Function at 0x1000d6760
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
mov r11, rsp
push rbp
push r14
lea rbp, [r11 - 0xd88]
sub rsp, 0xe78
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rbp + 0xd50], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x20], r12
xor ebx, ebx
test dword [rcx + 0x2d8], 0x1000
mov qword [r11 - 0x28], r15
mov r14, rcx
movsxd r15, edx
je 0x1000d67bc
test edx, edx
je 0x1000d67b5
cmp r15d, 2
je 0x1000d67b5
cmp r15d, 1
jne 0x1000d67bc
mov eax, 1
jmp 0x1000d67be
mov eax, ebx
cmp r15d, 6
je 0x1000d67cb
or dword [rcx + 0x220], 0x40
mov r12, qword [rcx + 0x210]
test eax, eax
jne 0x1000d6acd
cmp r15d, 6
ja case.default.0x1000d6806
lea rdx, [0x100000000]
mov qword [rsp + 0xea8], rsi
mov qword [rsp + 0xe70], rdi
mov ecx, dword [rdx + r15*4 + 0xd7024]
add rcx, rdx
jmp rcx
call fcn.100073d40
test eax, eax
je 0x1000d684d
lea rcx, [rsp + 0x70]
call fcn.100073cf0
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.100073d50
lea rcx, [rsp + 0x70]
mov rdx, r14
call fcn.100073d60
lea rcx, [rsp + 0x70]
mov edx, 1
call fcn.100073d70
lea rcx, [rsp + 0x70]
call fcn.100073d80
lea rsi, [r14 + 0x2b8]
mov rdi, qword [rsi + 8]
cmp rdi, rsi
je 0x1000d6885
nop dword [rax]
mov r8, rdi
test rdi, rdi
je 0x1000d6885
mov rax, qword [rdi + 8]
mov rcx, qword [r8 + 0x18]
mov edx, 1
mov rdi, rax
cmp rax, rsi
cmove rdi, rbx
call qword [r8 + 0x10]
jmp 0x1000d6860
call fcn.100073d40
test eax, eax
je 0x1000d68d7
lea rcx, [rbp + 0x410]
call fcn.100073cf0
lea rcx, [rbp + 0x410]
mov edx, 1
call fcn.100073d50
lea rcx, [rbp + 0x410]
mov rdx, r14
call fcn.100073d60
lea rcx, [rbp + 0x410]
mov edx, 1
call fcn.100073d70
lea rcx, [rbp + 0x410]
call fcn.100073d80
cmp qword [r14 + 0x3d8], rbx
je 0x1000d68ff
call fcn.100068bb0
test byte [rax + 0xbb], 0x10
je 0x1000d68ff
mov rcx, qword [r14 + 0x3d8]
mov edx, 6
call fcn.1000680b0
call fcn.10011b7d0
test eax, eax
je 0x1000d691a
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x38]
jmp 0x1000d6922
mov r11, qword [0x7ffe0008]
mov qword [r14 + 0x2e8], r11
mov qword [r14 + 0x2f0], r11
rdtsc
mov rcx, qword [r14 + 0x218]
shl rdx, 0x20
or rax, rdx
add rax, qword [rcx + 0xab0]
mov qword [r14 + 0x2f8], rax
jmp case.0x1000d6806.5
call fcn.10011b7d0
test eax, eax
je 0x1000d696e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rdi, qword [rsp + 0x60]
jmp 0x1000d6976
mov rdi, qword [0x7ffe0008]
mov rax, qword [r14 + 0x2e8]
cmp rdi, rax
jb 0x1000d69cd
mov rbx, rdi
sub rbx, rax
je 0x1000d69cd
add qword [r14 + 0x3a0], rbx
mov rax, qword [r14 + 0x218]
test byte [rax + 0x1008], 8
jne 0x1000d69cd
call fcn.100068930
test eax, eax
je 0x1000d69b9
mov rcx, qword [r14 + 0x1f0]
mov rdx, rbx
call fcn.100108820
mov rcx, qword [r14 + 0x3a8]
test rcx, rcx
je 0x1000d69cd
mov rax, rbx
lock xadd qword [rcx], rax
movabs rsi, 0x7fffffffffffffff
cmp qword [r14 + 0x2f8], rsi
je 0x1000d6a2a
mov rax, qword [r14 + 0x3b0]
mov rcx, rbx
cmp rax, rbx
cmova rcx, rax
cmp qword [r14 + 0x3d8], 0
mov qword [r14 + 0x3b0], rcx
je 0x1000d6a53
mov rax, qword [0x1002784f0]
cmp rbx, rax
jbe 0x1000d6a2a
mov rcx, qword [r14 + 0x2f0]
cmp rdi, rcx
jb 0x1000d6a2a
sub rdi, rcx
cmp rdi, rax
jbe 0x1000d6a2a
mov rcx, r14
call fcn.100066420
cmp qword [r14 + 0x3d8], 0
je 0x1000d6a53
call fcn.100068bb0
test byte [rax + 0xbb], 0x10
je 0x1000d6a53
mov rcx, qword [r14 + 0x3d8]
mov edx, 6
call fcn.1000680b0
call fcn.10011b7d0
test eax, eax
je 0x1000d6a6e
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x48]
jmp 0x1000d6a76
mov r11, qword [0x7ffe0008]
mov qword [r14 + 0x2e8], r11
mov qword [r14 + 0x2f0], r11
rdtsc
mov rcx, qword [r14 + 0x218]
shl rdx, 0x20
or rax, rdx
add rax, qword [rcx + 0xab0]
mov qword [r14 + 0x2f8], rax
inc dword [r14 + 0x88]
mov rsi, qword [rsp + 0xea8]
mov rdi, qword [rsp + 0xe70]
test r12, r12
je 0x1000d6acd
mov rcx, qword [r14 + 0x210]
mov edx, r15d
call fcn.1000cf4c0
mov r12, qword [rsp + 0xe68]
mov rbx, qword [rsp + 0xea0]
cmp r15d, 6
mov r15, qword [rsp + 0xe60]
je 0x1000d6b00
mov eax, dword [r14 + 0x220]
mov ecx, eax
xor ecx, 0x40
and ecx, eax
mov dword [r14 + 0x220], ecx
mov rcx, qword [rbp + 0xd50]
xor rcx, rsp
call fcn.10005f420
add rsp, 0xe78
pop r14
pop rbp
ret
call fcn.10011b7d0
test eax, eax
je 0x1000d6b35
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rsi, qword [rsp + 0x58]
jmp 0x1000d6b3d
mov rsi, qword [0x7ffe0008]
mov rax, qword [r14 + 0x2e8]
cmp rsi, rax
jb 0x1000d6b94
mov rdi, rsi
sub rdi, rax
je 0x1000d6b94
add qword [r14 + 0x3a0], rdi
call fcn.10006b640
call fcn.100068930
test eax, eax
je 0x1000d6b75
mov rcx, qword [r14 + 0x1f0]
mov rdx, rdi
call fcn.100108820
mov rax, qword [r14 + 0x3a8]
test rax, rax
je 0x1000d6b86
lock xadd qword [rax], rdi
mov qword [r14 + 0x2e8], rsi
mov qword [r14 + 0x2f0], rsi
mov rcx, qword [r14 + 0x1d8]
test rcx, rcx
je 0x1000d6bf9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x1000d6be4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x1004df3c0]
lea rdx, [0x1004df3b0]
mov dword [rsp + 0x28], eax
lea rax, [0x1004df3f8]
mov r9d, 0xe4c
mov ecx, 1
mov qword [rsp + 0x20], rax
call fcn.1001522c0
mov rax, qword [r14 + 0x228]
mov qword [r14 + 0x1d8], rbx
mov qword [rax + 0x108], rbx
call fcn.100073d40
test eax, eax
je 0x1000d6c48
lea rcx, [rbp + 0x8b0]
call fcn.100073cf0
lea rcx, [rbp + 0x8b0]
xor edx, edx
call fcn.100073d50
lea rcx, [rbp + 0x8b0]
mov rdx, r14
call fcn.100073d60
lea rcx, [rbp + 0x8b0]
mov edx, 2
call fcn.100073d70
lea rcx, [rbp + 0x8b0]
call fcn.100073d80
lea rsi, [r14 + 0x2c8]
mov rdi, qword [rsi + 8]
cmp rdi, rsi
je 0x1000d6c7d
mov r8, rdi
test rdi, rdi
je 0x1000d6c7d
mov rax, qword [rdi + 8]
mov rcx, qword [r8 + 0x18]
mov edx, 2
mov rdi, rax
cmp rax, rsi
cmove rdi, rbx
call qword [r8 + 0x10]
jmp 0x1000d6c58
call fcn.100073d40
test eax, eax
je 0x1000d6ccf
lea rcx, [rbp + 0x1c0]
call fcn.100073cf0
lea rcx, [rbp + 0x1c0]
mov edx, 1
call fcn.100073d50
lea rcx, [rbp + 0x1c0]
mov rdx, r14
call fcn.100073d60
lea rcx, [rbp + 0x1c0]
mov edx, 2
call fcn.100073d70
lea rcx, [rbp + 0x1c0]
call fcn.100073d80
lea r10, [r14 + 0x2a8]
mov r11d, 3
nop dword [rax]
mov r8, qword [r10 + 8]
cmp r8, r10
je 0x1000d6d28
mov rdx, rbx
nop dword [rax]
mov r9, r8
test r8, r8
je 0x1000d6d06
mov rax, qword [r8 + 8]
mov r8, rax
cmp rax, r10
cmove r8, rbx
test rdx, rdx
je 0x1000d6d20
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov qword [rax + 8], rcx
mov qword [rcx], rax
mov qword [rdx + 8], rbx
mov qword [rdx], rbx
mov rdx, r9
test r9, r9
jne 0x1000d6cf0
add r10, 0x10
dec r11
jne 0x1000d6ce0
jmp case.0x1000d6806.5
call fcn.100073d40
test eax, eax
je 0x1000d6d82
lea rcx, [rbp + 0x660]
call fcn.100073cf0
lea rcx, [rbp + 0x660]
xor edx, edx
call fcn.100073d50
lea rcx, [rbp + 0x660]
mov rdx, r14
call fcn.100073d60
lea rcx, [rbp + 0x660]
xor edx, edx
call fcn.100073d70
lea rcx, [rbp + 0x660]
call fcn.100073d80
lea rsi, [r14 + 0x2a8]
mov rdi, qword [rsi + 8]
cmp rdi, rsi
je 0x1000d6db4
mov r8, rdi
test rdi, rdi
je 0x1000d6db4
mov rax, qword [rdi + 8]
mov rcx, qword [r8 + 0x18]
mov rdi, rax
cmp rax, rsi
cmove rdi, rbx
xor edx, edx
call qword [r8 + 0x10]
jmp 0x1000d6d92
call fcn.100073d40
test eax, eax
je 0x1000d6e03
lea rcx, [rbp + 0xb00]
call fcn.100073cf0
lea rcx, [rbp + 0xb00]
mov edx, 1
call fcn.100073d50
lea rcx, [rbp + 0xb00]
mov rdx, r14
call fcn.100073d60
lea rcx, [rbp + 0xb00]
xor edx, edx
call fcn.100073d70
lea rcx, [rbp + 0xb00]
call fcn.100073d80
inc dword [r14 + 0x88]
call fcn.10011b7d0
test eax, eax
je 0x1000d6e25
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rdi, qword [rsp + 0x40]
jmp 0x1000d6e2d
mov rdi, qword [0x7ffe0008]
mov rax, qword [r14 + 0x2e8]
cmp rdi, rax
jb 0x1000d6e84
mov rbx, rdi
sub rbx, rax
je 0x1000d6e84
add qword [r14 + 0x3a0], rbx
mov rax, qword [r14 + 0x218]
test byte [rax + 0x1008], 8
jne 0x1000d6e84
call fcn.100068930
test eax, eax
je 0x1000d6e70
mov rcx, qword [r14 + 0x1f0]
mov rdx, rbx
call fcn.100108820
mov rcx, qword [r14 + 0x3a8]
test rcx, rcx
je 0x1000d6e84
mov rax, rbx
lock xadd qword [rcx], rax
movabs rsi, 0x7fffffffffffffff
cmp qword [r14 + 0x2f8], rsi
je case.0x1000d6806.5
mov rax, qword [r14 + 0x3b0]
mov rcx, rbx
cmp rax, rbx
cmova rcx, rax
cmp qword [r14 + 0x3d8], 0
mov qword [r14 + 0x3b0], rcx
je case.0x1000d6806.5
mov rax, qword [0x1002784f0]
cmp rbx, rax
jbe case.0x1000d6806.5
mov rcx, qword [r14 + 0x2f0]
cmp rdi, rcx
jb case.0x1000d6806.5
sub rdi, rcx
cmp rdi, rax
jbe case.0x1000d6806.5
mov rcx, r14
call fcn.100066420
jmp case.0x1000d6806.5
mov rax, qword [r14 + 0x218]
lock inc dword [rax + 0x105c]
inc dword [r14 + 0x88]
call fcn.10011b7d0
test eax, eax
je 0x1000d6f2a
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rdi, qword [rsp + 0x50]
jmp 0x1000d6f32
mov rdi, qword [0x7ffe0008]
mov rax, qword [r14 + 0x2e8]
cmp rdi, rax
jb 0x1000d6f89
mov rbx, rdi
sub rbx, rax
je 0x1000d6f89
add qword [r14 + 0x3a0], rbx
mov rax, qword [r14 + 0x218]
test byte [rax + 0x1008], 8
jne 0x1000d6f89
call fcn.100068930
test eax, eax
je 0x1000d6f75
mov rcx, qword [r14 + 0x1f0]
mov rdx, rbx
call fcn.100108820
mov rcx, qword [r14 + 0x3a8]
test rcx, rcx
je 0x1000d6f89
mov rax, rbx
lock xadd qword [rcx], rax
movabs rsi, 0x7fffffffffffffff
cmp qword [r14 + 0x2f8], rsi
je 0x1000d6fe6
mov rax, qword [r14 + 0x3b0]
mov rcx, rbx
cmp rax, rbx
cmova rcx, rax
cmp qword [r14 + 0x3d8], 0
mov qword [r14 + 0x3b0], rcx
je 0x1000d6fe6
mov rax, qword [0x1002784f0]
cmp rbx, rax
jbe 0x1000d6fe6
mov rcx, qword [r14 + 0x2f0]
cmp rdi, rcx
jb 0x1000d6fe6
sub rdi, rcx
cmp rdi, rax
jbe 0x1000d6fe6
mov rcx, r14
call fcn.100066420
call fcn.10011b7d0
test eax, eax
je 0x1000d7001
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x30]
jmp 0x1000d7009
mov r11, qword [0x7ffe0008]
mov qword [r14 + 0x2e8], r11
mov qword [r14 + 0x2f0], r11
mov qword [r14 + 0x2f8], rsi
jmp case.0x1000d6806.5