Function at 0x7ff654275a10
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Contain obfuscated stackstrings
Create thread
Encode data using xor
Execute command
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x7ff6543ef840]
xor rax, rsp
mov qword [rbp + 0x10], rax
lea rdx, [rbp - 0x7f]
mov dword [rbp - 0x80], 0x626f5245
xor ecx, ecx
mov dword [rbp - 0x7c], 0x786f6c
call qword [sym.imp.user32.dll_FindWindowA]
test rax, rax
jne 0x7ff654275bc4
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x130], rsi
call fcn.7ff6542761b0
movzx edx, byte [rax]
lea rdi, [rax + 1]
xor byte [rdi], dl
xor byte [rax + 2], dl
xor byte [rdi + 2], dl
lea rdx, [rsp + 0x30]
mov byte [rdi + 3], 0
call fcn.7ff654276160
movzx edx, byte [rax]
lea rsi, [rax + 1]
xor byte [rsi], dl
xor byte [rax + 2], dl
xor byte [rax + 3], dl
xor byte [rax + 4], dl
xor byte [rax + 5], dl
xor byte [rax + 6], dl
xor byte [rax + 7], dl
xor byte [rax + 8], dl
xor byte [rax + 9], dl
xor byte [rax + 0xa], dl
xor byte [rax + 0xb], dl
xor byte [rax + 0xc], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0xe], dl
xor byte [rax + 0xf], dl
xor byte [rax + 0x10], dl
xor byte [rax + 0x11], dl
xor byte [rax + 0x12], dl
xor byte [rax + 0x13], dl
xor byte [rax + 0x14], dl
xor byte [rax + 0x15], dl
xor byte [rax + 0x16], dl
xor byte [rax + 0x17], dl
xor byte [rax + 0x18], dl
xor byte [rax + 0x19], dl
xor byte [rax + 0x1a], dl
xor byte [rax + 0x1b], dl
xor byte [rax + 0x1c], dl
xor byte [rax + 0x1d], dl
xor byte [rax + 0x1e], dl
xor byte [rax + 0x1f], dl
xor byte [rax + 0x20], dl
xor byte [rsi + 0x20], dl
mov byte [rsi + 0x21], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov ebx, dword [rcx + r11 + 0x88]
add rbx, r11
cmp rbx, r11
je 0x7ff654275b87
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x7ff654275b87
mov r10d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0xc2978c10
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r11
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x7ff654275b82
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x7ff654275b60
cmp r8d, 0xcb2ce51b
je 0x7ff654275b8c
test r9d, r9d
jne 0x7ff654275b40
mov rax, qword [rax]
jmp 0x7ff654275b10
mov ecx, dword [rbx + 0x24]
mov r8, rdi
add rcx, r11
mov rdx, rsi
movzx r10d, word [rcx + r9*2]
mov r9d, 0x30
mov ecx, dword [rbx + 0x1c]
add rcx, r11
mov eax, dword [rcx + r10*4]
xor ecx, ecx
add rax, r11
call rax
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll_exit]
mov rsi, qword [rsp + 0x130]
lea rcx, [0x7ff6543b6c08]
call qword [sym.imp.ucrtbase.dll_getenv]
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x60], rax
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], 0
jne 0x7ff654275be0
mov qword [rsp + 0x68], rcx
call fcn.7ff654376b34
movaps xmm0, xmmword [rsp + 0x60]
lea r8, [rsp + 0x60]
mov edx, eax
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rbp - 0x10]
call fcn.7ff6542042c0
lea rax, [rsp + 0x61]
mov dword [rsp + 0x60], 0x6c656369
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x61]
mov rax, rbx
mov dword [rsp + 0x64], 0x762d7865
mov word [rsp + 0x68], 0x33
inc rax
cmp byte [rcx + rax], 0
jne 0x7ff654275c36
mov qword [rbp - 0x78], rax
call fcn.7ff654376b34
movaps xmm0, xmmword [rbp - 0x80]
lea r8, [rbp - 0x80]
mov edx, eax
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rsp + 0x30]
call fcn.7ff6542042c0
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.7ff654204890
lea rcx, [rsp + 0x30]
call fcn.7ff65420d880
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x80]
call fcn.7ff6542050d0
lea rdi, [0x7ff6543ef8d8]
movsd xmm0, qword [rax]
mov ecx, dword [rax + 8]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x60]
mov dword [rbp - 0x80], ecx
mov qword [rbp - 0x78], rdi
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
test eax, eax
je 0x7ff6542760b6
cmp eax, 1
setne al
test al, al
jne 0x7ff654275ce3
cmp qword [rbp - 0x58], 7
lea rcx, [rbp - 0x70]
cmova rcx, qword [rbp - 0x70]
call fcn.7ff654376d94
shr rax, 0x20
test eax, eax
jne 0x7ff654276133
lea rax, [rsp + 0x61]
mov dword [rsp + 0x60], 0x6e6f6331
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x61]
mov rax, rbx
mov dword [rsp + 0x64], 0x73676966
mov byte [rsp + 0x68], 0
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x7ff654275d10
mov qword [rbp - 0x78], rax
call fcn.7ff654376b34
movaps xmm0, xmmword [rbp - 0x80]
lea r8, [rbp - 0x80]
mov edx, eax
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rsp + 0x30]
call fcn.7ff6542042c0
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x30]
call fcn.7ff654204890
lea rcx, [rsp + 0x30]
call fcn.7ff65420d880
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x80]
call fcn.7ff6542050d0
movsd xmm0, qword [rax]
mov ecx, dword [rax + 8]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x60]
mov dword [rbp - 0x80], ecx
mov qword [rbp - 0x78], rdi
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
test eax, eax
je 0x7ff6542760bf
cmp eax, 1
setne al
test al, al
jne 0x7ff654275db6
cmp qword [rbp - 0x18], 7
lea rcx, [rbp - 0x30]
cmova rcx, qword [rbp - 0x30]
call fcn.7ff654376d94
shr rax, 0x20
test eax, eax
jne 0x7ff654276146
lea rax, [rbp - 0x7f]
mov dword [rbp - 0x80], 0x6e69620d
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x7f]
mov byte [rbp - 0x7c], 0
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x7ff654275dd0
mov qword [rsp + 0x68], rbx
call fcn.7ff654376b34
movaps xmm0, xmmword [rsp + 0x60]
lea r8, [rsp + 0x60]
mov edx, eax
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x30]
call fcn.7ff6542042c0
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.7ff654204890
lea rcx, [rsp + 0x30]
call fcn.7ff65420d880
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x80]
call fcn.7ff6542050d0
movsd xmm0, qword [rax]
mov ecx, dword [rax + 8]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x60]
mov dword [rbp - 0x80], ecx
mov qword [rbp - 0x78], rdi
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
test eax, eax
je 0x7ff6542760c8
cmp eax, 1
setne al
test al, al
jne 0x7ff654275e7a
cmp qword [rbp - 0x38], 7
lea rcx, [rbp - 0x50]
cmova rcx, qword [rbp - 0x50]
call fcn.7ff654376d94
shr rax, 0x20
test eax, eax
jne 0x7ff6542760f6
lea rcx, [0x7ff65448ab80]
call fcn.7ff6542065a0
test al, al
nop
nop
nop
nop
nop
nop
call qword [sym.imp.kernel32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.user32.dll_ShowWindow]
lea rdx, [rbp - 0x7f]
mov dword [rbp - 0x80], 0x626f5260
xor ecx, ecx
mov dword [rbp - 0x7c], 0x786f6c
call qword [sym.imp.user32.dll_FindWindowA]
mov rcx, rax
call qword [sym.imp.user32.dll_SetForegroundWindow]
mov ecx, 1
call qword [sym.imp.kernel32.dll_Sleep]
lea rdx, [rbp - 0x7f]
mov dword [rbp - 0x80], 0x626f5241
xor ecx, ecx
mov dword [rbp - 0x7c], 0x786f6c
call qword [sym.imp.user32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.user32.dll_GetForegroundWindow]
cmp rax, rbx
jne 0x7ff654275ec2
mov ecx, 1
call fcn.7ff6543776d0
lea rcx, [rsp + 0x68]
xor edi, edi
mov qword [rsp + 0x28], rcx
lea r8, [0x7ff654276280]
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov r9, rax
xor edx, edx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x7ff6542760dd
cmp dword [rsp + 0x68], edi
je 0x7ff6542760d1
movaps xmm0, xmmword [rsp + 0x60]
lea rcx, [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
call qword [sym.imp.msvcp140.dll__Thrd_detach]
test eax, eax
jne 0x7ff6542760d1
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
call fcn.7ff654265a00
xor ecx, ecx
mov qword [rsp + 0x60], rdi
mov rbx, rax
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rsp + 0x60]
xor edx, edx
lea r9, [0x7ff654395e80]
mov qword [rsp + 0x20], rax
mov r8d, 1
lea rcx, [0x7ff654395e90]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x7ff654275fb8
mov rcx, qword [rsp + 0x60]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rdx, rbx
call fcn.7ff654265d90
test al, al
je 0x7ff654276026
nop word [rax + rax]
lea rdx, [rbp - 0x7f]
mov dword [rbp - 0x80], 0x626f5262
xor ecx, ecx
mov dword [rbp - 0x7c], 0x786f6c
call qword [sym.imp.user32.dll_FindWindowA]
test rax, rax
je 0x7ff6542760ed
lea rdx, [rsp + 0x61]
mov dword [rsp + 0x60], 0x626f5273
xor ecx, ecx
mov dword [rsp + 0x64], 0x786f6c
call qword [sym.imp.user32.dll_FindWindowA]
mov r8, rbx
lea rcx, [0x7ff65448aa18]
mov rdx, rax
call fcn.7ff654266c00
test al, al
jne 0x7ff654275fd0
movdqa xmm0, xmmword [0x7ff6543cedd0]
lea r9, [rsp + 0x61]
mov r8d, 0x5a
mov dword [rsp + 0x70], 0x6c726576
lea rdx, [0x7ff6543c2900]
mov word [rsp + 0x74], 0x7961
mov ecx, 1
mov byte [rsp + 0x76], dil
movdqu xmmword [rsp + 0x60], xmm0
call fcn.7ff654275840
lea rcx, [0x7ff6543c28f4]
call qword [sym.imp.ucrtbase.dll_system]
lea rcx, [rbp - 0x50]
call fcn.7ff65420d880
lea rcx, [rbp - 0x30]
call fcn.7ff65420d880
lea rcx, [rbp - 0x70]
call fcn.7ff65420d880
lea rcx, [rbp - 0x10]
call fcn.7ff65420d880
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.7ff6543776b0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
test ecx, ecx
jne 0x7ff654276109
jmp 0x7ff654275cc4
test ecx, ecx
jne 0x7ff654276117
jmp 0x7ff654275d97
test ecx, ecx
jne 0x7ff654276125
jmp 0x7ff654275e5b
mov ecx, 1
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rsp + 0x68], edi
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll_exit]
int3
lea r8, [rbp - 0x50]
mov edx, eax
lea rcx, [0x7ff6543b67d8]
call fcn.7ff654205000
int3
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x80]
call fcn.7ff654205070
int3
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x80]
call fcn.7ff654205070
int3
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x80]
call fcn.7ff654205070
int3
lea r8, [rbp - 0x70]
mov edx, eax
lea rcx, [0x7ff6543b67d8]
call fcn.7ff654205000
int3
lea r8, [rbp - 0x30]
mov edx, eax
lea rcx, [0x7ff6543b67d8]
call fcn.7ff654205000
int3