Function at 0x1400014f0
Capabilities:
Block operations on executable memory pages using arbitrary code guard
Check for debugger via api
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Check mutex and terminate process on windows
Check mutex on windows
Create a process with modified i/o handles and window
Create process on windows
Enumerate processes
Hide thread from debugger
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8e0]
sub rsp, 0x9e0
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x8d0], rax
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140001552
mov ecx, 0x1002
lea rdx, str.Caught_by_IsDebuggerPresent_
call fcn.1400010d0
mov ecx, 0x1002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140002c80
test eax, eax
je 0x140001578
mov ecx, 0x1000
lea rdx, str.Caught_by_BeingDebugged_PEB_check_
call fcn.1400010d0
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140002c97
test eax, eax
je 0x14000159e
mov ecx, 0x1003
lea rdx, str.Caught_by_NtGlobalFlag_PEB_check_
call fcn.1400010d0
mov ecx, 0x1003
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r12d, r12d
mov dword [rbp + 0xf0], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0xf0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0xf0], r12d
je 0x1400015e4
mov ecx, 0x1001
lea rdx, str.Caught_by_CheckRemoteDebuggerPresent_
call fcn.1400010d0
mov ecx, 0x1001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
mov dword [rbp + 0xf0], r12d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000168b
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000168b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x30
lea r8, [rbp + 0xc0]
xor edx, edx
mov rcx, rax
call rbx
test eax, eax
js 0x14000168b
mov rax, qword [rbp + 0xc8]
test rax, rax
je 0x14000168b
cmp byte [rax + 2], r12b
je 0x14000168b
mov ecx, 0x1004
lea rdx, str.Caught_by_NtQueryInformationProcess__ProcessDebugPort__
call fcn.1400010d0
mov ecx, 0x1004
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
lea rcx, str.OLLYDBG
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
xor edx, edx
lea rcx, [0x140004668]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140001fd9
test rbx, rbx
jne 0x140001fd9
lea rdx, str.OllyDbg____CPU_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
lea rdx, str.Immunity_Debugger____CPU_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140001fbc
test rbx, rbx
jne 0x140001fbc
lea rax, str.cheatengine_x86_64.exe
mov qword [rbp + 0x660], rax
lea rax, str.ollydbg.exe
mov qword [rbp + 0x668], rax
lea rax, str.ida.exe
mov qword [rbp + 0x670], rax
lea rax, str.ida64.exe
mov qword [rbp + 0x678], rax
lea rax, str.radare2.exe
mov qword [rbp + 0x680], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x688], rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x194]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x690], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x694]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x190]
lea rax, [rbp + 0x690]
lea edx, [rbx + 4]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400017a0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
lea rdx, [rbp + 0x190]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140001832
lea rcx, str._Warning__It_is_impossible_to_check_process_list.
call fcn.140001010
jmp 0x14000187c
lea rbx, [rbp + 0x660]
nop dword [rax]
lea rdx, [rbp + 0x1bc]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140001f9f
add rbx, 8
lea rax, [rbp + 0x690]
cmp rbx, rax
jne 0x140001840
lea rdx, [rbp + 0x190]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001832
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400018c9
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400018c9
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
mov rbx, qword [rsi + 8]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x124], xmm0
movups xmmword [rbp + 0x134], xmm0
movups xmmword [rbp + 0x144], xmm0
movups xmmword [rbp + 0x154], xmm0
movups xmmword [rbp + 0x164], xmm0
movups xmmword [rbp + 0x174], xmm0
mov dword [rbp + 0x184], eax
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rax
mov dword [rbp + 0x120], 0x68
mov dword [rbp + 0xf0], r12d
lea r8, str.antidbg
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140001961
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
jne 0x140001a5e
mov ecx, 0x22b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov r8d, 0x104
lea rdx, [rbp + 0x190]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x20], ebx
lea r9, [rbp + 0x190]
lea r8, str._ws__d
mov edx, 0x109
lea rcx, [rbp + 0x690]
call fcn.140001070
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x690]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0xf0]
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0xa0]
cmp dword [rbp + 0xf0], 0x22b
jne 0x140001a4b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1008
lea rdx, str.Caught_by_DebugActiveProcess_
call fcn.1400010d0
mov ecx, 0x1008
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rbp + 0x190]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [rbp + 0x1c0], 0x100010
lea rdx, [rbp + 0x190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140001ae9
cmp qword [rbp + 0x1d8], r12
jne 0x140001acc
cmp qword [rbp + 0x1e0], r12
jne 0x140001acc
cmp qword [rbp + 0x1e8], r12
jne 0x140001acc
cmp qword [rbp + 0x1f0], r12
jne 0x140001acc
cmp qword [rbp + 0x1f8], r12
jne 0x140001acc
cmp qword [rbp + 0x200], r12
je 0x140001ae9
mov ecx, 0x2000
lea rdx, str.Caught_by_a_Hardware_Debug_Register_Check_
call fcn.1400010d0
mov ecx, 0x2000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
lea rcx, [rbp + 0xc0]
call fcn.140002ccd
mov rcx, qword [rbp + 0xc0]
shl rcx, 0x20
or rcx, qword [rbp + 0xc8]
mov rax, qword [rbp + 0xd0]
shl rax, 0x20
or rax, qword [rbp + 0xd8]
sub rax, rcx
cmp rax, 0x100000
jbe 0x140001b52
mov ecx, 0x3000
lea rdx, str.Caught_by_RDTSC_
call fcn.1400010d0
mov ecx, 0x3000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call fcn.140002caf
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0xf0]
sub rax, qword [rbp + 0x110]
cmp rax, 0x1e
jle 0x140001ba2
mov ecx, 0x3001
lea rdx, str.Caught_by_QueryPerformanceCounter_
call fcn.1400010d0
mov ecx, 0x3001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call fcn.140002cbe
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1e
jbe 0x140001bd9
mov ecx, 0x3002
lea rdx, str.Caught_by_GetTickCount_
call fcn.1400010d0
mov ecx, 0x3002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140001110
mov dword [rbp + 0xf0], 1
mov r8d, 4
lea rdx, [rbp + 0xf0]
lea ecx, [r8 + 4]
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
lea rdx, str.Passed_anti_debug
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002180
lea rdx, [0x140002350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
lea rax, str.check_highest_low_function_leaf
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 0x1f
lea rcx, vtable.std::_Func_impl_no_alloc_bool____cdecl___void___bool___.0
mov qword [rbp - 0x60], rcx
lea rax, [0x140001320]
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x28], rax
lea rax, str.check_invalid_leaf
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x12
mov qword [rbp - 0x10], rcx
lea rax, [0x1400012d0]
mov qword [rbp - 8], rax
lea rax, [rbp - 0x10]
mov qword [rbp + 0x28], rax
lea rax, str.check_for_known_hypervisor_vendors
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 0x22
mov qword [rbp + 0x40], rcx
lea rax, [0x140001370]
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], r12
mov ecx, 0x70
call fcn.140002d50
mov r15, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x100], rax
lea rdi, [rbp - 0x70]
movabs r13, 0x249249249249249
mov r9, rdi
mov r8, r15
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x100]
call fcn.140002860
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
movsd xmm0, qword [rax + 0x10]
movsd qword [rbp + 0x90], xmm0
cmp byte [rbp + 0x90], 0
jne 0x140001dd3
cmp qword [rbp + 0x108], r13
je 0x140001ff6
mov r14, qword [rbp + 0x100]
lea rax, [rbp + 0x100]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], r12
mov ecx, 0x70
call fcn.140002d50
mov rbx, rax
mov qword [rbp + 0xf8], rax
movups xmm0, xmmword [rdi]
movups xmmword [rax + 0x20], xmm0
lea rsi, [rax + 0x30]
mov qword [rbp + 0x110], rsi
mov qword [rsi + 0x38], r12
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140001d97
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax]
mov qword [rsi + 0x38], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov word [rbx + 0x18], 0
mov qword [rbp + 0xf8], r12
movups xmm0, xmmword [rbp + 0xa0]
movaps xmmword [rbp + 0xa0], xmm0
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x100]
call fcn.1400025e0
add rdi, 0x50
lea rax, [rbp + 0x80]
cmp rdi, rax
jne 0x140001cf2
lea r9, [0x140002000]
mov edx, 0x50
lea r8d, [rdx - 0x4d]
lea rcx, [rbp - 0x70]
call fcn.140002d8c
mov rbx, qword [rbp + 0x100]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x140001f29
lea rax, [rsp + 0x50]
mov qword [rbp + 0x110], rax
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rbp + 0xa0], xmm0
lea rax, [rsp + 0x50]
mov qword [rbp + 0xf0], rax
mov rax, r12
mov qword [rbp - 0x78], rax
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x140001e55
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140001f98
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test al, al
lea rdx, str.Detected
jne 0x140001e80
lea rdx, str.Passed
call fcn.140002180
movups xmm1, xmmword [rbp + 0xa0]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r8, xmm0
movq rdx, xmm1
mov rcx, rax
call fcn.140002390
lea rdx, [0x140002350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140001ed2
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140001efe
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140001ef9
cmp rbx, qword [rax + 0x10]
jne 0x140001ef9
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140001ee6
mov rbx, rax
jmp 0x140001f1f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140001f1f
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140001f10
cmp byte [rbx + 0x19], 0
je 0x140001e20
lea rdx, str.Passed_anti_vm
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002180
lea rdx, [0x140002350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
lea rcx, [rbp + 0x100]
call fcn.140002070
xor eax, eax
mov rcx, qword [rbp + 0x8d0]
xor rcx, rsp
call fcn.140002d30
lea r11, [rsp + 0x9e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
nop
mov ecx, 0x1009
lea rdx, str.Caught_by_ProcessFileName_
call fcn.1400010d0
mov ecx, 0x1009
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0x1005
lea rdx, str.Caught_by_FindWindow__WindowName__
call fcn.1400010d0
mov ecx, 0x1005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0x1005
lea rdx, str.Caught_by_FindWindow__ClassName__
call fcn.1400010d0
mov ecx, 0x1005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.1400012b0
int3