Function at 0x140003a90
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r14, r8
mov rdi, rdx
mov rbx, rcx
rdtsc
mov rcx, rdx
shl rcx, 0x20
or rcx, rax
rdtsc
shl rdx, 0x20
or rdx, rax
cmp rcx, rdx
mov eax, 0xe91c4cb3
mov esi, 0xb3822e87
cmove esi, eax
mov rcx, r8
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_RtlGetFullPathName_U]
test eax, eax
je 0x140003d07
mov qword [rsp + 0x40], rdi
mov ecx, esi
xor ecx, 0xd47b7465
mov edx, esi
xor edx, 0x2b848b9a
mov r12d, esi
xor r12d, 0xb3822e86
add eax, edx
add eax, r12d
sub eax, dword [rsp + 0x34]
mov edx, dword [rsp + 0x34]
xor edx, ecx
mov r13d, esi
xor r13d, 0x4c7dd179
imul edx, r13d
add edx, eax
mov eax, dword [rsp + 0x34]
or eax, ecx
mov edi, esi
xor edi, 0xb3822e85
imul eax, edi
xor ecx, dword [rsp + 0x34]
add eax, edx
lea ebp, [rcx + rax]
inc ebp
mov eax, esi
xor eax, 0xd31acffb
mov edx, dword [rsp + 0x30]
xor edx, esi
xor edx, 0x2ce53004
imul edx, r13d
mov ecx, esi
xor ecx, 0x2ce53002
mov r8d, dword [rsp + 0x30]
not r8d
or r8d, eax
imul r8d, edi
mov r9d, esi
xor r9d, 4
or r9d, dword [rsp + 0x30]
and eax, dword [rsp + 0x30]
imul r9d, r12d
add ecx, r12d
add ecx, r8d
add ecx, edx
add ecx, r9d
add ecx, eax
mov r8d, ebp
shl r8d, cl
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
mov eax, esi
xor eax, 0x37bd6c7a
or eax, dword [rsp + 0x38]
imul eax, edi
mov r9d, esi
xor r9d, 0xc8429385
mov edx, dword [rsp + 0x38]
xor edx, r9d
mov r10d, dword [rsp + 0x38]
not r10d
add r10d, edx
mov edx, esi
xor edx, 0xb3822e8c
imul r10d, r12d
add edx, r9d
add edx, eax
add edx, r10d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r15, rax
mov rcx, r14
mov edx, ebp
mov r8, rax
xor r9d, r9d
call qword [sym.imp.ntdll.dll_RtlGetFullPathName_U]
test eax, eax
je 0x140003d4d
mov eax, eax
mov word [r15 + rax*2], 0
mov rcx, r15
call section..text
test rax, rax
je 0x140003db1
mov r14, rax
mov rcx, rax
call fcn.1400021d0
mov ebp, eax
mov r8d, eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
imul r13d, dword [rsp + 0x24]
mov eax, esi
xor eax, 0x1d2547b4
mov edx, esi
xor edx, 0xe2dab849
mov r9d, dword [rsp + 0x24]
or r9d, edx
imul r9d, edi
mov r10d, esi
xor r10d, 0x1d2547b6
or r10d, dword [rsp + 0x24]
imul r10d, r12d
and edx, dword [rsp + 0x24]
add edx, r10d
xor esi, 0xb3822e8f
add esi, eax
add esi, r13d
add esi, r9d
add esi, edx
mov edx, esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r12, rax
mov rcx, r14
mov rdx, rax
mov r8d, ebp
call fcn.1400012e0
rdtsc
rdtsc
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, rbx
mov rdx, qword [rsp + 0x40]
mov r8, r12
call fcn.140003e30
mov esi, eax
test r12, r12
je 0x140003ce6
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, r12
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, r15
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140003e1b
mov eax, esi
xor eax, 0xcd47345f
and eax, dword [rsp + 0x3c]
mov ecx, esi
xor ecx, 0x32b8cba0
mov edx, dword [rsp + 0x3c]
and edx, ecx
mov r8d, esi
xor r8d, 0xb3822e86
xor ecx, dword [rsp + 0x3c]
add ecx, edx
imul ecx, r8d
mov edx, esi
xor edx, 0xcd47345e
xor esi, 0x73822fb2
add esi, edx
sub esi, eax
add esi, ecx
jmp 0x140003e1b
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, r15
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
xor eax, 0x96118ffc
mov ecx, dword [rsp + 0x2c]
and ecx, eax
mov edx, esi
xor edx, 0xb3822e84
imul edx, ecx
mov ecx, esi
xor ecx, 0x69ee7002
xor esi, 0x73822fb2
add esi, ecx
sub esi, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x2c]
xor ecx, eax
add ecx, esi
and eax, dword [rsp + 0x2c]
add ecx, edx
not eax
imul r12d, eax
lea esi, [r12 + rcx]
inc esi
jmp 0x140003e1b
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, r15
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
xor eax, 0xa22d6031
mov ecx, dword [rsp + 0x28]
and ecx, eax
mov edx, dword [rsp + 0x28]
not edx
mov r8d, esi
xor r8d, 0x5dd29fce
and edx, r8d
imul edx, edi
mov r9d, esi
xor r9d, 0xa22d6030
xor eax, dword [rsp + 0x28]
add eax, ecx
and r8d, dword [rsp + 0x28]
xor esi, 0x73822fb2
add esi, r9d
add esi, edx
add esi, r8d
imul eax, r12d
add esi, eax
inc esi
mov eax, esi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret