Function at 0x140003320
Capabilities:
Check for sandbox and av modules

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x670
movaps xmmword [rsp + 0x660], xmm6
mov rax, qword [0x140013040]
xor rax, rsp
mov qword [rsp + 0x658], rax
stmxcsr dword [rsp + 0x60]
or dword [rsp + 0x60], 0x8040
ldmxcsr dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x14000338b
mov rsi, rax
mov rcx, rax
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xefffffff
mov rcx, rsi
mov edx, 0xfffffff0
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea rdx, [0x14000f5a0]
lea rcx, [rsp + 0x60]
mov r8d, 0x5f0
call fcn.1400037a0
movaps xmm0, xmmword [0x14000f160]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x14000f170]
movaps xmmword [rsp + 0x40], xmm0
movabs rax, 0x75466f7430794b
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x38]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rsi, rax
call fcn.140002810
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
jmp 0x1400033fc
call fcn.140002810
inc edi
cmp edi, 0xa
je 0x140003467
test dil, 1
jne 0x1400033f0
mov ebp, 0xa
nop word [rax + rax]
call rbx
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x25
add ecx, edx
imul ecx, ecx, 0x64
sub eax, ecx
mov dword [rsp + 0x30], eax
call rbx
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x26
add ecx, edx
imul ecx, ecx, 0xc8
sub eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x2c]
mov dword [rsp + 0x34], eax
dec ebp
jne 0x140003410
jmp 0x1400033f5
mov r14, qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
call r14
mov edi, eax
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call r14
sub eax, edi
xorps xmm6, xmm6
cvtsi2sd xmm6, eax
mulsd xmm6, qword [0x14000f180]
lea rcx, str.Time_duration:__.2f_seconds_n
movapd xmm1, xmm6
movq rdx, xmm6
call fcn.140002570
mov edi, 0xa
nop dword [rax]
call rbx
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x25
add ecx, edx
imul ecx, ecx, 0x64
sub eax, ecx
mov dword [rsp + 0x30], eax
call rbx
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x26
add ecx, edx
imul ecx, ecx, 0xc8
sub eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x2c]
mov dword [rsp + 0x34], eax
dec edi
jne 0x1400034b0
movsd xmm0, qword [0x14000f188]
ucomisd xmm0, xmm6
ja 0x14000364c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov edi, eax
lea rcx, str.Debugger_present:__d_n
mov edx, eax
call fcn.140002570
mov ebp, 0xa
nop word cs:[rax + rax]
call rbx
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x25
add ecx, edx
imul ecx, ecx, 0x64
sub eax, ecx
mov dword [rsp + 0x30], eax
call rbx
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x26
add ecx, edx
imul ecx, ecx, 0xc8
sub eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x2c]
mov dword [rsp + 0x34], eax
dec ebp
jne 0x140003540
test edi, edi
jne 0x14000364c
call fcn.1400025f0
test eax, eax
jne 0x14000364c
lea rcx, str.SbieDll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
xor edx, edx
test rax, rax
setne dl
lea rcx, str.Sandboxed:__d_n
call fcn.140002570
mov ebp, 0xa
nop word cs:[rax + rax]
call rbx
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x25
add ecx, edx
imul ecx, ecx, 0x64
sub eax, ecx
mov dword [rsp + 0x30], eax
call rbx
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x26
add ecx, edx
imul ecx, ecx, 0xc8
sub eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x2c]
mov dword [rsp + 0x34], eax
dec ebp
jne 0x1400035e0
test rdi, rdi
jne 0x14000364c
call fcn.1400029e0
test eax, eax
jne 0x14000364c
call fcn.140002b20
test eax, eax
je 0x140003685
lea rcx, str.Environment_checks_failed__exiting.
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
mov esi, 1
mov rcx, qword [rsp + 0x658]
xor rcx, rsp
call fcn.14000c770
mov eax, esi
movaps xmm6, xmmword [rsp + 0x660]
add rsp, 0x670
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140002bc0
test eax, eax
je 0x14000364c
call fcn.140002ca0
test eax, eax
jne 0x14000364c
call fcn.140002d50
test eax, eax
jne 0x14000364c
call fcn.140002e20
test eax, eax
jne 0x14000364c
xor edi, edi
mov ebp, 0xa
call rbx
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x25
add ecx, edx
imul ecx, ecx, 0x64
sub eax, ecx
mov dword [rsp + 0x30], eax
call rbx
cdqe
imul rcx, rax, 0x51eb851f
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x26
add ecx, edx
imul ecx, ecx, 0xc8
sub eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x2c]
mov dword [rsp + 0x34], eax
dec ebp
jne 0x1400036b0
cmp edi, 3
jbe 0x140003718
jmp 0x14000373a
call fcn.1400025f0
mov edi, ebp
cmp ebp, 4
je 0x14000373a
lea ebp, [rdi + 1]
mov eax, edi
sub eax, 2
cmovb eax, ebp
cmp eax, 1
je 0x14000370c
test eax, eax
je 0x140003733
call fcn.1400024e0
jmp 0x140003711
inc edi
jmp 0x1400036ab
lea rdi, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.1400010f0
lea rdx, [rsp + 0x38]
mov rcx, rdi
mov r8, rsi
call fcn.140001010
call fcn.140002f10
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call fcn.140002ff0
xor esi, esi
jmp 0x14000365d