Function at 0x1408ba46a
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
mov rax, rsp
clc
jmp 0x1408ba49d
mov qword [rax + 8], rcx
test rbx, r15
push rbp
movzx rbp, di
push rbx
push rsi
sbb bpl, r11b
dec bpl
push rdi
clc
push r12
add bpl, 6
xor rbp, 0x557e5d23
push r13
cmp ebx, esp
push r14
bts rbp, rdx
test spl, 0xe
shl bp, 0x92
push r15
clc
lea rbp, [rax - 0xae8]
sub rsp, 0xba8
jmp 0x1408ba4e8
mov qword [rbp - 0x40], 0xfffffffffffffffe
movaps xmmword [rax - 0x58], xmm6
mov rbx, rcx
xor edx, edx
movzx r8w, dil
mov r8d, 0x248
lea rcx, [rbp + 0x160]
jmp 0x1408ba510
call fcn.1408c78c6
sub r14d, r14d
cqo
bswap edx
mov qword [rsp + 0x40], r14
mov ecx, r8d
bswap ecx
cmovbe dx, ax
mov rdx, rbx
xchg ch, ch
lea rcx, [rbp - 0x50]
call 0x14070c23f
movaps xmm6, xmmword [rbp - 0x50]
movaps xmmword [rsp + 0x50], xmm6
movd edi, xmm6
movzx edx, di
or esi, r15d
shr dx, 1
adc sil, 0x1a
lea esi, [r14 + 1]
cmp rsp, 0x1cb40a92
sub dx, si
jmp 0x1408ba566
je 0x1408ba5f6
mov rcx, qword [rbp - 0x48]
xor al, r13b
or al, r9b
movzx eax, dx
stc
cmp dil, spl
cmp word [rcx + rax*2], 0x5c
je 0x1408ba5b1
cmp word [rcx + rax*2], 0x2f
je 0x1408ba5b1
mov eax, 0xffff
test r10w, 0x290a
add dx, ax
jmp 0x1408ba5a6
jne 0x1408ba576
jmp 0x1408ba5f6
movzx eax, dx
cmp r15d, edi
lea rcx, [rcx + rax*2]
cmp r11, r10
clc
add rcx, 2
mov qword [rsp + 0x58], rcx
add dx, dx
test r10b, 0x90
clc
jmp 0x1408ba5d5
sub di, dx
clc
sub di, 2
jmp 0x1408ba5e2
mov word [rsp + 0x52], di
mov word [rsp + 0x50], di
jmp 0x1408ba5f1
movaps xmm6, xmmword [rsp + 0x50]
cmp qword [0x140074d88], r14
jmp 0x1408ba602
jne 0x1408ba68d
mov rax, qword gs:[0x60]
movsx r9, dx
setl ch
movsx r9d, r13w
mov rcx, qword [rax + 0x18]
rdtsc
mov rax, qword [rcx + 0x10]
mov r9b, r14b
mov rcx, qword [rax]
movsx r9, r14w
mov qword [rbp + 0xb00], r14
movsx edx, r10w
lea r9, [rbp + 0xb00]
setns dh
mov edx, 0x1e64b2a0
jmp 0x1408ba64f
mov rcx, qword [rcx + 0x30]
jmp 0x1408ba658
call fcn.140007fc0
mov rcx, qword [rbp + 0xb00]
cdq
cmp r13b, 0x49
bsf r8, r10
test eax, eax
movsx dx, r15b
cmovs rcx, r14
cmc
shl r8, 0x7a
mov qword [0x140074d88], rcx
not r8b
movzx r8, cx
sar dh, cl
lea r8, [rsp + 0x40]
cmp r11d, 0x34266dc3
movsx dx, r9b
rcr dl, cl
mov rdx, qword [rsp + 0x58]
test r12w, ax
sub ecx, ecx
call 0x140427cd5
test eax, eax
jmp 0x1408ba6b8
je 0x1408ba6c8
mov rax, qword [rsp + 0x40]
jmp 0x1408bb1f7
lea rdx, [0x140047c24]
setle ch
mov ecx, esi
jmp 0x1408ba6d9
call 0x14058b9e4
mov qword [rsp + 0x70], rax
cmc
test rax, rax
jmp 0x1408ba6ed
jne 0x1408ba6fb
mov rbx, r14
jmp 0x1408bb1d2
mov rdx, rbx
movzx rcx, cx
sete cl
lea rcx, [rbp + 0x10]
call fcn.1400020ec
lea rax, [0x1400757e0]
not ch
bswap cx
movsxd rcx, ebx
mov qword [rbp + 0x170], rax
movsx rcx, r15w
cmovp ecx, r9d
cbw
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x178], rax
jmp 0x1408ba742
lea rcx, [rbp + 0x160]
jmp 0x1408ba74e
call 0x140170941
mov r13d, r14d
mov dword [rbp + 0xb00], r14d
cmp spl, 0x69
movzx ebx, word [rsp + 0x50]
sub r15b, r15b
movsxd rdi, r10d
shr rbx, 1
rcl r15b, 8
mov qword [rsp + 0x50], rbx
rcr cl, cl
adc edi, eax
mov r15d, 0x208
xor rdi, r14
lea rdi, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
btc cx, 0xca
sub eax, eax
movsx cx, r14b
mov cx, 0x7736
movzx rcx, bp
mov rcx, r15
jmp 0x1408ba7a9
rep stosb byte [rdi], al
cdqe
movzx eax, r8w
mov eax, dword [rbp + 0x40]
not cx
movsx rcx, r14w
mov dword [rsp + 0x60], eax
mov ecx, 0x9c40
call 0x1402e2b65
mov r15, rax
cmp sil, 0xf6
test rax, rax
jmp 0x1408ba7d9
je 0x1408bb071
rdtsc
shl rdx, 0x20
shr ch, 0x96
ror ch, cl
or rax, rdx
movzx cx, bl
movsx ecx, ax
mov rcx, rax
jmp 0x1408ba7fc
call 0x1403dfef9
mov rcx, r15
jmp 0x1408ba80a
call 0x1408ba2b3
mov r12, rax
test rax, rax
jmp 0x1408ba81a
je 0x1408badbf
mov rdi, r12
test dx, r10w
cmp r10b, sil
cmc
sub rdi, r14
call 0x14037a4fc
cdqe
and r13b, 0x4e
sar r13w, cl
xadd r13w, r13w
sub edx, edx
rcl r13w, 0xe1
bsf r13, r11
div rdi
add rdx, r14
rcr ah, cl
cmc
mov r13, qword [r15 + rdx*8]
sbb ax, si
sar rax, 0x55
movzx eax, r15w
mov rax, qword [r15 + r14*8]
mov qword [r15 + rdx*8], rax
mov qword [r15 + r14*8], r13
test dx, 0x7369
stc
cmp r10w, r10w
or rsi, 0xffffffffffffffff
cmp rax, r14
cmc
sub edi, edi
jmp 0x1408ba88b
inc rsi
cmp sil, 0xfd
jmp 0x1408ba897
cmp word [r13 + rsi*2], di
jmp 0x1408ba8a2
jne 0x1408ba88b
cmp rsi, rbx
jmp 0x1408ba8b0
jbe 0x1408bad6d
mov rcx, r13
call 0x140135fba
test rax, rax
jmp 0x1408ba8c7
jne 0x1408bad6d
mov qword [rsp + 0x68], rdi
movsx r8w, dl
mov r9w, cx
lea r9, [rbp + 0xb08]
lea r8, [rsp + 0x68]
call fcn.14000af9c
cmp dword [rbp + 0xb08], edi
jmp 0x1408ba8f7
jge 0x1408ba90a
mov al, dil
jmp 0x1408ba905
jmp 0x1408ba9dd
mov rdx, r13
mov ch, dh
movsx cx, sil
lea rcx, [rbp - 0x38]
jmp 0x1408ba91d
call 0x1406b6442
mov dword [rbp - 0x28], 0x30
jmp 0x1408ba92f
mov rax, qword [rsp + 0x68]
jmp 0x1408ba939
mov qword [rbp - 0x20], rax
xchg ah, al
mov dword [rbp - 0x10], 0x40
movsxd rax, r9d
setp ah
xchg ah, ah
lea rax, [rbp - 0x38]
mov qword [rbp - 0x18], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 8], xmm0
lea r8, [rbp - 0x28]
movzx rdx, r9w
bswap dx
movsxd rdx, edi
mov edx, 5
mov cl, 0x30
movzx rcx, di
lea rcx, [rsp + 0x78]
call int.140893edc
mov edi, eax
movzx rcx, ax
movsx cx, r12b
movsx rcx, bp
mov dword [rbp + 0xb08], eax
movzx cx, ah
mov cx, r13w
movsx ecx, ax
mov rcx, qword [rsp + 0x78]
jmp 0x1408ba9ab
call fcn.1405e4ee5
mov rcx, qword [rsp + 0x68]
jmp 0x1408ba9ba
call fcn.1405fa536
xor eax, eax
xadd al, al
sub al, spl
test edi, edi
mov al, 0x9a
setns al
test rdx, 0x19346bc
xor edi, edi
cmp spl, 0x1d
cmp bl, bh
test al, al
jmp 0x1408ba9e4
jne 0x1408bad6d
mov ebx, 0x104
cqo
movzx rdx, r8w
jmp 0x1408ba9fa
mov edx, ebx
movsx rcx, r9w
bswap cx
mov ch, 0x33
lea rcx, [rbp + 0x880]
jmp 0x1408baa12
call 0x140325f60
lea r8, [0x14005bf70]
mov edx, ebx
setp ch
jmp 0x1408baa2b
lea rcx, [rbp + 0x880]
jmp 0x1408baa37
call 0x1406a4450
mov r8, r13
movzx rcx, bx
mov edx, ebx
mov ecx, 0x1c9c2fcc
lea rcx, [rbp + 0x880]
jmp 0x1408baa57
call 0x1401716d0
mov qword [rsp + 0x30], rdi
bsf r8w, r13w
shld cx, sp, 0xfd
mov dword [rsp + 0x28], 0x80
and r8, r13
neg ch
mov dword [rsp + 0x20], 3
and r8, 0x2b75233b
movsxd r8, eax
inc cl
xor r9d, r9d
cqo
movsx ecx, di
mov edx, 0x80000000
movsx cx, dl
cmovle rcx, r10
setnp r8b
lea r8d, [r9 + 1]
movzx ecx, r15w
movzx cx, r9b
lea rcx, [rbp + 0x880]
jmp 0x1408baabf
call 0x1407d2c89
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1408bad65
sub r9d, r9d
adc ecx, 0x52e3575c
sub r8d, r8d
jmp 0x1408baae5
xor edx, edx
movzx ecx, r11w
mov rcx, rax
call 0x1407fbed1
cmp eax, 0xffffffff
je 0x1408bad26
mov qword [rsp + 0x20], rdi
movzx r9d, dx
lea r9, [rbp + 0xaf8]
cqo
cwd
mov r8d, 0x40
not rcx
xchg ch, ch
lea rdx, [rbp + 0x50]
movzx ecx, di
movzx rcx, r14w
seto cl
mov rcx, rbx
jmp 0x1408bab32
call 0x1404be435
test eax, eax
jmp 0x1408bab3f
je 0x1408bad26
cmp dword [rbp + 0xaf8], 0x40
jmp 0x1408bab51
jne 0x1408bad26
mov eax, 0x5a4d
cmp word [rbp + 0x50], ax
jmp 0x1408bab65
jne 0x1408bad26
mov edx, dword [rbp + 0x8c]
test edx, edx
jmp 0x1408bab78
je 0x1408bad26
xor r9d, r9d
rcl ecx, 0x27
sar cx, cl
xor r8d, r8d
jmp 0x1408bab8f
mov rcx, rbx
jmp 0x1408bab97
call 0x1403f6b24
cmp eax, 0xffffffff
jmp 0x1408baba5
je 0x1408bad26
mov qword [rsp + 0x20], rdi
movzx r8w, bpl
mov cx, r14w
lea r9, [rbp + 0xaf8]
not dh
movsxd rdx, r8d
cmove cx, cx
mov r8d, 0x108
mov cx, 0x2868
not ch
lea rdx, [rbp + 0x50]
bswap cx
cmovbe cx, r13w
not cl
mov rcx, rbx
jmp 0x1408babeb
call 0x1406ba4a8
test eax, eax
jmp 0x1408babf8
je 0x1408bad26
cmp dword [rbp + 0xaf8], 0x108
jne 0x1408bad26
cmp dword [rbp + 0x50], 0x4550
jmp 0x1408bac1a
jne 0x1408bad26
mov eax, 0x8664
test ebp, r10d
cmp word [rbp + 0x54], ax
jmp 0x1408bac31
jne 0x1408bad26
movzx eax, word [rbp + 0x66]
mov ecx, 0x2022
cmp r9, 0x466f7f69
clc
and ax, cx
test r9b, 0x19
cmc
cmp ax, cx
jmp 0x1408bac58
jne 0x1408bad26
mov eax, 0x20b
cmp word [rbp + 0x68], ax
jmp 0x1408bac6c
jne 0x1408bad26
movzx eax, word [rbp + 0xac]
sub ch, 0
mov ch, 0xdf
and ch, 0xec
sub ax, 2
shr cl, 0x8d
mov ecx, 1
cmp r11b, 0xe2
cmp ax, cx
jmp 0x1408bac9a
ja 0x1408bad26
test byte [rbp + 0xae], 0x40
jmp 0x1408bacac
je 0x1408bad26
cmp dword [rbp + 0x78], edi
jmp 0x1408bacba
je 0x1408bad26
cmp dword [rbp + 0xd4], 0x10
jb 0x1408bad26
