Function at 0x1400019d0
Capabilities:
Check for debugger via api
Check for process debug object
Check processdebugflags
Check processdebugport
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
movaps xmmword [rsp + 0x170], xmm6
mov qword [rsp + 0x80], 0
mov dword [rsp + 0xf0], 0
mov dword [rsp + 0x48], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea r8, [rsp + 0x80]
mov rcx, rax
mov edx, 8
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x140001bb7
mov rcx, qword [rsp + 0x80]
lea rdi, [rsp + 0x48]
mov qword [rsp + 0x20], rdi
lea rsi, [rsp + 0xf0]
mov edx, 0x14
mov r8, rsi
mov r9d, 4
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x140001bb7
cmp dword [rsp + 0xf0], 0
je 0x140001bb7
lea rax, [0x141d21862]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
movabs rax, 0x28ee358551049bf3
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x80]
mov rdx, qword [rsp + 0x80]
call fcn.140035240
movabs rcx, 0x6473f65616740f59
xor rcx, qword [rax]
movabs rdx, 0x5c3c7d014d9e5a4a
xor rdx, qword [rax + 8]
movabs r8, 0x4259c9f0a01aad2f
xor r8, qword [rax + 0x10]
movabs r9, 0x3bbd058d17997c23
xor r9, qword [rax + 0x18]
movabs r10, 0x3021bc15fa91e96b
xor r10, qword [rax + 0x20]
mov r11d, 0xf3c0e744
xor r11d, dword [rax + 0x28]
mov ebx, r11d
shr ebx, 8
movzx eax, byte [rax + 0x2c]
xor al, 0xd0
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x68], r10
mov byte [rsp + 0x70], r11b
shr r11d, 0x18
mov byte [rsp + 0x73], r11b
mov word [rsp + 0x71], bx
mov byte [rsp + 0x74], al
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], 0x2d
mov qword [rsp + 0x30], rsi
lea rax, [0x14003d2b0]
mov qword [rsp + 0x38], rax
lea rax, [0x141d35dd0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 2
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
lea rcx, [rsp + 0x80]
call fcn.14002b9a0
jmp 0x140002486
lea r15, [rsp + 0x80]
lea rbx, [rsp + 0xf0]
lea r14, [rsp + 0x48]
xorps xmm6, xmm6
lea rsi, [0x141d35598]
nop word cs:[rax + rax]
mov rcx, r15
call fcn.14002c030
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x1400021a1
mov qword [rsp + 0x118], rcx
mov r8, qword [rsp + 0x90]
mov rcx, r15
mov qword [rsp + 0x110], rdx
call fcn.1400159c0
test byte [rsp + 0x80], 1
jne 0x140002746
mov rbp, qword [rsp + 0x90]
test rbp, rbp
js 0x140002746
mov r13, qword [rsp + 0x88]
je 0x140001c80
movzx eax, byte [0x141d43a20]
xor ecx, ecx
mov rdx, rbp
call fcn.14002f460
test rax, rax
je 0x140002746
mov rdi, rax
jmp 0x140001c85
mov edi, 1
mov rcx, rdi
mov rdx, r13
mov r8, rbp
call fcn.140055470
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 1
mov qword [rsp + 0x138], 0
lea rax, [rdi + rbp]
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], rax
mov word [rsp + 0x100], 0
mov dword [rsp + 0x108], 1
lea rcx, [rsp + 0x140]
mov rdx, rbx
call fcn.140023160
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 1
mov word [rsp + 0x58], 0
mov dword [rsp + 0x60], 1
lea rcx, [rsp + 0x158]
mov rdx, r14
call fcn.140023160
mov r15, qword [rsp + 0x148]
mov r12, qword [rsp + 0x160]
mov dword [rsp + 0x7c], 0
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
mov al, 1
test al, al
je 0x140002746
movzx eax, byte [0x141d43a20]
mov edx, 8
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140002746
mov word [rax], 0x72
mov ecx, 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 1
mov r13d, 1
xor ebx, ebx
lea r14, [0x141d35593]
jmp 0x140001ddf
mov word [rax + r13*2], bx
inc r13
mov qword [rsp + 0x40], r13
mov ebx, edi
test bx, bx
jne 0x140001e60
cmp r14, rsi
je 0x140001f00
movzx ecx, byte [r14]
test cl, cl
js 0x140001e05
inc r14
mov ebx, ecx
xor edi, edi
cmp r13, qword [rsp + 0x30]
jne 0x140001dd0
jmp 0x140001e6d
mov ebx, ecx
and ebx, 0x1f
movzx r8d, byte [r14 + 1]
and r8d, 0x3f
cmp cl, 0xdf
jbe 0x140001e53
movzx edx, byte [r14 + 2]
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp cl, 0xf0
jb 0x140001ebd
movzx ecx, byte [r14 + 3]
add r14, 4
and ebx, 7
shl ebx, 0x12
shl edx, 6
and ecx, 0x3f
or ecx, edx
or ebx, ecx
cmp ebx, 0xffff
jbe 0x140001e60
jmp 0x140001ece
add r14, 2
shl ebx, 6
