Function at 0x140004080
Capabilities:
Check for time delay via queryperformancecounter
Enumerate threads

Disassembly:
sub rsp, 0x4d8
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x60]
sub rax, qword [rsp + 0x68]
cmp rax, qword [rsp + 0x70]
jge 0x1400040f9
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Tampering_detected__Jixx_Dev_._Exiting.
call fcn.140009150
mov rcx, rax
lea rdx, [0x140009320]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x4e0], rbx
mov qword [rsp + 0x4d0], rdi
call fcn.140002a00
test al, al
jne 0x140004277
xor eax, eax
lea rcx, str..GlobalProcmonDebugLogger
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000424b
xor edx, edx
lea ecx, [rax + 5]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, rbx
je 0x1400041e9
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], Ordinal_33
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1400041e9
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x4c], eax
jne 0x1400041d7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rsp + 0x48]
cmp edx, eax
je 0x1400041d7
mov ecx, Ordinal_27
mov dword [rsp + 0x80], 0x438
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400041ce
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x14000421a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140004180
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x4d0]
mov rbx, qword [rsp + 0x4e0]
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.140070b50
add rsp, 0x4d8
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Code_injection_detected__Jixx_Dev_._Exiting.
call fcn.140009150
mov rcx, rax
lea rdx, [0x140009320]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
jmp 0x140004271
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Debugger_detected__Jixx_Dev_._Exiting.
call fcn.140009150
mov rcx, rax
lea rdx, [0x140009320]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140003dd0
int3