Function at 0x140388ff0
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xcd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc50], 0xfffffffffffffffe
mov qword [rbp + 0xc48], 0
cmp rcx, 0x1fefa
je 0x14038905b
mov rsi, rdx
mov rbx, rcx
call fcn.140389e70
rdtsc
mov r12, rax
mov r13, rdx
shl r13, 0x20
test rsi, rsi
je 0x1403890b8
mov rax, qword [rsi]
cmp rax, 7
jb 0x1403890a8
inc qword [0x140575d30]
jmp 0x1403890e5
cmp qword [0x140575d9c], 0x33c0
jne 0x140389ca7
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x38], 0x328b2d2f
mov dword [rsp + 0x30], 0xaed649b8
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.14038c670
add rax, 0x33c0
mov qword [0x140575d9c], rax
jmp 0x140389ca7
cmp rax, qword [0x140575d28]
jbe 0x1403890b8
mov qword [0x140575d28], rax
xor r14d, r14d
test rbx, rbx
je 0x1403890e5
mov qword [rbp + 0xbf8], rsi
nop word [rax + rax]
mov edi, r14d
movzx eax, byte [rbx + rdi]
test eax, eax
je 0x1403890ef
cmp eax, 0x2e
je 0x1403890ef
inc r14d
jmp 0x1403890d0
xor r15d, r15d
xor esi, esi
jmp 0x140389b3b
xor r15d, r15d
cmp byte [rbx + rdi], 0x2e
mov esi, 0
jne 0x140389b3b
mov qword [rbp + 0xc30], 0
mov r8d, 0x400
sub r8, rdi
xor esi, esi
cmp r14d, 0x400
cmovae r8, rsi
lea rcx, [rdi + rbp]
add rcx, 0x7c0
xor edx, edx
call fcn.140430d20
lea r15, [rbp + 0x7c0]
mov rcx, r15
mov qword [rbp + 0xc08], rbx
mov rdx, rbx
mov r8, rdi
call fcn.140430670
mov ecx, 1
xor edx, edx
mov r8, r15
mov r9d, 0xce7c9fb1
call fcn.14038c380
mov qword [rbp + 0xc30], rax
mov ecx, 0
mov qword [rbp + 0xc40], rcx
test rax, rax
jne 0x140389298
xor eax, eax
mov qword [rbp + 0xc40], rax
lea rcx, [rbp + 0x7c0]
xor edx, edx
call fcn.1403887a0
xor ecx, ecx
test rax, rax
sete cl
lea rbx, [0x140575c80]
inc qword [rbx + rcx*8 + 0x58]
mov qword [rbp + 0xc30], rax
test rax, rax
jne 0x140389298
mov r15d, 1
xor eax, eax
mov qword [rbp + 0xc40], rax
mov ecx, 1
xor edx, edx
mov r8d, 0x1a223a2b
mov r9d, 0x7fb4a6fe
call fcn.14038c590
test rax, rax
je 0x140389298
mov qword [rbp + 0xbd8], 0
lea rcx, [rbp - 0x40]
mov qword [rbp + 0xbe0], rcx
xor ecx, ecx
xor r10d, r10d
nop word [rax + rax]
mov edx, r10d
mov r8d, r10d
movsx r9d, byte [rbp + r8 + 0x7c0]
xor r10d, r10d
test r9w, r9w
setne r10b
mov word [rbp + r8*2 - 0x40], r9w
movzx ecx, cl
cmove ecx, r15d
add r10d, edx
mov edx, ecx
xor dl, 0xfe
test dl, cl
je 0x140389210
lea ecx, [r10 + r10]
mov word [rbp + 0xbd8], cx
neg ecx
xor ecx, 0xfffffffe
shl r10d, 2
sub r10d, ecx
mov word [rbp + 0xbda], r10w
lea r8, [rbp + 0xbd8]
lea r9, [rbp + 0xc30]
xor ecx, ecx
xor edx, edx
call qword [case.0x1401460cb.0]
mov rdx, qword [rbp + 0xc30]
xor eax, eax
mov rcx, rdx
mov qword [rbp + 0xc40], rdx
test rdx, rdx
sete al
inc qword [rbx + rax*8 + 0x20]
lea rcx, [rbp + 0x7c0]
xor edx, edx
mov r8, rdi
call fcn.140430d20
lea eax, [r14 + 1]
mov ecx, dword [0x14058f0a0]
mov edx, eax
not edx
mov r8d, ecx
xor r8d, edx
xor edx, eax
and edx, ecx
xor edx, eax
and r8d, ecx
lea eax, [rdx + r8*2]
mov rcx, qword [rbp + 0xc08]
movzx ebx, byte [rcx + rax]
mov r15d, 0
cmp bl, 0x23
jne 0x14038930d
add r14d, 2
mov rax, qword [rbp + 0xc08]
lea rcx, [rax + r14]
mov edx, 0x502f480
mov r8d, 0x4d3d69cb
mov r9d, 0xc307d0da
call fcn.140374000
mov esi, eax
mov r15b, 1
mov eax, r14d
mov rcx, qword [rbp + 0xbf8]
test rcx, rcx
mov r11, qword [rbp + 0xc40]
je 0x140389332
cmp qword [rcx], 7
jb 0x140389332
inc qword [0x140575d30]
jmp 0x140389afe
mov rdi, qword [rbp + 0xc30]
test rdi, rdi
je 0x140389afe
movsxd rdx, dword [rdi + 0x3c]
mov ecx, dword [rdi + rdx + 0x88]
test rcx, rcx
je 0x140389afe
mov r14, rsi
mov esi, dword [rdi + rdx + 0x8c]
test rsi, rsi
je 0x140389afe
cmp dword [rdi + rdx + 0x8c], 0x28
jb 0x140389afe
lea r8, [rdi + rcx]
add rsi, r8
mov edx, dword [r8 + 0x1c]
add rdx, rdi
mov qword [rbp + 0xbf0], rdx
mov edx, dword [r8 + 0x14]
cmp bl, 0x23
jne 0x140389463
mov eax, dword [r8 + 0x10]
mov r8, qword [0x140575cb0]
movabs r9, 0x99211882cdc31508
xor r9, r8
movabs r10, 0x19211882cdc31508
and r10, r8
lea r8, [r9 + r10*2]
movabs r9, 0x66dee77d323ceaf9
add r9, r8
mov qword [0x140575cb0], r9
test edx, edx
je 0x140389afe
mov r9, rsi
mov sil, 1
mov r8d, r14d
sub r8d, eax
jb 0x140389b00
cmp r8d, edx
jae 0x140389b00
mov eax, r8d
mov rdx, qword [rbp + 0xbf0]
mov ebx, dword [rdx + rax*4]
test rbx, rbx
je 0x140389afe
mov eax, ebx
add rbx, rdi
cmp eax, ecx
jb 0x140389af7
cmp rbx, r9
ja 0x140389af7
mov rcx, rbx
mov rdx, qword [rbp + 0xc08]
call fcn.1403885a0
test al, al
je 0x140389cc2
mov rcx, rbx
mov rdx, rdi
call fcn.1403887a0
test rax, rax
je 0x140389d24
mov qword [rbp + 0xc30], rax
lea rax, [0x140575cd8]
jmp 0x140389d2b
mov qword [rbp + 0xbd0], rsi
mov r9d, dword [r8 + 0x20]
mov ecx, dword [r8 + 0x24]
mov r10d, dword [r8 + 0x18]
inc qword [0x140575cb8]
xor esi, esi
test edx, edx
je 0x140389b00
add r9, rdi
add rcx, rdi
test r10d, r10d
je 0x140389b00
mov qword [rbp + 0xbc0], rcx
mov qword [rbp + 0xbc8], r8
je 0x140389b00
mov eax, eax
add rax, qword [rbp + 0xc08]
mov qword [rbp + 0xc00], rax
xor eax, eax
mov qword [rbp + 0xc18], r12
mov qword [rbp + 0xc20], r13
mov qword [rbp + 0xc28], r15
mov qword [rbp + 0xc10], r9
mov dword [rbp + 0xc3c], r10d
jmp 0x14038954e
mov qword [rbp + 0xc48], 0
mov rdx, qword [rbp + 0xbe8]
lea eax, [rdx + rdx]
and eax, 2
mov ecx, edx
xor ecx, eax
xor ecx, 1
xor edx, 0x7ffffffe
not eax
and eax, edx
or eax, ecx
not eax
add eax, eax
mov edx, ecx
xor edx, eax
and eax, ecx
lea eax, [rdx + rax*2]
xor esi, esi
mov r10d, dword [rbp + 0xc3c]
cmp eax, r10d
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
mov r9, qword [rbp + 0xc10]
jae 0x140389b00
mov qword [rbp + 0xbe8], rax
mov eax, eax
mov r8d, dword [r9 + rax*4]
test r8, r8
je 0x1403894ec
mov rsi, qword [rbp + 0xc30]
add r8, rsi
xor r9d, r9d
mov rdi, qword [rbp + 0xc00]
lea r14, [fcn.140388ff0]
nop dword [rax + rax]
movzx ecx, byte [r8 + r9]
movzx edx, byte [rdi + r9]
cmp cl, dl
sete r10b
test cl, cl
sete r11b
mov ebx, r10d
xor bl, r11b
and bl, r10b
or bl, r11b
xor bl, 1
or bl, r11b
jne 0x1403895af
inc r9
jmp 0x140389580
mov rbx, qword [0x140575dd0]
movsxd r8, dword [rbx]
mov r9d, dword [0x140591f88]
cmp r9d, 0x1c
lea r9d, [r14 + r14]
add r9d, 0x2920
mov r10d, r9d
not r10d
test r10d, r9d
jne 0x1403895c4
add rbx, r8
nop dword [rax]
mov r14d, dword [0x140472350]
mov r8d, dword [0x140591f88]
cmp r8d, 0x20
jl 0x14038961e
nop word cs:[rax + rax]
mov r8d, dword [0x140472350]
mov r8d, dword [0x140591f84]
lea r9d, [r8 - 1]
imul r9d, r8d
test r9b, 1
jne 0x140389600
jmp 0x1403895e0
cmp cl, dl
jne 0x1403894ec
movzx ecx, word [0x14058eb9c]
mov rdx, qword [rbp + 0xbc0]
add cx, word [rdx + rax*2]
movzx eax, cx
mov rcx, qword [rbp + 0xbf0]
mov edi, dword [rcx + rax*4]
test rdi, rdi
je 0x1403894ec
add rdi, rsi
cmp rdi, qword [rbp + 0xbc8]
jb 0x140389774
cmp rdi, qword [rbp + 0xbd0]
ja 0x140389774
mov rcx, rdi
mov rdx, qword [rbp + 0xc08]
call fcn.1403885a0
test al, al
je 0x14038972c
mov rcx, rdi
mov rdx, rsi
call fcn.1403887a0
test rax, rax
je 0x1403897c7
mov qword [rbp + 0xc30], rax
mov rcx, qword [0x140575cd8]
movabs rdx, 0x1620c25560da71a4
add rdx, rcx
xor rdx, 1
movabs r8, 0xe9df3daa9f258e5b
sub r8, rcx
movabs rcx, 0x7ffffffffffffffe
and r8, rcx
or r8, rdx
not r8
lea rcx, [rdx + r8*2]
mov rdx, rcx
movabs r8, 0xe9df3daa9f258e5c
xor rdx, r8
movabs r8, 0x69df3daa9f258e5c
and rcx, r8
lea rcx, [rdx + rcx*2]
mov qword [0x140575cd8], rcx
mov rcx, rax
mov rdx, qword [rbp + 0xc00]
call fcn.14038a2e0
mov qword [rbp + 0xc48], rax
inc qword [0x140575c88]
test rax, rax
je 0x1403897e0
jmp 0x140389d01
inc qword [0x140575c80]
mov rdx, qword [rbp + 0xbf8]
test rdx, rdx
je 0x140389769
mov rax, qword [rdx]
movabs rcx, 0x8056893de146aeb5
add rax, rcx
mov rcx, rax
movabs r8, 0x7fa976c21eb9514c
xor rcx, r8
and rax, r8
lea rax, [rcx + rax*2]
mov qword [rdx], rax
mov rcx, rdi
call fcn.140388ff0
mov rdi, rax
mov qword [rbp + 0xc48], rdi
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
mov r9, qword [rbp + 0xc10]
mov r10d, dword [rbp + 0xc3c]
xor esi, esi
test rdi, rdi
jne 0x140389b00
mov rax, qword [rbp + 0xbe8]
inc eax
cmp eax, r10d
jb 0x14038954e
jmp 0x140389b00
inc qword [0x140575ce0]
mov qword [rbp + 0xc48], 0
inc qword [0x140575c88]
call fcn.140395380
test rax, rax
je 0x1403894e1
mov qword [rbp - 0x40], 0
mov ecx, dword [0x140591e18]
lea r9, [fcn.140388ff0]
mov edx, dword [0x140591f84]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
je 0x14038982c
lea edx, [r9 + r9]
add edx, 0x2c60
mov r8d, edx
not r8d
test r8d, edx
jne 0x140389803
lea edx, [rcx + rcx]
sub edx, ecx
inc edx
mov r12, qword [rbp + 0xc00]
mov r13d, 1
mov dword [0x140591e18], edx
mov r8d, dword [0x140591f88]
cmp r8d, 0xf
jle 0x14038987d
mov dword [0x140591e18], edx
mov dword [0x140591f84], 1
mov r8d, dword [0x140591f84]
mov r9d, 1
sub r9d, r8d
imul r9d, r8d
test r9b, 1
jmp 0x140389840
mov r8d, ecx
xor r8d, edx
not edx
not ecx
and ecx, edx
or ecx, r8d
xor ecx, 0xffffffff
jne 0x1403898b9
mov edx, dword [0x140591f88]
cmp edx, 0x32
jle 0x1403898b0
mov edx, dword [0x140591f84]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
jne 0x140389891
test r14d, r14d
jg 0x140389a7b
xor edx, edx
mov r8d, dword [0x140591f88]
cmp r8d, 0x37
jg 0x1403898bb
xor r8d, r8d
xor r9d, r9d
mov r10, r8
xor r11d, r11d
test ecx, ecx
setne r11b
lea rdi, [r11 - 1]
xor r8d, r8d
cmp byte [r12 + r10], 0
mov rbx, qword [0x140471dd0]
setne r8b
movzx r9d, r9b
cmove r9d, r13d
sub rbx, rdx
mov r14, rbx
not r14
neg r11
mov rsi, rbx
xor rsi, r11
mov r15, rbx
and r15, r11
and r11, r14
and r14, rdi
or rsi, r14
not rsi
or rsi, r14
or r15, r14
xor rbx, rdi
or r11, rbx
not r11
or r11, r15
not rsi
mov rdi, rsi
xor rdi, r11
or rsi, r11
not rsi
or rsi, rdi
not rsi
mov r11, rsi
shr r11, 0x20
mov edi, dword [0x14058f0a0]
mov ebx, edi
not ebx
or r11d, esi
mov esi, r11d
xor esi, ebx
xor ebx, edi
and ebx, r11d
xor ebx, edi
and esi, r11d
lea r11d, [rbx + rsi*2]
mov dword [0x14058f0a0], r11d
add r8, r10
mov r10d, r9d
not r10b
mov r11d, r9d
xor r11b, 1
and r10b, 0xfe
or r10b, r11b
cmp r10b, 0xff
je 0x1403898ce
mov word [rbp - 0x40], r8w
lea ecx, [r8 + 1]
mov word [rbp - 0x3e], cx
mov qword [rbp - 0x38], r12
mov rcx, qword [rbp + 0xc30]
lea rdx, [rbp - 0x40]
xor r8d, r8d
lea r9, [rbp + 0xc48]
call qword [case.0x1401460cb.0]
cmp eax, 0xc0000142
je 0x1403899cd
cmp eax, 0xc0000138
jne 0x140389a20
mov qword [rbp + 0xc48], 0
inc qword [0x140575ce8]
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
mov r9, qword [rbp + 0xc10]
mov r10d, dword [rbp + 0xc3c]
inc qword [0x140575d20]
lea rax, [0x140575cf0]
lea rcx, [0x140575d00]
jmp 0x140389a69
inc qword [0x140575ce8]
cmp qword [rbp + 0xc48], 0
lea rax, [0x140575d08]
lea rcx, [0x140575d18]
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
mov r9, qword [rbp + 0xc10]
mov r10d, dword [rbp + 0xc3c]
je 0x140389a09
inc qword [rax]
inc qword [rcx]
mov rdi, qword [rbp + 0xc48]
jmp 0x1403897a5
xor r8d, r8d
xor edx, edx
movsxd r8, r8d
mov r9, qword [rbx + r8]
mov r10, rdx
not r10
mov r11, rdx
and r11, r9
not r9
mov rsi, r9
xor rsi, r10
and r10, r9
or r10, r11
and rdx, r9
xor rdx, r10
not rdx
and rsi, r9
mov r9, rdx
and r9, rsi
xor rdx, rsi
xor rdx, r9
neg r8d
mov r9d, r8d
xor r9d, 0xfffffff8
and r8d, 0x7ffffff8
lea r8d, [r9 + r8*2]
neg r8d
mov r9d, dword [0x140591f88]
nop dword [rax]
mov r9d, dword [0x140591f88]
cmp r9d, 0x4a
jg 0x140389ae0
cmp r8d, r14d
jl 0x140389a80
jmp 0x1403898bb
mov qword [rbp + 0xc48], rbx
xor esi, esi
mov rax, qword [rbp + 0xc48]
test rax, rax
jne 0x140389b42
test r11, r11
je 0x140389b42
xor ecx, ecx
mov edx, 1
mov r8d, 0x3da87300
mov r9d, 0xae978795
call fcn.14038c6c0
test rax, rax
je 0x140389b3b
mov rcx, qword [rbp + 0xc40]
call qword [case.0x1401460cb.0]
mov rax, qword [rbp + 0xc48]
or r12, r13
test rax, rax
je 0x140389b53
lea rax, [0x140575c90]
jmp 0x140389b89
lea rax, [0x140575c80]
inc qword [0x140575c98]
mov ecx, r15d
not cl
lea edx, [r15 - 2]
mov r8d, edx
not r8b
and r8b, cl
xor dl, r15b
or dl, r8b
xor ecx, ecx
cmp dl, 0xff
sete cl
lea rax, [rax + rcx*8]
add rax, 0x40
movabs rcx, 0x1260e8a84f9333e1
add rcx, qword [rax]
movabs rdx, 0x79dd1192c2b13b3e
mov r8, rcx
xor r8, rdx
and rcx, rdx
lea rcx, [r8 + rcx*2]
movabs rdx, 0x73c205c4edbb90e2
add rdx, rcx
mov qword [rax], rdx
rdtsc
shl rdx, 0x20
or rdx, rax
sub r12, rdx
movabs rax, 0x526eb8fabb9c9c3d
sub rax, r12
movabs rcx, 0xad914705446363c2
add rcx, r12
movabs rdx, 0xad914705446363c3
and rdx, rcx
movabs rcx, 0x526eb8fabb9c9c3c
and rcx, rax
or rcx, rdx
movabs rdx, 0x2d914705446363c3
and rdx, rax
lea rax, [rcx + rdx*2]
cmp qword [0x140575d50], 0
je 0x140389c27
mov rcx, qword [0x140575d50]
cmp rcx, rax
jae 0x140389c2e
mov qword [0x140575d50], rax
cmp qword [rbp + 0xc48], 0
je 0x140389c46
mov dword [rsp + 0x20], 0x5d7769bc
xor ecx, ecx
xor edx, edx
jmp 0x140389c99
mov eax, r15d
not al
test al, 1
sete cl
mov edx, esi
xor dl, 1
xor cl, sil
and dl, al
or dl, cl
jne 0x140389c6f
mov dword [rsp + 0x20], 0x5d7769bc
xor ecx, ecx
mov edx, 0x4750412d
jmp 0x140389c99
or r15b, 0xfe
test r15b, 1
je 0x140389c8a
mov dword [rsp + 0x20], 0x5d7769bc
xor ecx, ecx
mov edx, 0xc0000138
jmp 0x140389c99
mov dword [rsp + 0x20], 0x5d7769bc
xor ecx, ecx
mov edx, 0xc0000139
xor r8d, r8d
mov r9d, 0x27a19030
call fcn.14038c700
mov rax, qword [rbp + 0xc48]
add rsp, 0xcd8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [0x140575c80]
mov rcx, rax
xor rcx, 1
and eax, 1
lea rax, [rcx + rax*2]
mov qword [0x140575c80], rax
mov rdx, qword [rbp + 0xbf8]
test rdx, rdx
je 0x140389ced
inc qword [rdx]
mov rcx, rbx
call fcn.140388ff0
mov qword [rbp + 0xc48], rax
jmp 0x140389e16
xor esi, esi
mov r12, qword [rbp + 0xc18]
mov r13, qword [rbp + 0xc20]
mov r15, qword [rbp + 0xc28]
mov r11, qword [rbp + 0xc40]
jmp 0x140389b00
lea rax, [0x140575ce0]
inc qword [rax]
mov qword [rbp + 0xc48], 0
inc qword [0x140575c88]
mov ecx, 1
mov edx, 1
mov r8d, 0x1a223a2b
mov r9d, 0x7fb4a6fe
call fcn.14038c590
test rax, rax
je 0x140389d94
inc qword [0x140575ce8]
mov rcx, qword [rbp + 0xc30]
lea r9, [rbp + 0xc48]
xor edx, edx
mov r8d, r14d
call qword [case.0x1401460cb.0]
cmp eax, 0xc0000138
jne 0x140389da1
mov qword [rbp + 0xc48], 0
jmp 0x140389dc2
mov qword [rbp + 0xc48], 0
jmp 0x140389e16
cmp qword [rbp + 0xc48], 0
je 0x140389dc2
inc qword [0x140575d20]
inc qword [0x140575d08]
inc qword [0x140575d10]
jmp 0x140389e16
inc qword [0x140575d20]
inc qword [0x140575cf0]
mov rax, qword [0x140575cf8]
mov ecx, eax
not ecx
and ecx, 1
mov rdx, rax
xor rdx, 0xfffffffffffffffe
and eax, 1
add rax, rax
mov r8, rax
and eax, edx
or rdx, rcx
not rdx
or rdx, rcx
not r8
mov rcx, rdx
and rcx, r8
or rcx, rax
xor r8, rdx
and r8, rdx
lea rax, [rcx + r8*2]
mov qword [0x140575cf8], rax
xor esi, esi
mov r11, qword [rbp + 0xc40]
jmp 0x140389b00