Function at 0x140002830
Capabilities:
Check for debugger via api

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov r14, r8
mov r15, rdx
mov r12d, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ecx, ecx
call rsi
mov rbp, rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rdi
lea r8, [rsp + 0x38]
mov rcx, rax
mov rdx, rbp
mov r9d, 0x18
call sub.PSAPI.DLL_GetModuleInformation
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebp, eax
mov dword [rsp + 0x30], 0
call rdi
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ebx, dword [rsp + 0x30]
lea rcx, [0x140006241]
call rsi
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
call rdi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 7
mov r9d, 8
call rsi
test eax, eax
setns al
cmp qword [rsp + 0x30], 0
setne cl
or ebx, ebp
jne 0x140002abe
and al, cl
jne 0x140002abe
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebp, eax
mov dword [rsp + 0x30], 0
call rdi
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ebx, dword [rsp + 0x30]
lea rcx, [0x140006241]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
call rdi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 7
mov r9d, 8
call rsi
test eax, eax
setns al
cmp qword [rsp + 0x30], 0
setne cl
or ebx, ebp
jne 0x140002abe
and al, cl
jne 0x140002abe
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebp, eax
mov dword [rsp + 0x30], 0
call rdi
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ebx, dword [rsp + 0x30]
lea rcx, [0x140006241]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
call rdi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 7
mov r9d, 8
call rsi
test eax, eax
setns al
cmp qword [rsp + 0x30], 0
setne cl
or ebx, ebp
jne 0x140002abe
and al, cl
jne 0x140002abe
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebp, eax
mov dword [rsp + 0x30], 0
call rdi
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ebx, dword [rsp + 0x30]
lea rcx, [0x140006241]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
call rdi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 7
mov r9d, 8
call rsi
test eax, eax
setns al
cmp qword [rsp + 0x30], 0
setne cl
or ebx, ebp
jne 0x140002abe
and al, cl
jne 0x140002abe
mov rcx, qword [rsp + 0x38]
add rcx, qword [0x140009028]
mov edx, r12d
mov r8, r15
mov r9, r14
call fcn.140002160
nop
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 0x1f5
call sub.msvcrt.dll_exit
int3