Function at 0x14001e6c0
Capabilities:
Check for debugger via api
Check if file exists
Get file attributes
Get system information on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [0x140047040]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
mov rdi, rdx
mov ebx, ecx
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xor esi, esi
mov dword [rsp + 0x48], esi
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x4c], esi
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14001e746
lea rdx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x14001e746
mov edx, dword [rsp + 0x4c]
or edx, 4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov dword [rsp + 0x48], eax
cmp ebx, 1
jne 0x14001ef31
mov qword [rsp + 0x30], 0x59
xor eax, eax
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call fcn.14001d4f0
nop
cmp ax, 0x64
setae bl
call fcn.14001d880
test al, al
jne 0x14001e790
test bl, bl
lea rdx, str.en_una_vm
jne 0x14001e797
lea rdx, str.no_esta_en_una_vm
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140021440
lea rdx, [0x140021610]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14001eefe
mov dword [rsp + 0x40], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x40], 1
je 0x14001eefe
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14001e83c
mov dword [rsp + 0x40], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rsp + 0x40]
lea edx, [r9 + 3]
call rbx
cmp dword [rsp + 0x40], 0
setne al
test al, al
jne 0x14001eefe
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14001e8ad
cmp qword [rbp + 0x18], 0
jne 0x14001eefe
cmp qword [rbp + 0x20], 0
jne 0x14001eefe
cmp qword [rbp + 0x28], 0
jne 0x14001eefe
cmp qword [rbp + 0x30], 0
jne 0x14001eefe
cmp qword [rbp + 0x38], 0
jne 0x14001eefe
cmp qword [rbp + 0x40], 0
jne 0x14001eefe
lea rcx, [rsp + 0x30]
call fcn.1400044c0
lea rcx, [rsp + 0x40]
call fcn.1400044c0
movabs rax, 0x7fffffffc46535ff
mov rbx, qword [rsp + 0x40]
cmp rbx, rax
jge 0x14001e8de
add rbx, 0x3b9aca00
jmp 0x14001e8e8
movabs rbx, 0x7fffffffffffffff
lea rcx, [rsp + 0x40]
call fcn.1400044c0
mov rax, qword [rsp + 0x40]
cmp rax, rbx
jge 0x14001e960
movabs rdi, 0x4e94914f0000
movabs r14, 0x431bde82d7b634db
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jl 0x14001e922
mov ecx, 0x5265c00
jmp 0x14001e947
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14001e945
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x40]
call fcn.1400044c0
mov rax, qword [rsp + 0x40]
cmp rax, rbx
jl 0x14001e910
lea rcx, [rsp + 0x40]
call fcn.1400044c0
mov rax, qword [rsp + 0x40]
sub rax, qword [rsp + 0x30]
cmp rax, 0x3b9aca00
jl 0x14001ee6a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x60], xmm1
lea r8d, [rax + 0xd]
lea rdx, str.C:_sample.exe
lea rcx, [rbp - 0x70]
call fcn.140021f40
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x40], xmm1
mov r8d, 0x1b
lea rdx, str.C:Sandbox_sandbox_file.txt
lea rcx, [rbp - 0x50]
call fcn.140021f40
nop
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.14001f560
nop
lea r9, [fcn.1400204e0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp - 0x70]
call fcn.1400331a0
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
cmp rbx, rdi
je 0x14001ea45
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14001ea2d
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14001ee59
add rbx, 0x20
cmp rbx, rdi
jne 0x14001ea20
xor bl, bl
lea rcx, [rsp + 0x58]
call fcn.140020a40
test bl, bl
jne 0x14001ee6a
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp - 0x50], 2
jb 0x14001ee6a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
lea rdx, str.sample.exe
lea rcx, [rbp - 0x70]
call fcn.140020390
nop
lea rdx, str.vmsrvc.exe
lea rcx, [rbp - 0x50]
call fcn.140020390
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov ecx, 0x40
call fcn.140032fb8
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rcx, [rax + 0x40]
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x30], rcx
lea r9, [rsp + 0x58]
mov r8, rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.140023d20
mov qword [rsp + 0x60], rax
lea r9, [fcn.140020320]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp - 0x70]
call fcn.1400331a0
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
cmp rbx, rdi
je 0x14001eb2e
mov rcx, rbx
call fcn.14001e500
test al, al
jne 0x14001ee60
add rbx, 0x20
cmp rbx, rdi
jne 0x14001eb15
lea rcx, [rsp + 0x58]
call fcn.1400208e0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
lea rdx, str.ida64.exe
lea rcx, [rbp - 0x30]
call fcn.140020390
nop
lea rdx, str.Taskmgr.exe
lea rcx, [rbp - 0x10]
call fcn.140020390
nop
lea rdx, str.Dumpcap.exe
lea rcx, [rbp + 0x10]
call fcn.140020390
nop
lea rdx, str.Wireshark.exe
lea rcx, [rbp + 0x30]
call fcn.140020390
nop
lea rdx, str.SystemInformer.exe
lea rcx, [rbp + 0x50]
call fcn.140020390
nop
lea rdx, str.ProcessHacker.exe
lea rcx, [rbp + 0x70]
call fcn.140020390
nop
lea rdx, str.dotPeek64.exe
lea rcx, [rbp + 0x90]
call fcn.140020390
nop
lea rdx, str.ida32.exe
lea rcx, [rbp + 0xb0]
call fcn.140020390
nop
lea rdx, str.ida.exe
lea rcx, [rbp + 0xd0]
call fcn.140020390
nop
lea rdx, str.reclass.net.exe
lea rcx, [rbp + 0xf0]
call fcn.140020390
nop
lea rdx, str.reclass.exe
lea rcx, [rbp + 0x110]
call fcn.140020390
nop
lea rdx, str.heyrays.exe
lea rcx, [rbp + 0x130]
call fcn.140020390
nop
lea rdx, str.lighthouse.exe
lea rcx, [rbp + 0x150]
call fcn.140020390
nop
lea rdx, str.cheatengine___x86_64.exe
lea rcx, [rbp + 0x170]
call fcn.140020390
nop
lea rdx, str.classinformer.exe
lea rcx, [rbp + 0x190]
call fcn.140020390
nop
lea rdx, str.ida_x86emu.exe
lea rcx, [rbp + 0x1b0]
call fcn.140020390
nop
lea rdx, str.cffexplorer.exe
lea rcx, [rbp + 0x1d0]
call fcn.140020390
nop
lea rdx, str.winhex.exe
lea rcx, [rbp + 0x1f0]
call fcn.140020390
nop
lea rdx, str.hiew.exe
lea rcx, [rbp + 0x210]
call fcn.140020390
nop
lea rdx, str.fiddler.exe
lea rcx, [rbp + 0x230]
call fcn.140020390
nop
lea rdx, str.httpdebugger.exe
lea rcx, [rbp + 0x250]
call fcn.140020390
nop
lea rdx, str.httpdebuggerpro.exe
lea rcx, [rbp + 0x270]
call fcn.140020390
nop
lea rdx, str.scylla.exe
lea rcx, [rbp + 0x290]
call fcn.140020390
nop
lea rdx, str.Cheat_Engine.exe
lea rcx, [rbp + 0x2b0]
call fcn.140020390
nop
lea rdx, str.ollydbg.exe
lea rcx, [rbp + 0x2d0]
call fcn.140020390
nop
lea rdx, str.x64dbg.exe
lea rcx, [rbp + 0x2f0]
call fcn.140020390
nop
lea rdx, str.PE.EXE
lea rcx, [rbp + 0x310]
call fcn.140020390
nop
lea rdx, str.ida.exe
lea rcx, [rbp + 0x330]
call fcn.140020390
nop
lea rdx, str.PEiD.exe
lea rcx, [rbp + 0x350]
call fcn.140020390
nop
lea rdx, str.r2.exe
lea rcx, [rbp + 0x370]
call fcn.140020390
nop
lea rdx, str.procexp.exe
lea rcx, [rbp + 0x390]
call fcn.140020390
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rsi
mov ecx, 0x3e0
call fcn.140032fb8
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
lea rcx, [rax + 0x3e0]
mov qword [rbp - 0x78], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
lea r9, [rsp + 0x78]
mov r8, rax
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp - 0x30]
call fcn.140023d20
mov qword [rbp - 0x80], rax
lea r9, [fcn.140020320]
mov edx, 0x20
lea r8d, [rdx - 1]
lea rcx, [rbp - 0x30]
call fcn.1400331a0
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rbp - 0x80]
cmp rbx, rdi
je 0x14001ee31
mov rcx, rbx
call fcn.14001e500
test al, al
jne 0x14001ee9d
add rbx, 0x20
cmp rbx, rdi
jne 0x14001ee18
lea rcx, [rsp + 0x78]
call fcn.1400208e0
nop
cmp dword [rsp + 0x48], 0
je 0x14001ee52
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor eax, eax
jmp 0x14001ef7b
mov bl, 1
jmp 0x14001ea47
lea rcx, [rsp + 0x58]
call fcn.1400208e0
lea rdx, str.Sandbox_environment_detected.
lea rcx, [rsp + 0x58]
call fcn.1400205d0
nop
lea rcx, [rsp + 0x58]
call fcn.14001e670
nop
lea rcx, [rsp + 0x58]
call fcn.1400204e0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400202e0
mov r8, qword [rax]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140020300
mov rdx, qword [rax]
lea rcx, [rbp - 0x70]
call fcn.140021650
nop
mov r8, rax
lea rcx, [rsp + 0x58]
call fcn.140021780
nop
mov rcx, rax
call fcn.14001e670
nop
lea rcx, [rsp + 0x58]
call fcn.1400204e0
nop
lea rcx, [rbp - 0x70]
call fcn.1400204e0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rdx, str.Debugger_detected.
lea rcx, [rsp + 0x58]
call fcn.1400205d0
nop
lea rcx, [rsp + 0x58]
call fcn.14001e670
nop
lea rcx, [rsp + 0x58]
call fcn.1400204e0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Uso:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140021440
mov rdx, qword [rdi]
mov rcx, rax
call fcn.140021440
lea rdx, [0x140021610]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
cmp dword [rsp + 0x48], 0
je 0x14001ef76
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov eax, 1
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.140032f90
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret