Function at 0x14004c410
Capabilities:
Check for debugger via api
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x440
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1401550a0]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov r15, rcx
mov qword [rbp + 0x268], rcx
lea rax, [0x14011b2e8]
mov qword [rbp + 0x40], rax
lea rax, str.ProcessHacker.exe
mov qword [rbp + 0x48], rax
lea rax, str.tcpview.exe
mov qword [rbp + 0x50], rax
lea rax, str.autoruns.exe
mov qword [rbp + 0x58], rax
lea rax, str.autorunsc.exe
mov qword [rbp + 0x60], rax
lea rax, str.filemon.exe
mov qword [rbp + 0x68], rax
lea rax, str.procmon.exe
mov qword [rbp + 0x70], rax
lea rax, str.regmon.exe
mov qword [rbp + 0x78], rax
lea rax, str.procexp.exe
mov qword [rbp + 0x80], rax
lea rax, str.idaq.exe
mov qword [rbp + 0x88], rax
lea rax, str.idaq64.exe
mov qword [rbp + 0x90], rax
lea rax, str.ImmunityDebugger.exe
mov qword [rbp + 0x98], rax
lea rax, str.Wireshark.exe
mov qword [rbp + 0xa0], rax
lea rax, str.dumpcap.exe
mov qword [rbp + 0xa8], rax
lea rax, str.HookExplorer.exe
mov qword [rbp + 0xb0], rax
lea rax, str.ImportREC.exe
mov qword [rbp + 0xb8], rax
lea rax, str.PETools.exe
mov qword [rbp + 0xc0], rax
lea rax, str.LordPE.exe
mov qword [rbp + 0xc8], rax
lea rax, str.SysInspector.exe
mov qword [rbp + 0xd0], rax
lea rax, str.proc_analyzer.exe
mov qword [rbp + 0xd8], rax
lea rax, str.sysAnalyzer.exe
mov qword [rbp + 0xe0], rax
lea rax, str.sniff_hit.exe
mov qword [rbp + 0xe8], rax
lea rax, str.windbg.exe
mov qword [rbp + 0xf0], rax
lea rax, str.joeboxcontrol.exe
mov qword [rbp + 0xf8], rax
lea rax, str.joeboxserver.exe
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rax
lea rax, str.ResourceHacker.exe
mov qword [rbp + 0x110], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x118], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x120], rax
lea rax, str.Fiddler.exe
mov qword [rbp + 0x128], rax
lea rax, str.httpdebugger.exe
mov qword [rbp + 0x130], rax
lea rax, str.cheatengine_i386.exe
mov qword [rbp + 0x138], rax
lea rax, str.cheatengine_x86_64.exe
mov qword [rbp + 0x140], rax
lea rax, str.cheatengine_x86_64_SSE4_AVX2.exe
mov qword [rbp + 0x148], rax
lea rax, str.frida_helper_32.exe
mov qword [rbp + 0x150], rax
lea rax, str.frida_helper_64.exe
mov qword [rbp + 0x158], rax
xor r13d, r13d
lea rbx, [r13 - 1]
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x160]
call sub.VCRUNTIME140.dll_memset
mov r14, qword [rbp + r13*8 + 0x40]
mov qword [rbp], r14
mov rsi, rbx
inc rsi
cmp byte [r14 + rsi], 0
jne 0x14004c660
xor edx, edx
mov r8d, Ordinal_301
lea rcx, [rbp + 0x284]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x280], pe_nt_image_headers64
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
lea rdx, [rbp + 0x280]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14004c705
nop word [rax + rax]
lea rax, [rbp + 0x2ac]
mov rdi, rbx
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14004c6c0
mov r8, rsi
cmp rdi, rsi
cmovb r8, rdi
lea rdx, [rbp + 0x2ac]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004c6f1
cmp rsi, rdi
jb 0x14004c6f1
jbe 0x14004c83f
lea rdx, [rbp + 0x280]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14004c6b0
test r12, r12
je 0x14004c713
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r13
cmp r13, 0x24
jl 0x14004c640
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14004c96e
movabs rax, 0x46bd53b155153407
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp], rax
movabs rax, 0xe7aef3e093f6e968
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 8], rax
movabs rdx, 0x65d688ac2a8589f5
mov qword [rbp + 0x270], rdx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x10], rax
movabs rcx, 0xe5aea871817f2122
mov qword [rbp + 0x270], rcx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x18], rax
movabs rax, 0x34d834d620775143
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x93c09693f684b948
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c8], rax
mov qword [rbp + 0x270], rdx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 0x270], rcx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d8], rax
vmovdqu ymm0, ymmword [rbp]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp], ymm1
xor eax, eax
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
lea rax, [rbp]
vzeroupper
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004c831
jmp 0x14004e049
test r12, r12
je 0x14004c84d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x47b147af4c163f02
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp], rax
movabs rax, 0xfc86b6ff99ebed68
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 8], rax
movabs rax, 0x65d688ac2ae1e780
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x10], rax
movabs rcx, 0xe5aea871817f2122
mov qword [rbp + 0x270], rcx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x18], rax
movabs rax, 0x34d834d620775143
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x93c09693f684b948
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c8], rax
movabs rdx, 0x65d688ac2a8589f5
mov qword [rbp + 0x270], rdx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 0x270], rcx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d8], rax
vmovdqu ymm0, ymmword [rbp]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp], ymm1
xor eax, eax
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
lea rax, [rbp]
vzeroupper
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004c960
jmp 0x14004e049
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
cmp byte [rcx + 2], 1
jne 0x14004caa0
movabs rax, 0x46bd53b155153407
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp], rax
movabs rax, 0xf6b2c6b3b4c1e968
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 8], rax
movabs rax, 0x65d688ac5eebec86
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x10], rax
movabs rcx, 0xe5aea871817f2122
mov qword [rbp + 0x270], rcx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x18], rax
movabs rax, 0x34d834d620775143
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x93c09693f684b948
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c8], rax
movabs rdx, 0x65d688ac2a8589f5
mov qword [rbp + 0x270], rdx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 0x270], rcx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d8], rax
vmovdqu ymm0, ymmword [rbp]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp], ymm1
xor eax, eax
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
lea rax, [rbp]
vzeroupper
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004ca92
jmp 0x14004e049
xor r12d, r12d
mov dword [rbp + 0x27c], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x27c]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0x27c], r12d
je 0x14004cbee
movabs rax, 0x70f851a24f1a3411
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp], rax
movabs rax, 0xb3b2f3f491f1db2d
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 8], rax
movabs rax, 0x65a2e6c959e0fba5
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x10], rax
movabs rcx, 0xe5aea871817f2122
mov qword [rbp + 0x270], rcx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x18], rax
movabs rax, 0x34d834d620775143
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x93c09693f684b948
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c8], rax
movabs rdx, 0x65d688ac2a8589f5
mov qword [rbp + 0x270], rdx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 0x270], rcx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d8], rax
vmovdqu ymm0, ymmword [rbp]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp], ymm1
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
lea rax, [rbp]
vzeroupper
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004cbe0
jmp 0x14004e049
call fcn.14004f070
test al, al
je 0x14004cd1e
movabs rax, 0x14bc5dba41013f0a
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp], rax
movabs rax, 0xd0e0f3ff92ead800
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 8], rax
movabs rax, 0xcb7ce8c41e6ec9d
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x10], rax
movabs rax, 0xe5aea871811b444e
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x18], rax
movabs rax, 0x34d834d620775143
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x93c09693f684b948
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c8], rax
movabs rdx, 0x65d688ac2a8589f5
mov qword [rbp + 0x270], rdx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d0], rax
movabs rcx, 0xe5aea871817f2122
mov qword [rbp + 0x270], rcx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d8], rax
vmovdqu ymm0, ymmword [rbp]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp], ymm1
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
lea rax, [rbp]
vzeroupper
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004cd10
jmp 0x14004e049
mov r14d, r12d
mov edx, 0x4d0
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x14004cece
mov rdi, rax
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rsi + 0x30], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14004cd8b
cmp qword [rsi + 0x48], r12
jne 0x14004cd85
cmp qword [rsi + 0x50], r12
jne 0x14004cd85
cmp qword [rsi + 0x58], r12
jne 0x14004cd85
cmp qword [rsi + 0x60], r12
je 0x14004cd8b
mov r14d, 1
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14d, r14d
je 0x14004cece
movabs rax, 0x51aa55a14405300b
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp], rax
movabs rax, 0xfcb0fdf293f6fb68
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 8], rax
movabs rax, 0xba3e7ea0af1e79c
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x10], rax
movabs rax, 0xe5aea871817f2146
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x18], rax
movabs rax, 0x34d834d620775143
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x93c09693f684b948
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c8], rax
movabs rdx, 0x65d688ac2a8589f5
mov qword [rbp + 0x270], rdx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d0], rax
movabs rcx, 0xe5aea871817f2122
mov qword [rbp + 0x270], rcx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d8], rax
vmovdqu ymm0, ymmword [rbp]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp], ymm1
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
lea rax, [rbp]
vzeroupper
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004cec0
jmp 0x14004e049
lea rdx, [0x14004f0a0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov rdi, rax
mov dword [reloc.WS2_32.dll_accept], 1
call fcn.1400993a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
cmp dword [reloc.WS2_32.dll_accept], r12d
je 0x14004d021
movabs rax, 0x51b077f664452973
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp], rax
movabs rax, 0xf6acfff2b0a4d22b
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 8], rax
movabs rax, 0x65d688ac2a858991
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x10], rax
movabs rcx, 0xe5aea871817f2122
mov qword [rbp + 0x270], rcx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x18], rax
movabs rax, 0x34d834d620775143
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x93c09693f684b948
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3c8], rax
movabs rdx, 0x65d688ac2a8589f5
mov qword [rbp + 0x270], rdx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 0x270], rcx
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3d8], rax
vmovdqu ymm0, ymmword [rbp]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp], ymm1
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
lea rax, [rbp]
vzeroupper
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004d013
jmp 0x14004e049
lea rdx, [0x14004f0c0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov dword [reloc.WS2_32.dll_accept], 1
int3
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rbp + 0x20]
call fcn.14004e7d0
lea rdx, [rbp + 0x20]
mov rcx, r15
call fcn.1400a7fd0
nop
mov rcx, r15
call fcn.14004e0a0
xor al, al
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.1400fe240
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret