Function at 0x140069a80
Capabilities:
Check if file exists
Encode data using xor
Enumerate processes
Get file attributes
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x408]
sub rsp, 0x4f0
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x14032d5c0]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
lea rax, str.GWCtlSrv.exe
mov qword [rbp - 0x40], rax
lea rax, [0x140301628]
mov qword [rbp - 0x38], rax
lea rax, str.NLSvc.exe
mov qword [rbp - 0x30], rax
lea rax, str.Please_uninstall_NetLimiter.
mov qword [rbp - 0x28], rax
lea rax, str.YetAnotherService.exe
mov qword [rbp - 0x20], rax
lea rax, str.Please_uninstall_YetAnotherService.
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], r15
lea ecx, [r15 + 0x30]
call fcn.14021d53c
mov rdi, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov rsi, rax
mov qword [rbp + 0x90], rax
lea rbx, [rbp - 0x40]
movabs r14, 0x555555555555555
nop dword [rax]
mov r9, rbx
mov r8, rdi
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.14007c9f0
movups xmm6, xmmword [rax]
movsd xmm0, qword [rax + 0x10]
movsd qword [rbp - 0x50], xmm0
cmp byte [rbp - 0x50], 0
jne 0x140069bde
cmp qword [rbp + 0x98], r14
je 0x14006a6fa
lea rax, [rbp + 0x90]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r15
mov ecx, Ordinal_50
call fcn.14021d53c
nop
movups xmm0, xmmword [rbx]
movups xmmword [rax + 0x20], xmm0
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
mov qword [rsp + 0x38], r15
movaps xmmword [rbp - 0x60], xmm6
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x90]
call fcn.14007c360
mov rsi, qword [rbp + 0x90]
add rbx, 0x10
lea rax, [rbp - 0x10]
cmp rbx, rax
jne 0x140069b50
mov rax, qword [rsi]
mov qword [rbp + 0x70], rax
cmp byte [rax + 0x19], 0
jne 0x140069cdd
mov rdi, qword [rax + 0x20]
mov rsi, qword [rax + 0x28]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140069c31
lea rdx, str.CreateToolhelp32Snapshot__of_processes__failed._n
lea rcx, [0x140335fa0]
call fcn.14006e450
jmp 0x140069c99
mov dword [rbp + 0x190], 0x238
lea rdx, [rbp + 0x190]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140069c90
nop
lea rax, [rbp + 0x1bc]
mov r8, rdi
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140069c74
add rax, 2
test ecx, ecx
jne 0x140069c60
mov rcx, rbx
test edx, edx
je 0x140069d46
lea rdx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140069c50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Process
lea rcx, [0x140335e70]
call fcn.14006ebd0
mov rcx, rax
mov rdx, rdi
call fcn.14006ebd0
mov rcx, rax
lea rdx, str._is_not_running._Continuing_with_the_program._n
call fcn.14006ebd0
lea rcx, [rbp + 0x70]
call fcn.14006c610
mov rax, qword [rbp + 0x70]
cmp byte [rax + 0x19], 0
je 0x140069c00
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140069db2
lea rdx, str.Debugger_detected__Exiting..._n
lea rcx, [0x140335bb0]
call fcn.14006e450
nop
mov rcx, qword [rbp + 0x90]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14006a6b4
mov r8, qword [rbx + 0x10]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x90]
call fcn.140075e10
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_50
call fcn.14021d440
cmp byte [rbx + 0x19], 0
je 0x140069d14
jmp 0x14006a6ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, Ordinal_50
lea r8, str.Process_Detected
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rcx, qword [rbp + 0x90]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14006a6b4
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x90]
call fcn.140075e10
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_50
call fcn.14021d440
cmp byte [rbx + 0x19], 0
je 0x140069d80
jmp 0x14006a6ad
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREACPIDSDTVBOX__
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14006a652
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREACPIFADTVBOX__
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14006a652
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOSVMware
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14006a652
lea rcx, str.C:WindowsSystem32drivers_vmmouse.sys
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14006a652
lea rcx, str.C:WindowsSystem32drivers_vmhgfs.sys
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14006a652
lea rdx, str.No_debugger_or_VM_detected._Running_normally._n
lea rcx, [0x140335bb0]
call fcn.14006e450
mov dword [rbp + 0x70], 0x36303f03
mov dword [rbp + 0x74], 0x1002636
mov rcx, r15
nop dword [rax]
lea eax, [rcx + 0x4f]
xor byte [rbp + rcx + 0x70], al
inc rcx
cmp rcx, 6
jb 0x140069e90
mov byte [rbp + 0x77], 0
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movdqa xmm0, xmmword [0x140303410]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], 1
mov rcx, r15
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xf
jb 0x140069ed0
mov byte [rsp + 0x40], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140335bb0]
call fcn.14006e450
lea rcx, [0x1403376c0]
call fcn.140061e10
mov dword [rbp + 0x70], 0x223c2c
mov byte [rbp + 0x74], 1
mov rcx, r15
lea eax, [rcx + 0x4f]
xor byte [rbp + rcx + 0x70], al
inc rcx
cmp rcx, 3
jb 0x140069f10
mov byte [rbp + 0x74], 0
lea rcx, [rbp + 0x70]
call fcn.140232318
movdqa xmm0, xmmword [0x1403034d0]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1403034b0]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x140303470]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1403034f0]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [0x140303420]
movdqa xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x60], 1
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx + 0x4f]
xor byte [rbp + rcx + 0x10], al
inc rcx
cmp rcx, 0x4f
jb 0x140069f80
mov byte [rbp + 0x60], 0
lea rdx, [rbp + 0x10]
lea rcx, [0x140335bb0]
call fcn.14006e450
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
movdqa xmm1, xmmword [0x1403033b0]
movdqu xmmword [rbp + 0xd8], xmm1
mov byte [rbp + 0xc8], 0
movups xmmword [rbp + 0x100], xmm0
movdqu xmmword [rbp + 0x110], xmm1
mov byte [rbp + 0x100], 0
movups xmmword [rbp + 0xa8], xmm0
movdqu xmmword [rbp + 0xb8], xmm1
mov byte [rbp + 0xa8], 0
mov eax, dword [rbp + 0xa0]
mov dword [rbp + 0x70], eax
lea rdx, [rbp + 0x70]
call fcn.14006f160
mov ecx, dword [rbp + 0x70]
sub ecx, 1
je 0x14006a2f6
sub ecx, 1
je 0x14006a198
sub ecx, 1
je 0x14006a0a7
cmp ecx, 1
jne 0x14006a700
movdqa xmm0, xmmword [0x1403034c0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0x7f
mov byte [rsp + 0x42], cl
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x11
jb 0x14006a050
mov byte [rsp + 0x42], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140335bb0]
call fcn.14006e450
lea rdx, [rbp + 0xa8]
call fcn.14006ee90
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x50]
call fcn.14006bbf0
mov rdx, rax
lea rcx, [0x1403376c0]
call fcn.140066cc0
jmp 0x14006a3e3
movdqa xmm0, xmmword [0x140303490]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x415a3a
mov byte [rsp + 0x44], 1
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x13
jb 0x14006a0d0
mov byte [rsp + 0x44], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140335bb0]
call fcn.14006e450
lea rdx, [rbp + 0xc8]
call fcn.14006ee90
movdqa xmm0, xmmword [0x1403034c0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0x7f
mov byte [rsp + 0x42], 1
mov rcx, r15
nop
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x11
jb 0x14006a120
mov byte [rsp + 0x42], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140335bb0]
call fcn.14006e450
lea rdx, [rbp + 0xa8]
call fcn.14006ee90
lea rax, [rsp + 0x50]
mov qword [rbp + 0x70], rax
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x50]
call fcn.14006bbf0
mov rbx, rax
lea rdx, [rbp + 0xc8]
lea rcx, [rsp + 0x30]
call fcn.14006bbf0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [0x1403376c0]
call fcn.140065ae0
jmp 0x14006a3e3
movdqa xmm0, xmmword [0x140303490]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x415a3a
mov byte [rsp + 0x44], 1
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x13
jb 0x14006a1c0
mov byte [rsp + 0x44], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140335bb0]
call fcn.14006e450
lea rdx, [rbp + 0xc8]
call fcn.14006ee90
movdqa xmm0, xmmword [0x1403034a0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x1004065
mov rcx, r15
nop dword [rax + rax]
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x12
jb 0x14006a210
mov byte [rsp + 0x43], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140335bb0]
call fcn.14006e450
lea rdx, [rbp + 0x100]
call fcn.14006ee90
movdqa xmm0, xmmword [0x1403034c0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0x7f
mov byte [rsp + 0x42], 1
mov rcx, r15
nop
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x11
jb 0x14006a260
mov byte [rsp + 0x42], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140335bb0]
call fcn.14006e450
lea rdx, [rbp + 0xa8]
call fcn.14006ee90
lea rax, [rsp + 0x50]
mov qword [rbp - 0x60], rax
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x50]
call fcn.14006bbf0
mov rdi, rax
lea rax, [rbp - 0x10]
mov qword [rbp + 0x70], rax
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x10]
call fcn.14006bbf0
mov rbx, rax
lea rdx, [rbp + 0xc8]
lea rcx, [rsp + 0x70]
call fcn.14006bbf0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [0x1403376c0]
call fcn.140064410
jmp 0x14006a3e3
movdqa xmm0, xmmword [0x140303490]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x415a3a
mov byte [rsp + 0x44], 1
mov rcx, r15
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x13
jb 0x14006a320
mov byte [rsp + 0x44], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140335bb0]
call fcn.14006e450
lea rdx, [rbp + 0xc8]
call fcn.14006ee90
movdqa xmm0, xmmword [0x1403034a0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x1004065
mov rcx, r15
nop dword [rax + rax]
lea eax, [rcx + 0x4f]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x12
jb 0x14006a370
mov byte [rsp + 0x43], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140335bb0]
call fcn.14006e450
lea rdx, [rbp + 0x100]
call fcn.14006ee90
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x70]
call fcn.14006bbf0
mov rbx, rax
lea rdx, [rbp + 0xc8]
lea rcx, [rbp - 0x10]
call fcn.14006bbf0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [0x1403376c0]
call fcn.140062f70
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], rax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea r8d, [rax + 6]
lea rdx, str.077979
lea rcx, [rsp + 0x50]
call fcn.14006f780
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0xe8]
lea rcx, [0x1403376c0]
call fcn.140067eb0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [rbp + 0xa0], r15d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x120], xmm1
movups xmmword [rbp + 0x130], xmm1
movups xmmword [rbp + 0x140], xmm1
movups xmmword [rbp + 0x150], xmm1
movups xmmword [rbp + 0x160], xmm1
movups xmmword [rbp + 0x170], xmm1
mov qword [rbp + 0x180], rax
mov word [rbp + 0x70], r15w
lea r9, [rbp + 0x70]
mov r8, qword [rbp + 0xe8]
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x78]
call fcn.140069770
test eax, eax
jne 0x14006a4de
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rbp + 0xa0]
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
je 0x14006a536
mov rdx, qword [rbp + 0xf8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006a51f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006a749
call fcn.14021d440
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], r15
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x14006a578
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006a572
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006a74f
call fcn.14021d440
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x14006a5ba
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006a5b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006a755
call fcn.14021d440
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x14006a5fc
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006a5f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006a6f4
call fcn.14021d440
nop
mov rcx, qword [rbp + 0x90]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14006a644
nop dword [rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x90]
call fcn.140075e10
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_50
call fcn.14021d440
cmp byte [rbx + 0x19], 0
je 0x14006a610
mov rcx, qword [rbp + 0x90]
mov edx, Ordinal_50
call fcn.14021d440
mov eax, edi
jmp 0x14006a6c3
lea rdx, str.Virtual_machine_detected__Exiting..._n
lea rcx, [0x140335bb0]
call fcn.14006e450
nop
mov rcx, qword [rbp + 0x90]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14006a6b4
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x90]
call fcn.140075e10
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_50
call fcn.14021d440
cmp byte [rbx + 0x19], 0
je 0x14006a680
mov rcx, qword [rbp + 0x90]
mov edx, Ordinal_50
call fcn.14021d440
mov eax, 1
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.14021d420
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1402322a0
nop
call fcn.14005c250
nop
movdqa xmm0, xmmword [0x140303480]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140303430]
movdqu xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x1d18040c
mov word [rbp - 0x6c], Ordinal_30
mov byte [rbp - 0x6a], 1
lea rdx, [rsp + 0x70]
call fcn.14006a760
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14022cfe4
int3
call fcn.1402322a0
nop
call fcn.1402322a0
nop
call fcn.1402322a0
int3