Function at 0x140001020
Capabilities:
Check for peb beingdebugged flag
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x8f0]
sub rsp, 0x9f0
mov r14, qword gs:[0x60]
lea r9, [0x140017378]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r15d, r15d
test rax, rax
je 0x14000106b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
lea eax, [r15 + 1]
je 0x14000106e
mov eax, r15d
mov qword [rsp + 0xa20], rbx
mov qword [rsp + 0x9e8], rsi
mov qword [rsp + 0x9e0], rdi
test eax, eax
jne 0x14000162a
mov byte [rbp + 0x910], r15b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, 8
mov rcx, rax
mov edx, ebx
lea r8d, [rbx + 0x26]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rcx, [rsp + 0x40]
xorps xmm0, xmm0
mov rdi, rax
nop word [rax + rax]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm0
sub rbx, 1
jne 0x1400010c0
movups xmmword [rcx], xmm0
mov byte [rbp + 0x910], 1
lea rdx, [rsp + 0x40]
mov dword [rdi + 0x10], 0x16
mov r8d, 0x208
movups xmm0, xmmword [str.:SELFDELETE]
xor ecx, ecx
movups xmmword [rdi + 0x14], xmm0
mov eax, dword [0x140017370]
mov dword [rdi + 0x24], eax
movzx eax, word [0x140017374]
mov word [rdi + 0x28], ax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x30], r15
lea r8d, [rbx + 1]
mov dword [rsp + 0x28], r15d
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x110000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r9d, 0x2e
mov r8, rdi
mov rcx, rax
mov rbx, rax
lea edx, [r9 - 0x2b]
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, [rsp + 0x40]
mov edx, 0x110000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r9d, 1
lea r8, [rbp + 0x910]
mov rcx, rax
mov rbx, rax
lea edx, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
mov qword [rbp + 0x410], r15
mov qword [rbp + 0x418], r15
mov qword [rbp + 0x420], r15
mov qword [rbp + 0x428], r15
mov qword [rbp + 0x430], r15
mov qword [rbp + 0x438], r15
mov qword [rbp + 0x440], 0x100010
mov qword [rbp + 0x448], r15
mov qword [rbp + 0x450], r15
mov qword [rbp + 0x458], r15
mov qword [rbp + 0x460], r15
mov qword [rbp + 0x468], r15
mov qword [rbp + 0x470], r15
mov qword [rbp + 0x478], r15
mov qword [rbp + 0x480], r15
mov qword [rbp + 0x488], r15
mov qword [rbp + 0x490], r15
mov qword [rbp + 0x498], r15
mov qword [rbp + 0x4a0], r15
mov qword [rbp + 0x4a8], r15
mov qword [rbp + 0x4b0], r15
mov qword [rbp + 0x4b8], r15
mov qword [rbp + 0x4c0], r15
mov qword [rbp + 0x4c8], r15
mov qword [rbp + 0x4d0], r15
mov qword [rbp + 0x4d8], r15
mov qword [rbp + 0x4e0], r15
mov qword [rbp + 0x4e8], r15
mov qword [rbp + 0x4f0], r15
xorps xmm0, xmm0
mov qword [rbp + 0x4f8], r15
xor edx, edx
mov qword [rbp + 0x500], r15
mov r8d, pe_nt_image_headers64
mov qword [rbp + 0x508], r15
lea rcx, [rbp + 0x5b0]
mov dword [rbp + 0x510], r15d
movups xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x514], r15
movups xmmword [rbp + 0x540], xmm0
mov qword [rbp + 0x51c], r15
movups xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x524], r15
movups xmmword [rbp + 0x560], xmm0
mov dword [rbp + 0x52c], r15d
movups xmmword [rbp + 0x570], xmm0
movups xmmword [rbp + 0x580], xmm0
movups xmmword [rbp + 0x590], xmm0
movups xmmword [rbp + 0x5a0], xmm0
