Function at 0x140005cc0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1401a90c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
call fcn.140005930
test al, al
je 0x140005d0b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Dump_tool_detected__exiting...
call fcn.140006540
lea rdx, [0x140006720]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 0x1000
mov qword [rsp + 0x60], rbx
xor ecx, ecx
mov dword [rsp + 0x50], 0xd2c3b4a5
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x140005de1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Allocated_memory_for_critical_region.
call fcn.140006540
lea rdx, [0x140006720]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0xa5
mov r8d, 0x1000
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov r10d, 1
lea r8, [rbx + 2]
sub r10, rbx
mov r9, rbx
mov rcx, 0xfffffffffffffffe
not r9
sub rcx, rbx
lea rax, [rcx + r8]
and eax, 3
movzx eax, byte [rsp + rax + 0x50]
xor byte [r8 - 2], al
lea rax, [r9 + r8]
and eax, 3
movzx eax, byte [rsp + rax + 0x50]
xor byte [r8 - 1], al
mov rax, r8
sub rax, rbx
and eax, 3
movzx eax, byte [rsp + rax + 0x50]
xor byte [r8], al
lea rax, [r10 + r8]
and eax, 3
movzx eax, byte [rsp + rax + 0x50]
xor byte [r8 + 1], al
add r8, 4
lea rax, [rcx + r8]
cmp rax, 0x1000
jb 0x140005d90
lea r9, [rsp + 0x50]
mov edx, 0x1000
mov r8d, 0x101
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdx, [0x140005c70]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Anti_dump_protection_is_active.
call fcn.140006540
lea rdx, [0x140006720]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, qword [rsp + 0x60]
test rax, rax
je 0x140005eb4
lea rdx, [0x140179a90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005eb4
mov r8d, Ordinal_50
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test byte [rsp + 0x44], 0x40
je 0x140005eb4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.API_Hooking_detected__restoring_original_LoadLibraryA_
call fcn.140006540
lea rdx, [0x140006720]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [rsp + 0x38]
lea r9, [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, Ordinal_50
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rdx, qword [rsp + 0x38]
lea r9, [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Critical_memory_region_locked_and_protected_from_access.
test eax, eax
jne 0x140005f04
lea rdx, str.Failed_to_lock_critical_memory_region.
call fcn.140006540
lea rdx, [0x140006720]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140148580
add rsp, 0x68
ret