Function at 0x1800df96b
Capabilities:
Check for debugger via api
Hash data with crc32
Resolve function by parsing pe exports

Disassembly:
mov qword [rcx + 0xf8], rax
call fcn.1800df7fc
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
rol ax, 0x87
xor sil, r12b
mov qword [rsp + 0x20], rdi
cmp r11d, ebx
push r12
push r14
or rsi, 0x1fa58522
push r15
sub rsp, 0x5d0
mov rax, qword [section..data]
xor rax, rsp
cmc
mov qword [rsp + 0x5c0], rax
mov sil, 0x8b
mov rsi, rcx
cmp r11w, 0x6593
test byte [rcx + 0x10], 1
jmp 0x1800df9c0
je 0x1800dfba9
cmp dword [rcx + 0x18], 6
jb 0x1800dfba9
cmp dword [rcx + 0x1c], 1
jb 0x1800dfba9
add rcx, 0x3c
bswap rdx
cdq
mov r8d, 0x104
cwd
lea rdx, [rsp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_SHAnsiToUnicode]
sub r12d, r12d
sal eax, cl
neg ax
mov qword [rsp + 0xc0], 0x20
clc
cmp r8b, r9b
neg dx
lea rax, [rsp + 0xf0]
xadd r8b, r8b
mov qword [rsp + 0xc8], rax
movzx rdx, r9w
sal dl, cl
rcr rdx, cl
xorps xmm0, xmm0
bt r8w, r11w
movdqu xmmword [rsp + 0xd0], xmm0
mov dword [rsp + 0xe0], 0xaac56b
bsf edx, edi
bt dx, r13w
mov dword [rsp + 0xe4], 0x11d0cd44
shr dx, cl
movzx r8d, r14w
rcl dl, cl
mov dword [rsp + 0xe8], 0xc000c28c
ror r8d, cl
mov dword [rsp + 0xec], 0xee95c24f
cmc
bswap r8w
test ax, 0xc239
sub eax, eax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
cmovns edx, r10d
movups xmmword [rsp + 0x90], xmm0
rcl rdx, 0x2f
movups xmmword [rsp + 0xa0], xmm0
movzx rdx, r8w
rcl r8w, cl
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x60], 0x58
sal r8w, cl
mov qword [rsp + 0x68], r12
shr dx, cl
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 2
stc
movsxd rdx, r13d
or r8, rbx
mov dword [rsp + 0x80], 1
xchg edx, eax
mov dword [rsp + 0x90], 1
rol edx, cl
mov qword [rsp + 0x98], r12
bswap r8w
sbb r8w, r15w
mov qword [rsp + 0xa0], r12
or ah, ah
mov dword [rsp + 0xac], r12d
bt rax, rsp
sar ah, cl
shl ah, cl
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x88], rax
cdq
lea r8, [rsp + 0x60]
movzx dx, r15b
lea rdx, [rsp + 0xe0]
test spl, r12b
cmp esp, r15d
sub ecx, ecx
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov ebx, eax
mov dword [rsp + 0x90], 2
setg r8b
lea r8, [rsp + 0x60]
bt dx, ax
cmp ah, bl
xadd rdx, rdx
lea rdx, [rsp + 0xe0]
test r12b, 0xa0
sub ecx, ecx
jmp 0x1800dfb96
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
test ebx, ebx
jne 0x1800e023b
jmp 0x1800dfbb7
sub r12d, r12d
rcr r15b, 0x87
or r15d, 0x8f996196
mov r15d, dword [rsi + 0x10]
cmp r9b, r8b
stc
clc
test r15b, 2
je 0x1800dfcbc
mov r11, r12
bsr r9d, r9d
mov r9, qword [rsi + 0x140]
mov rbx, qword [rsi + 0x148]
sub rbx, r9
cmc
cmp r10d, ebx
sar rbx, 4
stc
test rbx, rbx
jmp 0x1800dfbf3
je 0x1800dfcbc
mov edi, 0xffffffff
sar r14b, 0x8f
bt r14d, ecx
rol eax, cl
lea r14, [0x1800234d0]
nop word [rax + rax]
shl ax, 0xbe
btr r8w, bp
mov ecx, dword [r9 + 8]
rol r8w, cl
mov r8, qword [r9]
bts rax, rbp
ror eax, 0x14
mov eax, edi
cmp r10, 0xffffffff84109709
stc
test ecx, ecx
jmp 0x1800dfc41
je 0x1800dfc87
mov r10d, ecx
movsxd rdx, edx
test si, 0x6f8b
shl dh, cl
mov edx, eax
xor ch, 0x36
movzx ecx, byte [r8]
clc
