Function at 0x140011177
Capabilities:
Check for time delay via queryperformancecounter
Contain obfuscated stackstrings
Resume thread
Suspend thread

Disassembly:
jmp 0x140018560
push rbp
push rdi
sub rsp, 0x868
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x17e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x820], rax
lea rcx, [0x1400270fa]
call fcn.1400114f1
lea rax, [rbp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rbp + 0x90], 0x100003
xor eax, eax
cmp eax, 1
je 0x140018868
mov rcx, qword [0x140021498]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rbp + 0x90], 0x10001f
lea rdx, [rbp + 0x60]
mov rcx, qword [0x140021498]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov byte [rbp + 0x548], 0x48
mov byte [rbp + 0x549], 0x85
mov byte [rbp + 0x54a], 0xc9
mov byte [rbp + 0x54b], 0x74
mov byte [rbp + 0x54c], 0xd
mov byte [rbp + 0x54d], pe_nt_image_headers64
mov byte [rbp + 0x54e], 0xf5
mov byte [rbp + 0x54f], 0x34
mov byte [rbp + 0x550], 0x98
mov byte [rbp + 0x551], 0xff
mov byte [rbp + 0x552], 0x4c
mov byte [rbp + 0x553], 0x8b
mov byte [rbp + 0x554], 0xf0
mov byte [rbp + 0x555], 0xeb
mov byte [rbp + 0x556], 3
mov byte [rbp + 0x557], 0x4d
mov byte [rbp + 0x558], 0x8b
mov byte [rbp + 0x559], 0xf5
mov byte [rbp + 0x55a], 0x4d
mov byte [rbp + 0x55b], 0x85
mov byte [rbp + 0x55c], 0xf6
mov byte [rbp + 0x55d], 0x74
mov byte [rbp + 0x55e], 0x7f
mov byte [rbp + 0x55f], 0x49
mov qword [rsp + 0x20], 0
mov r9d, 0x18
lea r8, [rbp + 0x578]
mov rdx, qword [rbp + 0x158]
mov rcx, qword [0x140021490]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r8d, 5
lea rdx, [rbp + 0x578]
lea rcx, [rbp + 0x548]
call fcn.1400111f9
test eax, eax
jne 0x1400186e5
mov dword [rbp + 0x814], 1
jmp 0x1400186ef
mov dword [rbp + 0x814], 0
lea rax, [rbp + 0x582]
lea rcx, [rbp + 0x552]
mov r8d, 0xe
mov rdx, rax
call fcn.1400111f9
test eax, eax
jne 0x14001871b
mov dword [rbp + 0x818], 1
jmp 0x140018725
mov dword [rbp + 0x818], 0
mov eax, dword [rbp + 0x818]
mov ecx, dword [rbp + 0x814]
and ecx, eax
mov eax, ecx
test eax, eax
je 0x1400187fd
mov rax, qword [rbp + 0xe0]
add rax, 0x48
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rbp + 0x38]
mov rdx, rax
mov rcx, qword [0x140021490]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x20], 0
mov r9d, 0xa
lea r8, [rbp + 8]
mov rdx, qword [rbp + 0x38]
mov rcx, qword [0x140021490]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [rbp + 8]
lea rcx, str.Workspace
call fcn.140011573
test eax, eax
jne 0x1400187fd
lea rdx, str.Found_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400110a0
lea rdx, [0x1400114a6]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rbp + 0xe0]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14001d3f8]
mov rcx, rax
call fcn.1400110a0
mov rcx, qword [0x140021498]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rbp + 0xe0]
jmp 0x140018868
mov rcx, qword [0x140021498]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov qword [rbp + 0x5a8], 0
mov qword [rbp + 0x5c8], 0
lea rcx, [rbp + 0x5a8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rbp + 0x5c8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x5a8]
mov rcx, qword [rbp + 0x5c8]
sub rcx, rax
mov rax, rcx
cmp rax, 0x3c
jae 0x140018863
lea rcx, [rbp + 0x5c8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x14001883a
jmp 0x1400185b7
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001cec0]
call fcn.140011456
mov rax, rdi
mov rcx, qword [rbp + 0x820]
xor rcx, rbp
call fcn.14001128a
lea rsp, [rbp + 0x838]
pop rdi
pop rbp
ret