Function at 0x140007270
Capabilities:
Check for debugger via api
Check for process debug object
Check processdebugflags
Check processdebugport

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
lea rcx, [rsp + 0x30]
call fcn.1400d8140
cmp byte [rsp + 0x30], 0x12
jne 0x140007ab6
call fcn.140002d90
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x78], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea rdx, [rsp + 0x78]
mov rcx, rax
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x100]
mov rcx, rax
mov edx, 7
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea rsi, [rsp + 0x88]
mov rcx, rax
mov edx, 0x1f
mov r8, rsi
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 0x1e
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [rsp + 0x78], 0
jne 0x140007ab8
cmp qword [rsp + 0x100], 0
jne 0x140007ab8
cmp dword [rsp + 0x88], 0
je 0x140007ab8
cmp qword [rsp + 0x30], 0
jne 0x140007ab8
lea rcx, [rsp + 0x100]
call fcn.1400898f0
mov r14, qword [rsp + 0x108]
mov rdi, qword [rsp + 0x110]
lea rax, [0x140126ede]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0x9c53b85c1bdd9191
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.140006ed0
movabs rcx, 0x934fb90587122ce2
xor rcx, qword [rax]
movzx eax, word [rax + 8]
mov edx, eax
xor dl, 0x72
shr eax, 8
xor al, 0x4d
mov qword [rsp + 0x78], rcx
mov byte [rsp + 0x80], dl
mov byte [rsp + 0x81], al
test rdi, rdi
je 0x140007432
js 0x140007ab6
movzx eax, byte [0x1401bb111]
xor ecx, ecx
mov rdx, rdi
call fcn.140089d40
test rax, rax
je 0x140007ab6
mov rbx, rax
mov r15, rdi
jmp 0x14000743a
mov ebx, 1
xor r15d, r15d
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x48], 0
lea rcx, [rsp + 0x30]
lea r15, [rsp + 0x78]
mov r8d, 0xa
mov rdx, r15
call fcn.140083e90
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
cmp qword [rsp + 0x100], 0
je 0x14000749f
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, r14
call fcn.1400fda74
lea r12, [rsp + 0x100]
mov rcx, r12
mov rdx, rdi
mov r8, rbx
xor r9d, r9d
call fcn.14008af90
cmp dword [rsp + 0x100], 2
jne 0x140007ac7
mov r14, qword [rsp + 0x108]
mov eax, r14d
and eax, 3
cmp rax, 2
jb 0x14000759a
cmp eax, 2
jne 0x14000759a
mov rax, r14
shr rax, 0x20
cmp eax, 0x780
jne 0x14000759a
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov r8, rbx
mov r9d, 0x200000
call fcn.14008af90
cmp dword [rsp + 0x30], 2
jne 0x140007580
mov rsi, qword [rsp + 0x38]
mov eax, esi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x14000759a
test rax, rax
je 0x14000759a
mov r15, qword [rsi - 1]
mov r12, qword [rsi + 7]
mov rax, qword [r12]
test rax, rax
je 0x140007545
mov rcx, r15
call rax
dec rsi
cmp qword [r12 + 8], 0
je 0x14000756d
cmp qword [r12 + 0x10], 0x11
jb 0x14000755c
mov r15, qword [r15 - 8]
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, r15
call fcn.1400fda74
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rsi
call fcn.1400fda74
jmp 0x14000759a
test byte [rsp + 0x71], 4
je 0x140007abf
mov eax, 0x20000000
and eax, dword [rsp + 0x74]
je 0x140007abf
mov eax, r14d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400075fb
test rax, rax
je 0x1400075fb
mov rsi, qword [r14 - 1]
mov r15, qword [r14 + 7]
mov rax, qword [r15]
test rax, rax
je 0x1400075c4
mov rcx, rsi
call rax
dec r14
cmp qword [r15 + 8], 0
je 0x1400075ea
cmp qword [r15 + 0x10], 0x11
jb 0x1400075d9
mov rsi, qword [rsi - 8]
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rsi
call fcn.1400fda74
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, r14
call fcn.1400fda74
mov dword [rsp + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 7
mov qword [rsp + 0x4c], 0
mov word [rsp + 0x54], 0
mov byte [rsp + 0x51], 1
mov byte [rsp + 0x54], 1
mov byte [rsp + 0x53], 1
lea r8, [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
call fcn.14008ac80
mov rbx, rax
mov rsi, rdx
test r13, r13
je 0x14000765e
mov rcx, qword [0x1401bb0c8]
xor edx, edx
mov r8, rdi
call fcn.1400fda74
test rbx, rbx
je 0x14000768e
movzx eax, byte [0x1401bb111]
mov edx, 8
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x140007ab6
mov qword [rax], rsi
lea rdx, [0x14012b3e0]
jmp 0x140007aa1
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
lea rax, [0x1401280d8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0xee4df5c93cb44ef6
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.140006d70
mov rbx, qword [rax]
mov edi, dword [rax + 8]
movzx esi, word [rax + 0xc]
movzx ebp, byte [rax + 0xe]
movzx eax, byte [0x1401bb111]
mov edx, 0xf
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x140007ab6
shl ebp, 0x10
or esi, ebp
mov ecx, esi
shr ecx, 0x10
xor cl, 8
mov edx, esi
shr edx, 8
xor dl, 0x48
xor sil, 0x66
xor edi, 0x9aa0769f
movabs r8, 0xeed8689a4638dd17
xor rbx, r8
mov qword [rax], rbx
mov dword [rax + 8], edi
mov byte [rax + 0xc], sil
mov byte [rax + 0xd], dl
mov byte [rax + 0xe], cl
mov qword [rsp + 0xa0], 0xf
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 0xf
lea rax, [0x14012b085]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0x33655708210cd2ce
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.140006f00
mov rcx, qword [rax]
mov qword [rsp + 0x98], rcx
mov rbp, qword [rax + 8]
mov r13, qword [rax + 0x10]
mov r12, qword [rax + 0x18]
mov r15, qword [rax + 0x20]
mov r14, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
mov rdi, qword [rax + 0x38]
mov esi, dword [rax + 0x40]
movzx eax, byte [0x1401bb111]
mov edx, 0x44
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x140007ab6
xor esi, 0x28318dd1
movabs rcx, 0xb6ad3b16b2472a50
xor rdi, rcx
movabs rcx, 0x114b3b41ae6a88d9
xor rbx, rcx
movabs rcx, 0x5f356e8b09f76100
xor r14, rcx
movabs rcx, 0x9a9e840fb26eee3b
xor r15, rcx
movabs rcx, 0x88677608e519be62
xor r12, rcx
movabs rcx, 0x835ef4c1dc4ddb70
xor r13, rcx
movabs rcx, 0x3f0f3961922fc417
xor rbp, rcx
movabs rcx, 0x10b9a829cad37bdd
mov rdx, qword [rsp + 0x98]
xor rdx, rcx
mov qword [rax], rdx
mov qword [rax + 8], rbp
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r14
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], rdi
mov dword [rax + 0x40], esi
mov qword [rsp + 0xb8], 0x44
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 0x44
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0xb8]
call fcn.140007bc0
test rax, rax
jne 0x140007aa1
lea rax, [0x140120c4c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0xf94da0cbad2e42c4
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.1400070d0
mov rbx, qword [rax]
mov edi, dword [rax + 8]
movzx esi, word [rax + 0xc]
movzx ebp, byte [rax + 0xe]
movzx eax, byte [0x1401bb111]
mov edx, 0xf
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x140007ab6
shl ebp, 0x10
or esi, ebp
mov ecx, esi
shr ecx, 0x10
xor cl, 0x71
mov edx, esi
shr edx, 8
xor dl, 0xe7
xor sil, 0xa9
xor edi, 0xad3f5542
movabs r8, 0x3b71b382387670f6
xor rbx, r8
mov qword [rax], rbx
mov dword [rax + 8], edi
mov byte [rax + 0xc], sil
mov byte [rax + 0xd], dl
mov byte [rax + 0xe], cl
mov qword [rsp + 0xd0], 0xf
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], 0xf
lea rax, [0x140126d1f]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0x5999c6d5605f3220
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.140006be0
mov rcx, qword [rax]
mov qword [rsp + 0x98], rcx
mov rbp, qword [rax + 8]
mov r13, qword [rax + 0x10]
mov r12, qword [rax + 0x18]
mov r15, qword [rax + 0x20]
mov r14, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
mov rdi, qword [rax + 0x38]
mov esi, dword [rax + 0x40]
movzx eax, byte [0x1401bb111]
mov edx, 0x44
xor ecx, ecx
call fcn.140089d40
test rax, rax
je 0x140007ab6
xor esi, 0x36c5838e
movabs rcx, 0x8dc084e06314c539
xor rdi, rcx
movabs rcx, 0x984e4ed3abbd7ac1
xor rbx, rcx
movabs rcx, 0x55fd7ba5b87d521a
xor r14, rcx
movabs rcx, 0x3afa26439bb13c38
xor r15, rcx
movabs rcx, 0x5bd2f945a4af61a8
xor r12, rcx
movabs rcx, 0xcf6dcfe08aa635ed
xor r13, rcx
movabs rcx, 0xb2915005bf47c771
xor rbp, rcx
movabs rcx, 0x6440d25492d4cd68
mov rdx, qword [rsp + 0x98]
xor rdx, rcx
mov qword [rax], rdx
mov qword [rax + 8], rbp
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r14
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], rdi
mov dword [rax + 0x40], esi
mov qword [rsp + 0xe8], 0x44
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 0x44
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0xe8]
call fcn.140007bc0
nop
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
xor ecx, ecx
call fcn.14008a330
mov rcx, r14
call fcn.14008af10
lea rax, [0x14011fbd1]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movabs rax, 0xada56884c899a790
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
call fcn.140006e80
movabs rcx, 0x114746543debb9ba
xor rcx, qword [rax]
mov edx, 0xc83ae8d2
xor edx, dword [rax + 8]
movzx r8d, byte [rax + 0xe]
movzx eax, word [rax + 0xc]
mov r9d, eax
shr r9d, 8
xor al, 2
xor r9b, 0xaa
xor r8b, 0x3c
mov qword [rsp + 0x88], rcx
mov dword [rsp + 0x90], edx
mov byte [rsp + 0x94], al
mov byte [rsp + 0x95], r9b
mov byte [rsp + 0x96], r8b
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x108], 0xf
mov qword [rsp + 0x78], r12
lea rax, [0x14008a4c0]
mov qword [rsp + 0x80], rax
lea rax, [0x14012b7d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 1
lea rcx, [rsp + 0x30]
call fcn.140081c00
mov ecx, 1
call fcn.14008a330
int3