cmp dword [rbp + 0x148], edi
jmp 0x1408bacd8
jne 0x1408bad26
cmp dword [rbp + 0x14c], edi
jmp 0x1408bace9
jne 0x1408bad26
cmp dword [rbp + 0xf0], edi
jmp 0x1408bacfa
je 0x1408bad26
cmp dword [rbp + 0xf4], edi
jmp 0x1408bad0b
je 0x1408bad26
mov eax, dword [rsp + 0x60]
cmp dword [rbp + 0xa0], eax
jmp 0x1408bad20
jae 0x1408bad37
mov edi, 1
jmp 0x1408bad37
mov rcx, rbx
jmp 0x1408bad3f
call fcn.1407b5e39
test dil, dil
jmp 0x1408bad4c
jne 0x1408bad65
lea eax, [rsi + 1]
test cx, 0x15e0
cmp eax, 0x104
jb 0x1408bad8c
mov rbx, qword [rsp + 0x50]
movzx esi, sp
mov esi, 1
test ax, 0x1fc9
add r14, rsi
cmp r14, r12
jmp 0x1408bad81
jae 0x1408badb0
jmp 0x1408ba820
mov r8, r13
cdq
mov edx, 0x104
movsx cx, bpl
lea rcx, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
jmp 0x1408bada6
call 0x1404674ee
mov esi, 1
mov r13d, dword [rbp + 0xb00]
neg rdi
movzx di, r8b
xor r14d, r14d
mov edi, r14d
clc
test dl, r12b
test r12, r12
jmp 0x1408badd2
je 0x1408badfc
mov rcx, qword [r15 + rdi*8]
jmp 0x1408bade1
call 0x1404e67e8
add rdi, rsi
test ch, 0x72
stc
cmp rdi, r12
jmp 0x1408badf6
jb 0x1408badd8
mov rcx, r15
jmp 0x1408bae04
call 0x14068627c
lea rax, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
test r9, r13
test rcx, 0x403557da
or rdx, 0xffffffffffffffff
jmp 0x1408bae24
inc rdx
cmp word [rax + rdx*2], r14w
jmp 0x1408bae31
jne 0x1408bae24
mov r15d, 0x208
cmp r12, 0x3d497dec
test edx, edx
jmp 0x1408bae4b
je 0x1408bb07d
lea rdi, [rbp - 0x80]
sub eax, eax
movsx ecx, ax
lea ecx, [rax + 0x30]
jmp 0x1408bae62
rep stosb byte [rdi], al
movdqu xmmword [rbp - 0x60], xmm6
lea rax, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
or cx, 0x2e73
mov qword [rbp - 0x78], rax
add dx, dx
movsxd rdi, r14d
movsx rdi, bx
mov word [rbp - 0x80], dx
shld di, ax, 0xb1
mov word [rbp - 0x7e], r15w
bsf cx, r14w
movzx rcx, cx
lea rdi, [rbp + 0x3b0]
clc
xor eax, eax
movzx ecx, cx
cwd
movzx dx, ah
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rbp + 0x3e0], 0x100010
mov rax, qword [0x140074d88]
not dx
movsx rcx, r14w
mov qword [rbp + 0x410], rax
jmp 0x1408baedc
mov qword [rbp + 0x420], 0x440
bswap rdx
lea rdx, [rbp + 0x3b0]
movsx ecx, r12w
movzx ecx, bx
movsxd rcx, esi
mov rcx, 0xfffffffffffffffe
call fcn.14032a5f5
test eax, eax
jmp 0x1408baf0e
js 0x1408bb07d
lea r8, [rbp - 0x80]
bts dx, bp
lea rdx, [0x140048638]
test sil, 0x1e
stc
cmc
sub ecx, ecx
jmp 0x1408baf30
call 0x1406dba21
mov rbx, qword gs:[0x30]
test rdx, rdx
mov rdi, qword [rbx + 0x28]
cmc
and r9, 0x7b3f4f10
mov qword [rbx + 0x28], r14
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
jmp 0x1408baf64
xor edx, edx
sub ecx, ecx
call 0x1407b4d36
mov esi, eax
mov qword [rbx + 0x28], rdi
mov dword [rbp - 0x6c], eax
setno r8b
cwde
mov eax, 1
mov dword [rbp - 0x70], eax
bt r8w, 0xb9
movzx dx, r14b
and r8d, esi
lea r8, [rbp - 0x80]
shl rdx, 0x9d
rcl rdx, cl
and dh, 0xb
lea rdx, [0x140048638]
cmc
cmp r14b, 0x48
xor ecx, ecx
jmp 0x1408bafb3
call 0x14067b34d
lea rdi, [rbp + 0x3b0]
movsx rdx, r8w
setns cl
bsf rcx, r8
xor eax, eax
setb ch
mov ecx, 0x4d0
mov dl, r11b
setne dl
rep stosb byte [rdi], al
mov dword [rbp + 0x3e0], 0x100010
cwd
cdq
cmovae edx, r13d
mov qword [rbp + 0x410], r14
mov qword [rbp + 0x420], 0x400
movsxd rcx, r8d
movsx edx, r8w
lea rdx, [rbp + 0x3b0]
movsx cx, r9b
movsxd rcx, r13d
lea rcx, [rax - 2]
jmp 0x1408bb01f
call 0x1407cb0a0
test esi, esi
jmp 0x1408bb02b
js 0x1408bb07d
mov rbx, qword [rsp + 0x40]
cmp dword [rbp + 0x198], r14d
jmp 0x1408bb042
jne 0x1408bb0c0
test rbx, rbx
jmp 0x1408bb050
je 0x1408bb082
mov rcx, rbx
call 0x1401f9062
mov rbx, r14
mov qword [rsp + 0x40], rbx
jmp 0x1408bb06c
jmp 0x1408bb082
mov r15d, 0x208
movsxd rsi, ecx
xor bl, r13b
mov rbx, qword [rsp + 0x40]
mov esi, 1
cmp bx, 0x7ab9
add r13d, esi
cmp r9w, bx
cmp rsi, 0x6a351bb0
mov dword [rbp + 0xb00], r13d
cmc
jmp 0x1408bb0a7
cmp r13d, 3
jmp 0x1408bb0b0
jae 0x1408bb0c0
mov rbx, qword [rsp + 0x50]
jmp 0x1408ba785
lea rdi, [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass]
sar cl, 4
xor eax, eax
sets ch
mov cl, spl
movsxd rcx, r13d
mov rcx, r15
jmp 0x1408bb0dd
rep stosb byte [rdi], al
sub dil, spl
mov rdi, qword [rbp + 0x10]
cmc
test rdi, rdi
jmp 0x1408bb0ef
je 0x1408bb113
mov rcx, qword [rbp + 0x18]
test r10w, bx
test rcx, rcx
jmp 0x1408bb105
je 0x1408bb113
rep stosb byte [rdi], al
mov rbx, qword [rsp + 0x40]
clc
test rbx, rbx
jmp 0x1408bb11b
jne 0x1408bb14e
sub edx, edx
movsxd r8, esp
mov r8d, 0x800
mov rcx, qword [rbp + 0xaf0]
jmp 0x1408bb138
call 0x14062f5cc
mov rbx, rax
seta ch
xchg cl, ch
mov qword [rsp + 0x40], rax
movsx rcx, di
lea rcx, [rbp + 0x160]
jmp 0x1408bb15b
call 0x14069107c
mov rdx, qword [rbp + 0x10]
test rdx, rdx
jmp 0x1408bb16d
je 0x1408bb1c6
mov rcx, qword [rdx - 8]
stc
jmp 0x1408bb17e
test rcx, rcx
jmp 0x1408bb186
je 0x1408bb1a8
mov rdi, rdx
test r15b, r8b
cmp r14b, 0x96
xor eax, eax
jmp 0x1408bb19d
rep stosb byte [rdi], al
movzx cx, dil
movsx rcx, dx
mov rcx, qword [rdx - 0x10]
jmp 0x1408bb1b1
call 0x14018bb4b
mov qword [rbp + 0x10], r14
sbb al, r11b
mov qword [rbp + 0x18], r14
ror ax, cl
cdqe
mov rax, qword [rsp + 0x70]
test rax, 0x6d2c19bd
clc
test rax, rax
jmp 0x1408bb1db
je 0x1408bb1ee
mov rcx, rax
jmp 0x1408bb1e9
call 0x14067edcf
mov rax, rbx
jmp 0x1408bb1f7
movaps xmm6, xmmword [rsp + 0xb90]
add rsp, 0xba8
cmovnp bp, r8w
setp bpl
pop r15
movsx si, cl
mov bx, 0xc49
movzx r13d, si
pop r14
movsxd rdi, r13d
pop r13
pop r12
setae bpl
pop rdi
bswap esi
pop rsi
pop rbx
movsx bp, sil
mov bp, 0x155b
pop rbp
jmp 0x1408bb23e
ret