Function at 0x18006d8d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x28
mov r15, r8
mov rbx, rdx
mov rbp, rcx
rdtsc
shl rdx, 0x20
mov r13d, 0xffff
or rax, rdx
mov qword [rsp + 0x70], rsi
xor r12d, r12d
mov qword [rbx + 0x323f0], rax
mov r14d, r12d
mov byte [r8], 0
mov qword [rsp + 0x20], rdi
cmp dword [rbp + 0x40], 0x64
je 0x18006da23
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call qword [sym.imp.VBoxRT.dll_RTThreadGetExecutionTimeMilli]
test eax, eax
js 0x18006da23
call qword [sym.imp.VBoxRT.dll_RTTimeMilliTS]
mov rcx, qword [rbx + 0x32010]
mov r8, qword [rsp + 0x60]
add rcx, 0x64
mov rdx, qword [rsp + 0x68]
cmp rcx, rax
jae 0x18006d968
mov qword [rbx + 0x32010], rax
lea rax, [rdx + r8]
mov qword [rbx + 0x32018], rax
jmp 0x18006d96f
mov rax, qword [rbx + 0x32018]
sub rdx, rax
mov eax, 0x51eb851f
add r8, rdx
mov qword [rbx + 0x32020], r8
imul ecx, dword [rbp + 0x40], 0x64
mul ecx
shr edx, 5
mov eax, edx
cmp r8, rax
jb 0x18006da23
rdtsc
shl rdx, 0x20
mov ecx, 5
or rax, rdx
mov qword [rbx + 0x32298], rax
call qword [sym.imp.VBoxRT.dll_RTThreadSleep]
mov rax, qword [rbx + 0x32298]
test rax, rax
je 0x18006da1e
rdtsc
mov rcx, qword [rbx + 0x32298]
mov qword [rbx + 0x32298], r12
shl rdx, 0x20
or rdx, rax
sub rdx, rcx
mov rcx, qword [rbx + 0x32280]
add rcx, rdx
mov qword [rbx + 0x32280], rcx
mov rcx, qword [rbx + 0x32278]
inc rcx
mov qword [rbx + 0x32278], rcx
mov rcx, qword [rbx + 0x32288]
cmp rcx, rdx
jae 0x18006da0b
mov qword [rbx + 0x32288], rdx
mov rax, qword [rbx + 0x32290]
cmp rax, rdx
jbe 0x18006da1e
mov qword [rbx + 0x32290], rdx
mov esi, r12d
jmp 0x18006da3b
xor r9d, r9d
mov edx, 0x2000
mov r8d, 0xfff
mov rcx, rbx
call sym.VBoxVMM.dll_IEMExecLots
mov esi, eax
mov ecx, dword [rbp + 4]
bt ecx, 0x13
jb 0x18006da54
mov rcx, qword [rbx]
test rcx, 0x200010a0
je 0x18006db25
mov rcx, qword [rbx]
mov edi, esi
test cl, 0x20
je 0x18006da69
mov rdx, rbx
mov rcx, rbp
call fcn.18019af90
mov rax, qword [rbx]
bt rax, 0xc
jae 0x18006dab4
mov eax, dword [rbx + 0x19150]
test rax, 0x16800000
je 0x18006da97
mov edx, 0x16800000
mov rcx, rbx
call fcn.1800f2440
test eax, eax
jns 0x18006da97
test esi, esi
cmovns edi, eax
mov rcx, rbx
call sym.VBoxVMM.dll_CPUMGetGuestCR3
mov rdx, rax
mov rcx, rbx
call sym.VBoxVMM.dll_PGMUpdateCR3
mov esi, eax
test eax, eax
js 0x18006dc8b
mov rax, qword [rbx]
test al, al
jns 0x18006dacb
mov r8d, edi
mov rdx, rbx
mov rcx, rbp
call fcn.1800fde20
mov edi, eax
mov rax, qword [rbx]
bt rax, 0x1d
jae 0x18006db09
mov r8d, edi
mov rdx, rbx
mov rcx, rbp
call fcn.180078df0
mov edi, eax
mov ecx, 0x400
movzx eax, word [rbx + 0x33d38]
cmp ax, cx
jae 0x18006db09
test edi, edi
jne 0x18006db01
mov edi, 0x489
jmp 0x18006db09
mov word [rbx + 0x33d38], r13w
mov eax, dword [rbp + 4]
bt eax, 0x13
jae 0x18006db23
lea eax, [rdi - 0x45b]
cmp eax, 5
mov eax, 0x45a
cmovbe edi, eax
mov esi, edi
test esi, esi
je 0x18006db44
lea eax, [rsi - 0x44c]
cmp eax, 0x14
jbe 0x18006dce3
cmp esi, 0x8fe
jne 0x18006dc8b
mov rdx, rbx
mov rcx, rbp
call fcn.1801c23d0
mov eax, dword [rbp + 4]
test eax, eax
jne 0x18006db61
mov rax, qword [rbx]
test rax, 0xfffffffffff4ffdf
je 0x18006dbaa
rdtsc
shl rdx, 0x20
mov r8d, esi
or rax, rdx
mov rcx, rbp
mov rdx, rbx
mov rdi, rax
call fcn.18006ff10
mov esi, eax
rdtsc
mov rcx, qword [rbx + 0x323f0]
shl rdx, 0x20
or rax, rdx
sub rax, rdi
add rax, rcx
mov qword [rbx + 0x323f0], rax
test esi, esi
je 0x18006dbaa
cmp esi, 0x45b
jne 0x18006dcdf
inc r14d
test r14b, 7
jne 0x18006d912
mov eax, dword [rbx + 0x32000]
cmp eax, 7
je 0x18006dbf5
cmp byte [rbp + 0x119600], r12b
jne 0x18006dbf5
movzx eax, byte [rbp + 0x50]
cmp al, 1
je 0x18006dbf5
mov rdx, rbx
mov rcx, rbp
cmp al, 2
jne 0x18006dc81
lea r8, [rbx + 0x19000]
call sym.VBoxVMM.dll_HMCanExecuteGuest
test al, al
je 0x18006d912
mov rax, qword [rbx + 0x323f0]
test rax, rax
je 0x18006dc63
rdtsc
mov rcx, qword [rbx + 0x323f0]
mov qword [rbx + 0x323f0], r12
shl rdx, 0x20
or rdx, rax
sub rdx, rcx
mov rcx, qword [rbx + 0x323d8]
add rcx, rdx
mov qword [rbx + 0x323d8], rcx
mov rcx, qword [rbx + 0x323d0]
inc rcx
mov qword [rbx + 0x323d0], rcx
mov rcx, qword [rbx + 0x323e0]
cmp rcx, rdx
jae 0x18006dc50
mov qword [rbx + 0x323e0], rdx
mov rax, qword [rbx + 0x323e8]
cmp rax, rdx
jbe 0x18006dc63
mov qword [rbx + 0x323e8], rdx
mov eax, 0x45e
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x70]
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret
call fcn.1801d5c60
jmp 0x18006dbed
cmp esi, 0xffffeaf2
je 0x18006dc9b
cmp esi, 0xffffeb4c
jne 0x18006dce3
mov eax, dword [rbx + 0x32000]
cmp eax, 7
je 0x18006dcd8
cmp byte [rbp + 0x119600], r12b
jne 0x18006dcd8
movzx eax, byte [rbp + 0x50]
cmp al, 1
je 0x18006dcd8
mov rdx, rbx
mov rcx, rbp
cmp al, 2
jne 0x18006dccf
lea r8, [rbx + 0x19000]
call sym.VBoxVMM.dll_HMCanExecuteGuest
jmp 0x18006dcd4
call fcn.1801d5c60
test al, al
je 0x18006dce3
mov esi, 0x45e
jmp 0x18006dce3
mov byte [r15], 1
mov rax, qword [rbx + 0x323f0]
test rax, rax
je 0x18006dd51
rdtsc
mov rcx, qword [rbx + 0x323f0]
mov qword [rbx + 0x323f0], r12
shl rdx, 0x20
or rdx, rax
sub rdx, rcx
mov rcx, qword [rbx + 0x323d8]
add rcx, rdx
mov qword [rbx + 0x323d8], rcx
mov rcx, qword [rbx + 0x323d0]
inc rcx
mov qword [rbx + 0x323d0], rcx
mov rcx, qword [rbx + 0x323e0]
cmp rcx, rdx
jae 0x18006dd3e
mov qword [rbx + 0x323e0], rdx
mov rax, qword [rbx + 0x323e8]
cmp rax, rdx
jbe 0x18006dd51
mov qword [rbx + 0x323e8], rdx
mov eax, esi
jmp 0x18006dc68