Function at 0x140375560
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x508
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x480], 0xfffffffffffffffe
mov rdi, rdx
mov rbx, rcx
mov r15d, dword [0x1405769e4]
mov qword [rbp + 0x470], 0
mov eax, dword [0x14055b800]
sub eax, r15d
add eax, 0x9e68
cdqe
add rax, qword [0x14055b838]
xor ecx, ecx
mov edx, 1
mov r8d, 0xb7cee2fc
call qword [case.0x14013cbc3.0]
cmp rbx, 0x12345678
je 0x14037561c
mov r13, rax
mov eax, dword [0x14055b818]
or eax, r15d
add eax, 0x9e68
cdqe
add rax, qword [0x14055b858]
call qword [case.0x14013cbc3.0]
test rdi, rdi
sets al
cmp rdi, 0x10000
setb sil
or sil, al
rdtsc
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x440], rdx
je 0x140375681
xor r14d, r14d
jmp 0x140375688
cmp qword [0x14055b60c], 0x33c0
jne 0x140375d6d
mov eax, dword [0x14055b82c]
add eax, r15d
add eax, 0x9e68
cdqe
add rax, qword [0x14055b880]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x38], 0xfe3ebf08
mov dword [rsp + 0x30], 0xe8be63d3
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [case.0x14013cbc3.0]
add rax, 0x33c0
mov qword [0x14055b60c], rax
jmp 0x140375d6d
cmp byte [rdi], 0
sete r14b
mov r12, rbx
test rbx, rbx
jne 0x1403756c8
mov eax, dword [0x14055b804]
or eax, r15d
add eax, 0x9e68
cdqe
add rax, qword [0x14055b878]
mov dword [rsp + 0x20], 0xd77735d7
xor ecx, ecx
mov edx, 1
xor r8d, r8d
mov r9d, 0x4dffb64e
call qword [case.0x14013cbc3.0]
mov r12, rax
movzx eax, byte [0x140578d58]
test al, 1
mov byte [rbp + 0x47f], sil
je 0x14037572f
mov eax, dword [0x14055b810]
or eax, r15d
add eax, 0x9e68
cdqe
add rax, qword [0x14055b860]
xor ecx, ecx
mov edx, 1
mov r8d, 0x1c0171c3
mov r9d, 0x5809a18f
call qword [case.0x14013cbc3.0]
test rax, rax
je 0x14037572f
test sil, sil
je 0x140375775
mov r8d, dword [0x1405769e4]
add r8d, edi
lea r9, [rbp + 0x470]
mov rcx, rbx
xor edx, edx
jmp 0x1403757e6
test r12, r12
je 0x1403757fe
mov eax, dword [r12 + 0x3c]
test rax, rax
je 0x1403757fe
cmp dword [r12 + rax], 0x4550
jne 0x1403757fe
cmp dword [r12 + rax + 0x88], 0
je 0x14037576e
cmp dword [r12 + rax + 0x8c], 0
jne 0x1403757fe
xor esi, esi
jmp 0x14037581b
mov qword [rbp - 0x20], 0
xor ecx, ecx
test rdi, rdi
je 0x1403757c7
xor edx, edx
jmp 0x1403757b5
mov edx, 1
mov r8b, r9b
add rcx, r8
mov r8d, edx
not r8b
mov r9d, edx
xor r9b, 1
and r8b, 0xfe
or r8b, r9b
cmp r8b, 0xff
jne 0x1403757c7
xor r8d, r8d
cmp byte [rdi + rcx], 0
setne r9b
je 0x140375790
movzx edx, dl
jmp 0x140375795
mov word [rbp - 0x20], cx
inc ecx
mov word [rbp - 0x1e], cx
mov qword [rbp - 0x18], rdi
lea rdx, [rbp - 0x20]
lea r9, [rbp + 0x470]
mov rcx, rbx
xor r8d, r8d
call qword [case.0x14013cbc3.0]
cmp eax, 0xc0000138
jne 0x1403757fe
mov qword [rbp + 0x470], 0
lea rcx, [rbp - 0x20]
mov r8d, 0x400
xor edx, edx
call fcn.14041da70
mov sil, 1
test r14b, r14b
je 0x140375946
mov rax, qword [rbp + 0x440]
shl rax, 0x20
mov r14, qword [rbp + 0x400]
or r14, rax
lea rcx, [rbp - 0x20]
mov r8d, 0x400
xor edx, edx
call fcn.14041da70
rdtsc
shl rdx, 0x20
or rdx, rax
sub rdx, r14
cmp qword [0x14055b598], 0
je 0x140375863
mov rax, qword [0x14055b598]
cmp rax, rdx
jae 0x14037586a
mov qword [0x14055b598], rdx
cmp qword [rbp + 0x470], 0
sete al
mov ecx, esi
xor cl, 1
xor sil, al
xor al, cl
and al, cl
or al, sil
jne 0x140375cc5
mov eax, dword [0x14055b80c]
or eax, r15d
add eax, 0x9e68
cdqe
add rax, qword [0x14055b850]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x50], 0x73feaad5
mov dword [rsp + 0x48], 0x4a1e40a8
mov qword [rsp + 0x40], 0
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [case.0x14013cbc3.0]
cmp eax, 0x4750412d
je 0x140375cc5
mov eax, dword [0x14055b810]
sub eax, r15d
add eax, 0x9e68
cdqe
add rax, qword [0x14055b860]
xor ecx, ecx
mov edx, 1
mov r8d, 0x1c0171c3
mov r9d, 0x5809a18f
call qword [case.0x14013cbc3.0]
test rax, rax
je 0x140375cc5
inc qword [0x14055b538]
cmp rdi, 0xffff
ja 0x140375b63
lea r9, [rbp + 0x470]
mov rcx, rbx
xor edx, edx
mov r8d, edi
jmp 0x140375bd8
mov eax, dword [0x14055b804]
sub eax, r15d
add eax, 0x9e68
cdqe
add rax, qword [0x14055b878]
mov dword [rsp + 0x20], 0xd77735d7
mov ecx, 1
mov edx, 1
mov r8, rbx
mov r9d, 0x4dffb64e
call qword [case.0x14013cbc3.0]
mov rcx, qword [0x14055b620]
movsxd r8, dword [rcx]
add r8, rcx
movabs rdx, 0xec6429a0d5d404a
add rdx, r8
nop dword [rax + rax]
mov ecx, dword [0x140578d70]
cmp ecx, 0x3b
jg 0x1403759a0
mov ecx, dword [0x140578d70]
movabs rcx, 0xf139bd65f2a2bfb6
add rdx, rcx
nop
mov ecx, dword [0x140578d6c]
lea r8d, [rcx - 1]
imul r8d, ecx
test r8b, 1
jne 0x1403759c0
mov r8d, dword [0x14045e06c]
test rax, rax
je 0x14037581b
mov qword [rbp + 0x408], r13
xor ecx, ecx
nop dword [rax]
mov r13d, ecx
movzx r9d, word [rax + r13*2]
test r9d, r9d
je 0x140375a0c
cmp r9d, 0x2e
je 0x140375a0c
mov byte [rbp + r13 - 0x20], r9b
inc ecx
jmp 0x1403759f0
mov eax, 0x400
sub eax, ecx
cmp eax, 2
jb 0x140375b57
mov dword [rbp + 0x414], eax
mov qword [rbp + 0x448], r15
mov qword [rbp + 0x468], 0xf
mov qword [rbp + 0x460], 1
mov word [rbp + 0x450], 0x2e
nop dword [rax + rax]
mov eax, dword [0x140578d70]
cmp eax, 0x4e
jle 0x140375a8a
mov eax, dword [0x14055b5b0]
mov ecx, 2
sub ecx, eax
dec eax
shl eax, cl
sub eax, ecx
imul eax, ecx
add eax, ecx
mov dword [0x14055b5b0], eax
mov eax, dword [0x140578d6c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x140375a50
mov r11d, dword [0x14055b5b0]
lea r12d, [r11 + 1]
mov dword [0x14055b5b0], r12d
xor r11d, r12d
not r11d
xor r14d, r14d
mov r15d, 0
test r11d, r12d
jne 0x140375ac7
xor eax, eax
mov r14d, 0
mov r15d, 0
test r8d, r8d
jg 0x140375dcc
cmp byte [rbp + 0x47f], 0
je 0x140375c29
mov rax, qword [rbp + 0x460]
mov rcx, qword [rbp + 0x468]
cmp rcx, rax
jne 0x140375d88
mov dword [rbp + 0x43c], r12d
mov eax, dword [0x14055b81c]
mov ecx, eax
mov rdx, qword [rbp + 0x448]
xor ecx, edx
and eax, edx
lea eax, [rcx + rax*2]
add eax, 0x9e68
cdqe
add rax, qword [0x14055b848]
xor ecx, ecx
mov edx, 1
mov r8d, 0xc3f45f8
mov r9d, 0xbf67a670
mov r12, r11
call qword [case.0x14013cbc3.0]
mov qword [rsp + 0x20], 1
lea rcx, [rbp + 0x450]
mov edx, 1
mov r9, rax
call fcn.14008a380
mov r11, r12
jmp 0x140375e42
mov r13, qword [rbp + 0x408]
jmp 0x14037581b
mov qword [rbp + 0x450], 0
xor ecx, ecx
test rdi, rdi
je 0x140375bad
xor edx, edx
jmp 0x140375b9b
mov edx, 1
mov r8b, r9b
add rcx, r8
mov r8d, edx
not r8b
or r8b, 0xfe
cmp r8b, 0xff
jne 0x140375bad
xor r8d, r8d
cmp byte [rdi + rcx], 0
setne r9b
je 0x140375b80
movzx edx, dl
jmp 0x140375b85
mov word [rbp + 0x450], cx
inc ecx
mov word [rbp + 0x452], cx
mov qword [rbp + 0x458], rdi
lea rdx, [rbp + 0x450]
lea r9, [rbp + 0x470]
mov rcx, rbx
xor r8d, r8d
call qword [case.0x14013cbc3.0]
cmp eax, 0xc0000142
je 0x140375bf0
cmp eax, 0xc0000138
jne 0x140375c90
mov qword [rbp + 0x470], 0
xor eax, eax
cmp rdi, 0x10000
setae al
lea rcx, [0x14055b4d0]
inc qword [0x14055b570]
inc qword [0x14055b540]
lea rax, [rcx + rax*8]
add rax, 0x78
jmp 0x140375cc2
mov eax, dword [0x14055b808]
or eax, dword [rbp + 0x448]
add eax, 0x9e68
cdqe
add rax, qword [0x14055b870]
mov rcx, rdi
mov edx, 0x3a9109d8
mov r8d, 0xf186529a
call qword [case.0x14013cbc3.0]
mov rcx, qword [rbp + 0x460]
mov rdx, qword [rbp + 0x468]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x140375da9
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x450]
mov rdx, rax
mov r9, rdi
call fcn.14008a380
jmp 0x1403760fd
cmp qword [rbp + 0x470], 0
je 0x140375bfb
xor eax, eax
cmp rdi, 0x10000
setae al
lea rcx, [0x14055b4d0]
inc qword [0x14055b558]
lea rax, [rcx + rax*8]
add rax, 0x90
inc qword [rax]
mov esi, r15d
not esi
xor esi, r15d
mov eax, dword [0x14055b814]
and eax, esi
xor eax, r15d
add eax, 0x9e68
cdqe
add rax, qword [0x14055b830]
mov dword [rsp + 0x20], 0x21e726fd
mov ecx, 1
mov edx, 1
mov r8, r13
mov r9d, 0x52a387b6
call qword [case.0x14013cbc3.0]
movzx ecx, byte [rbp + 0x47f]
xor ecx, 0xc0000139
xor eax, eax
cmp qword [rbp + 0x470], 0
cmovne ecx, eax
and esi, dword [0x14055b820]
xor esi, r15d
add esi, 0x9e68
movsxd rax, esi
add rax, qword [0x14055b888]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x38], 0x3711ccfc
mov dword [rsp + 0x30], 0x726efe86
mov qword [rsp + 0x20], 0
mov ecx, 1
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [case.0x14013cbc3.0]
mov rax, qword [rbp + 0x470]
add rsp, 0x508
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rdx, [rax + 1]
mov qword [rbp + 0x460], rdx
cmp rcx, 0x10
jb 0x140375e2e
mov rcx, qword [rbp + 0x450]
jmp 0x140375e35
mov r14, rax
add r14, rcx
mov qword [rbp + 0x460], r14
cmp rdx, 0x10
jb 0x140376057
mov r15, qword [rbp + 0x450]
jmp 0x14037605e
xor r14d, r14d
xor r15d, r15d
jmp 0x140375dfb
xor r14, qword [rcx]
xor r15, qword [rcx + 8]
mov ecx, eax
xor ecx, 0x10
and eax, 0x10
lea eax, [rcx + rax*2]
cmp eax, r8d
jge 0x140375ac7
movsxd rcx, eax
add rcx, rdx
mov r9d, dword [0x140578d70]
cmp r9d, 0x46
jle 0x140375de0
nop
mov r9, qword [rcx]
mov r9, qword [rcx + 8]
mov r9d, dword [0x140578d6c]
lea r10d, [r9 + 1]
imul r10d, r9d
test r10b, 1
jne 0x140375e10
jmp 0x140375de0
lea rcx, [rbp + 0x450]
mov dword [rbp + 0x43c], r12d
mov word [rcx + rax], 0x23
mov rdx, rdi
not rdx
mov rax, rdi
xor rax, 0xffff
and rdx, 0xffffffffffff0000
or rdx, rax
not rdx
mov r12d, 1
lea r9, [rbp + 0x3f4]
movabs r8, 0xcccccccccccccccd
nop word cs:[rax + rax]
mov rcx, rdx
mov rax, rdx
mul r8
shr rdx, 3
lea eax, [rdx + rdx]
lea eax, [rax + rax*4]
mov r10d, ecx
sub r10d, eax
or r10b, 0x30
mov byte [r9], r10b
cmp rcx, 0xa
jb 0x140375eb0
inc r12
dec r9
jmp 0x140375e80
mov eax, dword [0x140578d70]
cmp eax, 0x47
jle 0x140375eda
mov rax, qword [0x14045e078]
mov rax, qword [0x14045e070]
mov eax, dword [0x140578d6c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x140375eb0
mov rdx, qword [0x14045e078]
mov r8, qword [0x14045e070]
mov eax, dword [0x140578d6c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x140375ebb
xor eax, eax
test dword [rbp + 0x43c], r11d
setne al
xor ecx, ecx
add rax, 0xffffffffffffffff
adc rcx, 0xffffffffffffffff
sub r8, r14
sbb rdx, r15
xor rax, r8
xor rcx, rdx
not rcx
not rax
and rax, r8
and rcx, rdx
mov dl, 1
nop dword [rax]
mov r8d, dword [0x140578d70]
cmp r8d, 0x1c
jg 0x140375f52
mov r8d, dword [0x140578d6c]
lea r10d, [r8 - 1]
imul r10d, r8d
test r10b, 1
je 0x140375f58
test dl, dl
je 0x140375f30
jmp 0x140375f3d
or rax, rcx
mov rcx, rax
shr rcx, 0x20
or ecx, eax
mov eax, 0xe52e2189
add eax, dword [0x1405766c0]
mov edx, eax
xor edx, ecx
and eax, ecx
lea eax, [rdx + rax*2]
mov ecx, dword [0x140578d6c]
lea edx, [rcx + 1]
imul edx, ecx
test dl, 1
add eax, 0x1ad1de77
mov dword [0x1405766c0], eax
