Function at 0x14028681c
Capabilities:
Execute anti-debugging instructions

Disassembly:
call rax
mov rax, rdi
mov rbp, qword [rsp + 0x20]
sub dil, r13b
add rsp, 0x28
movsx rsi, cx
bswap rdi
movsx edi, bp
pop rdi
pop rsi
jmp 0x140295a47
mov rsi, qword [rsp + 0x40]
not r8w
setns r8b
sub qword [rsp + 0x28], r14
movsx r8d, byte [rsp + 0x2a]
test byte [rsp + 0x2c], r9b
mov r8, qword [rsp + 0x28]
js 0x14027e87d
not r12
call fcn.1402659c4
call rax
mov rbp, qword [rsp + 0x50]
clc
test eax, eax
js 0x140295a25
lea r10, [0x1401642e0]
xor r9b, bl
rcr cl, 0xed
cwde
mov r9, rdi
or r8b, 0xda
cwd
movzx r8w, spl
sub r10, rsi
setno cl
xchg r8b, cl
nop
movzx r8d, byte [r9 + rsi]
movzx rcx, r8w
rcl rax, cl
lea rax, [r9 + rsi]
movsxd rcx, r15d
rol cx, 0xd
mov ecx, r9d
rol dx, cl
cmovp rdx, rsi
btr rdx, r14
movzx edx, byte [r10 + rax]
jmp 0x1402956dd
mov eax, 0x2c896a7e
clc
stc
jmp 0x1402956e9
rol eax, cl
stc
jmp 0x1402956f2
add al, r9b
jmp 0x1402956fa
inc r9
xor dl, al
rcr ah, cl
lea eax, [rdx - 0x41]
cmp r8, rsi
cmp al, 0x19
jmp 0x14029570e
ja 0x14029571b
add dl, 0x20
rcr ah, cl
or al, 0x86
lea eax, [r8 - 0x41]
jmp 0x140295729
cmp al, 0x19
jmp 0x140295730
ja 0x14029573d
add r8b, 0x20
test rdi, r12
test dl, dl
jmp 0x140295744
je 0x140295753
cmp dl, r8b
je 0x140286882
cmp dl, 0x2e
jmp 0x14029575b
jne 0x14029576f
test r8b, r8b
jmp 0x140295769
je 0x140295786
cmp dl, r8b
jmp 0x140295777
jb 0x140295792
cmp dl, r8b
ja 0x140295792
mov r9, qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
jmp 0x140295880
lea r10, [0x140291398]
xchg r8b, r8b
xor dl, 0x78
sub ch, 0xc5
mov r9, rdi
movsx rdx, di
sub r10, rsi
rdtsc
nop
ror al, 0x27
movzx r8d, byte [r9 + rsi]
cwd
movsx edx, r15w
lea rax, [r9 + rsi]
rcl dh, cl
btr dx, 0
cwd
mov ecx, r9d
cqo
cdq
movsx edx, r10w
movzx edx, byte [r10 + rax]
mov eax, 0x2c896a7e
jmp 0x1402957e3
rol eax, cl
cmp dh, 0xe1
stc
cmc
add al, r9b
inc r9
xor dl, al
cmovns eax, ebp
rcr al, 0xec
bswap ax
lea eax, [rdx - 0x41]
cmp di, si
cmc
cmp al, 0x19
jmp 0x140295809
ja 0x140295814
add dl, 0x20
rcr al, cl
lea eax, [r8 - 0x41]
test spl, dil
test dil, 0xbf
cmp al, 0x19
jmp 0x140295826
ja 0x140295830
add r8b, 0x20
test dl, dl
jmp 0x140295837
je 0x14029584b
cmp dl, r8b
jmp 0x140295845
je 0x1402957b2
cmp dl, 0x2e
jne 0x140295862
test r8b, r8b
jmp 0x14029585c
je 0x140295879
cmp dl, r8b
jmp 0x14029586a
jb 0x1402958fc
cmp dl, r8b
ja 0x1402958fc
mov r9, qword [sym.imp.HAL.dll_KeQueryPerformanceCounter]
test r9, r9
je 0x1402958fc
mov r10d, dword [rbp]
or dl, 5
movsx rdx, r13w
shr dl, cl
mov rdx, rdi
test r10, r10
jmp 0x1402958a1
je 0x140295a25
lea rcx, [rbp + 0x18]
mov r8, qword [rcx]
cmc
cmp r8, r9
jae 0x1402958cd
mov eax, dword [rcx + 8]
clc
add rax, r8
cmp rax, r9
jmp 0x1402958c7
ja 0x1402958ef
inc rdx
test di, bx
stc
cmc
add rcx, 0x128
cmp rdx, r10
jmp 0x1402958e4
jb 0x1402958ab
jmp 0x140295a25
mov rdi, r8
jmp 0x1402958f7
jmp 0x140295a25
mov qword [rsp + 0x40], rbx
mov r11b, r13b
movsx r11w, r15b
mov ebx, dword [rbp]
neg r11d
sal r11b, cl
movzx r11, di
mov r11, rdi
test r15b, r12b
test rbx, rbx
jmp 0x140295924
je 0x140295a1f
lea r9, [rbp + 8]
cbw
rol cx, 0xb8
movzx eax, word [r9 + 0x26]
adc r10b, r13b
mov r8, rsi
sbb dl, 0x40
rol r10b, cl
sub rax, rsi
jmp 0x140295952
lea r10, [rax + r9 + 0x28]
rdtsc
cbw
not ah
movzx ecx, byte [r10 + r8]
movzx edx, byte [r8]
xchg ah, ah
movzx eax, r8w
inc r8
dec ah
lea eax, [rcx - 0x41]
jmp 0x14029597d
cmp al, 0x19
jmp 0x140295984
ja 0x140295993
add cl, 0x20
and al, r11b
sar ah, 0xae
lea eax, [rdx - 0x41]
cmp al, 0x19
ja 0x1402959aa
add dl, 0x20
test r15w, 0x12cb
cmp r11b, r9b
test cl, cl
jmp 0x1402959b1
je 0x1402959c4
cmp cl, dl
jmp 0x1402959be
je 0x14029595d
cmp cl, 0x2e
jmp 0x1402959cc
jne 0x1402959df
test dl, dl
jmp 0x1402959d9
je 0x140295a18
cmp cl, dl
jmp 0x1402959e6
jb 0x1402959f9
cmp cl, dl
jmp 0x1402959f3
jbe 0x140295a18
inc r11
add r9, 0x128
clc
cmc
cmp r11, rbx
jmp 0x140295a0d
jb 0x140295934
jmp 0x140295a1f
mov rdi, qword [r9 + 0x10]
sub bl, 0x2e
mov rbx, qword [rsp + 0x40]
cmc
test rbp, rbp
je 0x1402799c2
sub edx, edx
cwde
movsx rax, bp
mov rcx, rbp
movsxd rax, esi
mov rax, qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1402799c0
ret