Function at 0x180037830
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rbx, rcx
rdtsc
mov rcx, rdx
shl rcx, 0x20
or rcx, rax
rdtsc
shl rdx, 0x20
or rdx, rax
cmp rcx, rdx
mov eax, 0x76c9f695
mov r14d, 0x66210d3f
cmove r14d, eax
mov r8, r14
xor r8, 0x66210d1f
lea rsi, [rsp + 0x90]
mov rcx, rsi
xor edx, edx
call fcn.18003ad10
mov r8, r14
xor r8, 0x66210d2f
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
call fcn.18003ad10
mov r8, qword [rsp + 0x60]
mov rax, r14
xor rax, 0x66210d3e
movabs r9, 0x3e8b7e2c68ba5aad
lea rcx, [r9 + 1]
xor rcx, r14
mov rdx, qword [rsp + 0x60]
xor rdx, rcx
mov r10, r14
xor r10, 0x66210d3d
imul r10, rdx
or rcx, qword [rsp + 0x60]
mov rdx, r14
xor rdx, 0xffffffff99def2c1
imul rcx, rdx
mov r11, qword [rsp + 0x60]
xor r11, r14
movabs r15, 0xc17481d39745a551
xor r15, r11
add r15, r8
xor r9, r14
mov r8, r14
xor r8, 0x66210da6
add r8, r9
add r8, r10
add r8, rcx
imul r15, rax
add r15, r8
movabs rcx, 0x914860ef54ac2572
xor rcx, r14
imul rcx, r15
movabs r8, 0xad3eb23d11dc230f
xor r8, r14
add r8, rcx
mov qword [rsp + 0x88], r8
movabs rcx, 0x55896552af7b5dba
xor rcx, r14
imul rcx, qword [rsp + 0x88]
movabs r8, 0x7fe67cebf8090c2f
xor r8, r14
add r8, rcx
mov qword [rsp + 0xa8], r8
mov rcx, qword [rbx]
mov qword [rsp + 0xa0], rcx
movabs r8, 0x5949c9a8452909d3
xor r8, r14
mov r9, r8
sub r9, qword [rsp + 0x78]
mov r10, qword [rsp + 0x78]
xor r10, r14
movabs r11, 0xa6b63657bad6f62c
xor r11, r10
imul r11, rax
mov rax, qword [rsp + 0x78]
not rax
or rax, r8
imul rax, rdx
add rax, r9
add rax, r11
movabs rdx, 0xfe2e6b07ac6bf930
xor rdx, r14
imul rdx, rax
movabs rax, 0x99fc2027daa33a87
xor rax, r14
add rax, rdx
mov qword [rsp + 0x80], rax
movabs rax, 0xc1538866a3f877d0
xor rax, r14
imul rax, qword [rsp + 0x80]
movabs rdx, 0x2e68187f46c94607
xor rdx, r14
add rdx, rax
mov qword [rsp + 0x98], rdx
mov edx, r14d
xor edx, 0xc0868ac0
mov r8d, dword [rsp + 0x5c]
and r8d, edx
mov eax, r14d
xor eax, 0x66210d3e
mov r9d, r14d
xor r9d, 0x3f79753e
xor edx, dword [rsp + 0x5c]
add edx, r8d
mov r8d, r14d
xor r8d, 0x3f79753f
mov r10d, dword [rsp + 0x5c]
xor r10d, r8d
add r10d, edx
or r8d, dword [rsp + 0x5c]
mov edx, r14d
xor edx, 0x66202d1b
add edx, r9d
sub edx, r8d
imul r10d, eax
add r10d, edx
mov edx, r14d
xor edx, 0x5df13ecc
imul edx, r10d
mov r8d, r14d
xor r8d, 0x471707b
add r8d, edx
mov dword [rsp + 0x74], r8d
mov r8d, r14d
xor r8d, 0xc8199004
imul r8d, dword [rsp + 0x74]
mov edx, r14d
xor edx, 0x3de1606b
add edx, r8d
mov r8d, dword [rsp + 0x58]
not r8d
mov r9d, r14d
xor r9d, 0x3fb414c9
and r8d, r9d
mov r10d, r14d
xor r10d, 0x99def2c1
imul r10d, r8d
mov r8d, dword [rsp + 0x58]
xor r8d, r9d
mov r11d, r14d
xor r11d, 0x66210d3d
imul r11d, r8d
mov ebx, dword [rsp + 0x58]
or ebx, r9d
mov ebp, r14d
xor ebp, 0x3fb414c8
mov r15d, dword [rsp + 0x58]
not r15d
or r15d, r9d
imul r15d, eax
mov r8d, r14d
xor r8d, 0x66210d1f
add ebp, r8d
add ebp, r10d
add ebp, r11d
sub ebp, ebx
add ebp, r15d
mov r9d, r14d
xor r9d, 0x6811e47e
imul r9d, ebp
mov r10d, r14d
xor r10d, 0xcdaa520f
add r10d, r9d
mov dword [rsp + 0x70], r10d
mov r10d, r14d
xor r10d, 0x5bc1abfe
imul r10d, dword [rsp + 0x70]
mov r9d, r14d
xor r9d, 0xf41511ef
add r9d, r10d
mov r10d, dword [rsp + 0x54]
mov r11d, r14d
xor r11d, 0x8a3d136d
add r8d, r11d
or r11d, dword [rsp + 0x54]
mov ebx, dword [rsp + 0x54]
not ebx
add ebx, r10d
mov r10d, r14d
xor r10d, 0x75c2ec92
and r10d, dword [rsp + 0x54]
imul ebx, eax
sub r8d, r11d
add r8d, r10d
lea eax, [rbx + r8]
inc eax
mov r8d, r14d
xor r8d, 0xac9f19cc
imul r8d, eax
mov eax, r14d
xor eax, 0x2406a0e1
add eax, r8d
mov dword [rsp + 0x6c], eax
mov eax, r14d
xor eax, 0x95a42904
imul eax, dword [rsp + 0x6c]
xor r14d, 0x7830b8e9
add r14d, eax
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
xor ecx, ecx
cmp qword [rsp + 0x98], 0
sete cl
test eax, eax
mov eax, 0xffffffff
cmovns eax, ecx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret