Function at 0x140058fb0
Capabilities:
Check for debugger via api
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x430]
sub rsp, 0x530
mov rax, qword [0x1400d5180]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x30], 1
je 0x140059243
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x70], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140059057
cmp qword [rbp - 0x78], 0
jne 0x140059243
cmp qword [rbp - 0x70], 0
jne 0x140059243
cmp qword [rbp - 0x68], 0
jne 0x140059243
cmp qword [rbp - 0x60], 0
jne 0x140059243
lea rcx, [rsp + 0x20]
call fcn.140008260
lea rcx, [rsp + 0x30]
call fcn.140008260
mov rax, qword [rsp + 0x30]
sub rax, qword [rsp + 0x20]
cmp rax, 0x6052340
jge 0x140059243
mov qword [rsp + 0x540], rbx
mov al, 0x59
mov qword [rsp + 0x548], rsi
movzx r9d, al
mov qword [rsp + 0x550], rdi
xor al, 0x15
xor r9b, 0x15
mov qword [rsp + 0x558], r12
mov qword [rsp + 0x528], r14
mov dl, reloc.WS2_32.dll_WSACleanup
mov qword [rsp + 0x520], r15
movzx edi, dl
xor dl, 0x15
mov byte [rsp + 0x31], al
xor dil, 0x15
mov byte [rsp + 0x33], dl
mov bl, 0x67
mov byte [rsp + 0x35], r9b
movzx esi, bl
mov byte [rsp + 0x39], dil
xor bl, 0x15
mov byte [rsp + 0x30], reloc.WS2_32.dll_setsockopt
xor sil, 0x15
mov byte [rsp + 0x38], bl
mov byte [rsp + 0x3a], sil
xor r12d, r12d
mov cl, 0x7a
mov byte [rsp + 0x3d], r12b
xor cl, 0x15
mov byte [rsp + 0x20], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x32], cl
mov r10b, 0x7c
xor r10b, 0x15
mov cl, reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x36], r10b
movzx r9d, cl
mov r10b, 0x7a
xor cl, 0x16
xor r9b, 0x16
mov byte [rsp + 0x22], cl
mov r14b, 0x6c
mov byte [rsp + 0x25], r9b
xor r14b, 0x15
mov r8b, WSAStartup
xor r8b, 0x15
mov byte [rsp + 0x3b], r14b
mov byte [rsp + 0x34], r8b
movzx r14d, r10b
xor r14b, 0x16
mov r11b, 0x77
xor r11b, 0x15
mov byte [rsp + 0x2b], r14b
mov byte [rsp + 0x37], r11b
mov r15b, 0x54
xor r15b, 0x15
mov al, 0x7d
mov byte [rsp + 0x3c], r15b
xor al, 0x16
movzx r15d, r10b
mov byte [rsp + 0x21], al
xor r10b, 0x16
mov dl, 0x64
xor dl, 0x16
mov byte [rsp + 0x26], r10b
mov r8b, 0x78
mov byte [rsp + 0x23], dl
xor r8b, 0x16
mov r11b, 0x25
xor r11b, 0x16
mov byte [rsp + 0x24], r8b
mov bl, 0x24
mov byte [rsp + 0x27], r11b
xor bl, 0x16
mov dil, 0x38
xor dil, 0x16
mov byte [rsp + 0x28], bl
mov sil, WSACleanup
mov byte [rsp + 0x29], dil
xor sil, 0x16
xor r15b, 0x16
mov byte [rsp + 0x2a], sil
lea rcx, [rsp + 0x21]
mov byte [rsp + 0x2c], r15b
mov byte [rsp + 0x2d], r12b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x31]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, qword [rsp + 0x520]
mov r14, qword [rsp + 0x528]
mov r12, qword [rsp + 0x558]
mov rdi, qword [rsp + 0x550]
mov rsi, qword [rsp + 0x548]
mov rbx, qword [rsp + 0x540]
test rax, rax
je 0x140059243
cmp qword [sym.imp.KERNEL32.dll_LoadLibraryA], rax
jne 0x140059243
mov al, 1
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.1400a7140
add rsp, 0x530
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3