Function at 0x140060ef0
Capabilities:
Check for software breakpoints
Contain obfuscated stackstrings
Create process on windows
Execute command
Get token membership
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x130]
sub rsp, 0x230
xor esi, esi
mov dword [rbp + 0x168], 0
lea rax, [rsp + 0x70]
mov word [rbp + 0x16c], 0x500
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov dword [rsp + 0x48], esi
mov edi, ecx
mov dword [rsp + 0x40], esi
lea r8d, [rsi + 0x20]
mov dword [rsp + 0x38], esi
lea rcx, [rbp + 0x168]
mov dword [rsp + 0x30], esi
mov r9d, 0x220
mov dword [rsp + 0x28], esi
mov dl, 2
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp + 0x160], eax
test eax, eax
je 0x140060f99
mov rdx, qword [rsp + 0x70]
lea r8, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140060f84
mov dword [rbp + 0x160], esi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp + 0x160]
test eax, eax
jne 0x140060fbf
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.This_application_requires_administrative_privileges_to_run.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x14006176f
lea rcx, str.MODE_CON_COLS75_LINES12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r9d, 2
mov r8b, 0xc3
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov dword [rsp + 0x60], 0x7475614c
mov dword [rsp + 0x64], 0x69726f68
mov dword [rsp + 0x68], 0x64657a
cmp edi, 1
jne 0x1400616ee
mov rax, qword [rbx]
lea r8, [rsp + 0x61]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140061025
inc rax
test ecx, ecx
jne 0x140061012
test edx, edx
jne 0x1400616ee
lea r8d, [rdx + 0xa]
lea rdx, [0x140060c00]
lea rcx, [rsp + 0x70]
call fcn.1400011b0
cmp dword [rsp + 0x78], esi
je 0x14006104f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov edx, 0x2710
lea rcx, [rsp + 0x70]
call fcn.1400013b0
cmp dword [rsp + 0x78], esi
je 0x14006106b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rbx, qword [0x1402edf40]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, Ordinal_50
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rsp + 0x70]
xor edx, edx
call rbx
mov r8d, dword [rbp - 0x68]
xor edx, edx
mov ecx, 0x100400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
mov edx, 0x3e8
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x102
jne 0x140061161
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x160]
call fcn.140060790
movzx edx, byte [rax]
lea rcx, [rax + 1]
xor byte [rax + 1], dl
xor byte [rax + 2], dl
xor byte [rax + 3], dl
xor byte [rax + 4], dl
xor byte [rax + 5], dl
xor byte [rax + 6], dl
xor byte [rax + 7], dl
xor byte [rax + 8], dl
xor byte [rax + 9], dl
xor byte [rax + 0xa], dl
xor byte [rax + 0xb], dl
xor byte [rax + 0xc], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0xe], dl
xor byte [rax + 0xf], dl
xor byte [rax + 0x10], dl
xor byte [rax + 0x11], dl
xor byte [rax + 0x12], dl
xor byte [rax + 0x13], dl
xor byte [rax + 0x14], dl
xor byte [rax + 0x15], dl
xor byte [rax + 0x16], dl
xor byte [rax + 0x17], dl
xor byte [rax + 0x18], dl
xor byte [rax + 0x19], dl
xor byte [rax + 0x1a], dl
xor byte [rax + 0x1b], dl
mov byte [rax + 0x1c], sil
call fcn.140061790
mov ecx, 0x1f4
mov dword [0x1401dbee0], 0xcd9aadd8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x539
call qword [sym.imp.KERNEL32.dll_ExitProcess]
vmovdqu xmm0, xmmword [0x14018d7e0]
lea rcx, [rsp + 0x71]
mov dword [rbp - 0x80], 0x69746163
vmovdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x7c], 0x53206e6f
mov dword [rbp - 0x78], 0x74726174
mov word [rbp - 0x74], 0xa
call fcn.140061790
call fcn.14003b260
mov rcx, qword [0x1402edf30]
call fcn.140060930
call fcn.140060c40
call fcn.140001000
lea rcx, [rbp + 0x160]
call fcn.14003b4f0
mov rbx, qword [rbp + 0x160]
movabs rsi, 0x6fc23ac00
nop dword [rax]
lea rcx, [rbp + 0x160]
call fcn.14003b4f0
mov rax, qword [rbp + 0x160]
mov rcx, rax
sub rcx, rbx
cmp rcx, rsi
jl 0x14006126c
mov rbx, rax
call fcn.1400010e0
test al, al
jne 0x140061619
call fcn.140001020
