Function at 0x14035d250
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xcd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc50], 0xfffffffffffffffe
mov qword [rbp + 0xc48], 0
cmp rcx, 0x1fefa
je 0x14035d2bb
mov rsi, rdx
mov rbx, rcx
call fcn.14035e0d0
rdtsc
mov r12, rax
mov r13, rdx
shl r13, 0x20
test rsi, rsi
je 0x14035d318
mov rax, qword [rsi]
cmp rax, 7
jb 0x14035d308
inc qword [0x1405461f0]
jmp 0x14035d345
cmp qword [0x14054625c], 0x33c0
jne 0x14035df07
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x38], 0x328b2d2f
mov dword [rsp + 0x30], 0xaed649b8
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.1403608d0
add rax, 0x33c0
mov qword [0x14054625c], rax
jmp 0x14035df07
cmp rax, qword [0x1405461e8]
jbe 0x14035d318
mov qword [0x1405461e8], rax
xor r14d, r14d
test rbx, rbx
je 0x14035d345
mov qword [rbp + 0xbf8], rsi
nop word [rax + rax]
mov edi, r14d
movzx eax, byte [rbx + rdi]
test eax, eax
je 0x14035d34f
cmp eax, 0x2e
je 0x14035d34f
inc r14d
jmp 0x14035d330
xor r15d, r15d
xor esi, esi
jmp 0x14035dd9b
xor r15d, r15d
cmp byte [rbx + rdi], 0x2e
mov esi, 0
jne 0x14035dd9b
mov qword [rbp + 0xc30], 0
mov r8d, 0x400
sub r8, rdi
xor esi, esi
cmp r14d, 0x400
cmovae r8, rsi
lea rcx, [rdi + rbp]
add rcx, 0x7c0
xor edx, edx
call fcn.140404f80
lea r15, [rbp + 0x7c0]
mov rcx, r15
mov qword [rbp + 0xc08], rbx
mov rdx, rbx
mov r8, rdi
call fcn.1404048d0
mov ecx, 1
xor edx, edx
mov r8, r15
mov r9d, 0xce7c9fb1
call fcn.1403605e0
mov qword [rbp + 0xc30], rax
mov ecx, 0
mov qword [rbp + 0xc40], rcx
test rax, rax
jne 0x14035d4f8
xor eax, eax
mov qword [rbp + 0xc40], rax
lea rcx, [rbp + 0x7c0]
xor edx, edx
call fcn.14035ca00
xor ecx, ecx
test rax, rax
sete cl
lea rbx, [0x140546140]
inc qword [rbx + rcx*8 + 0x58]
mov qword [rbp + 0xc30], rax
test rax, rax
jne 0x14035d4f8
mov r15d, 1
xor eax, eax
mov qword [rbp + 0xc40], rax
mov ecx, 1
xor edx, edx
mov r8d, 0x1a223a2b
mov r9d, 0x7fb4a6fe
call fcn.1403607f0
test rax, rax
je 0x14035d4f8
mov qword [rbp + 0xbd8], 0
lea rcx, [rbp - 0x40]
mov qword [rbp + 0xbe0], rcx
xor ecx, ecx
xor r10d, r10d
nop word [rax + rax]
mov edx, r10d
mov r8d, r10d
movsx r9d, byte [rbp + r8 + 0x7c0]
xor r10d, r10d
test r9w, r9w
setne r10b
mov word [rbp + r8*2 - 0x40], r9w
movzx ecx, cl
cmove ecx, r15d
add r10d, edx
mov edx, ecx
xor dl, 0xfe
test dl, cl
je 0x14035d470
lea ecx, [r10 + r10]
mov word [rbp + 0xbd8], cx
neg ecx
xor ecx, 0xfffffffe
shl r10d, 2
sub r10d, ecx
mov word [rbp + 0xbda], r10w
lea r8, [rbp + 0xbd8]
lea r9, [rbp + 0xc30]
xor ecx, ecx
xor edx, edx
call qword [case.0x140119ecb.0]
mov rdx, qword [rbp + 0xc30]
xor eax, eax
mov rcx, rdx
mov qword [rbp + 0xc40], rdx
test rdx, rdx
sete al
inc qword [rbx + rax*8 + 0x20]
lea rcx, [rbp + 0x7c0]
xor edx, edx
mov r8, rdi
call fcn.140404f80
lea eax, [r14 + 1]
mov ecx, dword [0x14055f570]
mov edx, eax
not edx
mov r8d, ecx
xor r8d, edx
xor edx, eax
and edx, ecx
xor edx, eax
and r8d, ecx
lea eax, [rdx + r8*2]
mov rcx, qword [rbp + 0xc08]
movzx ebx, byte [rcx + rax]
mov r15d, 0
cmp bl, 0x23
jne 0x14035d56d
add r14d, 2
mov rax, qword [rbp + 0xc08]
lea rcx, [rax + r14]
mov edx, 0x502f480
mov r8d, 0x4d3d69cb
mov r9d, 0xc307d0da
call fcn.140348260
mov esi, eax
mov r15b, 1
mov eax, r14d
mov rcx, qword [rbp + 0xbf8]
test rcx, rcx
mov r11, qword [rbp + 0xc40]
je 0x14035d592
cmp qword [rcx], 7
jb 0x14035d592
inc qword [0x1405461f0]
jmp 0x14035dd5e
mov rdi, qword [rbp + 0xc30]
test rdi, rdi
je 0x14035dd5e
movsxd rdx, dword [rdi + 0x3c]
mov ecx, dword [rdi + rdx + 0x88]
test rcx, rcx
je 0x14035dd5e
mov r14, rsi
mov esi, dword [rdi + rdx + 0x8c]
test rsi, rsi
je 0x14035dd5e
cmp dword [rdi + rdx + 0x8c], 0x28
jb 0x14035dd5e
lea r8, [rdi + rcx]
add rsi, r8
mov edx, dword [r8 + 0x1c]
add rdx, rdi
mov qword [rbp + 0xbf0], rdx
mov edx, dword [r8 + 0x14]
cmp bl, 0x23
jne 0x14035d6c3
mov eax, dword [r8 + 0x10]
mov r8, qword [0x140546170]
movabs r9, 0x99211882cdc31508
xor r9, r8
movabs r10, 0x19211882cdc31508
and r10, r8
lea r8, [r9 + r10*2]
movabs r9, 0x66dee77d323ceaf9
add r9, r8
mov qword [0x140546170], r9
test edx, edx
je 0x14035dd5e
mov r9, rsi
mov sil, 1
mov r8d, r14d
sub r8d, eax
jb 0x14035dd60
cmp r8d, edx
jae 0x14035dd60
mov eax, r8d
mov rdx, qword [rbp + 0xbf0]
mov ebx, dword [rdx + rax*4]
test rbx, rbx
je 0x14035dd5e
mov eax, ebx
add rbx, rdi
cmp eax, ecx
jb 0x14035dd57
cmp rbx, r9
ja 0x14035dd57
mov rcx, rbx
mov rdx, qword [rbp + 0xc08]
call fcn.14035c800
test al, al
je 0x14035df22
mov rcx, rbx
mov rdx, rdi
call fcn.14035ca00
test rax, rax
je 0x14035df84
mov qword [rbp + 0xc30], rax
lea rax, [0x140546198]
jmp 0x14035df8b
mov qword [rbp + 0xbd0], rsi
mov r9d, dword [r8 + 0x20]
mov ecx, dword [r8 + 0x24]
mov r10d, dword [r8 + 0x18]
inc qword [0x140546178]
xor esi, esi
test edx, edx
je 0x14035dd60
add r9, rdi
add rcx, rdi
test r10d, r10d
je 0x14035dd60
mov qword [rbp + 0xbc0], rcx
mov qword [rbp + 0xbc8], r8
je 0x14035dd60
mov eax, eax
add rax, qword [rbp + 0xc08]
mov qword [rbp + 0xc00], rax
xor eax, eax
mov qword [rbp + 0xc18], r12
mov qword [rbp + 0xc20], r13
mov qword [rbp + 0xc28], r15
mov qword [rbp + 0xc10], r9
mov dword [rbp + 0xc3c], r10d
jmp 0x14035d7ae
mov qword [rbp + 0xc48], 0
mov rdx, qword [rbp + 0xbe8]
lea eax, [rdx + rdx]
and eax, 2
mov ecx, edx
xor ecx, eax
xor ecx, 1
xor edx, 0x7ffffffe
not eax
and eax, edx
or eax, ecx
not eax
add eax, eax
mov edx, ecx
xor edx, eax
and eax, ecx
lea eax, [rdx + rax*2]
xor esi, esi
mov r10d, dword [rbp + 0xc3c]
cmp eax, r10d
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
mov r9, qword [rbp + 0xc10]
jae 0x14035dd60
mov qword [rbp + 0xbe8], rax
mov eax, eax
mov r8d, dword [r9 + rax*4]
test r8, r8
je 0x14035d74c
mov rsi, qword [rbp + 0xc30]
add r8, rsi
xor r9d, r9d
mov rdi, qword [rbp + 0xc00]
lea r14, [fcn.14035d250]
nop dword [rax + rax]
movzx ecx, byte [r8 + r9]
movzx edx, byte [rdi + r9]
