Function at 0x1408bfa99
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov rax, rsp
stc
mov qword [rax + 8], rcx
test edi, 0x71ed2087
jmp 0x1408bfac6
push rbp
mov bp, 0x3566
push rbx
push rsi
rcl bpl, 0x85
push rdi
push r12
test r13w, bx
bts rbp, r10
adc bpl, 0xff
push r13
ror bp, cl
adc bpl, r8b
push r14
bswap bp
push r15
lea rbp, [rax - 0xae8]
stc
cmp ecx, r9d
sub rsp, 0xba8
mov qword [rbp - 0x40], 0xfffffffffffffffe
movaps xmmword [rax - 0x58], xmm6
mov rbx, rcx
setae r8b
sal rcx, cl
shr r8d, cl
xor edx, edx
movsx rcx, bx
mov r8d, 0x248
lea rcx, [rbp + 0x160]
jmp 0x1408bfb32
call fcn.1408ccfc1
sub r14d, r14d
cdq
mov qword [rsp + 0x40], r14
cmova ecx, ecx
xchg cx, cx
mov rdx, rbx
jmp 0x1408bfb4e
lea rcx, [rbp - 0x50]
jmp 0x1408bfb57
call 0x140567d74
movaps xmm6, xmmword [rbp - 0x50]
movaps xmmword [rsp + 0x50], xmm6
movd edi, xmm6
movzx edx, di
not sil
jmp 0x1408bfb75
shr dx, 1
rcr sil, cl
xor si, r15w
lea esi, [r14 + 1]
cmp r11, rbx
sub dx, si
jmp 0x1408bfb8e
je 0x1408bfc24
mov rcx, qword [rbp - 0x48]
setnp ah
bts eax, edi
adc ax, r9w
movzx eax, dx
stc
cmc
cmp word [rcx + rax*2], 0x5c
jmp 0x1408bfbb1
je 0x1408bfbdf
cmp word [rcx + rax*2], 0x2f
jmp 0x1408bfbc1
je 0x1408bfbdf
mov eax, 0xffff
add dx, ax
jmp 0x1408bfbd4
jne 0x1408bfba2
jmp 0x1408bfc24
movzx eax, dx
lea rcx, [rcx + rax*2]
test edi, 0x3a992f9e
add rcx, 2
mov qword [rsp + 0x58], rcx
add dx, dx
sub di, dx
jmp 0x1408bfc02
sub di, 2
jmp 0x1408bfc0b
mov word [rsp + 0x52], di
jmp 0x1408bfc15
mov word [rsp + 0x50], di
jmp 0x1408bfc1f
movaps xmm6, xmmword [rsp + 0x50]
cmp qword [0x140074d88], r14
jmp 0x1408bfc30
jne 0x1408bfcab
mov rax, qword gs:[0x60]
jmp 0x1408bfc4b
mov rcx, qword [rax + 0x18]
bswap r9w
rdtsc
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov qword [rbp + 0xb00], r14
cmovnp r9d, ecx
xchg dh, dl
lea r9, [rbp + 0xb00]
bswap dx
mov edx, 0x1e64b2a0
jmp 0x1408bfc7d
mov rcx, qword [rcx + 0x30]
jmp 0x1408bfc86
call fcn.140007fc0
mov rcx, qword [rbp + 0xb00]
ror r8, cl
test eax, eax
cmovs rcx, r14
mov qword [0x140074d88], rcx
bsf r8w, r14w
rcr rdx, 0x29
lea r8, [rsp + 0x40]
xadd rdx, rdx
neg dx
cdq
mov rdx, qword [rsp + 0x58]
cmp rax, 0x4db7349d
sub ecx, ecx
call 0x14036d937
test eax, eax
je 0x1408bfce3
mov rax, qword [rsp + 0x40]
jmp 0x1408bfcde
jmp 0x1408c082e