call fcn.140001670
xorps xmm0, xmm0
lea rcx, [rbp + 0x710]
xor edx, edx
mov r8d, 0x1a0
movups xmmword [rbp + 0x6b0], xmm0
movups xmmword [rbp + 0x6c0], xmm0
movups xmmword [rbp + 0x6d0], xmm0
movups xmmword [rbp + 0x6e0], xmm0
movups xmmword [rbp + 0x6f0], xmm0
movups xmmword [rbp + 0x700], xmm0
call fcn.140001670
lea rdx, [rbp + 0x410]
mov qword [rbp + 0x8b0], r15
xor ecx, ecx
mov qword [rbp + 0x8b8], r15
mov qword [rbp + 0x8c0], r15
mov qword [rbp + 0x8c8], r15
mov qword [rbp + 0x8d0], r15
mov qword [rbp + 0x8d8], r15
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp byte [r14 + 2], 1
je 0x140001651
cmp qword [rbp + 0x458], r15
jne 0x140001651
cmp qword [rbp + 0x460], r15
jne 0x140001651
cmp qword [rbp + 0x468], r15
jne 0x140001651
cmp qword [rbp + 0x470], r15
jne 0x140001651
lea rcx, [rbp + 0x910]
mov qword [rbp + 0x910], r15
mov qword [rbp + 0x918], r15
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rcx, [rbp + 0x918]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x910]
sub rax, qword [rbp + 0x918]
cmp rax, 0x186a0
jg 0x140001657
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x3e8
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub edi, eax
cmp edi, 0x3e8
jb 0x14000165d
mov rbx, qword gs:[0x60]
lea rcx, [rbp + 0xe0]
xorps xmm0, xmm0
mov qword [rsp + 0x40], r15
xor edx, edx
mov qword [rsp + 0x48], r15
mov r8d, pe_nt_image_headers64
mov qword [rsp + 0x50], r15
movups xmmword [rbp + 0x60], xmm0
mov qword [rsp + 0x58], r15
movups xmmword [rbp + 0x70], xmm0
mov qword [rsp + 0x60], r15
movups xmmword [rbp + 0x80], xmm0
mov qword [rsp + 0x68], r15
movups xmmword [rbp + 0x90], xmm0
mov qword [rsp + 0x70], 0x100010
movups xmmword [rbp + 0xa0], xmm0
mov qword [rsp + 0x78], r15
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp - 0x80], r15
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp - 0x78], r15
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
mov qword [rbp], r15
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r15
mov dword [rbp + 0x40], r15d
mov qword [rbp + 0x44], r15
mov qword [rbp + 0x4c], r15
mov qword [rbp + 0x54], r15
mov dword [rbp + 0x5c], r15d
call fcn.140001670
xorps xmm0, xmm0
lea rcx, [rbp + 0x240]
xor edx, edx
mov r8d, 0x1a0
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
call fcn.140001670
lea rdx, [rsp + 0x40]
mov qword [rbp + 0x3e0], r15
xor ecx, ecx
mov qword [rbp + 0x3e8], r15
mov qword [rbp + 0x3f0], r15
mov qword [rbp + 0x3f8], r15
mov qword [rbp + 0x400], r15
mov qword [rbp + 0x408], r15
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp byte [rbx + 2], 1
je 0x14000165d
cmp qword [rbp - 0x78], r15
jne 0x14000165d
cmp qword [rbp - 0x70], r15
jne 0x14000165d
cmp qword [rbp - 0x68], r15
jne 0x14000165d
cmp qword [rbp - 0x60], r15
jne 0x14000165d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub esi, eax
cmp esi, 0xfffff830
jb 0x14000165d
mov edx, esi
lea rcx, [0x140017380]
call fcn.1400016a0
mov rdi, qword [rsp + 0x9e0]
xor eax, eax
mov rsi, qword [rsp + 0x9e8]
mov rbx, qword [rsp + 0xa20]
add rsp, 0x9f0
pop r15
pop r14
pop rbp
ret
call section..text
int3
call section..text
int3
call section..text
int3