Function at 0x414890
Capabilities:
Create thread
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
jmp 0x4148ab
mov al, byte [esi + 0x31]
test al, al
je 0x4148bb
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0x18], eax
jne 0x4148d9
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x5360cc
push esi
call fcn.004132f0
add esp, 8
rdtsc
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, 0xffffc7ff
shr eax, 9
shl ecx, 0x17
and eax, 0x7f
xor ecx, 0xaa519580
or eax, ecx
add eax, 0x53a7321b
mov dword [esi + 8], eax
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], edx
rdtsc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
xor edx, 0xffffc7ff
shr edx, 9
shl eax, 0x17
and edx, 0x7f
xor eax, 0xaa519580
or edx, eax
add edx, 0x53a7321b
mov dword [esi + 0x24], edx
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], edx
rdtsc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
xor ecx, 0xffffc7ff
mov eax, dword [ebp + 8]
shr ecx, 9
shl edx, 0x17
and ecx, 0x7f
xor edx, 0xaa519580
or ecx, edx
mov edx, dword [esi]
add ecx, 0x53a7321b
mov dword [esi + 4], eax
mov dword [esi + 0xc], ecx
mov cl, byte [ebp + 0xc]
mov byte [esi + 0x28], cl
mov ecx, esi
call dword [edx + 8]
mov eax, dword [0x7ffe0018]
mov edx, dword [0x7ffe001c]
cmp eax, edx
mov ecx, 0x7ffe0014
je 0x4149bc
mov edx, dword [0x7ffe0018]
mov eax, dword [0x7ffe001c]
cmp edx, eax
jne 0x4149ad
mov eax, dword [0x7ffe0018]
mov ecx, dword [ecx]
push 0
push 0x3e8
push eax
push ecx
call fcn.00415f00
push 0
push 0x3e8
push edx
push eax
call fcn.00415f00
push 0
push 0xa
push edx
push eax
call fcn.00415f00
mov ecx, eax
xor eax, 0xc7ffffff
xor ecx, 0xff54a32b
lea edx, [ebp - 4]
shl ecx, 7
shr eax, 0x19
push edx
push 0
or ecx, eax
push esi
push 0x414730
add ecx, 0x53a7321b
push 0
push 0
mov dword [esi + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x1c], eax
jne 0x414a38
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov al, byte [esi + 0x28]
test al, al
je 0x414ace
mov ecx, dword [ebp - 4]
push ebx
push edi
push 0x559fc0
mov dword [ebp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call dword [sym.imp.MSVCRT.dll_rand]
and al, 0xfe
mov edi, 1
mov dword [0x559fb8], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov eax, dword [eax]
mov ecx, dword [0x559fb4]
add eax, 0x10
xor edx, edx
imul eax, dword [ecx]
mov ebx, 0x76
div ebx
inc edx
cmp edi, edx
jne 0x414a94
mov edx, dword [ebp + 0xc]
mov dword [ecx + edi*4], edx
jmp 0x414aa3
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, dword [0x559fb4]
mov dword [ecx + edi*4], eax
mov eax, dword [0x559fb4]
mov edx, dword [eax + 0x1fc]
mov ecx, dword [eax + edi*4]
shl edx, 1
xor ecx, edx
inc edi
cmp edi, 0x7f
mov dword [eax + 0x1fc], ecx
jb 0x414a68
push 0x559fc0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov al, 1
mov byte [esi + 0x31], al
jmp 0x414ae3
pop esi
mov esp, ebp
pop ebp
ret 8