Function at 0x180037310
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov dword [rsp + 0x88], r9d
mov qword [rsp + 0xb8], r8
mov dword [rsp + 0x84], edx
rdtsc
mov r8, rdx
shl r8, 0x20
or r8, rax
rdtsc
shl rdx, 0x20
or rdx, rax
cmp r8, rdx
mov eax, 0x51d54c16
mov edx, 0xe17c78c5
cmove edx, eax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0xb0], rcx
test rcx, rcx
mov eax, 0x8ffcb28d
mov ecx, 0x1bff3154
cmove ecx, eax
xor ecx, edx
mov esi, edx
xor esi, 0x158da43a
mov edi, edx
xor edi, 0x3a86cce7
mov eax, edx
xor eax, 0xbadcc6dd
mov dword [rsp + 0x7c], eax
mov ebx, edx
xor ebx, 0xbc6da40
mov dword [rsp + 0x60], edx
xor edx, 0xcfce6a8b
mov dword [rsp + 0x5c], edx
jmp 0x1800373c4
mov r8d, r15d
mov dword [rsp + 0x64], r13d
mov eax, r12d
mov ecx, dword [rsp + 0x5c]
mov ebp, ecx
mov r12d, eax
mov r15d, r8d
mov edx, ecx
imul edx, esi
add edx, edi
cmp edx, 0x190cae09
jg 0x180037420
cmp edx, 0xd2c1e29c
jle 0x180037460
cmp edx, 0xfa83f7d3
jle 0x1800374e2
cmp edx, 0xfa83f7d4
je 0x180037515
mov r8d, r15d
mov eax, r12d
mov ecx, ebp
cmp edx, 0x1192ed23
jne 0x1800373c4
mov eax, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x140]
mov dword [rcx], eax
jmp 0x1800373b5
cmp edx, 0x33f25512
jg 0x1800374a0
cmp edx, 0x190cae0a
je 0x18003753d
mov r8d, r14d
mov eax, r12d
mov ecx, ebx
cmp edx, 0x25c285a9
je 0x1800373c4
mov r8d, r15d
mov eax, r12d
mov ecx, ebp
cmp edx, 0x28b8b495
je 0x1800373b5
jmp 0x1800373c4
cmp edx, 0xa9e211da
je 0x180037572
cmp edx, 0xad7a9791
je 0x180037615
mov r8d, r15d
mov eax, r12d
mov ecx, ebp
cmp edx, 0xb70c8d5d
jne 0x1800373c4
mov r8d, r15d
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x64], eax
jmp 0x1800373bd
cmp edx, 0x33f25513
je 0x1800376d1
cmp edx, 0x5059a56f
je 0x1800376ed
mov r8d, r15d
mov eax, r12d
mov ecx, ebp
cmp edx, 0x74e39a2d
jne 0x1800373c4
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_NtClose]
mov r8d, r14d
jmp 0x18003760b
mov r8d, r15d
mov eax, dword [rsp + 0x90]
mov ecx, dword [rsp + 0x7c]
cmp edx, 0xd57b7d4e
je 0x1800373c4
mov r8d, r15d
mov eax, r12d
mov ecx, ebp
cmp edx, 0xd2c1e29d
jne 0x1800373c4
jmp 0x1800377fd
mov rax, qword [rsp + 0x70]
mov ecx, 0x92f2b137
mov qword [rsp + 0xc0], rax
test rax, rax
je 0x180037531
mov ecx, 0x803388bb
xor ecx, ebp
mov r14d, dword [rsp + 0x64]
jmp 0x1800377f2
mov r13d, r12d
test r12d, r12d
js 0x18003754d
mov r13d, dword [rsp + 0xa0]
mov eax, 0xffd757e7
mov ecx, 0xd8f00695
test r13d, r13d
jns 0x180037561
mov eax, 0xd8f00695
cmp qword [rsp + 0x140], 0
cmovne ecx, eax
jmp 0x1800377f0
xor ebp, dword [rsp + 0x60]
mov eax, ebp
xor eax, 0x9eb2d498
mov ecx, dword [rsp + 0x6c]
and ecx, eax
mov edx, ebp
xor edx, 0x8ffcb28f
imul edx, ecx
mov ecx, ebp
xor ecx, 0x614d2b67
and ecx, dword [rsp + 0x6c]
mov r8d, ebp
mov r9d, dword [rsp + 0x6c]
xor r9d, eax
and eax, dword [rsp + 0x6c]
xor r8d, 0x614d2b66
not eax
mov r10d, ebp
xor r10d, 0x8ffcb28c
imul r10d, eax
mov eax, ebp
xor eax, 0x4ffcb280
add eax, r8d
sub eax, ecx
add eax, r9d
add eax, edx
add eax, r10d
inc eax
mov ecx, ebp
xor ecx, 0xb8e48e62
imul ecx, eax
mov eax, ebp
xor eax, 0x47ca6e33
add eax, ecx
mov dword [rsp + 0x9c], eax
mov eax, ebp
xor eax, 0xff52c082
imul eax, dword [rsp + 0x9c]
xor ebp, 0x22a4c653
add ebp, eax
mov r8d, ebp
mov eax, r12d
mov ecx, ebx
jmp 0x1800373c4
mov edx, ebp
xor edx, dword [rsp + 0x60]
mov eax, edx
xor eax, 0x6cc985b7
mov ecx, dword [rsp + 0x68]
and ecx, eax
mov r8d, edx
xor r8d, 0x93367a48
mov r9d, dword [rsp + 0x68]
and r9d, r8d
add r9d, ecx
mov ecx, dword [rsp + 0x68]
or ecx, eax
mov r10d, edx
xor r10d, 0x1bff3155
and eax, dword [rsp + 0x68]
imul r10d, ecx
mov ecx, edx
xor ecx, 0xbff3154
add ecx, r8d
sub ecx, r9d
add ecx, eax
lea eax, [r10 + rcx]
inc eax
mov ecx, edx
xor ecx, 0x28b1f52f
imul ecx, eax
mov eax, edx
xor eax, 0xc1c1f3c4
add eax, ecx
mov dword [rsp + 0x98], eax
mov eax, edx
xor eax, 0x42414be7
imul eax, dword [rsp + 0x98]
xor edx, 0x1d7a6404
add edx, eax
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x70]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtCreateEvent]
mov ecx, 0x63dcdc22
mov dword [rsp + 0x8c], eax
test eax, eax
jns 0x1800377f0
mov ecx, 0xfb0b7e54
jmp 0x1800377f0
mov rcx, qword [rsp + 0x70]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov r8d, r15d
mov ecx, dword [rsp + 0x7c]
jmp 0x1800373c4
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
mov eax, dword [rsp + 0x138]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov r9d, ebp
xor r9d, dword [rsp + 0x60]
mov ecx, r9d
xor ecx, 0x523d5b3
mov edx, r9d
xor edx, 0xfadc2a4c
mov r8d, r9d
xor r8d, 0x7823ec74
add r8d, edx
sub r8d, dword [rsp + 0x80]
mov edx, dword [rsp + 0x80]
or edx, ecx
add edx, r8d
and ecx, dword [rsp + 0x80]
add ecx, edx
add ecx, 2
mov edx, r9d
xor edx, 0x501bba5b
imul edx, ecx
mov ecx, r9d
xor ecx, 0xf566c82a
add ecx, edx
mov dword [rsp + 0x94], ecx
mov ecx, r9d
xor ecx, 0x572fdd3
imul ecx, dword [rsp + 0x94]
xor r9d, 0x99dec6c2
add r9d, ecx
mov ecx, 0x59a1c7bc
mov dword [rsp + 0x90], eax
cmp eax, r9d
je 0x1800377f0
mov ecx, 0xf83af67
nop word [rax + rax]
xor ecx, ebp
mov r8d, r15d
mov eax, r12d
jmp 0x1800373c4
mov qword [rsp + 0x70], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov eax, r15d
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret