Function at 0x1408bdd1a
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Get kernel32 base address

Disassembly:
push rbp
movsx r8d, r10w
push rbx
sub bx, 0x1efc
rcr bx, 0x33
push rsi
or bpl, r13b
btc bx, bp
push rdi
or r8b, cl
add bpl, r8b
push r12
add bpl, 0xd0
push r13
sub bpl, 0x9a
push r14
push r15
bsf r8w, ax
and bx, 0x54ba
lea rbp, [rsp - 0x48]
rcl r8, cl
inc dil
seta r8b
sub rsp, 0x148
ror bl, cl
setp bl
mov rbx, rcx
shl dil, cl
movsx r8d, dx
shr r8b, 0x34
mov edi, 0x40
mov r8d, edi
shr cx, cl
test dil, r8b
lea rcx, [rbp]
cmp r8w, 0x6f2d
test spl, r9b
sub edx, edx
call fcn.1408c0f73
mov rcx, qword [rbx]
sal r8b, cl
sal r9, 0xc4
lea r8, [rbp]
test r11b, bl
add r9b, r12b
sub r13d, r13d
mov qword [rbp], rdi
mov r9d, edi
mov qword [rbp + 0xa8], r13
cmp cl, 0x5c
test rdi, rdi
sub edx, edx
mov qword [rsp + 0x20], r13
jmp 0x1408bddd5
call fcn.140370542
lea r12d, [rdi - 0x3f]
mov edx, eax
test eax, eax
jmp 0x1408bdde7
js 0x1408bde0a
mov ecx, dword [rbp + 0x38]
shr ecx, 1
test rcx, 0x688b65ee
stc
cmp r12b, cl
and cl, r12b
jmp 0x1408bde05
jmp 0x1408bde66
mov rcx, qword [rbx]
movzx r8d, sp
setno r8b
xchg r8b, r9b
lea r8, [rbp + 0xa8]
jmp 0x1408bde2b
mov r9d, 8
mov qword [rsp + 0x20], r13
cqo
movzx edx, di
setp dh
lea edx, [r9 + 0x12]
jmp 0x1408bde47
call fcn.1405e40af
cmp qword [rbp + 0xa8], r13
movsxd rdx, r10d
cwd
mov edx, r13d
setne cl
stc
cmc
test r11w, 0x2fe4
test edx, edx
jmp 0x1408bde6d
js 0x1408be549
test cl, cl
jmp 0x1408bde7a
je 0x1408be5a8
mov rcx, rbx
jmp 0x1408bde88
call fcn.1408be6bf
mov qword [rbp + 0xa0], r13
mov dil, 0x7a
bswap rdx
mov sil, r9b
rdtsc
shl rdx, 0x20
lea r15, [rbx + 0x138]
adc rsi, rdx
btr esi, esp
or rax, rdx
rcl rsi, 0x53
mov dword [rsp + 0x48], 0x20
cqo
clc
rol dx, 0xe0
mov rcx, rax
movsx r8d, di
mov dword [rsp + 0x40], r13d
mov sil, 0x86
ror dh, cl
mov rdx, rax
stc
ror rcx, 3
ror r8w, 0x90
adc ax, dx
xor rdx, rcx
bswap esi
or rdi, 0x20330427
movzx edi, bx
movabs rsi, 0x7010008004002001
xor ax, 0x5850
mov rcx, qword [rbx + 0x108]
dec r8w
and r8b, r14b
mov rax, rsi
rcr r8w, cl
xor r8b, 5
bt edi, edx
mul rdx
mov edi, 2
mov r8b, 0xa0
movsx r8w, dl
sbb r8b, dl
xor r9d, r9d
rcl r8w, cl
movsxd r8, r12d
xor rdx, rax
mov dword [rsp + 0x38], edi
bt r8w, di
cwde
shl r8w, cl
and edx, 7
lea rax, [rbp + 0x98]
add r8w, r8w
mov qword [rsp + 0x30], rax
xor ax, 0x10b1
add rdx, 8
sub al, cl
shl rdx, 0xc
xchg r8b, al
movsxd r8, r12d
lea rax, [rbp + 0xa0]
movzx r8w, bpl
movsx r8w, r9b
mov qword [rbp + 0x98], rdx
movzx edx, si
movsxd r8, r11d
mov r8, r15
not dh
movsx dx, bh
mov rdx, qword [rbx]
jmp 0x1408bdfa4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
jmp 0x1408bdfb3
call fcn.1403899bb
mov ecx, eax
cmp r12w, 0x1ad3
cmc
test edi, 0x6f257163
test eax, eax
jmp 0x1408bdfce
js 0x1408be606
mov rax, qword [rbp + 0x98]
bswap rcx
rcl ecx, cl
mov qword [rbx + 0x140], rax
movsx r8d, cx
xor cx, 0x1308
mov qword [rbp + 0xa0], 0x10000
add cx, 0x7915
rdtsc
shl rdx, 0x20
not r8
rcl rcx, cl
rcr r8w, cl
lea r8, [rbx + 0x130]
btr rcx, 0xfb
or rax, rdx
rcr dh, cl
bswap cx
mov dword [rsp + 0x48], 4
mov rcx, rax
mov dword [rsp + 0x40], r13d
btr dx, 0x4a
rcr dx, cl
ror dx, 0x2c
mov rdx, rax
xchg ah, ah
movzx eax, cx
setae ah
ror rcx, 3
rcr ax, 0x61
dec rax
mov rax, rax
xor rdx, rcx
cmp bl, r15b
rcl cx, cl
dec eax
mov dword [rsp + 0x38], edi
mov rcx, qword [rbx + 0x108]
movsxd rax, ebp
mov ax, sp
mov rax, rsi
cmc
mul rdx
test r11w, 0x2dc5
jmp 0x1408be087
sub r9d, r9d
cmp rbp, 0x570718df
xor rdx, rax
bts eax, ebp
sal al, 2
lea rax, [rbp + 0x98]
cmp r10d, esp
and edx, 7
cmc
mov qword [rsp + 0x30], rax
rcl ah, cl
mov ax, cx
add rdx, 8
shr ax, 0x51
sub ax, 0x65e4
xor ax, 0x4390
lea rax, [rbp + 0xa0]
test r15, 0x29314dc7
clc
shl rdx, 0xc
jmp 0x1408be0da
mov qword [rbp + 0x98], rdx
mov rdx, qword [rbx]
jmp 0x1408be0e9
mov qword [rsp + 0x28], rax
jmp 0x1408be0f3
mov qword [rsp + 0x20], r13
call fcn.140550ea0
mov ecx, eax
test ebp, 0x7ac846b2
test eax, eax
js 0x1408be658
mov rcx, qword [rbx + 0x118]
mov qword [rbx + 0x128], rcx
add rcx, qword [rbp + 0xa0]
cbw
mov qword [rbx + 0x120], rcx
sar r14b, 0x46
jmp 0x1408be139
mov rax, qword gs:[0x60]
or r14b, spl
sal r14w, cl
mov rcx, qword [rax + 0x18]
inc al
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov r14b, bpl
and r14b, cl
movsx r14, r10w
mov r14, qword [rcx + 0x30]
clc
test r14, r14
jne 0x1408be17b
mov rcx, r13
jmp 0x1408be176
jmp 0x1408be192
movsxd rcx, dword [r14 + 0x3c]
cmp rbx, 0x707a1299
test r10b, 6
add rcx, r14
jmp 0x1408be192
call fcn.140007ca0
mov rsi, rax
test rax, rax
je 0x1408be2ae
mov r8d, dword [rax + 0x10]
test r12w, 0x3f85
test r8d, r8d
jmp 0x1408be1b5
jne 0x1408be1c1
mov r8d, dword [rax + 8]
cbw
rdtsc
bsr r10w, dx
movzx r10, r13w
cmp dh, 0x2f
mov r9, qword [rbx + 0x140]
btr ecx, 0xd9
xchg rdi, r10
movabs r10, 0x7010008004002001
mov rdi, qword [rbx + 0x128]
rcl ecx, 0xab
shl rdx, 0x20
or ch, dh
or rax, rdx
bswap ecx
movsxd rcx, r14d
mov rcx, rax
bt edx, 0xfa
btr edx, ebx
mov rdx, rax
ror rcx, 3
dec al
shrd ax, r13w, 0x6d
mov rax, r10
test r11w, r9w
stc
test r10d, 0x42643cd5
xor rdx, rcx
mov cl, r11b
rcr ch, 0xfc
test sil, dl
mov ecx, r8d
mul rdx
test si, 0x5c7f
cmp r12b, r15b
sub rcx, r9
xor rax, rdx
stc
test dl, r15b
sub rcx, 0x10
cmp ebx, esp
cmp rdx, 0x433c1bcd
sub edx, edx
test r9b, r9b
div rcx
mov eax, dword [rsi + 0xc]
cmc
cmp r9b, dl
clc
add rdx, rax
and rdx, 0xfffffffffffffff0
add rdx, r14
test rdi, rdi
jmp 0x1408be27a
je 0x1408be2d7
test rdx, rdx
jmp 0x1408be288
je 0x1408be2d7
test r9, r9
je 0x1408be2d7
mov rsi, rdx
mov rcx, r9
jmp 0x1408be2a2
rep movsb byte [rdi], byte [rsi]
jmp 0x1408be2a9
jmp 0x1408be2d7
mov edx, dword [rbx + 0x140]
movzx cx, r13b
jmp 0x1408be2be
mov rcx, qword [rbx + 0x128]
call fcn.14089bb68
movabs r10, 0x7010008004002001
sar ch, cl
cwde
rdtsc
shl rdx, 0x20
movzx ecx, si
or rax, rdx
btc dx, r8w
cwd
ror dx, cl
mov rcx, rax
cdq
not dh
rol dh, 0x20
mov rdx, rax
nop
ror rcx, 3
mov rax, r10
cmp r10b, dl
cmp r9b, 0xdc
test edi, r10d
xor rdx, rcx
cmp r13b, 0x35
rol cx, cl
bts cx, r10w
mov rcx, qword [rbx + 0x140]
mul rdx
stc
test r14w, 0x43df
cmp r12b, 0x96
sub rcx, 0x2000
cmp bp, bx
test bpl, r8b
stc
xor rax, rdx
cmp r12b, spl
sub edx, edx
cmp bx, 0x48fa
stc
div rcx
bsr ecx, dword [r15]
add rdx, 0x1000
stc
shl r12d, cl
and rdx, 0xfffffffffffffff0
mov rcx, rbx
jmp 0x1408be36a
mov qword [rbx + 0x158], rdx
jmp 0x1408be376
mov dword [rbx + 0x170], r12d
jmp 0x1408be382
call fcn.1408befe6
mov rcx, qword [rbx + 0x120]
add dx, r13w
sal dx, 0x6b
mov edi, 0x2e8
sal edx, 0x48
dec dl
movsxd rdx, r11d
add rcx, rdi
cmova edx, r14d
cdq
xchg dx, dx
mov edx, 0x4000
jmp 0x1408be3b8
call fcn.14089bb68
mov eax, dword [rbx + 0x170]
cmovp cx, r8w
mov rcx, qword [rbx + 0x120]
jmp 0x1408be3d5
not eax
stc
and dword [rdi + rcx], eax
stc
add rdi, 4
jmp 0x1408be3e9
cmp rdi, 0x42e8
jb 0x1408be3bd
mov r8, qword [rbx + 0x120]
cmovno dx, si
shr dx, 0x1b
lea rax, [rsp + 0x50]
mov rdx, qword [rbx + 0x148]
add r8, 0x160
bswap rcx
mov rcx, qword [rbx]
movsxd r9, edx
mov r9d, 0x188
jmp 0x1408be42c
mov qword [rsp + 0x50], r13
jmp 0x1408be436
mov qword [rsp + 0x20], rax
jmp 0x1408be440
call fcn.140110498
mov ecx, eax
test al, 0x82
jmp 0x1408be44e
test eax, eax
jmp 0x1408be455
js 0x1408be4f8
mov rax, qword [rbx + 0x120]
mov rcx, qword [rbx + 0x150]
btc r14, r15
add rcx, qword [r15]
inc bpl
mov qword [rax + 0x160], rcx
xadd cx, cx
and ax, ax
mov rcx, qword [rbx + 0x120]
cmp bl, 0x2a
mov rax, qword [rbx + 0x148]
cmp rsi, r10
mov qword [rcx], rax
bswap rbp
mov rcx, qword [rbx + 0x120]
test dh, al
or ebx, 0x2faa1ff7
mov rax, qword [r15]
mov qword [rcx + 8], rax
add rsp, 0x148
movsxd r15, r13d
mov bpl, 0x6b
pop r15
movsx esi, r12w
setb r12b
pop r14
pop r13
movsx rbp, cx
cmovnp bp, si
pop r12
movzx di, cl
cmovs bx, r8w
pop rdi
pop rsi
jmp 0x1408be4e6
pop rbx
setns bpl
bswap ebp
mov bp, 0x27
pop rbp
jmp 0x1408be4f7
ret
sub eax, eax
mov dword [rbp - 0xc], ecx
cwd
cdq
movsx ecx, si
mov qword [rbp - 0x20], rax
cwd
lea rdx, [0x140068a88]
movsxd rcx, ebp
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x28]
movsx ax, cl
lahf
cdqe
lea rax, [0x14005b4d8]
mov dword [rbp - 0x10], 0xd0001b06
jmp 0x1408be535
mov qword [rbp - 0x28], rax
jmp 0x1408be53e
call 0x14084ee3a
int3
sub eax, eax
mov dword [rsp + 0x74], edx
bswap dx
mov dl, 0x6f
cqo
mov qword [rsp + 0x60], rax
lea rdx, [0x140068a88]
movsxd rcx, esp
movzx ecx, r11w
mov qword [rsp + 0x68], rax
cmovno rcx, r11
movsxd rcx, ebp
jmp 0x1408be57a
lea rcx, [rsp + 0x58]
not ax
mov eax, 0x9813d69
cdqe
lea rax, [0x14005b4d8]
mov dword [rsp + 0x70], 0xd0001b15
mov qword [rsp + 0x58], rax
call 0x14015b3a7
int3
xor eax, eax
movzx rdx, bx
mov dword [rbp - 0x70], 0xd0001500
mov qword [rbp - 0x80], rax
cdq
bswap ecx
movsx ecx, cx
lea rdx, [0x140068a88]
movzx rcx, bp
mov qword [rbp - 0x78], rax
movzx cx, bl
movsx ecx, cx
lea rcx, [rsp + 0x78]
lahf
movzx rax, ax
cdqe
lea rax, [0x14005b4d8]
jmp 0x1408be5ed
mov dword [rbp - 0x6c], r13d
jmp 0x1408be5f6
mov qword [rsp + 0x78], rax
call 0x140455234
int3
xor eax, eax
cqo
mov dword [rbp - 0x4c], ecx
mov dh, 0x18
mov qword [rbp - 0x60], rax
bswap rdx
lea rdx, [0x140068a88]
mov qword [rbp - 0x58], rax
movsx ax, r9b
lahf
bswap rcx
lea rcx, [rbp - 0x68]
movsxd rax, r8d
movsx rax, r9w
lea rax, [0x14005b4d8]
mov dword [rbp - 0x50], 0xd0001d01
jmp 0x1408be649
mov qword [rbp - 0x68], rax
call 0x140470132
int3
sub eax, eax
mov dword [rbp - 0x2c], ecx
movzx rdx, r14w
mov qword [rbp - 0x40], rax
cdq
cqo
movsx rdx, ax
lea rdx, [0x140068a88]
mov rcx, 0x7eef37f1
setno cl
jmp 0x1408be682
mov qword [rbp - 0x38], rax
xchg cx, ax
lahf
movzx ecx, r11w
lea rcx, [rbp - 0x48]
cdqe
jmp 0x1408be698
lea rax, [0x14005b4d8]
mov dword [rbp - 0x30], 0xd0001d01
jmp 0x1408be6ab
mov qword [rbp - 0x48], rax
jmp 0x1408be6b4
call 0x1402d24a5
int3