Function at 0x70b6af20
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push edi
push ebx
call esi
mov edi, dword [ebp + 0xc]
push edi
call esi
push ebx
call esi
push edi
call esi
mov edi, dword [ebp + 0x14]
push edi
call esi
test eax, eax
je 0x70b6b553
push edi
call esi
test eax, eax
je 0x70b6b553
mov edi, dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x70b6b553
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 0
mov eax, dword [edi + 4]
test eax, eax
jne 0x70b6b047
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx]
cmp eax, dword [edx]
je 0x70b6b047
mov eax, dword [edi]
cmp eax, 0x2faf080
jae 0x70b6b047
cmp eax, 0xf4240
jbe 0x70b6b047
lea eax, [ebp - 0x14]
push eax
call esi
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
rdtsc
mov dword [ebp + 0x14], eax
mov dword [ebp + 8], edx
mov ecx, 0x7a120
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec ecx
jne 0x70b6afbe
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp + 0x10], edx
lea ecx, [ebp - 0xc]
push ecx
call esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx]
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
mov ebx, dword [edx]
add ecx, eax
sub ecx, ebx
mov dword [ebp + 0xc], 0
sub ecx, esi
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
sub eax, dword [ebp + 0x14]
sbb edx, dword [ebp + 8]
sub eax, dword [0x70bcd578]
sbb edx, 0
jne 0x70b6b015
mov dword [ebp + 0xc], eax
mov edx, dword [ebp + 0xc]
mov eax, ecx
and eax, 0x7ffffffe
lea eax, [eax + edx*2]
xor edx, edx
shl eax, 1
div ecx
mov ecx, eax
mov eax, 0x431bde83
imul ecx, dword [edi]
shr ecx, 2
add ecx, 0x7a120
mul ecx
mov eax, dword [ebp + 0x18]
shr edx, 0x12
mov dword [eax], edx
mov ecx, eax
mov eax, dword [ecx]
cmp eax, 0x3d
ja 0x70b6b085
cmp eax, 0x3a
jae 0x70b6b075
cmp eax, 0x30
jb case.0x70b6b4fd.792
cmp eax, 0x33
ja case.0x70b6b4fd.792
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0x2faf080
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x3938700
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x4c
ja 0x70b6b0c1
cmp eax, 0x49
jae 0x70b6b0b1
cmp eax, 0x40
jb case.0x70b6b4fd.792
cmp eax, 0x43
ja case.0x70b6b4fd.792
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0x3f940ab
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0x47868c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x5b
ja 0x70b6b0fd
cmp eax, 0x58
jae 0x70b6b0ed
cmp eax, 0x52
jb case.0x70b6b4fd.792
cmp eax, 0x55
ja case.0x70b6b4fd.792
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x4f790d5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0x55d4a80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x79
ja 0x70b6b139
cmp eax, 0x76
jae 0x70b6b129
cmp eax, 0x62
jb case.0x70b6b4fd.792
cmp eax, 0x65
ja case.0x70b6b4fd.792
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0x989680
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x7270e00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x86
ja 0x70b6b179
cmp eax, 0x83
jae 0x70b6b169
cmp eax, 0x7b
jb case.0x70b6b4fd.792
cmp eax, 0x7e
ja case.0x70b6b4fd.792
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0x7735940
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0x7f28155
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xa7
ja 0x70b6b1bd
cmp eax, 0xa4
jae 0x70b6b1ad
cmp eax, 0x94
jb case.0x70b6b4fd.792
cmp eax, 0x97
ja case.0x70b6b4fd.792
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x8f0d180
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0x9ef21ab
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xb5
ja 0x70b6b201
cmp eax, 0xb2
jae 0x70b6b1f1
cmp eax, 0xad
jb case.0x70b6b4fd.792
cmp eax, 0xb0
ja case.0x70b6b4fd.792
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0xa76c3e3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0xaba9500
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xd3
ja 0x70b6b245
cmp eax, 0xd0
jae 0x70b6b235
cmp eax, 0xc6
jb case.0x70b6b4fd.792
cmp eax, 0xc9
ja case.0x70b6b4fd.792
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0xbebc200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0xc845880
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xf1
ja 0x70b6b289
cmp eax, 0xee
jae 0x70b6b279
cmp eax, 0xe7
jb case.0x70b6b4fd.792
cmp eax, 0xea
ja case.0x70b6b4fd.792
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0xde86255
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0xe4e1c00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x12f
ja 0x70b6b2cd
cmp eax, 0x127
jae 0x70b6b2bd
cmp eax, 0x106
jb case.0x70b6b4fd.792
cmp eax, 0x10d
ja case.0x70b6b4fd.792
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0xfe502ab
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x11e1a300
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x161
ja 0x70b6b311
cmp eax, 0x159
jae 0x70b6b301
cmp eax, 0x148
jb case.0x70b6b4fd.792
cmp eax, 0x151
ja case.0x70b6b4fd.792
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0x13de4355
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0x14dc9380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x194
ja 0x70b6b355
cmp eax, 0x18a
jae 0x70b6b345
cmp eax, 0x169
jb case.0x70b6b4fd.792
cmp eax, 0x172
ja case.0x70b6b4fd.792
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x15dae3ab
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0x17d78400
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x1c7
ja 0x70b6b399
cmp eax, 0x1bb
jae 0x70b6b389
cmp eax, 0x1aa
jb case.0x70b6b4fd.792
cmp eax, 0x1b6
ja case.0x70b6b4fd.792
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0x19d42455
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x1ad27480
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x1f9
ja 0x70b6b3dd
cmp eax, 0x1ec
jae 0x70b6b3cd
cmp eax, 0x1cb
jb case.0x70b6b4fd.792
cmp eax, 0x1d7
ja case.0x70b6b4fd.792
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0x1bd0c4ab
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0x1dcd6500
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x22c
ja 0x70b6b421
cmp eax, 0x21d
jae 0x70b6b411
cmp eax, 0x20d
jb case.0x70b6b4fd.792
cmp eax, 0x21b
ja case.0x70b6b4fd.792
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x1fca0555
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0x20c85580
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x28f
ja 0x70b6b465
cmp eax, 0x280
jae 0x70b6b455
cmp eax, 0x24f
jb case.0x70b6b4fd.792
cmp eax, 0x25e
ja case.0x70b6b4fd.792
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0x23c34600
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x26be3680
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x2c3
ja 0x70b6b4a9
cmp eax, 0x2b1
jae 0x70b6b499
cmp eax, 0x290
jb case.0x70b6b4fd.792
cmp eax, 0x2a2
ja case.0x70b6b4fd.792
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0x27bc86ab
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0x29b92700
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x2f6
ja 0x70b6b4e9
cmp eax, 0x2e5
jae 0x70b6b4d9
cmp eax, 0x2d2
jb case.0x70b6b4fd.792
cmp eax, 0x2e4
ja case.0x70b6b4fd.792
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x2bb5c755
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0x2cb41780
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 0xfffffcec
cmp eax, 0xde
ja case.0x70b6b4fd.792
xor edx, edx
mov dl, byte [eax + 0x70b6b570]
jmp dword [edx*4 + 0x70b6b55c]
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0x3b9aca00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 0x37a18955
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x33a848ab
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0x2faf0800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x1c]
mov dword [edx], 1
mov dword [ecx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret