Function at 0x140001bb9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbp
sub rsp, 0x1d0
lea rbp, [rsp + 0x80]
rdtsc
shl rdx, 0x20
or rax, rdx
mov dword [0x1400100a0], eax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
rdtsc
shl rdx, 0x20
or rax, rdx
mov dword [0x1400100a4], eax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call rax
test eax, eax
jne 0x140001e6d
lea rax, [0x1400100c0]
mov rcx, rax
call fcn.140001fdb
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x4b0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x130], rax
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x100
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [0x1400100b8], rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
call rax
mov qword [0x1400100b0], rax
mov dword [rbp + 0x14c], 0
jmp 0x140001d64
mov eax, dword [rbp + 0x14c]
movsxd rdx, eax
mov rax, rdx
add rax, rax
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp + 0x130]
add rdx, rax
mov eax, dword [rbp + 0x14c]
mov dword [rdx], eax
mov eax, dword [rbp + 0x14c]
movsxd rdx, eax
mov rax, rdx
add rax, rax
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp + 0x130]
add rdx, rax
mov rax, qword [0x1400100b8]
mov qword [rdx + 8], rax
mov eax, dword [rbp + 0x14c]
movsxd rdx, eax
mov rax, rdx
add rax, rax
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp + 0x130]
add rax, rdx
mov dword [rax + 0x10], 0
mov eax, dword [rbp + 0x14c]
movsxd rdx, eax
mov rax, rdx
add rax, rax
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp + 0x130]
add rax, rdx
mov r8, rax
lea rax, [0x140001941]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateFiber]
call rax
mov edx, dword [rbp + 0x14c]
movsxd rdx, edx
mov qword [rbp + rdx*8 - 0x60], rax
add dword [rbp + 0x14c], 1
cmp dword [rbp + 0x14c], 0x31
jle 0x140001c8e
mov dword [rbp + 0x148], 0
jmp 0x140001d9d
mov eax, dword [rbp + 0x148]
cdqe
mov rax, qword [rbp + rax*8 - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SwitchToFiber]
call rax
add dword [rbp + 0x148], 1
cmp dword [rbp + 0x148], 0x31
jle 0x140001d7d
mov dword [rbp + 0x144], 1
mov dword [rbp + 0x140], 0
jmp 0x140001e12
mov eax, dword [rbp + 0x140]
movsxd rdx, eax
mov rax, rdx
add rax, rax
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp + 0x130]
add rax, rdx
mov eax, dword [rax + 0x10]
test eax, eax
jne 0x140001e0b
mov dword [rbp + 0x144], 0
mov eax, dword [rbp + 0x140]
cdqe
mov rax, qword [rbp + rax*8 - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SwitchToFiber]
call rax
jmp 0x140001e1b
add dword [rbp + 0x140], 1
cmp dword [rbp + 0x140], 0x31
jle 0x140001dbc
cmp dword [rbp + 0x144], 0
jne 0x140001e26
jmp 0x140001da6
nop
mov dword [rbp + 0x13c], 0
jmp 0x140001e53
mov eax, dword [rbp + 0x13c]
cdqe
mov rax, qword [rbp + rax*8 - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFiber]
call rax
add dword [rbp + 0x13c], 1
cmp dword [rbp + 0x13c], 0x31
jle 0x140001e33
mov rax, qword [0x1400100b8]
mov rcx, rax
call fcn.140001ac5
jmp 0x140001e92
mov r9d, 0
lea r8, str.Uh_Oh
lea rax, str.Tiny_Little_Spider
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov eax, 0
add rsp, 0x1d0
pop rbp
ret