Function at 0x7ffa134e
Capabilities:
Check for debugger via api
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Execute anti-debugging instructions
Hide thread from debugger

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x7ffa4004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xc0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov dword [ebp - 0x80], eax
lea edi, [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x4c], 0x966fb0fa
stosd dword es:[edi], eax
xor ebx, ebx
pop ecx
mov dword [ebp - 0x48], 0xb62c5d26
mov dword [ebp - 0x44], 0xc06d967d
stosd dword es:[edi], eax
mov dword [ebp - 0x40], 0x4bc122bf
mov dword [ebp - 0x3c], 0x8a25a67
mov dword [ebp - 0x38], 0x8f35867e
stosd dword es:[edi], eax
mov dword [ebp - 0x34], 0x93b3be3
mov dword [ebp - 0x30], 0xf5fbcf90
mov dword [ebp - 0x2c], 0x8467cc8b
stosd dword es:[edi], eax
mov dword [ebp - 0x28], 0x7f4105b0
mov dword [ebp - 0x24], 0x68ec17b0
mov dword [ebp - 0x20], 0xea785a6c
stosw word es:[edi], ax
mov byte [ebp - 0x1c], bl
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
mov dword [ebp - 0x50], ebx
sbb al, al
add al, 0x66
mov byte [ebp - 0x18], al
xor eax, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 2]
and eax, 0xff
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], ebx
push 0x63
pop eax
push 0x32
pop ecx
cmovne eax, ecx
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x17], al
xor eax, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x68]
and eax, 0x70
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], ebx
push 0x66
pop eax
push 0x61
pop ecx
cmovne eax, ecx
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x16], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x50]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 0x50], ebx
lea edi, [ebp - 0x7c]
push 6
setne al
mov dword [ebp - 0x54], ebx
add al, 0x30
mov byte [ebp - 0x15], al
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, 0xffffffff
je 0x7ffa14b3
test eax, eax
je 0x7ffa14b3
push str.NtQueryInformationProcess
push eax
call edi
mov esi, eax
test esi, esi
je 0x7ffa14b3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x54]
push ecx
push 0x18
lea ecx, [ebp - 0x7c]
push ecx
push ebx
push eax
call esi
test eax, eax
js 0x7ffa14ae
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x7ffa14ae
xor eax, eax
cmp byte [ecx + 2], al
sete al
add eax, 0x36
jmp 0x7ffa14b5
mov eax, dword [ebp - 0x80]
jmp 0x7ffa14b5
mov eax, ebx
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
push ebx
push 0x7ffa3120
mov byte [ebp - 0x14], al
call esi
push ebx
push 0x7ffa3128
call esi
push str.ntdll.dll
mov byte [ebp - 0x13], 0x31
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, 0xffffffff
je 0x7ffa1506
test eax, eax
je 0x7ffa1506
push str.NtSetInformationThread
push eax
call edi
mov esi, eax
test esi, esi
je 0x7ffa1506
push ebx
push ebx
push 0x11
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push 0x32
pop eax
jmp 0x7ffa1508
mov al, bl
mov byte [ebp - 0x12], al
call fcn.7ffa1006
mov byte [ebp - 0x11], al
mov dword [ebp - 0x50], ebx
push ss
pop ss
pushfd
test byte [esp + 1], 1
jne 0x7ffa1522
jmp 0x7ffa1529
mov dword [ebp - 0x50], 1
nop
cmp dword [ebp - 0x50], ebx
mov dword [ebp - 0x60], ebx
sete al
mov dword [ebp - 0x54], ebx
add al, 0x33
mov dword [ebp - 0x58], ebx
mov byte [ebp - 0x10], al
mov dword [ebp - 0x50], ebx
rdtsc
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x54], eax
xor eax, eax
mov eax, 5
shr eax, 2
sub eax, ebx
cmp eax, ecx
rdtsc
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x54]
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp eax, 0x10000
setle al
add al, 0x38
mov byte [ebp - 0xf], al
lea eax, [ebp - 0x64]
push eax
call esi
xor eax, eax
push eax
push ecx
pop eax
pop ecx
sub ecx, eax
shl ecx, 4
lea eax, [ebp - 0x5c]
push eax
call esi
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x58]
sbb eax, dword [ebp - 0x60]
push 0x1e
mov dword [ebp - 0x58], eax
pop eax
js 0x7ffa15ac
jg 0x7ffa15a9
cmp ecx, eax
jbe 0x7ffa15ac
xor ebx, ebx
inc ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test ebx, ebx
push 0x62
pop eax
push 0x34
pop ecx
cmove eax, ecx
mov byte [ebp - 0xe], al
call esi
mov edi, eax
xor eax, eax
push eax
push ecx
pop eax
pop ecx
sub ecx, eax
shl ecx, 4
call esi
sub eax, edi
push 0x1e
pop ecx
cmp ecx, eax
sbb al, al
and al, 0xfe
add al, 0x65
mov byte [ebp - 0xd], al
call fcn.7ffa109a
mov byte [ebp - 0xc], al
call fcn.7ffa10e3
mov byte [ebp - 0xb], al
call fcn.7ffa1126
mov byte [ebp - 0xa], al
call fcn.7ffa11ac
mov byte [ebp - 9], al
call fcn.7ffa1166
cmp dword [ebp + 8], 0x63
mov byte [ebp - 8], al
jle 0x7ffa161e
push dword [ebp - 0x80]
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x18]
call fcn.7ffa1278
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7ffa165c
leave
ret