cmc
xor rdx, rcx
movzx ecx, dl
shr eax, 8
jmp 0x1800dfc6f
xor eax, dword [r14 + rcx*4]
lea r8, [r8 + 1]
stc
sub r10, 1
jmp 0x1800dfc81
jne 0x1800dfc54
not eax
cmc
cmp eax, dword [r9 + 0xc]
jmp 0x1800dfc93
jne 0x1800e023b
inc r11
test r10b, 0xbf
cmp spl, 0xa0
stc
add r9, 0x10
cmp r11, rbx
jmp 0x1800dfcb1
jb 0x1800dfc1e
jmp 0x1800dfcde
mov edi, 0xffffffff
movsx r14, r8w
bts r14w, r9w
lea r14, [0x1800234d0]
cmp r12, 0xffffffffa78d1a8b
test edx, 0x65b174b5
test r15b, 4
je 0x1800e018c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1800e023b
mov dword [rsp + 0x44], r12d
jmp 0x1800dfd00
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movzx edx, bp
not dx
mov dh, 0x95
lea rdx, [rsp + 0x44]
jmp 0x1800dfd1c
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x44], 0
jne 0x1800e023b
mov ecx, 0xdeadc0de
jmp 0x1800dfd37
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
movsx cx, sil
movsx ecx, r13w
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.ZwSetInformationObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
jmp 0x1800dfd6c
mov word [rsp + 0x40], 0x100
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
cwd
bswap r8
mov r9b, 0x92
mov qword [rsp + 0x48], rax
movsx r9, r14w
movsx r9w, r13b
mov dword [rsp + 0x30], r12d
movsx ecx, ax
mov dword [rsp + 0x28], r12d
cwd
movzx rdx, r15w
xchg cx, r9w
mov dword [rsp + 0x20], r12d
mov dl, 0xa8
cqo
movzx r9, bp
lea r9, [rsp + 0xe0]
cwd
movsx rdx, ax
mov r8, rax
cdq
cqo
mov rdx, rax
mov rcx, rax
jmp 0x1800dfdd5
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov r9d, 2
xchg dx, r8w
movsxd rdx, ecx
movzx rdx, cx
lea r8, [rsp + 0x40]
mov dx, 0x752c
movsx rdx, dx
lea edx, [r9 + 2]
movzx ecx, r11w
movsx cx, bpl
movzx rcx, di
mov rcx, qword [rsp + 0xe0]
jmp 0x1800dfe17
call r15
mov dword [rsp + 0x30], 1
movzx dx, r11b
mov dword [rsp + 0x28], r12d
movzx rdx, bp
cmovae r8w, si
movsx r8d, dx
mov dword [rsp + 0x20], r12d
movzx cx, bh
lea r9, [rsp + 0xe0]
movsx r8d, si
movzx r8w, dl
mov r8, rbx
mov rdx, qword [rsp + 0xe0]
mov ch, 0x2c
not cx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
nop
clc
test dil, r14b
cmp r15, 0xffffffffab8f1eb7
cmp dword [rsi + 4], 0
jmp 0x1800dfe82
jne 0x1800e023b
cmp dword [rsi + 0x20], 0
jmp 0x1800dfe91
je 0x1800e0019
mov rax, qword [rsi + 0x170]
movzx rcx, ax
mov cl, r10b
xchg r8d, r8d
lea rcx, [rsp + 0x50]
cqo
mov qword [rsp + 0x20], rcx
mov r9d, 8
movsxd rcx, r12d
jmp 0x1800dfec2
lea r8, [rsp + 0x58]
cdq
movzx dx, r14b
movzx ecx, r12w
lea edx, [r9 + 0x16]
movzx rcx, r8w
xchg ch, ch
movzx ecx, si
lea rcx, [rdx - 0x1f]
jmp 0x1800dfee7
call rax
mov ebx, 0xc0000353
test cx, r14w
test sp, 0xbfb4
cmp rax, rbx
jmp 0x1800dfeff
jne 0x1800e023b
cmp qword [rsp + 0x58], 0
jmp 0x1800dff10
jne 0x1800e023b
mov eax, dword [rsi + 0x2c]
test eax, eax
jmp 0x1800dff20
je 0x1800dff81
mov r8, qword [rsi + 0x30]
movsx r10d, bx
shrd r10w, cx, 0x2a
mov r10d, eax
movzx ecx, byte [r8]
mov ax, 0xf11
mov eax, edi
xor rcx, rax
bsr eax, ebp
movzx eax, cl
test bp, 0xf3a1
cmp rdi, rsi
shr edi, 8
jmp 0x1800dff61
xor edi, dword [r14 + rax*4]
clc
test r14b, 0xb0
lea r8, [r8 + 1]