lea rdx, [0x140047c24]
movzx cx, r12b
movsx cx, r9b
mov ecx, esi
jmp 0x1408bfcfb
call 0x140077bac
mov qword [rsp + 0x70], rax
stc
test rax, rax
jmp 0x1408bfd0f
jne 0x1408bfd22
mov rbx, r14
jmp 0x1408bfd1d
jmp 0x1408c0809
mov rdx, rbx
lea rcx, [rbp + 0x10]
jmp 0x1408bfd2e
call fcn.1400020ec
lea rax, [0x1400757e0]
bswap cx
mov qword [rbp + 0x170], rax
cbw
movzx ecx, r10w
mov rax, rbx
mov rax, qword [rbp + 0x20]
movzx rcx, r11w
mov rcx, 0x48c341bf
mov rcx, r15
mov qword [rbp + 0x178], rax
xchg cx, cx
movzx ecx, di
movsxd rcx, r14d
lea rcx, [rbp + 0x160]
jmp 0x1408bfd7b
call 0x140778e68
mov r13d, r14d
mov dword [rbp + 0xb00], r14d
bt di, r12w
movzx ebx, word [rsp + 0x50]
shl ch, cl
mov rcx, 0x7efc299f
movzx rdi, r10w
shr rbx, 1
shl r15b, cl
rcr rcx, 0xfe
sar rdi, cl
mov qword [rsp + 0x50], rbx
btc ecx, 0xd7
clc
mov r15d, 0x208
cmp r8w, r12w
bswap edi
movsx ecx, r12w
lea rdi, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
stc
movzx cx, dil
sub eax, eax
movzx cx, ch
mov rcx, r15
jmp 0x1408bfde4
rep stosb byte [rdi], al
cmova ax, bx
mov eax, dword [rbp + 0x40]
mov dword [rsp + 0x60], eax
mov ecx, 0x9c40
jmp 0x1408bfdfb
call 0x14078444c
mov r15, rax
test rax, rax
jmp 0x1408bfe0c
je 0x1408c06a3
rdtsc
jmp 0x1408bfe19
shl rdx, 0x20
ror cx, 0x67
or rax, rdx
mov rcx, rax
call 0x140776071
mov rcx, r15
jmp 0x1408bfe35
call 0x1408bf8e1
mov r12, rax
clc
jmp 0x1408bfe43
test rax, rax
jmp 0x1408bfe4b
je 0x1408c0393
mov rdi, r12
sub rdi, r14
jmp 0x1408bfe5c
call 0x1400970b5
cdqe
sar r13, cl
btc r13, rbx
xor edx, edx
mov r13, 0x41ca4a30
div rdi
add rdx, r14
cwde
mov r13, qword [r15 + rdx*8]
and al, bh
mov rax, qword [r15 + r14*8]
clc
mov qword [r15 + rdx*8], rax
test ah, 0xe7
cmc
mov qword [r15 + r14*8], r13
cmp al, 0xce
or rsi, 0xffffffffffffffff
clc
test sil, 0xda
xor edi, edi
inc rsi
test sil, 0x17
cmp r13b, r10b
cmp word [r13 + rsi*2], di
jmp 0x1408bfeb4
jne 0x1408bfe9e
cmp rsi, rbx
jmp 0x1408bfec2
jbe 0x1408c033a
mov rcx, r13
call 0x1405b228e
test rax, rax
jmp 0x1408bfed9
jne 0x1408c033a
mov qword [rsp + 0x68], rdi
movsx r8, ax
movzx r8w, al
lea r9, [rbp + 0xb08]
cmovno r8d, edi
lea r8, [rsp + 0x68]
jmp 0x1408bff02
call fcn.14000af9c
cmp dword [rbp + 0xb08], edi
jmp 0x1408bff12
jge 0x1408bff25
mov al, dil
jmp 0x1408bff20
jmp 0x1408bffcd
mov rdx, r13