mov qword [rbp + 0x428], 0
mov qword [rbp + 0x430], 0xf
mov byte [rbp + 0x418], 0
test r12, r12
je 0x140375fed
cmp r12, 0xf
jbe 0x140375fcb
lea rcx, [rbp + 0x418]
mov rdx, r12
call fcn.1400896c0
jmp 0x140375fed
mov qword [rbp + 0x428], r12
lea rcx, [rbp + 0x418]
mov rdx, r9
mov r8, r12
call fcn.14041d3c0
mov byte [rbp + r12 + 0x418], 0
mov r8, qword [rbp + 0x428]
cmp qword [rbp + 0x430], 0x10
jb 0x140376007
mov r9, qword [rbp + 0x418]
jmp 0x14037600e
lea r9, [rbp + 0x418]
mov rcx, qword [rbp + 0x460]
mov rax, qword [rbp + 0x468]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x14037603d
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x450]
mov rdx, r8
call fcn.14008a380
jmp 0x14037608d
lea r14, [rcx + r8]
mov qword [rbp + 0x460], r14
cmp rax, 0x10
jb 0x140376076
mov r15, qword [rbp + 0x450]
jmp 0x14037607d
lea r15, [rbp + 0x450]
add rcx, r15
mov rdx, rdi
mov r8, rax
call fcn.14041d3c0
mov byte [r15 + r14], 0
jmp 0x1403760fd
lea r15, [rbp + 0x450]
add rcx, r15
mov rdx, r9
call fcn.14041d3c0
mov byte [r15 + r14], 0
mov rax, qword [rbp + 0x430]
cmp rax, 0x10
jb 0x1403760fd
mov rcx, qword [rbp + 0x418]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1403760cd
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x140376212
add rax, 0x28
mov rdx, rax
mov rcx, r8
mov r8, qword [rbp + 0x448]
mov eax, dword [0x14055b824]
or eax, r8d
add eax, 0x9e68
cdqe
add rax, qword [0x14055b868]
mov r8d, 0x32e7905e
mov r9d, 0x29338d1a
call qword [case.0x14013cbc3.0]
mov rax, qword [rbp + 0x460]
mov ecx, dword [rbp + 0x414]
cmp rax, rcx
jae 0x140376191
cmp qword [rbp + 0x468], 0x10
jb 0x140376126
mov rdx, qword [rbp + 0x450]
jmp 0x14037612d
lea rdx, [rbp + 0x450]
lea rcx, [r13 - 0x20]
add rcx, rbp
xor r8d, r8d
test rax, rax
je 0x140376168
mov r9d, dword [0x1405766c0]
xor r9d, r8d
mov r10d, r9d
not r10d
and r10d, r8d
movzx r11d, byte [rdx + r8]
mov byte [rcx + r8], r11b
lea r8d, [r9 + r10*2]
inc r8d
cmp rax, r8
ja 0x140376140
mov eax, r8d
mov byte [rcx + rax], 0
mov qword [rbp + 0x418], 0
lea rcx, [rbp - 0x20]
lea rdx, [rbp + 0x418]
call fcn.140374640
mov qword [rbp + 0x470], rax
mov rax, qword [rbp + 0x468]
cmp rax, 0x10
mov r15, qword [rbp + 0x448]
mov r13, qword [rbp + 0x408]
jb 0x14037581b
mov rcx, qword [rbp + 0x450]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1403761df
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x14037620d
add rax, 0x28
mov rdx, rax
mov rcx, r8
mov eax, dword [0x14055b824]
xor eax, r15d
add eax, 0x9e68
cdqe
add rax, qword [0x14055b868]
mov r8d, 0x32e7905e
mov r9d, 0x29338d1a
call qword [case.0x14013cbc3.0]
jmp 0x14037581b
call fcn.1403d599c
call fcn.1403d599c
int3