Function at 0x140326960
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xcf8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc70], 0xfffffffffffffffe
mov qword [rbp + 0xc68], 0
cmp rcx, 0x1fefa
je 0x1403269cb
mov rsi, rdx
mov r15, rcx
call fcn.1403276b0
rdtsc
mov r12, rax
mov r13, rdx
shl r13, 0x20
test rsi, rsi
je 0x140326a30
mov rax, qword [rsi]
cmp rax, 7
jb 0x140326a20
inc qword [0x140502400]
jmp 0x140326a8d
cmp qword [0x14050246c], 0x33c0
jne 0x14032750d
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x40], 0xd0272616
mov dword [rsp + 0x38], 0x4f168755
mov dword [rsp + 0x30], 0x6428d10a
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call fcn.14032a540
add rax, 0x33c0
mov qword [0x14050246c], rax
jmp 0x14032750d
cmp rax, qword [0x1405023f8]
jbe 0x140326a30
mov qword [0x1405023f8], rax
mov rax, qword [0x1405024a8]
movsxd rcx, dword [rax]
mov r8d, dword [0x140410c0c]
xor r14d, r14d
test r15, r15
je 0x140326a8d
mov qword [rbp + 0xc20], rsi
mov rdx, rcx
xor rdx, rax
and rcx, rax
lea rcx, [rdx + rcx*2]
nop dword [rax]
mov edi, r14d
movzx eax, byte [r15 + rdi]
test eax, eax
je 0x140326a97
cmp eax, 0x2e
je 0x140326a97
add r14d, 0x12108d82
mov eax, r14d
xor eax, 0xedef727f
and r14d, 0x6def727f
lea r14d, [rax + r14*2]
jmp 0x140326a60
xor r9d, r9d
xor ebx, ebx
jmp 0x1403273c0
xor r9d, r9d
cmp byte [r15 + rdi], 0x2e
mov ebx, 0
jne 0x1403273c0
mov qword [rbp + 0xbd8], rcx
mov dword [rbp + 0xc1c], r8d
mov qword [rbp + 0xc58], 0
mov r8d, 0x400
sub r8, rdi
xor esi, esi
cmp r14d, 0x400
cmovae r8, rsi
lea rcx, [rdi + rbp]
add rcx, 0x7d0
xor edx, edx
call fcn.1403d1170
lea rbx, [rbp + 0x7d0]
mov rcx, rbx
mov qword [rbp + 0xc30], r15
mov rdx, r15
mov r8, rdi
call fcn.1403d0ac0
mov dword [rsp + 0x20], 0xde3f8a1b
mov ecx, 1
xor edx, edx
mov r8, rbx
mov r9d, 0xa680be28
call fcn.140329e90
mov qword [rbp + 0xc58], rax
mov ebx, 0
test rax, rax
jne 0x140326c99
xor ebx, ebx
lea rcx, [rbp + 0x7d0]
xor edx, edx
call fcn.140324710
xor ecx, ecx
test rax, rax
sete cl
lea r10, [0x140502350]
movabs rdx, 0xb9b3c12ddae7a733
sub rdx, qword [r10 + rcx*8 + 0x58]
movabs r8, 0x464c3ed2251858cc
mov r9, rdx
xor r9, r8
and rdx, r8
lea rdx, [r9 + rdx*2]
neg rdx
mov qword [rbp + 0xc58], rax
mov qword [r10 + rcx*8 + 0x58], rdx
test rax, rax
jne 0x140326c99
mov dword [rsp + 0x20], 0xa80a70f0
xor ebx, ebx
xor ecx, ecx
xor edx, edx
mov r8d, 0x75f11bef
mov r9d, 0x9b630f62
call fcn.14032a490
test rax, rax
je 0x140326c99
mov qword [rbp + 0xbf0], 0
lea rcx, [rbp - 0x30]
mov qword [rbp + 0xbf8], rcx
mov ecx, 1
xor edx, edx
nop dword [rax + rax]
mov r8d, ebx
mov r9d, ebx
movsx r10d, byte [rbp + r9 + 0x7d0]
xor ebx, ebx
test r10w, r10w
setne bl
mov word [rbp + r9*2 - 0x30], r10w
movzx edx, dl
cmove edx, ecx
add ebx, r8d
mov r8d, edx
not r8b
mov r9d, r8d
and r9b, 1
mov r10d, edx
and r10b, 0xfe
or r10b, r9b
and r8b, 0xfe
mov r9d, r10d
not r9b
mov r11d, r10d
xor r11b, r8b
mov r15d, r9d
and r9b, r8b
not r8b
and r15b, r8b
or r15b, r11b
not r15b
and r8b, r10b
or r8b, r9b
or r8b, r15b
cmp r8b, 0xff
je 0x140326be0
lea ecx, [rbx + rbx]
mov word [rbp + 0xbf0], cx
lea ecx, [rbx + rbx]
add ecx, 2
mov word [rbp + 0xbf2], cx
lea r8, [rbp + 0xbf0]
lea r9, [rbp + 0xc58]
xor ecx, ecx
xor edx, edx
call qword [case.0x1400f5c95.0]
mov rbx, qword [rbp + 0xc58]
xor eax, eax
test rbx, rbx
sete al
lea rcx, [0x140502350]
inc qword [rcx + rax*8 + 0x20]
mov qword [rbp + 0xbd0], rbx
lea rcx, [rbp + 0x7d0]
xor edx, edx
mov r8, rdi
call fcn.1403d1170
lea r15d, [r14 + 1]
mov rax, qword [rbp + 0xc30]
movzx ebx, byte [rax + r15]
mov r9d, 0
cmp bl, 0x23
jne 0x140326d0c
mov eax, r14d
xor eax, 0x12968081
and r14d, 0x12968081
lea r15d, [rax + r14*2]
add r15d, 0xed697f81
mov rax, qword [rbp + 0xc30]
lea rcx, [rax + r15]
mov edx, 0xee9eabf4
mov r8d, 0x69e7b2d6
mov r9d, 0xfa6c8ea7
call fcn.140277820
mov esi, eax
mov r9b, 1
mov rax, qword [rbp + 0xc20]
test rax, rax
je 0x140326d2a
cmp qword [rax], 7
jb 0x140326d2a
inc qword [0x140502400]
jmp 0x14032737a
mov rdi, qword [rbp + 0xc58]
test rdi, rdi
je 0x14032737a
movsxd rcx, dword [rdi + 0x3c]
mov eax, dword [rdi + rcx + 0x88]
test rax, rax
je 0x14032737a
mov edx, dword [rdi + rcx + 0x8c]
test rdx, rdx
je 0x14032737a
cmp dword [rdi + rcx + 0x8c], 0x28
jb 0x14032737a
lea r8, [rdi + rax]
add rdx, r8
mov qword [rbp + 0xc10], rdx
mov ecx, dword [r8 + 0x1c]
add rcx, rdi
mov qword [rbp + 0xc08], rcx
mov ecx, dword [r8 + 0x14]
cmp bl, 0x23
jne 0x140326e2d
mov r8d, dword [r8 + 0x10]
inc qword [0x140502380]
test ecx, ecx
je 0x14032737a
mov bl, 1
mov edx, esi
sub edx, r8d
jb 0x14032737c
cmp edx, ecx
jae 0x14032737c
mov ecx, edx
mov rdx, qword [rbp + 0xc08]
mov ebx, dword [rdx + rcx*4]
test rbx, rbx
je 0x14032737a
mov ecx, ebx
add rbx, rdi
cmp ecx, eax
jb 0x140327373
cmp rbx, qword [rbp + 0xc10]
ja 0x140327373
mov r14, r9
mov rcx, rbx
mov rdx, qword [rbp + 0xc30]
call fcn.140324490
test al, al
je 0x140327528
mov rcx, rbx
mov rdx, rdi
call fcn.140324710
test rax, rax
je 0x14032756e
mov qword [rbp + 0xc58], rax
lea rax, [0x1405023a8]
jmp 0x140327575
mov edx, dword [r8 + 0x20]
mov eax, dword [r8 + 0x24]
mov r10d, dword [r8 + 0x18]
inc qword [0x140502388]
xor ebx, ebx
test ecx, ecx
je 0x14032737c
add rdx, rdi
add rax, rdi
test r10d, r10d
je 0x14032737c
mov qword [rbp + 0xbe0], rax
mov qword [rbp + 0xbe8], r8
je 0x14032737c
mov eax, r15d
add rax, qword [rbp + 0xc30]
mov qword [rbp + 0xc28], rax
xor r11d, r11d
mov qword [rbp + 0xc40], r12
mov qword [rbp + 0xc48], r13
mov qword [rbp + 0xc50], r9