test al, al
jne 0x140061561
call fcn.140001120
test al, al
jne 0x14006149d
vmovdqu xmm0, xmmword [0x14018d7f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x71]
vmovdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x74656420
mov dword [rbp - 0x7c], 0x65746365
mov dword [rbp - 0x78], 0xa2e64
call fcn.140002e70
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rax], 0xcc
je 0x140061379
mov rax, qword [sym.imp.KERNEL32.dll_SleepEx]
cmp byte [rax], 0xcc
je 0x140061379
mov edi, dword [0x1401dbee0]
mov ecx, 0x539
xor edi, 0xdeadbeef
call qword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [rdi + 0x40000000]
cmp eax, 0x10000000
ja 0x1400616c1
mov edi, dword [0x1401dbee0]
mov ecx, 0x539
xor edi, 0xdeadbeef
call qword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [rdi + 0x40000000]
cmp eax, 0x10000000
ja 0x1400616c1
cmp byte [0x1402edf48], 0
je 0x1400611d0
mov r9, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x160]
call fcn.140060900
mov rcx, r9
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
mov byte [rax + 0x16], 0
call fcn.140002e70
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x539
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0], 0xdead
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov r9, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x160]
call fcn.140060890
mov rcx, r9
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
xor byte [rax + 0x23], r8b
xor byte [rax + 0x24], r8b
xor byte [rax + 0x25], r8b
xor byte [rax + 0x26], r8b
xor byte [rax + 0x27], r8b
xor byte [rax + 0x28], r8b
xor byte [rax + 0x29], r8b
xor byte [rax + 0x2a], r8b
xor byte [rax + 0x2b], r8b
xor byte [rax + 0x2c], r8b
xor byte [rax + 0x2d], r8b
xor byte [rax + 0x2e], r8b
xor byte [rax + 0x2f], r8b
xor byte [rax + 0x30], r8b
xor byte [rax + 0x31], r8b
xor byte [rax + 0x32], r8b
xor byte [rax + 0x33], r8b
xor byte [rax + 0x34], r8b
xor byte [rax + 0x35], r8b
xor byte [rax + 0x36], r8b
mov byte [rax + 0x37], 0
call fcn.140002e70
mov ecx, 0x1f4
mov dword [0x1401dbee0], 0xcd9aadd8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x539
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r9, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x160]
call fcn.140060850
mov rcx, r9
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
mov byte [rax + 0x1f], 0
call fcn.140002e70
mov ecx, 0x1f4
mov dword [0x1401dbee0], 0xcd9aadd8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x539
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r9, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x160]
call fcn.140060810
mov rcx, r9
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
mov byte [rax + 0x1c], 0
call fcn.140002e70
mov ecx, 0x1f4
mov dword [0x1401dbee0], 0xcd9aadd8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x539
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r9, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x160]
call fcn.1400607d0
mov rcx, r9
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
mov byte [rax + 0x18], 0
call fcn.140002e70
mov ecx, 0x1f4
mov dword [0x1401dbee0], 0xcd9aadd8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x539
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.Here_is_the_function__n
call fcn.140061790
mov ecx, 0x1f4
mov dword [0x1401dbee0], 0xcd9aadd8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x539
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x104
lea rdx, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
lea rdx, [rsp + 0x61]
vpxor xmm0, xmm0, xmm0
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x20]
mov qword [rbp - 0x80], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
vmovups ymmword [rbp - 0x50], ymm0
vmovups ymmword [rbp - 0x30], ymm0
vmovups ymmword [rbp - 0x10], ymm0
vmovups xmmword [rsp + 0x70], xmm0
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov rbx, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
pop rsi
pop rbp
ret