Function at 0x401fc0
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x409040]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 4]
push edi
push eax
xor edi, edi
push 8
mov dword [esp + 0x10], edi
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4021b9
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esp + 0x14]
push eax
push 0x14
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [esp + 8]
test eax, eax
cmovne edi, dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4021b9
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40203b
int3
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [esp + 8], 0
jne 0x4020c4
push str.NtQueryInformationProcess
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4020bb
push 0
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 7
call esi
push eax
call edi
test eax, eax
js 0x402098
cmp dword [esp + 0x10], 0
jne 0x4020c4
push 0
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0x1f
call esi
push eax
call edi
test eax, eax
js 0x4020bb
cmp dword [esp + 0xc], 0
je 0x4020c4
call fcn.004012c0
test al, al
je 0x4020ce
mov dword [0], 0x2a
push 0x40631c
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40211c
cmp eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
je 0x40211c
push 0x4036e0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.API_hook_detected_on_CreateFileW_
call fcn.004034c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov dword [0], 0x2a
mov esi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
call esi
test al, 1
jne 0x402149
push 0x4036e0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Performing_system_diagnostics...
call fcn.004034c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
call esi
test al, 1
jne 0x402170
push 0x4036e0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Starting_network_analysis_module...
call fcn.004034c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
call esi
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x40219f
push 0x4036e0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Running_malware_scanner...
call fcn.004034c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
call fcn.004018b0
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0040403f
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x14]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.0040403f
mov esp, ebp
pop ebp
ret 0x10