lea rcx, [rbp - 0x38]
jmp 0x1408bff31
call 0x1402058b8
mov dword [rbp - 0x28], 0x30
nop
mov rax, qword [rsp + 0x68]
jmp 0x1408bff49
mov qword [rbp - 0x20], rax
cdqe
lahf
mov dword [rbp - 0x10], 0x40
mov al, r11b
movzx ax, r10b
lea rax, [rbp - 0x38]
jmp 0x1408bff68
mov qword [rbp - 0x18], rax
jmp 0x1408bff71
xorps xmm0, xmm0
movdqu xmmword [rbp - 8], xmm0
lea r8, [rbp - 0x28]
cdq
movsx rcx, r14w
mov edx, 5
lea rcx, [rsp + 0x78]
jmp 0x1408bff91
call fcn.140588a0f
mov edi, eax
cmovae ecx, r15d
mov dword [rbp + 0xb08], eax
mov rcx, qword [rsp + 0x78]
call fcn.140408b15
mov rcx, qword [rsp + 0x68]
jmp 0x1408bffb6
call fcn.14046eda4
xor eax, eax
test edi, edi
setns al
sub edi, edi
cmp r8w, di
jmp 0x1408bffcd
test al, al
jmp 0x1408bffd4
jne 0x1408c033a
mov ebx, 0x104
setge cl
mov edx, ebx
lea rcx, [rbp + 0x880]
call 0x1403a898c
lea r8, [0x14005bf70]
bswap edx
mov edx, ebx
movzx rcx, r8w
movzx cx, bl
movsx cx, sil
lea rcx, [rbp + 0x880]
jmp 0x1408c0015
call 0x1401c7c12
mov r8, r13
mov dh, 0x73
movzx edx, r9w
movsx rdx, r15w
mov edx, ebx
setne ch
lea rcx, [rbp + 0x880]
jmp 0x1408c003a
call 0x1407298e9
mov qword [rsp + 0x30], rdi
movsx r8w, r11b
rcl dh, 0xa4
mov dword [rsp + 0x28], 0x80
btc ecx, 0x9b
btr r8w, 0xaa
mov dword [rsp + 0x20], 3
btr dx, bp
xor r9d, r9d
mov edx, 0x80000000
jmp 0x1408c0078
lea r8d, [r9 + 1]
mov cx, r13w
movsx ecx, si
lea rcx, [rbp + 0x880]
jmp 0x1408c008f
call 0x1404d6f1e
mov rbx, rax
cmp r15b, r8b
stc
test ecx, 0x3aa70b91
cmp rax, 0xffffffffffffffff
jmp 0x1408c00ab
je 0x1408c032a
sub r9d, r9d
shl cl, cl
xor r8d, r8d
sub edx, edx
movzx cx, r8b
mov rcx, rax
jmp 0x1408c00c8
call 0x14072a676
cmp eax, 0xffffffff
jmp 0x1408c00d6
je 0x1408c02f2
mov qword [rsp + 0x20], rdi
xchg cl, r9b
lea r9, [rbp + 0xaf8]
mov r8d, 0x40
lea rdx, [rbp + 0x50]
movsxd rcx, eax
jmp 0x1408c00fd
mov rcx, rbx
jmp 0x1408c0105
call 0x140638260
test eax, eax
je 0x1408c02f2
cmp dword [rbp + 0xaf8], 0x40
jmp 0x1408c011f
jne 0x1408c02f2
mov eax, 0x5a4d
test bpl, r14b
cmp r15w, r15w
cmp word [rbp + 0x50], ax
jmp 0x1408c013a
jne 0x1408c02f2
mov edx, dword [rbp + 0x8c]
cmp esi, 0x7f5a0f47
jmp 0x1408c0151
test edx, edx
jmp 0x1408c0158
je 0x1408c02f2
sub r9d, r9d
movsx cx, dh
sal ecx, 0x2f
xor r8d, r8d
mov rcx, rbx
jmp 0x1408c0173
call 0x140391623
cmp eax, 0xffffffff