cmp cl, dl
sete r10b
test cl, cl
sete r11b
mov ebx, r10d
xor bl, r11b
and bl, r10b
or bl, r11b
xor bl, 1
or bl, r11b
jne 0x14035d80f
inc r9
jmp 0x14035d7e0
mov rbx, qword [0x140546290]
movsxd r8, dword [rbx]
mov r9d, dword [0x140562470]
cmp r9d, 0x1c
lea r9d, [r14 + r14]
add r9d, 0x2920
mov r10d, r9d
not r10d
test r10d, r9d
jne 0x14035d824
add rbx, r8
nop dword [rax]
mov r14d, dword [0x140446310]
mov r8d, dword [0x140562470]
cmp r8d, 0x20
jl 0x14035d87e
nop word cs:[rax + rax]
mov r8d, dword [0x140446310]
mov r8d, dword [0x14056246c]
lea r9d, [r8 - 1]
imul r9d, r8d
test r9b, 1
jne 0x14035d860
jmp 0x14035d840
cmp cl, dl
jne 0x14035d74c
movzx ecx, word [0x140562474]
mov rdx, qword [rbp + 0xbc0]
add cx, word [rdx + rax*2]
movzx eax, cx
mov rcx, qword [rbp + 0xbf0]
mov edi, dword [rcx + rax*4]
test rdi, rdi
je 0x14035d74c
add rdi, rsi
cmp rdi, qword [rbp + 0xbc8]
jb 0x14035d9d4
cmp rdi, qword [rbp + 0xbd0]
ja 0x14035d9d4
mov rcx, rdi
mov rdx, qword [rbp + 0xc08]
call fcn.14035c800
test al, al
je 0x14035d98c
mov rcx, rdi
mov rdx, rsi
call fcn.14035ca00
test rax, rax
je 0x14035da27
mov qword [rbp + 0xc30], rax
mov rcx, qword [0x140546198]
movabs rdx, 0x1620c25560da71a4
add rdx, rcx
xor rdx, 1
movabs r8, 0xe9df3daa9f258e5b
sub r8, rcx
movabs rcx, 0x7ffffffffffffffe
and r8, rcx
or r8, rdx
not r8
lea rcx, [rdx + r8*2]
mov rdx, rcx
movabs r8, 0xe9df3daa9f258e5c
xor rdx, r8
movabs r8, 0x69df3daa9f258e5c
and rcx, r8
lea rcx, [rdx + rcx*2]
mov qword [0x140546198], rcx
mov rcx, rax
mov rdx, qword [rbp + 0xc00]
call fcn.14035e540
mov qword [rbp + 0xc48], rax
inc qword [0x140546148]
test rax, rax
je 0x14035da40
jmp 0x14035df61
inc qword [0x140546140]
mov rdx, qword [rbp + 0xbf8]
test rdx, rdx
je 0x14035d9c9
mov rax, qword [rdx]
movabs rcx, 0x8056893de146aeb5
add rax, rcx
mov rcx, rax
movabs r8, 0x7fa976c21eb9514c
xor rcx, r8
and rax, r8
lea rax, [rcx + rax*2]
mov qword [rdx], rax
mov rcx, rdi
call fcn.14035d250
mov rdi, rax
mov qword [rbp + 0xc48], rdi
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
mov r9, qword [rbp + 0xc10]
mov r10d, dword [rbp + 0xc3c]
xor esi, esi
test rdi, rdi
jne 0x14035dd60
mov rax, qword [rbp + 0xbe8]
inc eax
cmp eax, r10d
jb 0x14035d7ae
jmp 0x14035dd60
inc qword [0x1405461a0]
mov qword [rbp + 0xc48], 0
inc qword [0x140546148]
call fcn.1403695e0
test rax, rax
je 0x14035d741
mov qword [rbp - 0x40], 0
mov ecx, dword [0x140562300]
lea r9, [fcn.14035d250]
mov edx, dword [0x14056246c]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
je 0x14035da8c
lea edx, [r9 + r9]
add edx, 0x2c60
mov r8d, edx
not r8d
test r8d, edx
jne 0x14035da63
lea edx, [rcx + rcx]
sub edx, ecx
inc edx
mov r12, qword [rbp + 0xc00]
mov r13d, 1
mov dword [0x140562300], edx
mov r8d, dword [0x140562470]
cmp r8d, 0xf
jle 0x14035dadd
mov dword [0x140562300], edx
mov dword [0x14056246c], 1
mov r8d, dword [0x14056246c]
mov r9d, 1
sub r9d, r8d
imul r9d, r8d