cmc
cmp r14, rbp
sub r10, 1
jmp 0x1800dff7b
jne 0x1800dff37
not edi
jmp 0x1800dff8c
cmp edi, dword [rsi + 0x38]
jmp 0x1800dff94
jne 0x1800e023b
mov rax, qword [rsi + 0x170]
movsx cx, r8b
bswap edx
lea rdx, [rsp + 0x48]
movsx ecx, r14w
cmovle r9w, di
movsx r8, bp
mov qword [rsp + 0x20], rdx
bswap r9w
cmovg edx, r13d
movzx r8d, bx
mov r9d, 8
cdq
lea r8, [rsp + 0x48]
jmp 0x1800dffe3
lea edx, [r9 + 0x16]
setno cl
mov cl, r14b
not rcx
lea rcx, [rdx - 0x1f]
jmp 0x1800dfff9
call rax
cmp rax, rbx
jmp 0x1800e0003
jne 0x1800e018c
cmp qword [rsp + 0x48], 8
jmp 0x1800e0014
jmp 0x1800e0186
mov rax, qword [rsi + 0x168]
movzx cx, r15b
movsx r8w, r9b
lea rcx, [rsp + 0x48]
cqo
movsxd r9, r11d
movzx r9d, ax
mov qword [rsp + 0x20], rcx
mov r9b, 0x96
cmovg r9w, r11w
not cl
mov r9d, 4
movsx ecx, r12w
cqo
not ch
lea r8, [rsp + 0x58]
cdq
lea edx, [r9 + 0x1a]
mov ecx, edi
jmp 0x1800e0066
call rax
mov ebx, 0xc0000353
test r11w, ax
cmc
cmp eax, ebx
jmp 0x1800e0079
jne 0x1800e023b
cmp dword [rsp + 0x58], 0
jmp 0x1800e0089
jne 0x1800e023b
mov edx, edi
movsx rax, dx
sub al, cl
cwde
mov eax, dword [rsi + 0x2c]
test r10, r14
cmp ch, cl
test eax, eax
jmp 0x1800e00a7
je 0x1800e0110
mov r8, qword [rsi + 0x30]
rol ch, cl
shld cx, r10w, 0x90
mov r10d, eax
cmc
rcr rcx, cl
nop
cmc
movzx ecx, byte [r8]
and rax, r15
mov eax, edx
xor rcx, rax
setl ah
mov ax, 0x48a5
shld eax, r9d, 0x8c
movzx eax, cl
test r15b, r8b
clc
shr edx, 8
cmp r14b, 0x15
stc
xor edx, dword [r14 + rax*4]
cmc
lea r8, [r8 + 1]
cmp r15, 0xffffffffc38ab1a7
cmp bl, r13b
jmp 0x1800e0101
sub r10, 1
jmp 0x1800e010a
jne 0x1800e00c2
not edx
cmp edx, eax
stc
cmc
cmp edx, dword [rsi + 0x38]
jmp 0x1800e011e
jne 0x1800e023b
mov rax, qword [rsi + 0x168]
not r9w
lea rcx, [rsp + 0x50]
movzx r8w, bl
mov qword [rsp + 0x20], rcx
mov r9d, 4
lea r8, [rsp + 0x50]
lea edx, [r9 + 0x1a]
mov ecx, edi
jmp 0x1800e0154
call rax
cmp eax, ebx
jmp 0x1800e015d
jne 0x1800e018c
cmp dword [rsp + 0x50], 4
jmp 0x1800e0186
jne 0x1800e023b
test byte [rsi + 0x10], 8
je 0x1800e026e
xor edx, edx
jmp 0x1800e01a4
mov r8d, 0x4d0
movzx cx, spl
movsx rcx, r8w
movsxd rcx, edx
lea rcx, [rsp + 0xf0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x120], 0x100010
lea rdx, [rsp + 0xf0]
mov rcx, 0xfffffffffffffffe
jmp 0x1800e01e2
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1800e024a
cmp qword [rsp + 0x138], 0
jmp 0x1800e01fe
jne 0x1800e023b
cmp qword [rsp + 0x140], 0
jmp 0x1800e0212
jne 0x1800e023b
cmp qword [rsp + 0x148], 0
jmp 0x1800e0226
jne 0x1800e023b
cmp qword [rsp + 0x150], 0
je 0x1800e024a
mov eax, 1
jmp 0x1800e0245
jmp 0x1800e0270
lea rdx, [0x180001820]
test r15b, 0x9a
stc
jmp 0x1800e025b
xor ecx, ecx
jmp 0x1800e0262
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
int3
xor eax, eax
mov rcx, qword [rsp + 0x5c0]
cmc
xor rcx, rsp
jmp 0x1800e0281
call fcn.180008730
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x28]
xchg r14b, r15b
movsx r15, r13w
movsx edi, r8w
mov rsi, qword [r11 + 0x30]
setp r14b
movsx r14, r13w
mov rdi, qword [r11 + 0x38]
mov rsp, r11
movsx r15w, r13b
pop r15
pop r14
bswap r12d
pop r12
jmp 0x1800e02c3
ret