804
mov dword [rsp + 0x30], r12d
lea r8, [0x140004510]
mov dword [rsp + 0x28], r12d
lea rcx, [rsp + 0x40]
mov r9d, 0xdeadbeef
mov dword [rsp + 0x20], 0x3a980
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x1400017d1
mov ebx, r15d
jmp 0x1400017ec
mov rcx, qword [0x1400434c8]
mov edx, 0x249f00
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ebx, r12d
cmovne ebx, r12d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov rcx, qword [0x1400434c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
mov ecx, ebx
call fcn.140001e40
lea rdx, str.Checking_RDTSC_Locky_trick
lea rcx, str.____s
call fcn.140001a70
mov ebx, 0x44
nop word [rax + rax]
lea rcx, [0x140025138]
call fcn.140001a70
sub rbx, 1
jne 0x140001830
mov esi, r12d
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
rdtsc
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
rdtsc
shl rdx, 0x20
or rax, rdx
xor edx, edx
sub eax, ebx
sub ebx, edi
div ebx
cmp eax, 0xa
jae 0x140001895
inc esi
cmp esi, 0xa
jb 0x140001850
jmp 0x140001898
mov r15d, r12d
lea rdx, str.Checking_RDTSC_Locky_trick
mov ecx, r15d
call fcn.140001e40
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
lea rcx, str.____s
call fcn.140001a70
nop word [rax + rax]
lea rcx, [0x140025138]
call fcn.140001a70
sub r14, 1
jne 0x1400018c0
mov r8, r12
lea r9d, [r14 + 0xa]
nop dword [rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x4c], edx
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rdi
add r8, rax
sub r9, 1
jne 0x1400018e0
mov ecx, r12d
movabs rax, 0xcccccccccccccccd
mul r8
shr rdx, 3
lea rax, [rdx - 1]
cmp rax, 0x3e6
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
seta cl
call fcn.140001e40
lea rcx, str.Anti_Dumping
call fcn.140001da0
lea rcx, str.___Erasing_PE_header_from_memory_n
call fcn.140001a70
xor ecx, ecx
mov dword [rsp + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rsp + 0x40]
mov edx, 0x1000
mov rcx, rax
mov r8d, 4
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rbx, qword gs:[0x60]
lea rcx, str.___Increasing_SizeOfImage_in_PE_Header_to:_0x100000_n
call fcn.140001a70
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x30]
add eax, 0x100000
mov dword [rcx + 0x40], eax
lea rcx, str._n_nAnalysis_done__I_hope_you_didnt_get_red_flags_:_
call fcn.140001a70
call fcn.140009ed8
xor eax, eax
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400045c0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret