Function at 0x1403620c0
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xce8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc60], 0xfffffffffffffffe
mov qword [rbp + 0xc50], 0
cmp rcx, 0x1fefa
je 0x14036212f
mov rsi, rdx
mov rbx, rcx
call fcn.140362fa0
rdtsc
mov r11, rax
mov r13, rdx
shl r13, 0x20
test rsi, rsi
je 0x1403621b1
mov rax, qword [rsi]
cmp rax, 7
jb 0x1403621a1
inc qword [0x14054b5f0]
jmp 0x1403621d6
cmp qword [0x14054b65c], 0x33c0
jne 0x140362db4
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x38], 0x2e8cc297
mov dword [rsp + 0x30], 0x4ac384f1
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.140364bb0
neg rax
movabs rcx, 0xe2fbf8204cd4f004
xor rcx, rax
movabs rdx, 0x62fbf8204cd4f004
and rdx, rax
lea rax, [rcx + rdx*2]
movabs rcx, 0xe2fbf8204cd523c4
sub rcx, rax
mov qword [0x14054b65c], rcx
jmp 0x140362db4
cmp rax, qword [0x14054b5e8]
jbe 0x1403621b1
mov qword [0x14054b5e8], rax
test rbx, rbx
je 0x1403621d6
mov r14d, 1
nop dword [rax]
lea edi, [r14 - 1]
movzx eax, byte [rbx + rdi]
test eax, eax
je 0x1403621e1
cmp eax, 0x2e
je 0x1403621e1
inc r14d
jmp 0x1403621c0
xor r15d, r15d
xor r12d, r12d
jmp 0x140362cef
xor r15d, r15d
cmp byte [rbx + rdi], 0x2e
mov r12d, 0
jne 0x140362cef
mov qword [rbp + 0xc48], r11
mov qword [rbp + 0xc10], rsi
mov qword [rbp + 0xc40], 0
mov r8d, 0x400
sub r8, rdi
xor esi, esi
cmp edi, 0x400
cmovae r8, rsi
lea rcx, [rdi + rbp]
add rcx, 0x7c0
xor edx, edx
call fcn.14040c5e0
lea r15, [rbp + 0x7c0]
mov rcx, r15
mov qword [rbp + 0xc20], rbx
mov rdx, rbx
mov r8, rdi
call fcn.14040bf30
mov dword [rsp + 0x28], 0x79407804
mov dword [rsp + 0x20], 0x11eb72f
xor ecx, ecx
xor edx, edx
mov r8, r15
mov r9d, 0xe7998a23
call fcn.140364ea0
mov qword [rbp + 0xc40], rax
mov ecx, 0
mov qword [rbp + 0xc58], rcx
test rax, rax
jne 0x1403623bc
xor eax, eax
mov qword [rbp + 0xc58], rax
lea rcx, [rbp + 0x7c0]
xor edx, edx
call fcn.1403613f0
xor ecx, ecx
test rax, rax
sete cl
lea rbx, [0x14054b540]
inc qword [rbx + rcx*8 + 0x58]
mov qword [rbp + 0xc40], rax
test rax, rax
jne 0x1403623bc
mov dword [rsp + 0x28], 0x35a69d31
mov dword [rsp + 0x20], 0x3044cc03
xor eax, eax
mov qword [rbp + 0xc58], rax
mov r15d, 1
xor ecx, ecx
mov edx, 1
xor r8d, r8d
mov r9d, 0x80c7c371
call fcn.1403650c0
test rax, rax
je 0x1403623bc
mov qword [rbp + 0xbd8], 0
lea rcx, [rbp - 0x40]
mov qword [rbp + 0xbe0], rcx
xor ecx, ecx
xor r10d, r10d
nop word cs:[rax + rax]
mov edx, r10d
movsx r8d, byte [rbp + rdx + 0x7c0]
xor r9d, r9d
test r8w, r8w
setne r9b
movzx ecx, cl
cmove ecx, r15d
mov word [rbp + rdx*2 - 0x40], r8w
add r9d, dword [0x1405640a8]
mov edx, r10d
xor edx, r9d
and r9d, r10d
lea r10d, [rdx + r9*2]
test cl, 1
je 0x140362330
lea ecx, [r10 + r10]
mov word [rbp + 0xbd8], cx
lea ecx, [r10 + r10]
add ecx, 2
mov word [rbp + 0xbda], cx
lea r8, [rbp + 0xbd8]
lea r9, [rbp + 0xc40]
xor ecx, ecx
xor edx, edx
call qword [0x1404ee420]
mov rdx, qword [rbp + 0xc40]
xor eax, eax
mov rcx, rdx
mov qword [rbp + 0xc58], rdx
test rdx, rdx
sete al
inc qword [rbx + rax*8 + 0x20]
lea rcx, [rbp + 0x7c0]
xor edx, edx
mov r8, rdi
call fcn.14040c5e0
mov eax, r14d
mov rcx, qword [rbp + 0xc20]
movzx ebx, byte [rcx + rax]
cmp bl, 0x23
jne 0x140362403
inc r14d
add rcx, r14
mov edx, 0xb25b3b87
mov r8d, 0x8aed6d6d
mov r9d, 0x4b25e300
call fcn.140288170
mov esi, eax
mov r15b, 1
jmp 0x140362406
xor r15d, r15d
mov r11, qword [rbp + 0xc48]
mov rax, qword [rbp + 0xc10]
test rax, rax
mov r10, qword [rbp + 0xc58]
je 0x140362432
cmp qword [rax], 7
jb 0x140362432
inc qword [0x14054b5f0]
jmp 0x140362c9e
mov r12, qword [rbp + 0xc40]
test r12, r12
je 0x140362c9e
movsxd rcx, dword [r12 + 0x3c]
mov eax, dword [r12 + rcx + 0x88]
test rax, rax
je 0x140362c9e
mov edx, dword [r12 + rcx + 0x8c]
test rdx, rdx
je 0x140362c9e
cmp dword [r12 + rcx + 0x8c], 0x28
jb 0x140362c9e
mov r9, rax
add r9, r12
add rdx, r9
mov qword [rbp + 0xc00], rdx
mov r8d, dword [r9 + 0x10]
mov ecx, dword [r9 + 0x14]
mov edx, dword [r9 + 0x1c]
add rdx, r12
mov qword [rbp + 0xbf0], rdx
mov edx, dword [r9 + 0x20]
add rdx, r12
mov qword [rbp + 0xbc8], rdx
mov edx, dword [r9 + 0x18]
mov dword [rbp + 0xc34], edx
mov qword [rbp + 0xbd0], r9
mov edx, dword [r9 + 0x24]
mov r9, qword [0x14054b690]
nop dword [rax + rax]
mov r10d, dword [0x1405673d8]
mov r11d, 0x612a76b1
sub r11d, r10d
imul r11d, r10d
test r11b, 1
jne 0x140362502
movsxd r10, dword [r9]
mov r11d, dword [0x1405673d8]
lea edi, [r11 + 1]
imul edi, r11d
test dil, 1
je 0x140362520
mov r10d, dword [r9]
mov r10d, dword [0x1405673d8]
lea r11d, [r10 + 1]
imul r11d, r10d
test r11b, 1
jne 0x1403624d0
jmp 0x1403624ea
mov r11d, dword [0x1405673dc]
cmp r11d, 0x61
jle 0x140362542
mov r11d, dword [0x1405673d8]
lea edi, [r11 - 1]
imul edi, r11d
test dil, 1
jne 0x140362520
mov r11d, dword [0x1405673d8]
lea edi, [r11 - 1]
imul edi, r11d
test dil, 1
jne 0x14036252d
mov r11d, dword [0x14044c188]
mov dword [rbp + 0xc0c], r11d
cmp bl, 0x23
mov r11, qword [rbp + 0xc48]
jne 0x140362611
inc qword [0x14054b570]
test ecx, ecx
je 0x1403626a3
mov rbx, r12
mov r12b, 1
mov edx, esi
sub edx, r8d
mov r10, qword [rbp + 0xc58]
jb 0x140362ca1
cmp edx, ecx
jae 0x140362ca1
mov ecx, edx
mov rdx, qword [rbp + 0xbf0]
mov edi, dword [rdx + rcx*4]
test rdi, rdi
je 0x140362c9e
mov ecx, edi
add rdi, rbx
cmp ecx, eax
jb 0x140362c97
cmp rdi, qword [rbp + 0xc00]
ja 0x140362c97
mov rcx, rdi
mov rdx, qword [rbp + 0xc20]
call fcn.140361230
test al, al
je 0x140362dcf
mov rcx, rdi
mov rdx, rbx
call fcn.1403613f0
test rax, rax
je 0x140362e62
mov qword [rbp + 0xc40], rax
lea rax, [0x14054b598]
jmp 0x140362e69
mov qword [rbp + 0xbf8], r12
inc qword [0x14054b578]
xor r12d, r12d
test ecx, ecx
je 0x140362c8e
add r10, r9
movabs r8, 0x7fcc1b406fd50262
add r8, r10
movabs rax, 0x8033e4bf902afd9e
xor rax, r8
movabs rcx, 0x33e4bf902afd9e
and rcx, r8
add qword [rbp + 0xbf8], rdx
cmp dword [rbp + 0xc34], 0
je 0x140362c8e
mov r10, qword [rbp + 0xc58]
je 0x140362ca1
lea rax, [rax + rcx*2]
mov qword [rbp + 0xbc0], rax
mov eax, r14d
add rax, qword [rbp + 0xc20]
mov qword [rbp + 0xc18], rax
xor ecx, ecx
mov qword [rbp + 0xc38], r13
mov qword [rbp + 0xc28], r15
jmp 0x140362705
xor r12d, r12d
mov r10, qword [rbp + 0xc58]
jmp 0x140362ca1
mov qword [rbp + 0xc50], 0
mov rcx, qword [rbp + 0xbe8]
add ecx, 0xd66732fc
mov eax, ecx
xor eax, 0x2998cd05
and ecx, 0x2998cd05
lea ecx, [rax + rcx*2]
xor r12d, r12d
cmp ecx, dword [rbp + 0xc34]
mov r11, qword [rbp + 0xc48]
mov r13, qword [rbp + 0xc38]
mov r10, qword [rbp + 0xc58]
mov r15, qword [rbp + 0xc28]
jae 0x140362ca1
mov qword [rbp + 0xbe8], rcx
mov eax, ecx
mov rcx, qword [rbp + 0xbc8]
mov ecx, dword [rcx + rax*4]
test rcx, rcx
je 0x1403626bd
mov rdi, qword [rbp + 0xc40]
add rcx, rdi
xor edx, edx
mov r14, qword [rbp + 0xc18]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [r14 + rdx]
cmp r8b, r9b
setne r10b
sete r11b
test r8b, r8b
sete bl
setne sil
xor sil, r11b
and bl, r10b
cmp sil, bl
jne 0x14036275f
inc rdx
jmp 0x140362730
cmp r8b, r9b
jne 0x1403626bd
mov rcx, qword [rbp + 0xbf8]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0xbf0]
mov esi, dword [rcx + rax*4]
test rsi, rsi
je 0x1403626bd
mov ebx, dword [0x14054b620]
mov eax, ebx
xor eax, 1
mov ecx, dword [0x1405673dc]
nop word [rax + rax]
mov ecx, dword [0x1405673dc]
cmp ecx, 0x56
jg 0x1403627a0
mov ecx, ebx
and ecx, 1
lea r14d, [rax + rcx*2]
mov dword [0x14054b620], r14d
test ebx, r14d
mov r12d, dword [rbp + 0xc0c]
je 0x1403627e4
xor r15d, r15d
mov r11, qword [rbp + 0xc48]
mov r13, qword [rbp + 0xc38]
mov r10, qword [rbp + 0xc58]
jmp 0x14036291d
mov eax, dword [0x1405673d8]
nop word [rax + rax]
mov eax, dword [0x1405673dc]
cmp eax, 0x4a
jg 0x1403627f0
test r12d, r12d
mov r11, qword [rbp + 0xc48]
mov r13, qword [rbp + 0xc38]
mov r10, qword [rbp + 0xc58]
jg 0x14036281d
xor r15d, r15d
jmp 0x14036291d
xor eax, eax
xor r15d, r15d
mov ecx, dword [0x1405673dc]
cmp ecx, 0x5b
jg 0x140362850
nop dword [rax]
mov ecx, dword [0x1405673d8]
lea edx, [rcx + 1]
imul edx, ecx
test dl, 1
je 0x140362863
nop word cs:[rax + rax]
mov ecx, dword [0x1405673d8]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
jne 0x140362850
jmp 0x140362830
movsxd rcx, eax
add rcx, qword [rbp + 0xbc0]
nop dword [rax]
mov edx, dword [0x1405673dc]
cmp edx, 0x14
jle 0x140362889
mov rdx, qword [rcx]
mov edx, dword [0x1405673dc]
cmp edx, 0x2a
jge 0x140362870
mov rcx, qword [rcx]
mov r8, r15
not r8
not rcx
mov rdx, r8
xor rdx, rcx
and rdx, r8
and rcx, r15
mov r8d, dword [0x1405673dc]
cmp r8d, 0x14
jge 0x1403628d0
nop
mov r8d, dword [0x1405673d8]
lea r9d, [r8 - 1]
imul r9d, r8d
test r9b, 1
je 0x1403628df
nop word cs:[rax + rax]
mov r8d, dword [0x1405673dc]
cmp r8d, 0x17
jge 0x1403628d0
jmp 0x1403628b0
mov r15, rdx
or r15, rcx
mov ecx, eax
xor ecx, 8
mov edx, eax
xor edx, 0x7ffffff7
and edx, eax
add edx, edx
nop word cs:[rax + rax]
mov eax, dword [0x1405673dc]
cmp eax, 0x22
jg 0x140362900
mov eax, ecx
xor eax, edx
and ecx, edx
lea eax, [rax + rcx*2]
cmp eax, r12d
jl 0x140362822
add rsi, rdi
cmp rsi, qword [rbp + 0xbd0]
jb 0x1403629c0
cmp rsi, qword [rbp + 0xc00]
ja 0x1403629c0
mov rcx, rsi
mov rdx, qword [rbp + 0xc20]
call fcn.140361230
test al, al
je 0x1403629cc
mov rcx, rsi
mov rdx, rdi
call fcn.1403613f0
test rax, rax
je 0x140362abd
mov qword [rbp + 0xc40], rax
inc qword [0x14054b598]
mov rcx, rax
mov rdx, qword [rbp + 0xc18]
call fcn.140363300
mov qword [rbp + 0xc50], rax
mov rcx, qword [0x14054b548]
mov rdx, rcx
xor rdx, 0xfffffffffffffffe
mov r8, rdx
and rdx, rcx
not ecx
and ecx, 1
or r8, rcx
not r8
or r8, rcx
lea rcx, [r8 + rdx*2]
mov qword [0x14054b548], rcx
test rax, rax
je 0x140362b00
jmp 0x140362e3e
mov qword [rbp + 0xc50], rsi
jmp 0x140362a87
mov rax, qword [0x14054b540]
mov rcx, rax
movabs rdx, 0x5df3525d17770ae8
xor rcx, rdx
and rax, rdx
lea rax, [rcx + rax*2]
movabs rcx, 0xa20cada2e888f519
add rax, rcx
mov qword [0x14054b540], rax
mov rdx, qword [rbp + 0xc10]
test rdx, rdx
je 0x140362a60
mov rax, qword [rdx]
movabs rcx, 0x59b8aa3f86f50ae5
add rax, rcx
mov rcx, rax
not rcx
mov r9, rcx
movabs r8, 0xa64755c0790af51c
and r9, r8
mov r8, rax
movabs r10, 0x59b8aa3f86f50ae3
and r8, r10
or r8, r9
movabs r9, 0x264755c0790af51c
xor rax, r9
and rcx, r10
or rcx, rax
not rcx
lea rax, [r8 + rcx*2]
mov qword [rdx], rax
mov rcx, rsi
call fcn.1403620c0
mov rsi, rax
mov qword [rbp + 0xc50], rax
mov r11, qword [rbp + 0xc48]
mov r13, qword [rbp + 0xc38]
mov r10, qword [rbp + 0xc58]
mov r15, qword [rbp + 0xc28]
xor r12d, r12d
test rsi, rsi
jne 0x140362ca1
mov rcx, qword [rbp + 0xbe8]
mov eax, ecx
xor eax, 1
and ecx, 1
lea ecx, [rax + rcx*2]
cmp ecx, dword [rbp + 0xc34]
jb 0x140362705
jmp 0x140362ca1
inc qword [0x14054b5a0]
mov qword [rbp + 0xc50], 0
mov rax, qword [0x14054b548]
mov rcx, rax
not rcx
mov edx, ecx
and edx, 1
mov r8, rax
and r8, 0xfffffffffffffffe
or r8, rdx
xor rax, 0xfffffffffffffffe
xor rcx, rax
and rcx, rax
lea rax, [r8 + rcx*2]
mov qword [0x14054b548], rax
call fcn.14036f960
test rax, rax
je 0x1403626b2
mov qword [rbp - 0x40], 0
xor ecx, ecx
xor edx, edx
mov r11, qword [rbp + 0xc18]
mov esi, 1
movabs rdi, 0x74649a029a30e424
movabs r12, 0x4fadfd66af54ccac
movabs r13, 0xc436989bca9bd777
mov r8, rcx
xor ecx, ecx
cmp byte [r11 + r8], 0
setne cl
movzx edx, dl
cmove edx, esi
add rcx, r8
xor r8d, r8d
test ebx, r14d
setne r8b
mov r9, qword [0x14044c180]
sub r9, r15
or r8, rdi
xor r8, r12
add r8, r13
mov r10, r9
xor r10, r8
or r8, r9
not r8
or r8, r10
not r8
mov r9, r8
shr r9, 0x20
or r9d, r8d
add dword [0x1405640a8], r9d
test dl, 1
je 0x140362b44
mov word [rbp - 0x40], cx
add ecx, 0x696e
mov edx, ecx
xor edx, 1
and ecx, 1
lea ecx, [rdx + rcx*2]
add ecx, 0xffff9692
mov word [rbp - 0x3e], cx
mov qword [rbp - 0x38], r11
mov rcx, qword [rbp + 0xc40]
lea rdx, [rbp - 0x40]
xor r8d, r8d
lea r9, [rbp + 0xc50]
call qword [0x1404ee420]
cmp eax, 0xc0000142
je 0x140362beb
cmp eax, 0xc0000138
jne 0x140362c41
mov qword [rbp + 0xc50], 0
mov rax, qword [0x14054b5a8]
lea rcx, [rax + rax]
sub rcx, rax
inc rcx
mov qword [0x14054b5a8], rcx
mov r11, qword [rbp + 0xc48]
mov r13, qword [rbp + 0xc38]
mov r10, qword [rbp + 0xc58]
mov r15, qword [rbp + 0xc28]
inc qword [0x14054b5e0]
lea rax, [0x14054b5b0]
lea rcx, [0x14054b5c0]
jmp 0x140362c7c
inc qword [0x14054b5a8]
cmp qword [rbp + 0xc50], 0
lea rax, [0x14054b5c8]
lea rcx, [0x14054b5d8]
mov r11, qword [rbp + 0xc48]
mov r13, qword [rbp + 0xc38]
mov r10, qword [rbp + 0xc58]
mov r15, qword [rbp + 0xc28]
je 0x140362c2a
inc qword [rax]
inc qword [rcx]
mov rsi, qword [rbp + 0xc50]
jmp 0x140362a8e
mov r10, qword [rbp + 0xc58]
jmp 0x140362ca1
mov qword [rbp + 0xc50], rdi
xor r12d, r12d
mov rax, qword [rbp + 0xc50]
test rax, rax
jne 0x140362cf6
test r10, r10
je 0x140362cf6
mov rsi, r11
mov dword [rsp + 0x28], 0x35a69d31
mov dword [rsp + 0x20], 0x3044cc03
mov ecx, 1
xor edx, edx
xor r8d, r8d
mov r9d, 0x80c7c371
call fcn.1403650c0
test rax, rax
je 0x140362cec
mov rcx, qword [rbp + 0xc58]
call qword [0x1404ee420]
mov r11, rsi
mov rax, qword [rbp + 0xc50]
or r11, r13
test rax, rax
je 0x140362d07
lea rax, [0x14054b550]
jmp 0x140362d25
lea rax, [0x14054b540]
inc qword [0x14054b558]
xor ecx, ecx
test r15b, r15b
sete cl
lea rax, [rax + rcx*8]
add rax, 0x40
inc qword [rax]
rdtsc
shl rdx, 0x20
or rdx, rax
sub rdx, r11
cmp qword [0x14054b610], 0
je 0x140362d4a
mov rax, qword [0x14054b610]
cmp rax, rdx
jae 0x140362d51
mov qword [0x14054b610], rdx
cmp qword [rbp + 0xc50], 0
je 0x140362d5f
xor ecx, ecx
jmp 0x140362d9e
not r15b
movzx eax, byte [0x140564730]
add al, r15b
and r15b, 1
and al, 0xfe
or al, r15b
xor al, 0xff
setne cl
xor r12b, 1
cmp cl, r12b
je 0x140362d8e
test al, al
je 0x140362d8e
mov ecx, 0x4750412d
jmp 0x140362d9e
test al, al
je 0x140362d99
mov ecx, 0xc0000138
jmp 0x140362d9e
mov ecx, 0xc0000139
mov edx, 0xf7a90784
mov r8d, 0x37807ae6
mov r9d, 0xad63ca8d
call fcn.140365110
mov rax, qword [rbp + 0xc50]
add rsp, 0xce8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
inc qword [0x14054b540]
mov rdx, qword [rbp + 0xc10]
test rdx, rdx
je 0x140362e2a
mov rax, qword [rdx]
movabs rcx, 0xd2677db5b1e2bd60
xor rcx, rax
movabs r8, 0x52677db5b1e2bd60
and r8, rax
lea rax, [rcx + r8*2]
movabs rcx, 0xd9bd4d23c2f1f3e
add rcx, rax
movabs rax, 0x1ffcad7811ee2363
mov r8, rcx
xor r8, rax
and rcx, rax
lea rax, [r8 + rcx*2]
mov qword [rdx], rax
mov rcx, rdi
call fcn.1403620c0
mov qword [rbp + 0xc50], rax
jmp 0x140362efb
xor r12d, r12d
mov r11, qword [rbp + 0xc48]
mov r13, qword [rbp + 0xc38]
mov r10, qword [rbp + 0xc58]
mov r15, qword [rbp + 0xc28]
jmp 0x140362ca1
lea rax, [0x14054b5a0]
mov rcx, qword [rax]
lea rdx, [rcx + rcx]
sub rdx, rcx
inc rdx
mov qword [rax], rdx
mov qword [rbp + 0xc50], 0
inc qword [0x14054b548]
mov dword [rsp + 0x28], 0x1fa0dde2
mov dword [rsp + 0x20], 0x729b2e7f
mov ecx, 1
xor edx, edx
xor r8d, r8d
mov r9d, 0x7ac1e53b
call fcn.140364d90
test rax, rax
je 0x140362ef0
mov rdi, qword [rbp + 0xc48]
inc qword [0x14054b5a8]
mov rcx, qword [rbp + 0xc40]
lea r9, [rbp + 0xc50]
xor edx, edx
mov r8d, esi
call qword [0x1404ee420]
cmp eax, 0xc0000138
jne 0x140362f11
mov qword [rbp + 0xc50], 0
jmp 0x140362f32
mov qword [rbp + 0xc50], 0
xor r12d, r12d
mov r10, qword [rbp + 0xc58]
mov r11, qword [rbp + 0xc48]
jmp 0x140362ca1
cmp qword [rbp + 0xc50], 0
je 0x140362f32
inc qword [0x14054b5e0]
inc qword [0x14054b5c8]
inc qword [0x14054b5d0]
jmp 0x140362f47
inc qword [0x14054b5e0]
inc qword [0x14054b5b0]
inc qword [0x14054b5b8]
xor r12d, r12d
mov r11, rdi
mov r10, qword [rbp + 0xc58]
jmp 0x140362ca1