Function at 0x180072570
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov qword [rsp + 0x40], rbp
mov rbx, rdx
mov byte [r8], 0
mov rbp, rcx
mov rax, qword [rdx + 0x32510]
inc rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r14
mov r14, r8
mov qword [rdx + 0x32510], rax
mov qword [rsp + 0x20], r15
call fcn.1801d5c60
test al, al
je 0x1800727ba
xor r15d, r15d
nop dword [rax]
mov eax, dword [rbp + 4]
test eax, 0xc0000
jne 0x1800725d5
mov rax, qword [rbx]
test rax, 0x30000
je 0x180072619
mov rax, qword [rbx]
test rax, 0x30000
je 0x1800725e8
lock and qword [rbx], 0xfffffffffffcffff
mov eax, dword [rbp + 4]
bt eax, 0x12
jae 0x18007260c
mov eax, dword [rbp + 4]
bt eax, 0x13
jb 0x18007260c
mov rcx, rbp
call sym.VBoxVMM.dll_PGMR3PhysAllocateHandyPages
mov esi, eax
test eax, eax
js 0x1800727bf
mov eax, dword [rbp + 4]
bt eax, 0x13
jb 0x1800727fe
mov rdx, rbx
mov rcx, rbp
call fcn.180070ba0
test al, al
rdtsc
je 0x18007269e
shl rdx, 0x20
mov rcx, rbp
or rax, rdx
mov rdx, rbx
mov rdi, rax
call fcn.18007dd60
mov esi, eax
rdtsc
mov rcx, qword [rbx + 0x32358]
shl rdx, 0x20
or rdx, rax
sub rdx, rdi
add rcx, rdx
mov qword [rbx + 0x32358], rcx
mov rcx, qword [rbx + 0x32350]
inc rcx
mov qword [rbx + 0x32350], rcx
mov rcx, qword [rbx + 0x32360]
cmp rcx, rdx
jae 0x180072682
mov qword [rbx + 0x32360], rdx
mov rax, qword [rbx + 0x32368]
cmp rax, rdx
jbe 0x180072728
mov qword [rbx + 0x32368], rdx
jmp 0x180072728
shl rdx, 0x20
mov ecx, 5
or rax, rdx
mov qword [rbx + 0x32298], rax
call qword [sym.imp.VBoxRT.dll_RTThreadSleep]
mov rax, qword [rbx + 0x32298]
test rax, rax
je 0x180072725
rdtsc
mov rcx, qword [rbx + 0x32298]
mov qword [rbx + 0x32298], r15
shl rdx, 0x20
or rdx, rax
sub rdx, rcx
mov rcx, qword [rbx + 0x32280]
add rcx, rdx
mov qword [rbx + 0x32280], rcx
mov rcx, qword [rbx + 0x32278]
inc rcx
mov qword [rbx + 0x32278], rcx
mov rcx, qword [rbx + 0x32288]
cmp rcx, rdx
jae 0x180072712
mov qword [rbx + 0x32288], rdx
mov rax, qword [rbx + 0x32290]
cmp rax, rdx
jbe 0x180072725
mov qword [rbx + 0x32290], rdx
mov esi, r15d
lock and qword [rbx], 0xffffffffefffffff
mov eax, dword [rbp + 4]
bt eax, 0x13
jb 0x180072744
mov rax, qword [rbx]
test rax, 0x200010a0
je 0x180072754
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call fcn.180070ab0
mov esi, eax
lea eax, [rsi - 0x44c]
cmp eax, 0x14
jbe 0x1800727bf
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call fcn.180072270
mov esi, eax
test eax, eax
jne 0x1800727bf
mov rdx, rbx
mov rcx, rbp
call fcn.1801c23d0
mov eax, dword [rbp + 4]
test eax, eax
jne 0x18007278c
mov rax, qword [rbx]
test eax, eax
je 0x1800727a7
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
call fcn.18006ff10
mov esi, eax
test eax, eax
je 0x1800727a7
cmp eax, 0x45c
jne 0x1800727f8
mov rdx, rbx
mov rcx, rbp
call fcn.1801d5c60
test al, al
jne 0x1800725c0
mov esi, 0x45b
mov rdx, qword [rbx + 0x19150]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
test rdx, rdx
je 0x1800727ef
mov rcx, rbx
call fcn.1801d5c30
test eax, eax
jns 0x1800727ef
test esi, esi
jns 0x1800727f1
mov eax, esi
add rsp, 0x28
pop rsi
pop rbx
ret
mov byte [r14], 1
jmp 0x1800727bf
mov esi, 0x45a
jmp 0x1800727bf