Function at 0x140003ea0
Capabilities:
Check for debugger via api
Check for outputdebugstring error
Hide thread from debugger
Print debug messages

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140094080]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140011748
call fcn.1400116f0
call fcn.14001175e
call fcn.1400116f0
call fcn.14001171c
call fcn.140011706
call fcn.14001171c
call fcn.140011706
call fcn.140011732
call fcn.140001e70
test al, al
jne 0x140004089
call fcn.140003c00
call fcn.140003be0
call fcn.140003bb0
call fcn.140003ab0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140003f47
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140003f47
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x40], 0
jne 0x1400040a6
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400040c3
call fcn.140001f40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.ReFo_Security
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.140002300
call fcn.140003a90
call fcn.140003780
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400040e0
call fcn.1400039e0
test al, al
jne 0x1400040fd
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
test eax, eax
jne 0x14000411a
call fcn.140002240
test eax, eax
jne 0x140004137
call fcn.140003870
test eax, eax
jne 0x14000406c
mov qword [rsp + 0x40], 0x3e8
lea rcx, [rsp + 0x40]
call fcn.1400104a0
call fcn.14001175e
call fcn.1400116f0
call fcn.140011748
call fcn.140011706
call fcn.14001171c
call fcn.1400116f0
call fcn.140011732
call fcn.140011706
call fcn.14001171c
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400731c0
add rsp, 0x50
pop rbx
ret
lea rdx, str.Debugger_Detected._Restart_computer
lea rcx, [rsp + 0x20]
call fcn.14000f8a0
nop
lea rcx, [rsp + 0x20]
call fcn.1400021c0
nop
lea rdx, str.Virtual_Machines_are_not_allowed_
lea rcx, [rsp + 0x20]
call fcn.14000f8a0
nop
lea rcx, [rsp + 0x20]
call fcn.1400021c0
nop
lea rdx, str.Debugging_Detected
lea rcx, [rsp + 0x20]
call fcn.14000f8a0
nop
lea rcx, [rsp + 0x20]
call fcn.1400021c0
nop
lea rdx, str.Debugging_Detected
lea rcx, [rsp + 0x20]
call fcn.14000f8a0
nop
lea rcx, [rsp + 0x20]
call fcn.1400021c0
nop
lea rdx, str.Debugger_Detected
lea rcx, [rsp + 0x20]
call fcn.14000f8a0
nop
lea rcx, [rsp + 0x20]
call fcn.1400021c0
nop
lea rdx, str.Check_failed._Reopen
lea rcx, [rsp + 0x20]
call fcn.14000f8a0
nop
lea rcx, [rsp + 0x20]
call fcn.1400021c0
nop
lea rdx, str.Debugging_Detected
lea rcx, [rsp + 0x20]
call fcn.14000f8a0
nop
lea rcx, [rsp + 0x20]
call fcn.1400021c0
nop
lea rdx, str.Debugging_Detected
lea rcx, [rsp + 0x20]
call fcn.14000f8a0
nop
lea rcx, [rsp + 0x20]
call fcn.1400021c0
int3