jmp 0x1408c0181
je 0x1408c02f2
mov qword [rsp + 0x20], rdi
movsx r9d, bp
movzx r9d, ax
not r9b
lea r9, [rbp + 0xaf8]
movzx rcx, cx
mov r8d, 0x108
lea rdx, [rbp + 0x50]
mov ecx, 0x1841860
movzx rcx, r10w
movsx ecx, bx
mov rcx, rbx
call 0x140735782
test eax, eax
jmp 0x1408c01c8
je 0x1408c02f2
cmp dword [rbp + 0xaf8], 0x108
jmp 0x1408c01dd
jne 0x1408c02f2
cmp dword [rbp + 0x50], 0x4550
jne 0x1408c02f2
mov eax, 0x8664
stc
cmp word [rbp + 0x54], ax
jne 0x1408c02f2
movzx eax, word [rbp + 0x66]
cmove rcx, r11
sub ecx, 0x1c5c29a5
mov ecx, 0x2022
cmc
and ax, cx
cmp dl, r11b
cmp ax, cx
jmp 0x1408c0222
jne 0x1408c02f2
mov eax, 0x20b
jmp 0x1408c0235
cmp word [rbp + 0x68], ax
jne 0x1408c02f2
movzx eax, word [rbp + 0xac]
movsx rcx, bx
shl cl, cl
jmp 0x1408c0251
sub ax, 2
mov ecx, 1
clc
cmc
cmp ax, cx
jmp 0x1408c0264
ja 0x1408c02f2
test byte [rbp + 0xae], 0x40
jmp 0x1408c0276
je 0x1408c02f2
cmp dword [rbp + 0x78], edi
jmp 0x1408c0284
je 0x1408c02f2
cmp dword [rbp + 0xd4], 0x10
jmp 0x1408c0296
jb 0x1408c02f2
cmp dword [rbp + 0x148], edi
jne 0x1408c02f2
cmp dword [rbp + 0x14c], edi
jmp 0x1408c02b3
jne 0x1408c02f2
cmp dword [rbp + 0xf0], edi
jmp 0x1408c02c4
je 0x1408c02f2
cmp dword [rbp + 0xf4], edi
je 0x1408c02f2
mov eax, dword [rsp + 0x60]
cmp ecx, 0x4f4338e3
cmc
cmp dword [rbp + 0xa0], eax
jmp 0x1408c02ec
jae 0x1408c0301
mov edi, 1
xchg ch, ch
not rcx
jmp 0x1408c0301
mov rcx, rbx
jmp 0x1408c0309
call fcn.1406fcd52
test dil, dil
jmp 0x1408c0316
jne 0x1408c032a
lea eax, [rsi + 1]
cmp eax, 0x104
jb 0x1408c035b
mov rbx, qword [rsp + 0x50]
rcl esi, cl
jmp 0x1408c033a
mov esi, 1
stc
jmp 0x1408c0345
add r14, rsi
cmp bpl, 0xf8
clc
cmp r14, r12
jae 0x1408c0385
jmp 0x1408bfe51
mov r8, r13
cwd
cqo
setae dl
mov edx, 0x104
cmovno rcx, r15
xchg rcx, rcx
lea rcx, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
call 0x1400eb04a
mov esi, 1
rcl dil, cl
mov r13d, dword [rbp + 0xb00]
sar dil, cl
cmc
shl dil, cl
xor r14d, r14d
bsf rdi, r10
sar dil, cl
or dil, cl
mov edi, r14d
cmp spl, r13b
cmc
cmp ax, 0x2f62
test r12, r12
jmp 0x1408c03b4
je 0x1408c03e1
mov rcx, qword [r15 + rdi*8]
jmp 0x1408c03c3
call 0x140765c34
lea rdi, [rdi + rsi]
jmp 0x1408c03d3
cmp rdi, r12
jmp 0x1408c03db
jb 0x1408c03ba
mov rcx, r15
jmp 0x1408c03e9
call 0x1407e7d07
lea rax, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
clc
or rdx, 0xffffffffffffffff
inc rdx
jmp 0x1408c0403
cmp word [rax + rdx*2], r14w
jmp 0x1408c040d
jne 0x1408c03fa
mov r15d, 0x208
test r15b, 0x1f
test edx, edx
jmp 0x1408c0424
je 0x1408c06a9
lea rdi, [rbp - 0x80]
shrd ecx, r13d, 6
rcl cl, 0x41
add rcx, 0x7a900362
sub eax, eax
jmp 0x1408c0449
lea ecx, [rax + 0x30]
jmp 0x1408c0451
rep stosb byte [rdi], al
jmp 0x1408c0458
movdqu xmmword [rbp - 0x60], xmm6
lea rax, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
btc rdi, 0xf8
rcl cl, 0xb1
mov qword [rbp - 0x78], rax
sub cl, 2
bt cx, 0x62
add dx, dx
test r12b, 0xf4
mov word [rbp - 0x80], dx
mov word [rbp - 0x7e], r15w
adc edx, 0x5e295cce
lea rdi, [rbp + 0x3b0]
bswap dx
movzx rcx, dx
and ecx, 0x16df7502
sub eax, eax
movsx dx, dh
setge cl
mov ecx, 0x4d0
cmovo dx, r12w
mov edx, ecx
movsxd rdx, r8d
rep stosb byte [rdi], al
cwd
cwde
mov dword [rbp + 0x3e0], 0x100010
cmovl dx, r12w
mov rax, qword [0x140074d88]
movzx cx, sil
cmovl rcx, rdx
mov qword [rbp + 0x410], rax
movsx ecx, r11w
mov qword [rbp + 0x420], 0x440
movsx edx, cx
xchg ecx, edx
cmovbe dx, di
lea rdx, [rbp + 0x3b0]
movzx ecx, sp
mov rcx, 0xfffffffffffffffe
jmp 0x1408c0513
call fcn.140320347
test eax, eax
jmp 0x1408c051f
js 0x1408c06a9
lea r8, [rbp - 0x80]
dec dl
lea rdx, [0x140048638]
clc
sub ecx, ecx
jmp 0x1408c053a
call 0x1405e8008
mov rbx, qword gs:[0x30]
sbb r9b, 0xde
shr r8b, 0x77
movsx r8w, dl
mov rdi, qword [rbx + 0x28]
movzx r9w, spl
test r15b, r14b
rcl r9d, cl
mov qword [rbx + 0x28], r14
lea r9, [rsp + 0x40]
or r8b, 0xcb
lea r8, [rbp - 0x80]
test si, si
sub edx, edx
sub ecx, ecx
call 0x1404a1068
mov esi, eax
movzx edx, ax
add dl, r15b
movsx edx, di
mov qword [rbx + 0x28], rdi
shl r8b, 0xe8
movzx edx, r8w
mov dword [rbp - 0x6c], eax
movsx edx, r8w
mov eax, 1
bsf r8, rcx
cmc
inc r8b
mov dword [rbp - 0x70], eax
mov dl, 0x54
xchg dl, dh
bt r8d, 0xcb
lea r8, [rbp - 0x80]
lea rdx, [0x140048638]
test r8w, 0x34
test r8w, r12w
sub ecx, ecx
jmp 0x1408c05d6
call 0x14089b716
lea rdi, [rbp + 0x3b0]
sbb cx, 0xc9e
cmc
dec dh
sub eax, eax
cwd
mov ecx, 0x4d0
jmp 0x1408c05fd
rep stosb byte [rdi], al
seta dl
mov cl, r10b
movsxd rcx, esi
mov dword [rbp + 0x3e0], 0x100010
cdq
mov qword [rbp + 0x410], r14
not dh
mov ecx, r12d
movzx edx, cx
mov qword [rbp + 0x420], 0x400
movsx rcx, bx
