Function at 0x140038090
Capabilities:
Enumerate gui resources
Hide thread from debugger
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x420]
sub rsp, 0x520
lea rcx, str.niggerfnjkjkhawaitjkagainimeantitlol
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
call fcn.140031e40
test al, al
je 0x14003814f
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov ecx, Ordinal_50
call fcn.14004d6f4
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_33]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [str.Virtual_Machines_are_not_allowed_]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x140131980]
movups xmmword [rax + 0x10], xmm0
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], 0
lea rcx, [rsp + 0x20]
call fcn.1400324a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14003814f
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003814a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038605
call fcn.14004d314
xor edx, edx
lea rcx, [0x1400327b0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x1401326e0]
mov dword [rbp + 0x430], eax
movzx eax, word [0x1401326e4]
mov word [rbp + 0x434], ax
mov byte [rbp + 0x430], reloc.WLDAP32.dll_Ordinal_46
xor byte [rbp + 0x431], 0x37
xor byte [rbp + 0x432], 0x38
xor byte [rbp + 0x433], 0x39
xor byte [rbp + 0x434], 0x3a
xor byte [rbp + 0x435], 0x3b
lea rcx, [rbp + 0x430]
call fcn.1400342e0
test al, al
jne 0x140038633
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140038633
call fcn.140037a90
call fcn.140037a70
call fcn.140037a40
call fcn.140037870
lea rcx, [0x140131928]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140038225
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140038225
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
call fcn.140037700
call fcn.1400377c0
call fcn.140031c60
call fcn.140032600
call fcn.140034530
call fcn.1400376e0
call fcn.140037370
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400382db
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14004d6f4
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_recvfrom]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [str.Debugger_Detected]
movups xmmword [rax], xmm1
movzx ecx, byte [0x140131a48]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
lea rcx, [rsp + 0x20]
call fcn.1400324a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400382db
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400382d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038605
call fcn.14004d314
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x80], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp qword [rbp - 0x68], 0
jne 0x140038332
cmp qword [rbp - 0x60], 0
jne 0x140038332
cmp qword [rbp - 0x58], 0
jne 0x140038332
cmp qword [rbp - 0x50], 0
jne 0x140038332
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400383b6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14004d6f4
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_sendto]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [str.Check_failed._Reopen]
movups xmmword [rax], xmm1
mov ecx, dword [0x140131a60]
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], 0
lea rcx, [rsp + 0x20]
call fcn.1400324a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400383b6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400383b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038605
call fcn.14004d314
lea rcx, [0x140131488]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
test eax, eax
je 0x140038479
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14004d6f4
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_select]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [str.Debugging_Detected]
movups xmmword [rax], xmm1
movzx ecx, word [0x140131920]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0
lea rcx, [rsp + 0x20]
call fcn.1400324a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140038479
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038474
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038605
call fcn.14004d314
xor ebx, ebx
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x80], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400384d5
cmp qword [rbp - 0x68], rbx
jne 0x1400384d0
cmp qword [rbp - 0x60], rbx
jne 0x1400384d0
cmp qword [rbp - 0x58], rbx
jne 0x1400384d0
cmp qword [rbp - 0x50], rbx
jne 0x1400384d0
cmp qword [rbp - 0x48], rbx
jne 0x1400384d0
cmp qword [rbp - 0x40], rbx
je 0x1400384d5
mov ebx, 1
test ebx, ebx
je 0x140038563
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14004d6f4
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_select]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [str.Debugging_Detected]
movups xmmword [rax], xmm1
movzx ecx, word [0x140131920]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0
lea rcx, [rsp + 0x20]
call fcn.1400324a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140038563
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003855e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038605
call fcn.14004d314
call fcn.1400374c0
test eax, eax
je 0x140038611
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov ecx, Ordinal_50
call fcn.14004d6f4
mov rdx, rax
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_35]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [str.Debugger_Detected._Restart_computer]
movups xmmword [rax], xmm1
movups xmm0, xmmword [0x140131a78]
movups xmmword [rax + 0x10], xmm0
movzx ecx, word [0x140131a88]
mov word [rax + 0x20], cx
movzx eax, byte [0x140131a8a]
mov byte [rdx + 0x22], al
mov byte [rdx + 0x23], 0
lea rcx, [rsp + 0x20]
call fcn.1400324a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140038611
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003860c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003860c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d314
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x538]
add rsp, 0x520
pop rbp
jmp qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3