Function at 0x140001620
Capabilities:
Check for debugger via api
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Enumerate processes
Hide thread from debugger
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8e0]
sub rsp, 0x9e0
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x8d0], rax
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140001682
mov ecx, 0x1002
lea rdx, str.Caught_by_IsDebuggerPresent_
call fcn.1400010d0
mov ecx, 0x1002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140002da0
test eax, eax
je 0x1400016a8
mov ecx, 0x1000
lea rdx, str.Caught_by_BeingDebugged_PEB_check_
call fcn.1400010d0
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140002db7
test eax, eax
je 0x1400016ce
mov ecx, 0x1003
lea rdx, str.Caught_by_NtGlobalFlag_PEB_check_
call fcn.1400010d0
mov ecx, 0x1003
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r12d, r12d
mov dword [rbp + 0xf0], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0xf0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0xf0], r12d
je 0x140001714
mov ecx, 0x1001
lea rdx, str.Caught_by_CheckRemoteDebuggerPresent_
call fcn.1400010d0
mov ecx, 0x1001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
mov dword [rbp + 0xf0], r12d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400017bb
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400017bb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x30
lea r8, [rbp + 0xc0]
xor edx, edx
mov rcx, rax
call rbx
test eax, eax
js 0x1400017bb
mov rax, qword [rbp + 0xc8]
test rax, rax
je 0x1400017bb
cmp byte [rax + 2], r12b
je 0x1400017bb
mov ecx, 0x1004
lea rdx, str.Caught_by_NtQueryInformationProcess__ProcessDebugPort__
call fcn.1400010d0
mov ecx, 0x1004
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
lea rcx, str.OLLYDBG
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
xor edx, edx
lea rcx, [0x140004658]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140002109
test rbx, rbx
jne 0x140002109
lea rdx, str.OllyDbg____CPU_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
lea rdx, str.Immunity_Debugger____CPU_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x1400020ec
test rbx, rbx
jne 0x1400020ec
lea rax, str.cheatengine_x86_64.exe
mov qword [rbp + 0x660], rax
lea rax, str.ollydbg.exe
mov qword [rbp + 0x668], rax
lea rax, str.ida.exe
mov qword [rbp + 0x670], rax
lea rax, str.ida64.exe
mov qword [rbp + 0x678], rax
lea rax, str.radare2.exe
mov qword [rbp + 0x680], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x688], rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x194]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x690], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x694]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x190]
lea rax, [rbp + 0x690]
lea edx, [rbx + 4]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400018d0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
lea rdx, [rbp + 0x190]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140001962
lea rcx, str._Warning__It_is_impossible_to_check_process_list.
call fcn.140001010
jmp 0x1400019ac
lea rbx, [rbp + 0x660]
nop dword [rax]
lea rdx, [rbp + 0x1bc]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400020cf
add rbx, 8
lea rax, [rbp + 0x690]
cmp rbx, rax
jne 0x140001970
lea rdx, [rbp + 0x190]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001962
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400019f9
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400019f9
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
mov rbx, qword [rsi + 8]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x124], xmm0
movups xmmword [rbp + 0x134], xmm0
movups xmmword [rbp + 0x144], xmm0
movups xmmword [rbp + 0x154], xmm0
movups xmmword [rbp + 0x164], xmm0
movups xmmword [rbp + 0x174], xmm0
mov dword [rbp + 0x184], eax
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rax
mov dword [rbp + 0x120], 0x68
mov dword [rbp + 0xf0], r12d
lea r8, str.antidbg
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140001a91
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
jne 0x140001b8e
mov ecx, 0x22b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov r8d, 0x104
lea rdx, [rbp + 0x190]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x20], ebx
lea r9, [rbp + 0x190]
lea r8, str._ws__d
mov edx, 0x109
lea rcx, [rbp + 0x690]
call fcn.140001070
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x120]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x690]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0xf0]
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0xa0]
cmp dword [rbp + 0xf0], 0x22b
jne 0x140001b7b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1008
lea rdx, str.Caught_by_DebugActiveProcess_
call fcn.1400010d0
mov ecx, 0x1008
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rbp + 0x190]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [rbp + 0x1c0], 0x100010
lea rdx, [rbp + 0x190]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140001c19
cmp qword [rbp + 0x1d8], r12
jne 0x140001bfc
cmp qword [rbp + 0x1e0], r12
jne 0x140001bfc
cmp qword [rbp + 0x1e8], r12
jne 0x140001bfc
cmp qword [rbp + 0x1f0], r12
jne 0x140001bfc
cmp qword [rbp + 0x1f8], r12
jne 0x140001bfc
cmp qword [rbp + 0x200], r12
je 0x140001c19
mov ecx, 0x2000
lea rdx, str.Caught_by_a_Hardware_Debug_Register_Check_
call fcn.1400010d0
mov ecx, 0x2000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
lea rcx, [rbp + 0xc0]
call fcn.140002ded
mov rcx, qword [rbp + 0xc0]
shl rcx, 0x20
or rcx, qword [rbp + 0xc8]
mov rax, qword [rbp + 0xd0]
shl rax, 0x20
or rax, qword [rbp + 0xd8]
sub rax, rcx
cmp rax, 0x100000
jbe 0x140001c82
mov ecx, 0x3000
lea rdx, str.Caught_by_RDTSC_
call fcn.1400010d0
mov ecx, 0x3000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call fcn.140002dcf
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0xf0]
sub rax, qword [rbp + 0x110]
cmp rax, 0x1e
jle 0x140001cd2
mov ecx, 0x3001
lea rdx, str.Caught_by_QueryPerformanceCounter_
call fcn.1400010d0
mov ecx, 0x3001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call fcn.140002dde
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1e
jbe 0x140001d09
mov ecx, 0x3002
lea rdx, str.Caught_by_GetTickCount_
call fcn.1400010d0
mov ecx, 0x3002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140001110
call fcn.140001160
call fcn.1400011a0
call fcn.140001200
call fcn.1400011e0
call fcn.140001240
lea rdx, str.Passed_Anti_debug
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400022b0
lea rdx, [0x140002480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
lea rax, str.check_highest_low_function_leaf
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 0x1f
lea rcx, vtable.std::_Func_impl_no_alloc_bool____cdecl___void___bool___.0
mov qword [rbp - 0x60], rcx
lea rax, [0x140001450]
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x28], rax
lea rax, str.check_invalid_leaf
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x12
mov qword [rbp - 0x10], rcx
lea rax, [0x140001400]
mov qword [rbp - 8], rax
lea rax, [rbp - 0x10]
mov qword [rbp + 0x28], rax
lea rax, str.check_for_known_hypervisor_vendors
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 0x22
mov qword [rbp + 0x40], rcx
lea rax, [0x1400014a0]
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], r12
mov ecx, 0x70
call fcn.140002e70
mov r15, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x100], rax
lea rdi, [rbp - 0x70]
movabs r13, 0x249249249249249
nop word [rax + rax]
mov r9, rdi
mov r8, r15
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x100]
call fcn.140002990
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
movsd xmm0, qword [rax + 0x10]
movsd qword [rbp + 0x90], xmm0
cmp byte [rbp + 0x90], 0
jne 0x140001f01
cmp qword [rbp + 0x108], r13
je 0x140002126
mov rsi, qword [rbp + 0x100]
lea rax, [rbp + 0x100]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], r12
mov ecx, 0x70
call fcn.140002e70
mov rbx, rax
mov qword [rbp + 0xf8], rax
movups xmm0, xmmword [rdi]
movups xmmword [rax + 0x20], xmm0
lea r14, [rax + 0x30]
mov qword [rbp + 0x110], r14
mov qword [r14 + 0x38], r12
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140001ec5
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [r14 + 0x38], rax
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov word [rbx + 0x18], 0
mov qword [rbp + 0xf8], r12
movups xmm0, xmmword [rbp + 0xa0]
movaps xmmword [rbp + 0xa0], xmm0
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x100]
call fcn.140002710
add rdi, 0x50
lea rax, [rbp + 0x80]
cmp rdi, rax
jne 0x140001e20
lea r9, [0x140002130]
mov edx, 0x50
lea r8d, [rdx - 0x4d]
lea rcx, [rbp - 0x70]
call fcn.140002eac
mov rbx, qword [rbp + 0x100]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x140002059
lea rax, [rsp + 0x50]
mov qword [rbp + 0x110], rax
nop
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rbp + 0xa0], xmm0
lea rax, [rsp + 0x50]
mov qword [rbp + 0xf0], rax
mov rax, r12
mov qword [rbp - 0x78], rax
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x140001f85
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x1400020c8
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test al, al
lea rdx, str.Detected
jne 0x140001fb0
lea rdx, str.Passed
call fcn.1400022b0
movups xmm1, xmmword [rbp + 0xa0]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r8, xmm0
movq rdx, xmm1
mov rcx, rax
call fcn.1400024c0
lea rdx, [0x140002480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140002002
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000202e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140002029
cmp rbx, qword [rax + 0x10]
jne 0x140002029
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140002016
mov rbx, rax
jmp 0x14000204f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000204f
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140002040
cmp byte [rbx + 0x19], 0
je 0x140001f50
lea rdx, str.Passed_anti_vm
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400022b0
lea rdx, [0x140002480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
lea rcx, [rbp + 0x100]
call fcn.1400021a0
xor eax, eax
mov rcx, qword [rbp + 0x8d0]
xor rcx, rsp
call fcn.140002e50
lea r11, [rsp + 0x9e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
nop
mov ecx, 0x1009
lea rdx, str.Caught_by_ProcessFileName_
call fcn.1400010d0
mov ecx, 0x1009
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0x1005
lea rdx, str.Caught_by_FindWindow__WindowName__
call fcn.1400010d0
mov ecx, 0x1005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0x1005
lea rdx, str.Caught_by_FindWindow__ClassName__
call fcn.1400010d0
mov ecx, 0x1005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.1400013e0
int3