Function at 0x18003c320
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
rdtsc
mov r8, rdx
shl r8, 0x20
or r8, rax
rdtsc
shl rdx, 0x20
or rdx, rax
cmp r8, rdx
mov eax, 0xebf4de39
mov esi, 0x508688ff
cmove esi, eax
mov rdi, rcx
mov ecx, dword [rsp + 0x68]
not ecx
mov eax, esi
xor eax, 0x6255386
and ecx, eax
mov edx, esi
xor edx, 0xf9daac79
mov r8d, dword [rsp + 0x68]
and r8d, edx
mov ebp, esi
xor ebp, 0xaf797701
imul r8d, ebp
mov r9d, dword [rsp + 0x68]
or r9d, eax
mov r15d, esi
xor r15d, 0x508688fe
imul r9d, r15d
xor eax, dword [rsp + 0x68]
add edx, r15d
sub edx, ecx
add edx, r8d
add edx, r9d
add eax, edx
inc eax
mov ecx, esi
xor ecx, 0x6ccfa044
imul ecx, eax
mov eax, esi
xor eax, 0x9670f8fb
add eax, ecx
mov dword [rsp + 0xcc], eax
mov ecx, esi
xor ecx, 0xfbc0548c
imul ecx, dword [rsp + 0xcc]
mov eax, esi
xor eax, 0xd976b6cb
add eax, ecx
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
cmp r8d, edx
je 0x18003c46e
movzx eax, word [rsp + 0x46]
not eax
mov ecx, esi
xor ecx, 0x575d
movzx edx, word [rsp + 0x46]
or dx, cx
and ecx, eax
mov eax, esi
xor eax, 0xffff88fe
add edx, ecx
mov ecx, esi
xor ecx, 0xa8a2
movzx r8d, word [rsp + 0x46]
xor r8w, cx
add r8d, edx
imul r8d, eax
mov eax, esi
xor eax, 0xffff88b8
add eax, ecx
add eax, r8d
mov ecx, esi
xor ecx, 0xffff8a3e
imul ecx, eax
mov eax, esi
xor eax, 0x435f
add eax, ecx
mov word [rsp + 0x76], ax
mov eax, esi
xor eax, 0x5be
imul ax, word [rsp + 0x76]
mov ecx, esi
xor ecx, 0xffffa49f
add ecx, eax
mov word [rsp + 0x78], cx
mov eax, esi
xor eax, 0x6d559c73
mov ecx, dword [rsp + 0x64]
and ecx, eax
mov edx, esi
xor edx, 0x6d559c72
mov r12d, esi
xor r12d, 0x508688fd
mov r8d, dword [rsp + 0x64]
imul r8d, r12d
mov r9d, dword [rsp + 0x64]
not r9d
imul r9d, r15d
or eax, dword [rsp + 0x64]
add edx, r15d
sub edx, ecx
add edx, r9d
add edx, r8d
sub edx, eax
mov eax, esi
xor eax, 0xed742078
imul eax, edx
mov ecx, esi
xor ecx, 0x12c6d261
add ecx, eax
mov dword [rsp + 0xc8], ecx
mov ecx, esi
xor ecx, 0x8ca315c8
imul ecx, dword [rsp + 0xc8]
mov eax, esi
xor eax, 0x3b452af1
add eax, ecx
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
cmp r8d, edx
je 0x18003c58f
mov ecx, esi
xor ecx, 0x907c
and cx, word [rsp + 0x44]
mov eax, esi
xor eax, 0xffff88fd
imul eax, ecx
mov ecx, esi
xor ecx, 0x6f83
movzx edx, word [rsp + 0x44]
or dx, cx
mov r8d, esi
xor r8d, 0x6f82
movzx r9d, word [rsp + 0x44]
not r9d
or r9d, ecx
mov ecx, esi
xor ecx, 0xffff88fe
imul ecx, r9d
mov r9d, esi
xor r9d, 0xffff888d
add r9d, r8d
sub r9d, edx
add r9d, ecx
add r9d, eax
mov eax, esi
xor eax, 0xffff8c1a
imul eax, r9d
mov ecx, esi
xor ecx, 0xffffb6e5
add ecx, eax
mov word [rsp + 0x74], cx
mov eax, esi
xor eax, 0x9012
imul ax, word [rsp + 0x74]
mov ecx, esi
xor ecx, 0xffff9911
add ecx, eax
mov word [rsp + 0x7a], cx
mov eax, dword [rsp + 0x60]
not eax
mov ecx, esi
xor ecx, 0x56deb6ea
and eax, ecx
imul eax, ebp
mov edx, dword [rsp + 0x60]
or edx, ecx
imul edx, r15d
mov r8d, dword [rsp + 0x60]
not r8d
imul r8d, r12d
mov r9d, dword [rsp + 0x60]
not r9d
or r9d, ecx
mov ecx, esi
xor ecx, 0x56deb6e9
add ecx, r15d
add ecx, eax
add ecx, r8d
add ecx, edx
sub ecx, r9d
mov eax, esi
xor eax, 0x3bd9c5ac
imul eax, ecx
mov ecx, esi
xor ecx, 0x68abf2e5
add ecx, eax
mov dword [rsp + 0xc4], ecx
mov ecx, esi
xor ecx, 0xe528f624
imul ecx, dword [rsp + 0xc4]
mov eax, esi
xor eax, 0x7fd5373d
add eax, ecx
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
cmp r8d, edx
je 0x18003c6a1
mov eax, esi
xor eax, 0xb02a
and ax, word [rsp + 0x42]
mov ecx, esi
xor ecx, 0xffffb028
mov edx, esi
xor edx, 0x4fd5
movzx r8d, word [rsp + 0x42]
xor r8w, dx
mov r9d, esi
xor r9d, 0xffff88fe
imul r9d, r8d
and dx, word [rsp + 0x42]
mov r8d, esi
xor r8d, 0xffff888e
add r8d, ecx
sub r8d, eax
add r8d, edx
add r8d, r9d
mov eax, esi
xor eax, 0xffffc7e6
imul eax, r8d
mov ecx, esi
xor ecx, 0x123f
add ecx, eax
mov word [rsp + 0x72], cx
mov eax, esi
xor eax, 0x15d6
imul ax, word [rsp + 0x72]
mov ecx, esi
xor ecx, 0xffffffbf
add ecx, eax
mov word [rsp + 0x7c], cx
mov eax, esi
xor eax, 0x6e22ca83
and eax, dword [rsp + 0x90]
imul eax, ebp
mov ecx, esi
xor ecx, 0x6e22ca82
mov edx, dword [rsp + 0x90]
mov r8d, dword [rsp + 0x90]
xor r8d, esi
xor r8d, 0x91dd357c
add r8d, edx
imul r8d, r15d
add ecx, r15d
add ecx, eax
add ecx, r8d
mov eax, esi
xor eax, 0x5810dade
imul eax, ecx
mov ecx, esi
xor ecx, 0xba3d0cab
add ecx, eax
mov dword [rsp + 0xc0], ecx
mov ecx, esi
xor ecx, 0x137f391e
imul ecx, dword [rsp + 0xc0]
mov eax, esi
xor eax, 0x87816d3
add eax, ecx
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
cmp r8d, edx
je 0x18003c7be
mov ecx, esi
xor ecx, 0x8c1e
and cx, word [rsp + 0x40]
mov eax, esi
xor eax, 0xffff88fd
imul eax, ecx
mov ecx, esi
xor ecx, 0x73e1
movzx edx, word [rsp + 0x40]
or dx, cx
movzx r8d, word [rsp + 0x40]
not r8d
or r8d, ecx
mov ecx, esi
xor ecx, 0xffff88fe
imul ecx, r8d
mov r8d, esi
xor r8d, 0x73e0
mov r9d, esi
xor r9d, 0xffff8890
add r9d, r8d
sub r9d, edx
add r9d, ecx
add r9d, eax
mov eax, esi
xor eax, 0x4032
imul eax, r9d
mov ecx, esi
xor ecx, 0x4009
add ecx, eax
mov word [rsp + 0x70], cx
mov eax, esi
xor eax, 0xecfa
imul ax, word [rsp + 0x70]
mov ecx, esi
xor ecx, 0x73cd
add ecx, eax
mov word [rsp + 0x7e], cx
mov eax, esi
xor eax, 0xe0215182
and eax, dword [rsp + 0x8c]
imul eax, r12d
mov ecx, esi
xor ecx, 0x1fdeae7d
mov edx, dword [rsp + 0x8c]
or edx, ecx
mov r8d, esi
xor r8d, 0x1fdeae7c
mov r9d, dword [rsp + 0x8c]
not r9d
or r9d, ecx
imul r9d, r15d
add r8d, r15d
sub r8d, edx
add r8d, r9d
add r8d, eax
mov eax, esi
xor eax, 0x1dc597ea
imul eax, r8d
mov ecx, esi
xor ecx, 0xc376bd0b
add ecx, eax
mov dword [rsp + 0xbc], ecx
mov ecx, esi
xor ecx, 0xbc27b0c2
imul ecx, dword [rsp + 0xbc]
mov eax, esi
xor eax, 0x5074c23
add eax, ecx
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
cmp r8d, edx
je 0x18003c8dc
movzx eax, word [rsp + 0x3e]
not eax
mov ecx, esi
xor ecx, 0xdb1e
movzx edx, word [rsp + 0x3e]
or dx, cx
and ecx, eax
mov eax, esi
xor eax, 0xffff88fe
mov r8d, esi
xor r8d, 0x24e0
movzx r9d, word [rsp + 0x3e]
xor r9w, si
xor r9d, 0x24e1
add r9d, ecx
imul r9d, eax
mov eax, esi
xor eax, 0xffff888d
add eax, r8d
add eax, edx
add eax, r9d
inc eax
mov ecx, esi
xor ecx, 0x7e16
imul ecx, eax
mov eax, esi
xor eax, 0x2217
add eax, ecx
mov word [rsp + 0x6e], ax
mov eax, esi
xor eax, 0xc9a6
imul ax, word [rsp + 0x6e]
mov ecx, esi
xor ecx, 0x25a7
add ecx, eax
mov word [rsp + 0x80], cx
mov eax, esi
xor eax, 0x4f3e6700
mov edx, dword [rsp + 0x5c]
xor edx, eax
imul edx, r12d
mov ecx, esi
xor ecx, 0xb0c198fe
mov r8d, dword [rsp + 0x5c]
xor r8d, esi
xor r8d, 0xb0c198ff
mov r9d, dword [rsp + 0x5c]
not r9d
add r9d, r8d
and eax, dword [rsp + 0x5c]
not eax
imul eax, ebp
imul r9d, r15d
add ecx, r15d
add ecx, edx
add ecx, r9d
add ecx, eax
mov eax, esi
xor eax, 0xb5c6e50
imul eax, ecx
mov ecx, esi
xor ecx, 0x489e9f61
add ecx, eax
mov dword [rsp + 0xb8], ecx
mov ecx, esi
xor ecx, 0xc3e8b8b0
imul ecx, dword [rsp + 0xb8]
mov eax, esi
xor eax, 0x7cb99ec1
add eax, ecx
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
cmp r8d, edx
je 0x18003c973
mov word [rsp + 0x82], 0
mov r13, qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rbx, [rsp + 0x120]
lea rdx, [rsp + 0x78]
mov rcx, rbx
call r13
lea r14, [rsp + 0x110]
mov rcx, r14
mov rdx, rdi
call r13
mov eax, esi
xor eax, 0xf975bbb7
mov ecx, dword [rsp + 0x58]
xor ecx, eax
mov edx, dword [rsp + 0x58]
or edx, eax
not edx
mov r8d, dword [rsp + 0x58]
xor r8d, esi
xor r8d, 0x68a4448
add r8d, ecx
add r8d, edx
imul r8d, r15d
mov ecx, dword [rsp + 0x58]
not ecx
or ecx, eax
mov eax, esi
xor eax, 0xf975bbb6
add eax, r15d
sub eax, ecx
add eax, r8d
mov ecx, esi
xor ecx, 0xace72a42
imul ecx, eax
mov eax, esi
xor eax, 0xfd81e255
add eax, ecx
mov dword [rsp + 0xb4], eax
mov eax, esi
xor eax, 0xa83606a
imul eax, dword [rsp + 0xb4]
mov ecx, esi
xor ecx, 0xe83453f1
add ecx, eax
mov dword [rsp + 0x94], ecx
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0xf8], rbx
mov eax, esi
movabs r8, 0x9106f03f522e7796
xor r8, rax
mov r9, qword [rsp + 0xd8]
and r9, r8
mov rcx, rax
xor rcx, 0x508688fd
imul r9, rcx
xor r8, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xd8]
not r10
mov rdx, rax
xor rdx, 0x508688fe
imul r10, rdx
movabs r11, 0x6ef90fc0add18868
xor r11, rax
mov rdi, rax
xor rdi, 0x508688ef
add rdi, r11
add rdi, r8
add rdi, r9
lea r8, [r10 + rdi]
inc r8
movabs r9, 0x79a812bc00b9eb80
xor r9, rax
imul r9, r8
movabs r8, 0x9690b06edd0c005f
xor r8, rax
add r8, r9
mov qword [rsp + 0xe8], r8
movabs r8, 0x9278e101db2d480
xor r8, rax
imul r8, qword [rsp + 0xe8]
movabs r9, 0x16f8090e4e2a305f
xor r9, rax
add r9, r8
mov qword [rsp + 0x100], r9
mov r10, qword [rsp + 0xd0]
movabs r8, 0x5c12c82df5573ac6
xor r8, rax
mov r11, qword [rsp + 0xd0]
xor r11, rax
movabs r9, 0xa3ed37d20aa8c539
xor r9, r11
add r9, r10
mov r10, qword [rsp + 0xd0]
and r10, r8
not r10
imul r10, rcx
imul r9, rdx
movabs rcx, 0xfe304f8aa553ca4c
xor rcx, rax
movabs rdx, 0x4c16685d142c5891
xor rdx, rax
movabs r11, 0x1ad67e47447bb484
xor r11, rax
movabs rdi, 0x3d51d77d34d89bd9
xor rdi, rax
xor rax, 0x5086afec
add rax, r8
add rax, r10
add rax, r9
imul rcx, rax
add rdx, rcx
mov qword [rsp + 0xe0], rdx
imul r11, qword [rsp + 0xe0]
add rdi, r11
mov qword [rsp + 0x108], rdi
mov eax, esi
xor eax, 0x7a24cf73
mov ecx, dword [rsp + 0xb0]
and ecx, eax
mov edx, esi
xor edx, 0x85db308c
or edx, dword [rsp + 0xb0]
imul edx, r15d
mov r8d, esi
xor r8d, 0x8688e6
add r8d, eax
sub r8d, ecx
add r8d, edx
mov eax, esi
xor eax, 0xe7fd0bb8
imul eax, r8d
mov ecx, esi
xor ecx, 0xa921607f
add ecx, eax
mov dword [rsp + 0xac], ecx
mov edx, esi
xor edx, 0x9f5be88
imul edx, dword [rsp + 0xac]
mov ecx, esi
xor ecx, 0xc6e1647f
mov eax, esi
xor eax, 0x4804c24
mov r8d, dword [rsp + 0x54]
and r8d, eax
mov r9d, dword [rsp + 0x54]
or r9d, eax
mov r10d, dword [rsp + 0x54]
not r10d
or r10d, eax
add r10d, r9d
mov r9d, dword [rsp + 0x54]
and r9d, eax
not r9d
add r9d, r8d
mov r8d, esi
xor r8d, 0x508688fb
imul r9d, r15d
add r8d, eax
sub r8d, r10d
add r8d, r9d
mov eax, esi
xor eax, 0x7d2fe72e
imul eax, r8d
mov r8d, esi
xor r8d, 0xd83f9fb5
add r8d, eax
mov dword [rsp + 0xa8], r8d
mov eax, esi
xor eax, 0x79f9c1ce
imul eax, dword [rsp + 0xa8]
add ecx, edx
mov edx, esi
xor edx, 0xf5bef829
mov r8d, esi
xor r8d, 0xbb1ec4f9
and r8d, dword [rsp + 0x50]
imul r8d, ebp
mov r9d, esi
xor r9d, 0xbb1ec4f8
mov r10d, dword [rsp + 0x50]
imul r10d, r12d
mov r11d, dword [rsp + 0x50]
xor r11d, esi
xor r11d, 0x44e13b06
mov edi, esi
xor edi, 0x508688fc
add edi, r9d
mov r9d, dword [rsp + 0x50]
not r9d
imul r9d, r15d
add edi, r10d
add edi, r8d
add edi, r11d
lea r8d, [r9 + rdi]
inc r8d
mov r9d, esi
xor r9d, 0x368dfc22
imul r9d, r8d
mov r8d, esi
xor r8d, 0xbb0814d7
add r8d, r9d
mov dword [rsp + 0xa4], r8d
mov r9d, esi
xor r9d, 0x8faf8b8a
imul r9d, dword [rsp + 0xa4]
add edx, eax
mov r8d, esi
xor r8d, 0x8110a147
mov eax, dword [rsp + 0x4c]
not eax
mov r10d, esi
xor r10d, 0xfcbda416
and eax, r10d
mov r11d, dword [rsp + 0x4c]
or r11d, r10d
mov edi, esi
xor edi, 0x3425be9
or edi, dword [rsp + 0x4c]
add edi, eax
mov eax, dword [rsp + 0x4c]
not eax
or eax, r10d
mov r10d, esi
xor r10d, 0x3425be8
add eax, r11d
imul eax, r15d
add r10d, r15d
sub r10d, edi
add r10d, eax
mov eax, esi
xor eax, 0x50b59008
imul eax, r10d
mov r10d, esi
xor r10d, 0xae7d5bb
add r10d, eax
mov dword [rsp + 0xa0], r10d
mov eax, esi
xor eax, 0x27e1a038
imul eax, dword [rsp + 0xa0]
add r8d, r9d
mov r9d, esi
xor r9d, 0x35e768db
add r9d, eax
lea rax, [rsp + 0x94]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
lea r9, [rsp + 0xf0]
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
test eax, eax
js 0x18003cebe
imul r15d, dword [rsp + 0x48]
mov eax, esi
xor eax, 0x9e4715e9
mov ecx, dword [rsp + 0x48]
xor ecx, eax
mov edx, dword [rsp + 0x48]
or edx, eax
not edx
imul r12d, edx
mov edx, dword [rsp + 0x48]
xor edx, esi
xor edx, 0x61b8ea16
imul edx, ebp
mov r8d, esi
xor r8d, 0x108688ea
add r8d, eax
add r8d, r15d
sub r8d, ecx
add r8d, r12d
add r8d, edx
mov eax, esi
xor eax, 0x554d122a
imul eax, r8d
mov ecx, esi
xor ecx, 0xe23dab19
add ecx, eax
mov dword [rsp + 0x98], ecx
mov eax, esi
xor eax, 0xb4804682
imul eax, dword [rsp + 0x98]
xor esi, 0x24deec4d
add esi, eax
mov rcx, 0xffffffffffffffff
mov edx, esi
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0x100], xmm0
mov dword [rsp + 0x94], 0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x80], 0
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, esi
xor eax, 0x14bf0c7
mov ecx, dword [rsp + 0x88]
xor ecx, eax
mov edx, esi
xor edx, 0xfeb40f37
mov r8d, dword [rsp + 0x88]
not r8d
and eax, dword [rsp + 0x88]
add r8d, ecx
not eax
imul ebp, eax
mov eax, esi
xor eax, 0x108688eb
add eax, edx
imul r8d, r15d
add r8d, eax
add r8d, ebp
mov eax, esi
xor eax, 0xfd0bae26
imul eax, r8d
mov ecx, esi
xor ecx, 0xb8097eeb
add ecx, eax
mov dword [rsp + 0x9c], ecx
mov eax, esi
xor eax, 0x89247196
imul eax, dword [rsp + 0x9c]
xor esi, 0xb9741533
add esi, eax
mov ecx, esi
int 0x29
int3