Function at 0x1403972d0
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xcd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc50], 0xfffffffffffffffe
mov qword [rbp + 0xc48], 0
cmp rcx, 0x1fefa
je 0x14039733b
mov rsi, rdx
mov rbx, rcx
call fcn.140398150
rdtsc
mov r12, rax
mov r13, rdx
shl r13, 0x20
test rsi, rsi
je 0x140397398
mov rax, qword [rsi]
cmp rax, 7
jb 0x140397388
inc qword [0x14058f5c0]
jmp 0x1403973c5
cmp qword [0x14058f62c], 0x33c0
jne 0x140397f87
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x38], 0x328b2d2f
mov dword [rsp + 0x30], 0xaed649b8
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.14039a950
add rax, 0x33c0
mov qword [0x14058f62c], rax
jmp 0x140397f87
cmp rax, qword [0x14058f5b8]
jbe 0x140397398
mov qword [0x14058f5b8], rax
xor r14d, r14d
test rbx, rbx
je 0x1403973c5
mov qword [rbp + 0xbf8], rsi
nop word [rax + rax]
mov edi, r14d
movzx eax, byte [rbx + rdi]
test eax, eax
je 0x1403973cf
cmp eax, 0x2e
je 0x1403973cf
inc r14d
jmp 0x1403973b0
xor r15d, r15d
xor esi, esi
jmp 0x140397e1b
xor r15d, r15d
cmp byte [rbx + rdi], 0x2e
mov esi, 0
jne 0x140397e1b
mov qword [rbp + 0xc30], 0
mov r8d, 0x400
sub r8, rdi
xor esi, esi
cmp r14d, 0x400
cmovae r8, rsi
lea rcx, [rdi + rbp]
add rcx, 0x7c0
xor edx, edx
call fcn.140446830
lea r15, [rbp + 0x7c0]
mov rcx, r15
mov qword [rbp + 0xc08], rbx
mov rdx, rbx
mov r8, rdi
call fcn.140446180
mov ecx, 1
xor edx, edx
mov r8, r15
mov r9d, 0xce7c9fb1
call fcn.14039a660
mov qword [rbp + 0xc30], rax
mov ecx, 0
mov qword [rbp + 0xc40], rcx
test rax, rax
jne 0x140397578
xor eax, eax
mov qword [rbp + 0xc40], rax
lea rcx, [rbp + 0x7c0]
xor edx, edx
call fcn.140396a80
xor ecx, ecx
test rax, rax
sete cl
lea rbx, [0x14058f510]
inc qword [rbx + rcx*8 + 0x58]
mov qword [rbp + 0xc30], rax
test rax, rax
jne 0x140397578
mov r15d, 1
xor eax, eax
mov qword [rbp + 0xc40], rax
mov ecx, 1
xor edx, edx
mov r8d, 0x1a223a2b
mov r9d, 0x7fb4a6fe
call fcn.14039a870
test rax, rax
je 0x140397578
mov qword [rbp + 0xbd8], 0
lea rcx, [rbp - 0x40]
mov qword [rbp + 0xbe0], rcx
xor ecx, ecx
xor r10d, r10d
nop word [rax + rax]
mov edx, r10d
mov r8d, r10d
movsx r9d, byte [rbp + r8 + 0x7c0]
xor r10d, r10d
test r9w, r9w
setne r10b
mov word [rbp + r8*2 - 0x40], r9w
movzx ecx, cl
cmove ecx, r15d
add r10d, edx
mov edx, ecx
xor dl, 0xfe
test dl, cl
je 0x1403974f0
lea ecx, [r10 + r10]
mov word [rbp + 0xbd8], cx
neg ecx
xor ecx, 0xfffffffe
shl r10d, 2
sub r10d, ecx
mov word [rbp + 0xbda], r10w
lea r8, [rbp + 0xbd8]
lea r9, [rbp + 0xc30]
xor ecx, ecx
xor edx, edx
call qword [case.0x14013008b.0]
mov rdx, qword [rbp + 0xc30]
xor eax, eax
mov rcx, rdx
mov qword [rbp + 0xc40], rdx
test rdx, rdx
sete al
inc qword [rbx + rax*8 + 0x20]
lea rcx, [rbp + 0x7c0]
xor edx, edx
mov r8, rdi
call fcn.140446830
lea eax, [r14 + 1]
mov ecx, dword [0x1405a9b30]
mov edx, eax
not edx
mov r8d, ecx
xor r8d, edx
xor edx, eax
and edx, ecx
xor edx, eax
and r8d, ecx
lea eax, [rdx + r8*2]
mov rcx, qword [rbp + 0xc08]
movzx ebx, byte [rcx + rax]
mov r15d, 0
cmp bl, 0x23
jne 0x1403975ed
add r14d, 2
mov rax, qword [rbp + 0xc08]
lea rcx, [rax + r14]
mov edx, 0x502f480
mov r8d, 0x4d3d69cb
mov r9d, 0xc307d0da
call fcn.140382710
mov esi, eax
mov r15b, 1
mov eax, r14d
mov rcx, qword [rbp + 0xbf8]
test rcx, rcx
mov r11, qword [rbp + 0xc40]
je 0x140397612
cmp qword [rcx], 7
jb 0x140397612
inc qword [0x14058f5c0]
jmp 0x140397dde
mov rdi, qword [rbp + 0xc30]
test rdi, rdi
je 0x140397dde
movsxd rdx, dword [rdi + 0x3c]
mov ecx, dword [rdi + rdx + 0x88]
test rcx, rcx
je 0x140397dde
mov r14, rsi
mov esi, dword [rdi + rdx + 0x8c]
test rsi, rsi
je 0x140397dde
cmp dword [rdi + rdx + 0x8c], 0x28
jb 0x140397dde
lea r8, [rdi + rcx]
add rsi, r8
mov edx, dword [r8 + 0x1c]
add rdx, rdi
mov qword [rbp + 0xbf0], rdx
mov edx, dword [r8 + 0x14]
cmp bl, 0x23
jne 0x140397743
mov eax, dword [r8 + 0x10]
mov r8, qword [0x14058f540]
movabs r9, 0x99211882cdc31508
xor r9, r8
movabs r10, 0x19211882cdc31508
and r10, r8
lea r8, [r9 + r10*2]
movabs r9, 0x66dee77d323ceaf9
add r9, r8
mov qword [0x14058f540], r9
test edx, edx
je 0x140397dde
mov r9, rsi
mov sil, 1
mov r8d, r14d
sub r8d, eax
jb 0x140397de0
cmp r8d, edx
jae 0x140397de0
mov eax, r8d
mov rdx, qword [rbp + 0xbf0]
mov ebx, dword [rdx + rax*4]
test rbx, rbx
je 0x140397dde
mov eax, ebx
add rbx, rdi
cmp eax, ecx
jb 0x140397dd7
cmp rbx, r9
ja 0x140397dd7
mov rcx, rbx
mov rdx, qword [rbp + 0xc08]
call fcn.140396880
test al, al
je 0x140397fa2
mov rcx, rbx
mov rdx, rdi
call fcn.140396a80
test rax, rax
je 0x140398004
mov qword [rbp + 0xc30], rax
lea rax, [0x14058f568]
jmp 0x14039800b
mov qword [rbp + 0xbd0], rsi
mov r9d, dword [r8 + 0x20]
mov ecx, dword [r8 + 0x24]
mov r10d, dword [r8 + 0x18]
inc qword [0x14058f548]
xor esi, esi
test edx, edx
je 0x140397de0
add r9, rdi
add rcx, rdi
test r10d, r10d
je 0x140397de0
mov qword [rbp + 0xbc0], rcx
mov qword [rbp + 0xbc8], r8
je 0x140397de0
mov eax, eax
add rax, qword [rbp + 0xc08]
mov qword [rbp + 0xc00], rax
xor eax, eax
mov qword [rbp + 0xc18], r12
mov qword [rbp + 0xc20], r13
mov qword [rbp + 0xc28], r15
mov qword [rbp + 0xc10], r9
mov dword [rbp + 0xc3c], r10d
jmp 0x14039782e
mov qword [rbp + 0xc48], 0
mov rdx, qword [rbp + 0xbe8]
lea eax, [rdx + rdx]
and eax, 2
mov ecx, edx
xor ecx, eax
xor ecx, 1
xor edx, 0x7ffffffe
not eax
and eax, edx
or eax, ecx
not eax
add eax, eax
mov edx, ecx
xor edx, eax
and eax, ecx
lea eax, [rdx + rax*2]
xor esi, esi
mov r10d, dword [rbp + 0xc3c]
cmp eax, r10d
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
mov r9, qword [rbp + 0xc10]
jae 0x140397de0
mov qword [rbp + 0xbe8], rax
mov eax, eax
mov r8d, dword [r9 + rax*4]
test r8, r8
je 0x1403977cc
mov rsi, qword [rbp + 0xc30]
add r8, rsi
xor r9d, r9d
mov rdi, qword [rbp + 0xc00]
lea r14, [fcn.1403972d0]
nop dword [rax + rax]
movzx ecx, byte [r8 + r9]
movzx edx, byte [rdi + r9]
cmp cl, dl
sete r10b
test cl, cl
sete r11b
mov ebx, r10d
xor bl, r11b
and bl, r10b
or bl, r11b
xor bl, 1
or bl, r11b
jne 0x14039788f
inc r9
jmp 0x140397860
mov rbx, qword [0x14058f660]
movsxd r8, dword [rbx]
mov r9d, dword [0x1405acb80]
cmp r9d, 0x1c
lea r9d, [r14 + r14]
add r9d, 0x2920
mov r10d, r9d
not r10d
test r10d, r9d
jne 0x1403978a4
add rbx, r8
nop dword [rax]
mov r14d, dword [0x140488740]
mov r8d, dword [0x1405acb80]
cmp r8d, 0x20
jl 0x1403978fe
nop word cs:[rax + rax]
mov r8d, dword [0x140488740]
mov r8d, dword [0x1405acb7c]
lea r9d, [r8 - 1]
imul r9d, r8d
test r9b, 1
jne 0x1403978e0
jmp 0x1403978c0
cmp cl, dl
jne 0x1403977cc
movzx ecx, word [0x1405acb84]
mov rdx, qword [rbp + 0xbc0]
add cx, word [rdx + rax*2]
movzx eax, cx
mov rcx, qword [rbp + 0xbf0]
mov edi, dword [rcx + rax*4]
test rdi, rdi
je 0x1403977cc
add rdi, rsi
cmp rdi, qword [rbp + 0xbc8]
jb 0x140397a54
cmp rdi, qword [rbp + 0xbd0]
ja 0x140397a54
mov rcx, rdi
mov rdx, qword [rbp + 0xc08]
call fcn.140396880
test al, al
je 0x140397a0c
mov rcx, rdi
mov rdx, rsi
call fcn.140396a80
test rax, rax
je 0x140397aa7
mov qword [rbp + 0xc30], rax
mov rcx, qword [0x14058f568]
movabs rdx, 0x1620c25560da71a4
add rdx, rcx
xor rdx, 1
movabs r8, 0xe9df3daa9f258e5b
sub r8, rcx
movabs rcx, 0x7ffffffffffffffe
and r8, rcx
or r8, rdx
not r8
lea rcx, [rdx + r8*2]
mov rdx, rcx
movabs r8, 0xe9df3daa9f258e5c
xor rdx, r8
movabs r8, 0x69df3daa9f258e5c
and rcx, r8
lea rcx, [rdx + rcx*2]
mov qword [0x14058f568], rcx
mov rcx, rax
mov rdx, qword [rbp + 0xc00]
call fcn.1403985c0
mov qword [rbp + 0xc48], rax
inc qword [0x14058f518]
test rax, rax
je 0x140397ac0
jmp 0x140397fe1
inc qword [0x14058f510]
mov rdx, qword [rbp + 0xbf8]
test rdx, rdx
je 0x140397a49
mov rax, qword [rdx]
movabs rcx, 0x8056893de146aeb5
add rax, rcx
mov rcx, rax
movabs r8, 0x7fa976c21eb9514c
xor rcx, r8
and rax, r8
lea rax, [rcx + rax*2]
mov qword [rdx], rax
mov rcx, rdi
call fcn.1403972d0
mov rdi, rax
mov qword [rbp + 0xc48], rdi
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
mov r9, qword [rbp + 0xc10]
mov r10d, dword [rbp + 0xc3c]
xor esi, esi
test rdi, rdi
jne 0x140397de0
mov rax, qword [rbp + 0xbe8]
inc eax
cmp eax, r10d
jb 0x14039782e
jmp 0x140397de0
inc qword [0x14058f570]
mov qword [rbp + 0xc48], 0
inc qword [0x14058f518]
call fcn.1403a3660
test rax, rax
je 0x1403977c1
mov qword [rbp - 0x40], 0
mov ecx, dword [0x1405aca10]
lea r9, [fcn.1403972d0]
mov edx, dword [0x1405acb7c]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
je 0x140397b0c
lea edx, [r9 + r9]
add edx, 0x2c60
mov r8d, edx
not r8d
test r8d, edx
jne 0x140397ae3
lea edx, [rcx + rcx]
sub edx, ecx
inc edx
mov r12, qword [rbp + 0xc00]
mov r13d, 1
mov dword [0x1405aca10], edx
mov r8d, dword [0x1405acb80]
cmp r8d, 0xf
jle 0x140397b5d
mov dword [0x1405aca10], edx
mov dword [0x1405acb7c], 1
mov r8d, dword [0x1405acb7c]
mov r9d, 1
sub r9d, r8d
imul r9d, r8d
test r9b, 1
jmp 0x140397b20
mov r8d, ecx
xor r8d, edx
not edx
not ecx
and ecx, edx
or ecx, r8d
xor ecx, 0xffffffff
jne 0x140397b99
mov edx, dword [0x1405acb80]
cmp edx, 0x32
jle 0x140397b90
mov edx, dword [0x1405acb7c]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
jne 0x140397b71
test r14d, r14d
jg 0x140397d5b
xor edx, edx
mov r8d, dword [0x1405acb80]
cmp r8d, 0x37
jg 0x140397b9b
xor r8d, r8d
xor r9d, r9d
mov r10, r8
xor r11d, r11d
test ecx, ecx
setne r11b
lea rdi, [r11 - 1]
xor r8d, r8d
cmp byte [r12 + r10], 0
mov rbx, qword [0x1404881c0]
setne r8b
movzx r9d, r9b
cmove r9d, r13d
sub rbx, rdx
mov r14, rbx
not r14
neg r11
mov rsi, rbx
xor rsi, r11
mov r15, rbx
and r15, r11
and r11, r14
and r14, rdi
or rsi, r14
not rsi
or rsi, r14
or r15, r14
xor rbx, rdi
or r11, rbx
not r11
or r11, r15
not rsi
mov rdi, rsi
xor rdi, r11
or rsi, r11
not rsi
or rsi, rdi
not rsi
mov r11, rsi
shr r11, 0x20
mov edi, dword [0x1405a9b30]
mov ebx, edi
not ebx
or r11d, esi
mov esi, r11d
xor esi, ebx
xor ebx, edi
and ebx, r11d
xor ebx, edi
and esi, r11d
lea r11d, [rbx + rsi*2]
mov dword [0x1405a9b30], r11d
add r8, r10
mov r10d, r9d
not r10b
mov r11d, r9d
xor r11b, 1
and r10b, 0xfe
or r10b, r11b
cmp r10b, 0xff
je 0x140397bae
mov word [rbp - 0x40], r8w
lea ecx, [r8 + 1]
mov word [rbp - 0x3e], cx
mov qword [rbp - 0x38], r12
mov rcx, qword [rbp + 0xc30]
lea rdx, [rbp - 0x40]
xor r8d, r8d
lea r9, [rbp + 0xc48]
call qword [case.0x14013008b.0]
cmp eax, 0xc0000142
je 0x140397cad
cmp eax, 0xc0000138
jne 0x140397d00
mov qword [rbp + 0xc48], 0
inc qword [0x14058f578]
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
mov r9, qword [rbp + 0xc10]
mov r10d, dword [rbp + 0xc3c]
inc qword [0x14058f5b0]
lea rax, [0x14058f580]
lea rcx, [0x14058f590]
jmp 0x140397d49
inc qword [0x14058f578]
cmp qword [rbp + 0xc48], 0
lea rax, [0x14058f598]
lea rcx, [0x14058f5a8]
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
mov r9, qword [rbp + 0xc10]
mov r10d, dword [rbp + 0xc3c]
je 0x140397ce9
inc qword [rax]
inc qword [rcx]
mov rdi, qword [rbp + 0xc48]
jmp 0x140397a85
xor r8d, r8d
xor edx, edx
movsxd r8, r8d
mov r9, qword [rbx + r8]
mov r10, rdx
not r10
mov r11, rdx
and r11, r9
not r9
mov rsi, r9
xor rsi, r10
and r10, r9
or r10, r11
and rdx, r9
xor rdx, r10
not rdx
and rsi, r9
mov r9, rdx
and r9, rsi
xor rdx, rsi
xor rdx, r9
neg r8d
mov r9d, r8d
xor r9d, 0xfffffff8
and r8d, 0x7ffffff8
lea r8d, [r9 + r8*2]
neg r8d
mov r9d, dword [0x1405acb80]
nop dword [rax]
mov r9d, dword [0x1405acb80]
cmp r9d, 0x4a
jg 0x140397dc0
cmp r8d, r14d
jl 0x140397d60
jmp 0x140397b9b
mov qword [rbp + 0xc48], rbx
xor esi, esi
mov rax, qword [rbp + 0xc48]
test rax, rax
jne 0x140397e22
test r11, r11
je 0x140397e22
xor ecx, ecx
mov edx, 1
mov r8d, 0x3da87300
mov r9d, 0xae978795
call fcn.14039a9a0
test rax, rax
je 0x140397e1b
mov rcx, qword [rbp + 0xc40]
call qword [case.0x14013008b.0]
mov rax, qword [rbp + 0xc48]
or r12, r13
test rax, rax
je 0x140397e33
lea rax, [0x14058f520]
jmp 0x140397e69
lea rax, [0x14058f510]
inc qword [0x14058f528]
mov ecx, r15d
not cl
lea edx, [r15 - 2]
mov r8d, edx
not r8b
and r8b, cl
xor dl, r15b
or dl, r8b
xor ecx, ecx
cmp dl, 0xff
sete cl
lea rax, [rax + rcx*8]
add rax, 0x40
movabs rcx, 0x1260e8a84f9333e1
add rcx, qword [rax]
movabs rdx, 0x79dd1192c2b13b3e
mov r8, rcx
xor r8, rdx
and rcx, rdx
lea rcx, [r8 + rcx*2]
movabs rdx, 0x73c205c4edbb90e2
add rdx, rcx
mov qword [rax], rdx
rdtsc
shl rdx, 0x20
or rdx, rax
sub r12, rdx
movabs rax, 0x526eb8fabb9c9c3d
sub rax, r12
movabs rcx, 0xad914705446363c2
add rcx, r12
movabs rdx, 0xad914705446363c3
and rdx, rcx
movabs rcx, 0x526eb8fabb9c9c3c
and rcx, rax
or rcx, rdx
movabs rdx, 0x2d914705446363c3
and rdx, rax
lea rax, [rcx + rdx*2]
cmp qword [0x14058f5e0], 0
je 0x140397f07
mov rcx, qword [0x14058f5e0]
cmp rcx, rax
jae 0x140397f0e
mov qword [0x14058f5e0], rax
cmp qword [rbp + 0xc48], 0
je 0x140397f26
mov dword [rsp + 0x20], 0x5d7769bc
xor ecx, ecx
xor edx, edx
jmp 0x140397f79
mov eax, r15d
not al
test al, 1
sete cl
mov edx, esi
xor dl, 1
xor cl, sil
and dl, al
or dl, cl
jne 0x140397f4f
mov dword [rsp + 0x20], 0x5d7769bc
xor ecx, ecx
mov edx, 0x4750412d
jmp 0x140397f79
or r15b, 0xfe
test r15b, 1
je 0x140397f6a
mov dword [rsp + 0x20], 0x5d7769bc
xor ecx, ecx
mov edx, 0xc0000138
jmp 0x140397f79
mov dword [rsp + 0x20], 0x5d7769bc
xor ecx, ecx
mov edx, 0xc0000139
xor r8d, r8d
mov r9d, 0x27a19030
call fcn.14039a9e0
mov rax, qword [rbp + 0xc48]
add rsp, 0xcd8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [0x14058f510]
mov rcx, rax
xor rcx, 1
and eax, 1
lea rax, [rcx + rax*2]
mov qword [0x14058f510], rax
mov rdx, qword [rbp + 0xbf8]
test rdx, rdx
je 0x140397fcd
inc qword [rdx]
mov rcx, rbx
call fcn.1403972d0
mov qword [rbp + 0xc48], rax
jmp 0x1403980f6
xor esi, esi
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
jmp 0x140397de0
lea rax, [0x14058f570]
inc qword [rax]
mov qword [rbp + 0xc48], 0
inc qword [0x14058f518]
mov ecx, 1
mov edx, 1
mov r8d, 0x1a223a2b
mov r9d, 0x7fb4a6fe
call fcn.14039a870
test rax, rax
je 0x140398074
inc qword [0x14058f578]
mov rcx, qword [rbp + 0xc30]
lea r9, [rbp + 0xc48]
xor edx, edx
mov r8d, r14d
call qword [case.0x14013008b.0]
cmp eax, 0xc0000138
jne 0x140398081
mov qword [rbp + 0xc48], 0
jmp 0x1403980a2
mov qword [rbp + 0xc48], 0
jmp 0x1403980f6
cmp qword [rbp + 0xc48], 0
je 0x1403980a2
inc qword [0x14058f5b0]
inc qword [0x14058f598]
inc qword [0x14058f5a0]
jmp 0x1403980f6
inc qword [0x14058f5b0]
inc qword [0x14058f580]
mov rax, qword [0x14058f588]
mov ecx, eax
not ecx
and ecx, 1
mov rdx, rax
xor rdx, 0xfffffffffffffffe
and eax, 1
add rax, rax
mov r8, rax
and eax, edx
or rdx, rcx
not rdx
or rdx, rcx
not r8
mov rcx, rdx
and rcx, r8
or rcx, rax
xor r8, rdx
and r8, rdx
lea rax, [rcx + r8*2]
mov qword [0x14058f588], rax
xor esi, esi
mov r11, qword [rbp + 0xc40]
jmp 0x140397de0