or ebx, r8d
nop dword [rax]
xor edi, edi
cmp r13, qword [rsp + 0x30]
jne 0x140001dd0
lea rax, [0x141d35592]
sub rax, r14
add rax, 8
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
cmp di, 1
sbb rdx, 0
lea r8, [rdx + 2]
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x30]
mov rdx, r13
call fcn.140059920
mov rax, qword [rsp + 0x38]
jmp 0x140001dd0
add r14, 3
shl ebx, 0xc
or ebx, edx
cmp ebx, 0xffff
jbe 0x140001e60
lea ecx, [rbx + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and ebx, 0x3ff
or ebx, 0xdc00
mov edi, ebx
mov ebx, ecx
cmp r13, qword [rsp + 0x30]
jne 0x140001dd0
jmp 0x140001e6d
mov rbx, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
xor ecx, ecx
mov edx, 6
call qword [sym.imp.ole32.dll_CoInitializeEx]
movabs rax, 0x14000000070
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], r15
mov qword [rsp + 0xa0], r12
mov dword [rsp + 0xb0], 1
lea r15, [rsp + 0x80]
mov rcx, r15
call qword [sym.imp.shell32.dll_ShellExecuteExW]
test eax, eax
sete al
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
sete dl
or dl, al
cmp dl, 1
jne 0x140001fa0
test rbx, rbx
lea r14, [rsp + 0x48]
je 0x140001f93
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, 0xffffffff
jmp 0x140001fe8
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xe8]
lea rdx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, 1
mov edi, 0
sbb edi, edi
or edi, dword [rsp + 0x7c]
test rbx, rbx
lea r14, [rsp + 0x48]
je 0x140001fe8
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rbx, [rsp + 0xf0]
cmp qword [rsp + 0x158], 0
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
je 0x140002016
mov r8, qword [rsp + 0x160]
mov rcx, qword [0x141d439e8]
xor edx, edx
call r13
cmp qword [rsp + 0x140], 0
je 0x140002035
mov r8, qword [rsp + 0x148]
mov rcx, qword [0x141d439e8]
xor edx, edx
call r13
cmp qword [rsp + 0x128], 0
je 0x140002054
mov r8, qword [rsp + 0x130]
mov rcx, qword [0x141d439e8]
xor edx, edx
call r13
test rbp, rbp
je 0x14000206d
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x120]
call r13
test edi, edi
je 0x140002305
lea rax, [0x141d2baad]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
movabs rax, 0x595f673b99754862
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
call fcn.1400349b0
mov rcx, qword [rax]
movabs rdx, 0x27ba6ed99e947921
xor rcx, rdx
mov rdx, qword [rax + 8]
movabs r8, 0x347de5c2264e06c9
xor rdx, r8
mov r8, qword [rax + 0x10]
movabs r9, 0xf37d98069079d5a0
xor r8, r9
mov r9, qword [rax + 0x18]
movabs r10, 0x69a9b624fd27f38
xor r9, r10
movzx eax, byte [rax + 0x20]
xor al, 0xb9
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], r9
mov byte [rsp + 0x68], al
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0xf8], 0x21
mov qword [rsp + 0x30], rbx
lea rax, [0x14003d2b0]
mov qword [rsp + 0x38], rax
lea rax, [0x141d35dd0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 2
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
mov rcx, r15
call fcn.14002b9a0
cmp qword [rsp + 0x118], 0
je 0x140001be0
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x110]
call r13
jmp 0x140001be0
test rdx, rdx
je 0x140002327
lea rax, [0x141d2c78c]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
movabs rax, 0x63c9020a48e60ebf
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x80]
mov r15, rdx
mov rdx, qword [rsp + 0x80]
call fcn.140034320
movabs rcx, 0x73d7bddf5b238f5b
xor rcx, qword [rax]
movabs rdx, 0x4361ba5209efe2c9
xor rdx, qword [rax + 8]
movabs r8, 0x80aafc04f153c8a7
xor r8, qword [rax + 0x10]
movabs r9, 0xfd95095e3a6861b1
xor r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
xor al, 0x21
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], r9
mov byte [rsp + 0x68], al
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0xf8], 0x21
mov qword [rsp + 0x30], rbx
lea rax, [0x14003d2b0]
mov qword [rsp + 0x38], rax
lea rax, [0x141d35dd0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 2
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
lea rcx, [rsp + 0x80]
call fcn.14002b9a0
mov r8, r15
mov eax, r8d
and eax, 3
cmp eax, 1
jne 0x140002486
mov rsi, qword [r8 - 1]
mov rdi, qword [r8 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x1400022e4
mov rcx, rsi
call rax
mov r8, r15
dec r8
cmp qword [rdi + 8], 0
je 0x140002477
cmp qword [rdi + 0x10], 0x11
jae 0x14000245b
mov rdi, r8
jmp 0x140002462
cmp qword [rsp + 0x118], 0
mov r8, qword [rsp + 0x110]
je 0x140002327
mov rcx, qword [0x141d439e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [0x141d2252e]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
movabs rax, 0x9d45940f69b50d5a
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x80]
mov rdx, qword [rsp + 0x80]
call fcn.140034200
movabs rcx, 0x44f21e587249d16a
xor rcx, qword [rax]
movabs rdx, 0x22fd9cbde01aa544
xor rdx, qword [rax + 8]
movabs r8, 0x72396d0abc24f508
xor r8, qword [rax + 0x10]
movabs r9, 0x5cc1f4aaac985a06
xor r9, qword [rax + 0x18]
movabs r10, 0x60f835fa28c43580
xor r10, qword [rax + 0x20]
movzx eax, word [rax + 0x28]
mov r11d, eax
xor r11b, 0xf9
shr eax, 8
xor al, 0x9d
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x68], r10
mov byte [rsp + 0x70], r11b
mov byte [rsp + 0x71], al
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0xf8], 0x2a
mov qword [rsp + 0x30], rbx
lea rax, [0x14003d2b0]
mov qword [rsp + 0x38], rax
lea rax, [0x141d35dd0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 2
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
lea rcx, [rsp + 0x80]
call fcn.14002b9a0
jmp 0x14000272a
mov rdi, r8
mov rsi, qword [rsi - 8]
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, rdi
mov rcx, qword [0x141d439e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.140025c50
mov r14, rax
mov edi, edx
mov ecx, 0x23
call fcn.140033590
call fcn.140025c50
mov rsi, rax
mov ebx, edx
mov r8, qword [0x141d439f0]
test r8, r8
jne 0x1400024ea
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14000274d
mov r8, qword [rsp + 0x80]
mov qword [0x141d439f0], r8
test r8, r8
je 0x140002746
cmp r8, 0x3b9aca00
ja 0x1400024ff
mov eax, 0x3b9aca00
xor edx, edx
div r8d
jmp 0x140002501
xor eax, eax
lea ecx, [rax - 0x3b9aca00]
xor edx, edx
cmp r8, 2
cmovae ecx, eax
setb al
xor r9d, r9d
cmp r14, rsi
setne r9b
mov r8d, 0xff
cmovae r8d, r9d
test r8b, r8b
jne 0x140002538
cmp edi, ebx
setne r8b
jb 0x1400025d7
cmp r8b, 1
jne 0x1400025d7
mov r8, r14
sub r8, rsi
jb 0x140002746
cmp edi, ebx
jae 0x140002573
test r8, r8
je 0x140002746
dec r8
lea r9d, [rdi + 0x3b9aca00]
sub r9d, ebx
cmp r9d, 0x3b9aca00
jae 0x140002582
jmp 0x1400025a7
mov r9d, edi
sub r9d, ebx
cmp r9d, 0x3b9aca00
jb 0x1400025a7
mov r10d, r9d
shr r10d, 9
imul r10, r10, 0x44b83
shr r10, 0x27
add r8, r10
jb 0x140002746
imul r10d, r10d, 0x3b9aca00
sub r9d, r10d
mov dl, al
xor eax, eax
cmp r8, rdx
setne al
mov edx, 0xff
cmovb eax, edx
xor r8d, r8d
cmp r9d, ecx
setne r8b
cmovb r8d, edx
test al, al
cmovne r8d, eax
cmp r8b, 1
jne 0x140002748
cmp rsi, r14
jb 0x140002748
sub rsi, r14
cmp ebx, edi
jae 0x1400025f9
test rsi, rsi
je 0x140002748
dec rsi
add ebx, 0x3b9aca00
sub ebx, edi
cmp ebx, 0x3b9aca00
jb 0x14000261a
shr ebx, 9
imul rax, rbx, 0x44b83
shr rax, 0x27
add rsi, rax
jb 0x140002746
cmp rsi, 0x19
jb 0x140002748
lea rcx, [rsp + 0x80]
call fcn.140049f50
cmp byte [rsp + 0x80], 0x12
jne 0x140002746
call fcn.1400353a0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0xf0], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea rdx, [rsp + 0xf0]
mov rcx, rax
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x48]
mov rcx, rax
mov edx, 7
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 0x1f
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x80]
mov rcx, rax
mov edx, 0x1e
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [rsp + 0xf0], 0
jne 0x140002748
cmp qword [rsp + 0x48], 0
jne 0x140002748
cmp dword [rsp + 0x30], 0
je 0x140002748
cmp qword [rsp + 0x80], 0
jne 0x140002748
mov ecx, 0x80000001
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call fcn.140002760
movaps xmm6, xmmword [rsp + 0x170]
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
call fcn.140030440
call qword [sym.imp.KERNEL32.dll_GetLastError]
ud2