test r9b, 1
jmp 0x14035daa0
mov r8d, ecx
xor r8d, edx
not edx
not ecx
and ecx, edx
or ecx, r8d
xor ecx, 0xffffffff
jne 0x14035db19
mov edx, dword [0x140562470]
cmp edx, 0x32
jle 0x14035db10
mov edx, dword [0x14056246c]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
jne 0x14035daf1
test r14d, r14d
jg 0x14035dcdb
xor edx, edx
mov r8d, dword [0x140562470]
cmp r8d, 0x37
jg 0x14035db1b
xor r8d, r8d
xor r9d, r9d
mov r10, r8
xor r11d, r11d
test ecx, ecx
setne r11b
lea rdi, [r11 - 1]
xor r8d, r8d
cmp byte [r12 + r10], 0
mov rbx, qword [0x140445d90]
setne r8b
movzx r9d, r9b
cmove r9d, r13d
sub rbx, rdx
mov r14, rbx
not r14
neg r11
mov rsi, rbx
xor rsi, r11
mov r15, rbx
and r15, r11
and r11, r14
and r14, rdi
or rsi, r14
not rsi
or rsi, r14
or r15, r14
xor rbx, rdi
or r11, rbx
not r11
or r11, r15
not rsi
mov rdi, rsi
xor rdi, r11
or rsi, r11
not rsi
or rsi, rdi
not rsi
mov r11, rsi
shr r11, 0x20
mov edi, dword [0x14055f570]
mov ebx, edi
not ebx
or r11d, esi
mov esi, r11d
xor esi, ebx
xor ebx, edi
and ebx, r11d
xor ebx, edi
and esi, r11d
lea r11d, [rbx + rsi*2]
mov dword [0x14055f570], r11d
add r8, r10
mov r10d, r9d
not r10b
mov r11d, r9d
xor r11b, 1
and r10b, 0xfe
or r10b, r11b
cmp r10b, 0xff
je 0x14035db2e
mov word [rbp - 0x40], r8w
lea ecx, [r8 + 1]
mov word [rbp - 0x3e], cx
mov qword [rbp - 0x38], r12
mov rcx, qword [rbp + 0xc30]
lea rdx, [rbp - 0x40]
xor r8d, r8d
lea r9, [rbp + 0xc48]
call qword [case.0x140119ecb.0]
cmp eax, 0xc0000142
je 0x14035dc2d
cmp eax, 0xc0000138
jne 0x14035dc80
mov qword [rbp + 0xc48], 0
inc qword [0x1405461a8]
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
mov r9, qword [rbp + 0xc10]
mov r10d, dword [rbp + 0xc3c]
inc qword [0x1405461e0]
lea rax, [0x1405461b0]
lea rcx, [0x1405461c0]
jmp 0x14035dcc9
inc qword [0x1405461a8]
cmp qword [rbp + 0xc48], 0
lea rax, [0x1405461c8]
lea rcx, [0x1405461d8]
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
mov r9, qword [rbp + 0xc10]
mov r10d, dword [rbp + 0xc3c]
je 0x14035dc69
inc qword [rax]
inc qword [rcx]
mov rdi, qword [rbp + 0xc48]
jmp 0x14035da05
xor r8d, r8d
xor edx, edx
movsxd r8, r8d
mov r9, qword [rbx + r8]
mov r10, rdx
not r10
mov r11, rdx
and r11, r9
not r9
mov rsi, r9
xor rsi, r10
and r10, r9
or r10, r11
and rdx, r9
xor rdx, r10
not rdx
and rsi, r9
mov r9, rdx
and r9, rsi
xor rdx, rsi
xor rdx, r9
neg r8d
mov r9d, r8d
xor r9d, 0xfffffff8
and r8d, 0x7ffffff8
lea r8d, [r9 + r8*2]
neg r8d
mov r9d, dword [0x140562470]
nop dword [rax]
mov r9d, dword [0x140562470]
cmp r9d, 0x4a
jg 0x14035dd40
cmp r8d, r14d
jl 0x14035dce0
jmp 0x14035db1b
mov qword [rbp + 0xc48], rbx
xor esi, esi
mov rax, qword [rbp + 0xc48]
test rax, rax
jne 0x14035dda2
test r11, r11
je 0x14035dda2
xor ecx, ecx
mov edx, 1
mov r8d, 0x3da87300
mov r9d, 0xae978795
call fcn.140360920
test rax, rax
je 0x14035dd9b
mov rcx, qword [rbp + 0xc40]
call qword [case.0x140119ecb.0]
mov rax, qword [rbp + 0xc48]
or r12, r13
test rax, rax
je 0x14035ddb3
lea rax, [0x140546150]
jmp 0x14035dde9
lea rax, [0x140546140]
inc qword [0x140546158]
mov ecx, r15d
not cl
lea edx, [r15 - 2]
mov r8d, edx
not r8b
and r8b, cl
xor dl, r15b
or dl, r8b
xor ecx, ecx
cmp dl, 0xff
sete cl
lea rax, [rax + rcx*8]
add rax, 0x40
movabs rcx, 0x1260e8a84f9333e1
add rcx, qword [rax]
movabs rdx, 0x79dd1192c2b13b3e
mov r8, rcx
xor r8, rdx
and rcx, rdx
lea rcx, [r8 + rcx*2]
movabs rdx, 0x73c205c4edbb90e2
add rdx, rcx
mov qword [rax], rdx
rdtsc
shl rdx, 0x20
or rdx, rax
sub r12, rdx
movabs rax, 0x526eb8fabb9c9c3d
sub rax, r12
movabs rcx, 0xad914705446363c2
add rcx, r12
movabs rdx, 0xad914705446363c3
and rdx, rcx
movabs rcx, 0x526eb8fabb9c9c3c
and rcx, rax
or rcx, rdx
movabs rdx, 0x2d914705446363c3
and rdx, rax
lea rax, [rcx + rdx*2]
cmp qword [0x140546210], 0
je 0x14035de87
mov rcx, qword [0x140546210]
cmp rcx, rax
jae 0x14035de8e
mov qword [0x140546210], rax
cmp qword [rbp + 0xc48], 0
je 0x14035dea6
mov dword [rsp + 0x20], 0x5d7769bc
xor ecx, ecx
xor edx, edx
jmp 0x14035def9
mov eax, r15d
not al
test al, 1
sete cl
mov edx, esi
xor dl, 1
xor cl, sil
and dl, al
or dl, cl
jne 0x14035decf
mov dword [rsp + 0x20], 0x5d7769bc
xor ecx, ecx
mov edx, 0x4750412d
jmp 0x14035def9
or r15b, 0xfe
test r15b, 1
je 0x14035deea
mov dword [rsp + 0x20], 0x5d7769bc
xor ecx, ecx
mov edx, 0xc0000138
jmp 0x14035def9
mov dword [rsp + 0x20], 0x5d7769bc
xor ecx, ecx
mov edx, 0xc0000139
xor r8d, r8d
mov r9d, 0x27a19030
call fcn.140360960
mov rax, qword [rbp + 0xc48]
add rsp, 0xcd8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [0x140546140]
mov rcx, rax
xor rcx, 1
and eax, 1
lea rax, [rcx + rax*2]
mov qword [0x140546140], rax
mov rdx, qword [rbp + 0xbf8]
test rdx, rdx
je 0x14035df4d
inc qword [rdx]
mov rcx, rbx
call fcn.14035d250
mov qword [rbp + 0xc48], rax
jmp 0x14035e076
xor esi, esi
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
jmp 0x14035dd60
lea rax, [0x1405461a0]
inc qword [rax]
mov qword [rbp + 0xc48], 0
inc qword [0x140546148]
mov ecx, 1
mov edx, 1
mov r8d, 0x1a223a2b
mov r9d, 0x7fb4a6fe
call fcn.1403607f0
test rax, rax
je 0x14035dff4
inc qword [0x1405461a8]
mov rcx, qword [rbp + 0xc30]
lea r9, [rbp + 0xc48]
xor edx, edx
mov r8d, r14d
call qword [case.0x140119ecb.0]
cmp eax, 0xc0000138
jne 0x14035e001
mov qword [rbp + 0xc48], 0
jmp 0x14035e022
mov qword [rbp + 0xc48], 0
jmp 0x14035e076
cmp qword [rbp + 0xc48], 0
je 0x14035e022
inc qword [0x1405461e0]
inc qword [0x1405461c8]
inc qword [0x1405461d0]
jmp 0x14035e076
inc qword [0x1405461e0]
inc qword [0x1405461b0]
mov rax, qword [0x1405461b8]
mov ecx, eax
not ecx
and ecx, 1
mov rdx, rax
xor rdx, 0xfffffffffffffffe
and eax, 1
add rax, rax
mov r8, rax
and eax, edx
or rdx, rcx
not rdx
or rdx, rcx
not r8
mov rcx, rdx
and rcx, r8
or rcx, rax
xor r8, rdx
and r8, rdx
lea rax, [rcx + r8*2]
mov qword [0x1405461b8], rax
xor esi, esi
mov r11, qword [rbp + 0xc40]
jmp 0x14035dd60