Function at 0x140786ab0
Capabilities:
Check for debugger via api
Hide thread from debugger

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14084b080]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, str.GEORGEFLOYD
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
call fcn.140783860
test al, al
jne 0x140786cf0
call fcn.140786790
call fcn.140786770
call fcn.140786740
call fcn.140786640
lea rcx, [0x140825848]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140786b47
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140786b47
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
mov dword [rbp - 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp - 0x10], 0
jne 0x140786d0b
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140786d26
call fcn.14079cac0
call fcn.140783660
call fcn.140783a30
call fcn.140783ca0
call fcn.140786620
call fcn.140786240
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140786d41
call fcn.140786570
test al, al
jne 0x140786d5c
lea rcx, [0x140825848]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
test eax, eax
jne 0x140786d77
call fcn.140783be0
test eax, eax
jne 0x140786d92
call fcn.140786330
test eax, eax
jne 0x140786cd5
lea rcx, [rbp - 0x10]
call fcn.140783550
movabs rax, 0x7fffffffc46535ff
mov rbx, qword [rbp - 0x10]
cmp rbx, rax
jge 0x140786c2e
add rbx, 0x3b9aca00
jmp 0x140786c38
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp - 0x10]
call fcn.140783550
mov rax, qword [rbp - 0x10]
cmp rax, rbx
jge 0x140786cae
movabs rdi, 0x4e94914f0000
movabs rsi, 0x431bde82d7b634db
nop
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jl 0x140786c72
mov ecx, 0x5265c00
jmp 0x140786c97
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140786c95
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp - 0x10]
call fcn.140783550
mov rax, qword [rbp - 0x10]
cmp rax, rbx
jl 0x140786c60
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14080fdb0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
lea rdx, str.Debugger_Detected._Restart_computer
lea rcx, [rbp - 0x30]
call fcn.140797230
nop
lea rcx, [rbp - 0x30]
call fcn.1407839b0
nop
lea rdx, str.Virtual_Machines_are_not_allowed_
lea rcx, [rbp - 0x30]
call fcn.140797230
nop
lea rcx, [rbp - 0x30]
call fcn.1407839b0
nop
lea rdx, str.Debugging_Detected
lea rcx, [rbp - 0x30]
call fcn.140797230
nop
lea rcx, [rbp - 0x30]
call fcn.1407839b0
nop
lea rdx, str.Debugging_Detected
lea rcx, [rbp - 0x30]
call fcn.140797230
nop
lea rcx, [rbp - 0x30]
call fcn.1407839b0
nop
lea rdx, str.Debugger_Detected
lea rcx, [rbp - 0x30]
call fcn.140797230
nop
lea rcx, [rbp - 0x30]
call fcn.1407839b0
nop
lea rdx, str.Check_failed._Reopen
lea rcx, [rbp - 0x30]
call fcn.140797230
nop
lea rcx, [rbp - 0x30]
call fcn.1407839b0
nop
lea rdx, str.Debugging_Detected
lea rcx, [rbp - 0x30]
call fcn.140797230
nop
lea rcx, [rbp - 0x30]
call fcn.1407839b0
nop
lea rdx, str.Debugging_Detected
lea rcx, [rbp - 0x30]
call fcn.140797230
nop
lea rcx, [rbp - 0x30]
call fcn.1407839b0
int3