mov qword [rbp + 0xc38], rdx
mov dword [rbp + 0xc64], r10d
jmp 0x140326ee9
mov qword [rbp + 0xc68], 0
mov r11, qword [rbp + 0xc00]
inc r11d
xor ebx, ebx
mov r10d, dword [rbp + 0xc64]
cmp r11d, r10d
mov r12, qword [rbp + 0xc40]
mov r13, qword [rbp + 0xc48]
mov r9, qword [rbp + 0xc50]
mov rdx, qword [rbp + 0xc38]
jae 0x14032737c
mov eax, r11d
mov ecx, dword [rdx + rax*4]
mov r8d, dword [0x1405024a0]
mov edx, dword [0x140520290]
nop dword [rax]
mov edx, dword [0x140520290]
cmp edx, 0x10
jg 0x140326f00
mov qword [rbp + 0xc00], r11
mov r9d, r8d
neg r9d
mov edx, 1
sub edx, r9d
mov dword [0x1405024a0], edx
mov r10d, r8d
not r10d
add r9d, 0xfffffffe
and r9d, r10d
xor edx, r8d
or edx, r9d
xor edx, 0xffffffff
mov r11d, dword [rbp + 0xc1c]
mov rsi, qword [rbp + 0xbd8]
je 0x140326f51
xor r8d, r8d
jmp 0x140326fa4
xor r9d, r9d
mov r8d, 0
test r11d, r11d
jle 0x140326fa4
xor r8d, r8d
nop word cs:[rax + rax]
mov r10d, dword [0x140520290]
cmp r10d, 0x4e
mov r10d, dword [0x140520290]
cmp r10d, 0x4f
jge 0x140326f7b
movsxd r9, r9d
xor r8w, word [rsi + r9]
mov r10d, r9d
xor r10d, 2
and r9d, 2
lea r9d, [r10 + r9*2]
cmp r9d, r11d
jl 0x140326f70
test ecx, ecx
je 0x140326eb1
mov rsi, qword [rbp + 0xc58]
xor r9d, r9d
test edx, edx
setne r9b
movzx edx, word [0x140411180]
mov r10d, r9d
xor r10d, 0x1e1d
lea r9d, [r10 + r9*2]
add r9d, 0xffffe1e2
sub edx, r8d
mov r8d, edx
xor r8d, r9d
not r9d
xor edx, r9d
and edx, r9d
or edx, r8d
not edx
movzx edx, dx
mov r8d, dword [0x14051df04]
nop dword [rax]
mov r9d, dword [0x14052028c]
lea r10d, [r9 + 1]
imul r10d, r9d
test r10b, 1
je 0x140327022
mov r9d, dword [0x140520290]
cmp r9d, 0xe
jge 0x140327000
add edx, r8d
mov dword [0x14051df04], edx
add rcx, rsi
xor edx, edx
mov r10, qword [rbp + 0xc28]
nop word [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [r10 + rdx]
test r8b, r8b
je 0x140327059
cmp r8b, r9b
jne 0x140327059
inc rdx
jmp 0x140327040
cmp r8b, r9b
jne 0x140326eb1
mov rcx, qword [rbp + 0xbe0]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0xc08]
mov edi, dword [rcx + rax*4]
test rdi, rdi
je 0x140326eb1
add rdi, rsi
cmp rdi, qword [rbp + 0xbe8]
mov rax, qword [rbp + 0xc10]
jb 0x14032717a
cmp rdi, rax
ja 0x14032717a
mov rcx, rdi
mov rdx, qword [rbp + 0xc30]
call fcn.140324490
test al, al
je 0x14032712e
mov rcx, rdi
mov rdx, rsi
call fcn.140324710
test rax, rax
je 0x1403271c7
mov qword [rbp + 0xc58], rax
inc qword [0x1405023a8]
mov rcx, rax
mov rdx, qword [rbp + 0xc28]
call fcn.140327a80
mov qword [rbp + 0xc68], rax
mov rcx, qword [0x140502358]
mov rdx, rcx
xor rdx, 0xfffffffffffffffe
mov r8, rdx
and r8, rcx
add r8, r8
xor rcx, r8
xor rcx, 1
not r8
and r8, rdx
or r8, rcx
not r8
lea rcx, [rcx + r8*2]
mov qword [0x140502358], rcx
test rax, rax
je 0x140327218