lea rdx, [rbp + 0x3b0]
mov cx, cx
mov cx, 0x37da
movzx cx, bl
lea rcx, [rax - 2]
call fcn.14055bb2b
test esi, esi
jmp 0x1408c0653
js 0x1408c06a9
mov rbx, qword [rsp + 0x40]
cmp dword [rbp + 0x198], r14d
jmp 0x1408c066a
jne 0x1408c06ef
test rbx, rbx
jmp 0x1408c0678
je 0x1408c06ae
mov rcx, rbx
jmp 0x1408c0686
call 0x1405e0e9d
mov rbx, r14
jmp 0x1408c0694
mov qword [rsp + 0x40], rbx
jmp 0x1408c069e
jmp 0x1408c06ae
mov r15d, 0x208
mov rbx, qword [rsp + 0x40]
mov esi, 1
cmp di, r10w
add r13d, esi
cmp r12b, spl
test r12b, dil
stc
mov dword [rbp + 0xb00], r13d
jmp 0x1408c06d1
cmp r13d, 3
jmp 0x1408c06da
jae 0x1408c06ef
mov rbx, qword [rsp + 0x50]
jmp 0x1408c06ea
jmp 0x1408bfdc8
lea rdi, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
add rcx, 0xeea6af3
xor eax, eax
bswap rcx
mov ch, 0x85
mov rcx, r15
jmp 0x1408c070d
rep stosb byte [rdi], al
bt rdi, rsp
and di, 0x59ba
mov rdi, qword [rbp + 0x10]
test rdi, rdi
je 0x1408c074b
mov rcx, qword [rbp + 0x18]
test r13b, r13b
jmp 0x1408c0731
test rcx, rcx
jmp 0x1408c0739
je 0x1408c074b
rep stosb byte [rdi], al
shrd bx, ax, 0x60
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jmp 0x1408c0753
jne 0x1408c078d
sub edx, edx
xchg r8b, r8b
mov r8d, 0x800
movsxd rcx, edi
movsx cx, bl
movzx cx, r15b
mov rcx, qword [rbp + 0xaf0]
call 0x140802411
mov rbx, rax
cmovs ecx, r10d
bswap rcx
not ch
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0x160]
jmp 0x1408c079a
call 0x140488c4d
mov rdx, qword [rbp + 0x10]
test al, r9b
test rdx, rdx
jmp 0x1408c07af
je 0x1408c07fc
mov rcx, qword [rdx - 8]
stc
test r12b, dil
test rcx, rcx
je 0x1408c07dc
mov rdi, rdx
xor eax, eax
jmp 0x1408c07d0
rep stosb byte [rdi], al
movsx rcx, r13w
mov cx, 0x42df
bswap ecx
mov rcx, qword [rdx - 0x10]
jmp 0x1408c07e5
call 0x14087d4aa
mov qword [rbp + 0x10], r14
btr rax, r14
mov qword [rbp + 0x18], r14
xor ah, 0x59
xor ax, di
mov rax, qword [rsp + 0x70]
test r14w, 0x162f
stc
clc
test rax, rax
jmp 0x1408c0812
je 0x1408c0825
mov rcx, rax
jmp 0x1408c0820
call 0x1404dc476
mov rax, rbx
jmp 0x1408c082e
movaps xmm6, xmmword [rsp + 0xb90]
add rsp, 0xba8
mov r15d, 0x4b776b7c
movsxd rbp, r15d
movzx rsi, r15w
pop r15
pop r14
pop r13
mov bp, r13w
not sil
pop r12
bswap bp
pop rdi
mov bpl, r11b
movsx esi, si
movsx rsi, r14w
pop rsi
pop rbx
pop rbp
ret