Function at 0x1400038f0
Capabilities:
Access peb ldr_data
Block operations on executable memory pages using arbitrary code guard
Check for debugger via api
Check for time delay via queryperformancecounter
Get ntdll base address
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x430]
sub rsp, 0x530
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x420], rax
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140003934
call fcn.140001940
mov ecx, 0x1002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140003bf0
test eax, eax
je 0x14000394e
call fcn.140001940
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140003c07
test eax, eax
je 0x140003968
call fcn.140001940
mov ecx, 0x1003
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x20], 0
je 0x14000399c
call fcn.140001940
mov ecx, 0x1001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140003080
mov rcx, qword [rbx + 8]
call fcn.1400034f0
call fcn.140001c70
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, [rsp + 0x50]
mov dword [rbp - 0x80], 0x100010
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140003a1b
cmp qword [rbp - 0x68], 0
jne 0x140003a0a
cmp qword [rbp - 0x60], 0
jne 0x140003a0a
cmp qword [rbp - 0x58], 0
jne 0x140003a0a
cmp qword [rbp - 0x50], 0
jne 0x140003a0a
cmp qword [rbp - 0x48], 0
jne 0x140003a0a
cmp qword [rbp - 0x40], 0
je 0x140003a1b
call fcn.140001940
mov ecx, 0x2000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
call fcn.140003c3d
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
shl rcx, 0x20
or rcx, qword [rsp + 0x40]
shl rax, 0x20
or rax, qword [rsp + 0x30]
sub rcx, rax
cmp rcx, 0x100000
jbe 0x140003a6b
call fcn.140001940
mov ecx, 0x3000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call fcn.140003c1f
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
sub rax, qword [rsp + 0x28]
cmp rax, 0x1e
jle 0x140003aa7
call fcn.140001940
mov ecx, 0x3001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
call fcn.140003c2e
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, ebx
cmp eax, 0x1e
jbe 0x140003ad3
call fcn.140001940
mov ecx, 0x3002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8d, 4
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x20]
lea ecx, [r8 + 4]
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
call fcn.140001a60
call fcn.140003280
call fcn.140002810
call fcn.140002bd0
call fcn.140002590
xor ecx, ecx
mov eax, 0x40000000
cpuid
mov r10d, ecx
mov r8d, eax
xor ecx, ecx
mov r9d, edx
mov r11d, ebx
mov eax, 1
cpuid
xor ecx, ecx
cpuid
cmp eax, r8d
jne 0x140003b5b
cmp ebx, r11d
jne 0x140003b5b
cmp ecx, r10d
jne 0x140003b5b
cmp edx, r9d
je 0x140003b60
call fcn.140001940
xor ecx, ecx
mov eax, 0x4201337
cpuid
mov r8d, eax
mov r10d, ecx
xor ecx, ecx
mov eax, 0x40000000
mov r9d, edx
mov r11d, ebx
cpuid
cmp r8d, eax
jne 0x140003b92
cmp r11d, ebx
jne 0x140003b92
cmp r10d, ecx
jne 0x140003b92
cmp r9d, edx
je 0x140003b97
call fcn.140001940
call fcn.140002e30
lea rcx, str.known_username_n
call fcn.140003890
lea rcx, str.known_hostname_n
call fcn.140003890
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor eax, eax
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.140003ca0
mov rbx, qword [rsp + 0x540]
add rsp, 0x530
pop rbp
ret