jmp 0x140327552
inc qword [0x140502350]
mov rdx, qword [rbp + 0xc20]
test rdx, rdx
je 0x14032716f
mov rax, qword [rdx]
movabs rcx, 0x2afb02cd0213a4b9
add rax, rcx
mov rcx, rax
xor rcx, 1
and eax, 1
lea rax, [rcx + rax*2]
movabs rcx, 0xd504fd32fdec5b47
add rax, rcx
mov qword [rdx], rax
mov rcx, rdi
call fcn.140326960
mov rdi, rax
mov qword [rbp + 0xc68], rdi
mov r12, qword [rbp + 0xc40]
mov r13, qword [rbp + 0xc48]
mov r9, qword [rbp + 0xc50]
mov rdx, qword [rbp + 0xc38]
mov r10d, dword [rbp + 0xc64]
xor ebx, ebx
test rdi, rdi
jne 0x14032737c
mov r11, qword [rbp + 0xc00]
inc r11d
cmp r11d, r10d
jb 0x140326ee9
jmp 0x14032737c
inc qword [0x1405023b0]
mov qword [rbp + 0xc68], 0
mov rax, qword [0x140502358]
movabs rcx, 0x340ed988005550bb
add rax, rcx
mov rcx, rax
movabs rdx, 0x300f30707717551f
xor rcx, rdx
and rax, rdx
lea rax, [rcx + rax*2]
movabs rcx, 0x9be1f60788935a27
add rax, rcx
mov qword [0x140502358], rax
call fcn.1403333b0
test rax, rax
je 0x140326ea6
mov qword [rbp - 0x30], 0
xor ecx, ecx
xor edx, edx
mov r11, qword [rbp + 0xc28]
mov esi, 1
xor r8d, r8d
cmp byte [r11 + rcx], 0
setne r8b
mov r9, r8
not r9
movzx edx, dl
cmove edx, esi
mov r10, rcx
and r10, r9
xor r9, rcx
and r9, rcx
not ecx
and ecx, r8d
or r10, rcx
lea rcx, [r10 + r9*2]
mov r8d, edx
not r8b
mov r9d, edx
xor r9b, 1
and r8b, 0xfe
or r8b, r9b
cmp r8b, 0xff
je 0x14032723e
mov word [rbp - 0x30], cx
inc ecx
mov word [rbp - 0x2e], cx
mov qword [rbp - 0x28], r11
mov rcx, qword [rbp + 0xc58]
lea rdx, [rbp - 0x30]
xor r8d, r8d
lea r9, [rbp + 0xc68]
call qword [case.0x1400f5c95.0]
cmp eax, 0xc0000142
je 0x1403272bf
cmp eax, 0xc0000138
jne 0x14032731f
mov qword [rbp + 0xc68], 0
mov rax, qword [0x1405023b8]
mov rcx, qword [0x14051df88]
add rax, rcx
inc rax
mov qword [0x1405023b8], rax
mov r12, qword [rbp + 0xc40]
mov r13, qword [rbp + 0xc48]
mov r9, qword [rbp + 0xc50]
mov rdx, qword [rbp + 0xc38]
mov r10d, dword [rbp + 0xc64]
inc qword [0x1405023f0]
lea rax, [0x1405023c0]
lea rcx, [0x1405023d0]
jmp 0x140327361
inc qword [0x1405023b8]
cmp qword [rbp + 0xc68], 0
lea rax, [0x1405023d8]
lea rcx, [0x1405023e8]
mov r12, qword [rbp + 0xc40]
mov r13, qword [rbp + 0xc48]
mov r9, qword [rbp + 0xc50]
mov rdx, qword [rbp + 0xc38]
mov r10d, dword [rbp + 0xc64]
je 0x140327308
inc qword [rax]
inc qword [rcx]
mov rdi, qword [rbp + 0xc68]
jmp 0x1403271a4
mov qword [rbp + 0xc68], rbx
xor ebx, ebx
mov rax, qword [rbp + 0xc68]
test rax, rax
jne 0x1403273c7
mov rsi, qword [rbp + 0xbd0]
test rsi, rsi
je 0x1403273c7
mov rdi, r9
mov ecx, 1
xor edx, edx
mov r8d, 0x77181d0a
mov r9d, 0xe4c8dff7
call fcn.140329f20
test rax, rax
je 0x1403273bd
mov rcx, rsi
call qword [case.0x1400f5c95.0]
mov r9, rdi
mov rax, qword [rbp + 0xc68]
or r12, r13
test rax, rax
je 0x1403273d8
lea rax, [0x140502360]
jmp 0x140327421
lea rax, [0x140502350]
mov rcx, qword [0x140502368]
movabs rdx, 0x4184a1c01a7bd6c3
mov r8, rcx
xor r8, rdx
and rcx, rdx
lea rcx, [r8 + rcx*2]
movabs rdx, 0xbe7b5e3fe584293e
add rdx, rcx
mov qword [0x140502368], rdx
xor ecx, ecx
test r9b, r9b
sete cl
lea rax, [rax + rcx*8]
add rax, 0x40
inc qword [rax]
rdtsc
shl rdx, 0x20
or rdx, rax
sub rdx, r12
cmp qword [0x140502420], 0
je 0x140327446
mov rax, qword [0x140502420]
cmp rax, rdx
jae 0x14032744d
mov qword [0x140502420], rdx
cmp qword [rbp + 0xc68], 0
je 0x140327481
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x38], 0x3a7ecad6
mov dword [rsp + 0x30], 0x2c9f7f4e
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x140327508
test bl, bl
je 0x1403274b4
test r9b, r9b
je 0x1403274b4
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x38], 0x3a7ecad6
mov dword [rsp + 0x30], 0x2c9f7f4e
mov ecx, 1
xor edx, edx
xor r8d, r8d
mov r9d, 0x4750412d
jmp 0x140327508
xorps xmm0, xmm0
test r9b, r9b
je 0x1403274e3
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x38], 0x3a7ecad6
mov dword [rsp + 0x30], 0x2c9f7f4e
mov ecx, 1
xor edx, edx
xor r8d, r8d
mov r9d, 0xc0000138
jmp 0x140327508
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x38], 0x3a7ecad6
mov dword [rsp + 0x30], 0x2c9f7f4e
mov ecx, 1
xor edx, edx
xor r8d, r8d
mov r9d, 0xc0000139
call fcn.140329e10
mov rax, qword [rbp + 0xc68]
add rsp, 0xcf8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
inc qword [0x140502350]
mov rdx, qword [rbp + 0xc20]
test rdx, rdx
je 0x14032753e
inc qword [rdx]
mov rcx, rbx
call fcn.140326960
mov qword [rbp + 0xc68], rax
jmp 0x140327658
xor ebx, ebx
mov r12, qword [rbp + 0xc40]
mov r13, qword [rbp + 0xc48]
mov r9, qword [rbp + 0xc50]
jmp 0x14032737c
lea rax, [0x1405023b0]
mov rcx, qword [rax]
mov rdx, rcx
xor rdx, 1
and ecx, 1
lea rcx, [rdx + rcx*2]
mov qword [rax], rcx
mov qword [rbp + 0xc68], 0
inc qword [0x140502358]
mov dword [rsp + 0x20], 0x6181aed0
mov ecx, 1
mov edx, 1
xor r8d, r8d
mov r9d, 0xe1dd5d6f
call fcn.140329e50
test rax, rax
je 0x1403275f4
inc qword [0x1405023b8]
mov rcx, qword [rbp + 0xc58]
lea r9, [rbp + 0xc68]
xor edx, edx
mov r8d, esi
call qword [case.0x1400f5c95.0]
cmp eax, 0xc0000138
jne 0x140327601
mov qword [rbp + 0xc68], 0
jmp 0x140327643
mov qword [rbp + 0xc68], 0
jmp 0x140327658
cmp qword [rbp + 0xc68], 0
je 0x140327643
mov rax, qword [0x1405023f0]
mov rcx, rax
xor rcx, 1
mov rdx, rax
not rdx
and rdx, rax
xor rdx, rcx
and eax, 1
lea rax, [rdx + rax*2]
mov qword [0x1405023f0], rax
inc qword [0x1405023d8]
inc qword [0x1405023e0]
jmp 0x140327658
inc qword [0x1405023f0]
inc qword [0x1405023c0]
inc qword [0x1405023c8]
xor ebx, ebx
mov r9, r14
jmp 0x14032737c