Function at 0x2b858
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfq
push rsi
mov rsi, qword [rsp + 8]
lea rsi, [rsi + 0x2f]
xchg qword [rsp + 8], rsi
mov qword [rsp + 8], rsi
mov rsi, qword [rsp]
lea rsp, [rsp + 8]
xchg rcx, rax
lea rsp, [rsp - 8]
mov qword [rsp], rcx
mov rcx, rax
mov rax, qword [rsp]
xchg rdx, rax
lea rsp, [rsp - 8]
mov qword [rsp], rax
mov rax, rdx
mov rdx, qword [rsp]
rdtsc
push rax
mov rax, qword [rsp + 8]
lea rax, [rax + 2]
xchg qword [rsp + 8], rax
mov qword [rsp + 8], rax
mov rax, qword [rsp]
lea rsp, [rsp + 8]
and rax, 1
pushfq
add rbp, 0x62
popfq
lea rbp, [rbp - 0x62]
xchg rdi, rdx
xchg qword [rsp], rdi
xchg rdi, rdx
lea rsp, [rsp + 8]
xchg rdi, rax
xchg qword [rsp], rdi
xchg rdi, rax
lea rsp, [rsp + 8]
je 0x30528
jne 0x4eb10
jmp 0x30526
rol dword [rax], 1
mov rax, rsi
mov esi, dword [rbp + 0x70]
push rax
xchg esi, eax
pop rsi
dec eax
pushfq
add rbp, 0x70
popfq
lea rbp, [rbp - 0x70]
mov dword [rbp + 0x70], eax
push rax
mov rax, qword [rsp + 8]
lea rax, [rax + 0x2f]
xchg qword [rsp + 8], rax
mov qword [rsp + 8], rax
mov rax, qword [rsp]
lea rsp, [rsp + 8]
cmp dword [rbp + 0x70], 0
push rsi
mov rsi, qword [rsp + 8]
lea rsi, [rsi + 0x2d]
xchg qword [rsp + 8], rsi
mov qword [rsp + 8], rsi
mov rsi, qword [rsp]
lea rsp, [rsp + 8]
je fcn.0002d490
cmp dword [rbp], 0
push rbp
mov rbp, rsp
leave
je fcn.0002d490
mov rax, rcx
mov ecx, dword [rbp + 4]
push rax
xchg ecx, eax
pop rcx
cmp dword [rbp], eax
push rcx
mov rcx, qword [rsp + 8]
lea rcx, [rcx + 0x5e]
xchg qword [rsp + 8], rcx
mov qword [rsp + 8], rcx
mov rcx, qword [rsp]
lea rsp, [rsp + 8]
je 0x25730
jmp fcn.0002d490
invalid
xchg rcx, rax
mov rcx, qword [rbp + 0x68]
push rax
xchg rcx, rax
pop rcx
movzx eax, word [rax]
lea rcx, [rcx]
mov dword [rbp + 4], eax
push rsi
mov rsi, qword [rsp + 8]
lea rsi, [rsi + 0x52]
xchg qword [rsp + 8], rsi
mov qword [rsp + 8], rsi
mov rsi, qword [rsp]
lea rsp, [rsp + 8]
mov rax, rbx
mov ebx, dword [rbp + 4]
push rax
xchg ebx, eax
pop rbx
mov dword [rbp + 0x48], eax
push rcx
mov rcx, qword [rsp + 8]
lea rcx, [rcx + 0x25]
xchg qword [rsp + 8], rcx
mov qword [rsp + 8], rcx
mov rcx, qword [rsp]
lea rsp, [rsp + 8]
xchg rcx, rax
mov rcx, qword [rbp + 0x68]
push rax
xchg rcx, rax
pop rcx
add rax, 2
push rcx
mov rcx, qword [rsp + 8]
lea rcx, [rcx + 0x5b]
xchg qword [rsp + 8], rcx
mov qword [rsp + 8], rcx
mov rcx, qword [rsp]
lea rsp, [rsp + 8]
xchg qword [rbp + 0x68], rcx
mov rcx, rax
push qword [rbp + 0x68]
xchg qword [rbp + 0x68], rcx
pop rcx
cmp dword [rbp + 0x48], 0x41
push rsi
mov rsi, qword [rsp + 8]
lea rsi, [rsi + 0x55]
xchg qword [rsp + 8], rsi
mov qword [rsp + 8], rsi
mov rsi, qword [rsp]
lea rsp, [rsp + 8]
jl 0x17b80
cmp dword [rbp + 4], 0x5a
push rcx
mov rcx, qword [rsp + 8]
lea rcx, [rcx + 0x38]
xchg qword [rsp + 8], rcx
mov qword [rsp + 8], rcx
mov rcx, qword [rsp]
lea rsp, [rsp + 8]
jg 0x41ce0
mov rax, rdi
mov edi, dword [rbp + 4]
push rax
xchg edi, eax
pop rdi
add eax, 0x20
push rax
mov rax, qword [rsp + 8]
lea rax, [rax + 0x41]
xchg qword [rsp + 8], rax
mov qword [rsp + 8], rax
mov rax, qword [rsp]
lea rsp, [rsp + 8]
mov dword [rbp + 4], eax
push rcx
mov rcx, qword [rsp + 0xc]
pop rcx
jmp 0x41ce0
xchg rbx, rax
mov rbx, qword [rbp + 0x60]
push rax
xchg rbx, rax
pop rbx
movzx eax, word [rax]
push rdx
mov rdx, qword [rsp + 8]
lea rdx, [rdx + 0x39]
xchg qword [rsp + 8], rdx
mov qword [rsp + 8], rdx
mov rdx, qword [rsp]
lea rsp, [rsp + 8]
mov dword [rbp], eax
pushfq
add rbp, 0x59
popfq
lea rbp, [rbp - 0x59]
mov rax, rdi
mov edi, dword [rbp]
push rax
xchg edi, eax
pop rdi
mov dword [rbp + 0x48], eax
push rdx
mov rdx, qword [rsp + 8]
lea rdx, [rdx + 4]
xchg qword [rsp + 8], rdx
mov qword [rsp + 8], rdx
mov rdx, qword [rsp]
lea rsp, [rsp + 8]
xchg rsi, rax
mov rsi, qword [rbp + 0x60]
push rax
xchg rsi, rax
pop rsi
add rax, 2
push rbx
mov rbx, qword [rsp + 8]
lea rbx, [rbx + 8]
xchg qword [rsp + 8], rbx
mov qword [rsp + 8], rbx
mov rbx, qword [rsp]
lea rsp, [rsp + 8]
xchg qword [rbp + 0x60], rcx
mov rcx, rax
push qword [rbp + 0x60]
xchg qword [rbp + 0x60], rcx
pop rcx
cmp dword [rbp + 0x48], 0x41
push rsi
mov rsi, qword [rsp + 8]
lea rsi, [rsi + 0x11]
xchg qword [rsp + 8], rsi
mov qword [rsp + 8], rsi
mov rsi, qword [rsp]
lea rsp, [rsp + 8]
jl 0x314c8
cmp dword [rbp], 0x5a
push rdx
mov rdx, qword [rsp + 8]
lea rdx, [rdx + 0x43]
xchg qword [rsp + 8], rdx
mov qword [rsp + 8], rdx
mov rdx, qword [rsp]
lea rsp, [rsp + 8]
jg 0x23d48
mov rax, rdi
mov edi, dword [rbp]
push rax
xchg edi, eax
pop rdi
add eax, 0x20
push rax
mov rax, qword [rsp + 8]
lea rax, [rax + 0x46]
xchg qword [rsp + 8], rax
mov qword [rsp + 8], rax
mov rax, qword [rsp]
lea rsp, [rsp + 8]
mov dword [rbp], eax
push rcx
mov rcx, qword [rsp + 8]
lea rcx, [rcx + 0x34]
xchg qword [rsp + 8], rcx
mov qword [rsp + 8], rcx
mov rcx, qword [rsp]
lea rsp, [rsp + 8]
jmp 0x23d48
or byte [rcx + 0x48550045], cl
mov ebp, esp
leave
jmp 0x23d48
call fcn.00053eb0
jrcxz 0x2b845
sbb eax, 0x3c3e41ec
sub ebp, edx
mov bh, 0x7b
leave
imul eax, ecx, 0xe8e39578
ja 0x2b88b
mov edx, eax
sbb al, 0x35
and byte [rdi], bl
cmp byte [rbp + 0x556f92da], dh
rcr byte [rsi], 1
call fcn.0003b100
sti
invalid
pop rbp
xchg edi, eax
invalid
add byte [rax], al
popfq
lea rdi, [rdi]
je 0x41ce0
jne 0x41ce0
jmp 0x41cde
pushfq
pushfq
add rbp, 0x25
popfq
lea rbp, [rbp - 0x25]
xchg rcx, rax
lea rsp, [rsp - 8]
mov qword [rsp], rcx
mov rcx, rax
mov rax, qword [rsp]
xchg rsi, rdx
lea rsp, [rsp - 8]
mov qword [rsp], rsi
mov rsi, rdx
mov rdx, qword [rsp]
rdtsc
push rbx
mov rbx, qword [rsp + 8]
lea rbx, [rbx + 9]
xchg qword [rsp + 8], rbx
mov qword [rsp + 8], rbx
mov rbx, qword [rsp]
lea rsp, [rsp + 8]
and rax, 1
push rcx
mov rcx, qword [rsp + 8]
lea rcx, [rcx + 0x3d]
xchg qword [rsp + 8], rcx
mov qword [rsp + 8], rcx
mov rcx, qword [rsp]
lea rsp, [rsp + 8]
xchg rdx, rax
xchg qword [rsp], rax
xchg rdx, rax
lea rsp, [rsp + 8]
xchg rcx, rax
xchg qword [rsp], rcx
xchg rcx, rax
lea rsp, [rsp + 8]
je 0x332d0
jne 0x54530
jmp 0x332ce
add byte [rax], al
popfq
mov rsi, rsi
je 0x23d48
jne 0x23d48
jmp 0x23d46
push rbp
mov rbp, rsp
leave
add qword [rsp], 0xfffffffffffe972f
xchg qword [rsp], rbx
push rsi
mov rsi, qword [rsp + 8]
lea rsi, [rsi + 0x17]
xchg qword [rsp + 8], rsi
mov qword [rsp + 8], rsi
mov rsi, qword [rsp]
lea rsp, [rsp + 8]
xchg qword [rsp + 8], rbx
push rcx
mov rcx, rdi
pop rcx
xchg qword [rsp], rbx
pushfq
add rbp, 0x6a
popfq
lea rbp, [rbp - 0x6a]
popfq
push rbp
mov rbp, rsp
leave
jmp 0x2b858
rcl dword [rbx - 0x743d74b8]
push rbp
jo 0x41d37
mov rax, rdx
mov edx, dword [rbp + 0x70]
push rax
xchg edx, eax
pop rdx
dec eax
pushfq
add rbp, 0x3d
popfq
lea rbp, [rbp - 0x3d]
mov dword [rbp + 0x70], eax
push rbx
mov rbx, qword [rsp + 8]
lea rbx, [rbx + 0x78]
xchg qword [rsp + 8], rbx
mov qword [rsp + 8], rbx
mov rbx, qword [rsp]
lea rsp, [rsp + 8]
cmp dword [rbp + 0x70], 0
push rsi
mov rsi, qword [rsp + 8]
lea rsi, [rsi + 0x3d]
xchg qword [rsp + 8], rsi
mov qword [rsp + 8], rsi
mov rsi, qword [rsp]
lea rsp, [rsp + 8]
je 0x4fb78
test byte [rsi + rbx*8], bh
add byte [rax], al
cmp dword [rbp], 0
mov rsi, rsi
je fcn.0002d490
mov rax, rcx
mov ecx, dword [rbp + 4]
push rax
xchg ecx, eax
pop rcx
cmp dword [rbp], eax
push rbp
mov rbp, rsp
leave
je 0x25730
jmp fcn.0002d490
add byte [rax], al
xchg rdx, rax
mov rdx, qword [rbp + 0x68]
push rax
xchg rdx, rax
pop rdx
movzx eax, word [rax]
push rdi
mov rdi, qword [rsp + 8]
lea rdi, [rdi + 0x3c]
xchg qword [rsp + 8], rdi
mov qword [rsp + 8], rdi
mov rdi, qword [rsp]
lea rsp, [rsp + 8]
mov dword [rbp + 4], eax
mov rdi, rdi
mov rax, rdi
mov edi, dword [rbp + 4]
push rax
xchg edi, eax
pop rdi
mov dword [rbp + 0x48], eax
push rdi
mov rdi, qword [rsp + 8]
lea rdi, [rdi + 0x29]
xchg qword [rsp + 8], rdi
mov qword [rsp + 8], rdi
mov rdi, qword [rsp]
lea rsp, [rsp + 8]
xchg rcx, rax
mov rcx, qword [rbp + 0x68]
push rax
xchg rcx, rax
pop rcx
add rax, 2
push rbx
mov rbx, qword [rsp + 8]
lea rbx, [rbx + 0xe]
xchg qword [rsp + 8], rbx
mov qword [rsp + 8], rbx
mov rbx, qword [rsp]
lea rsp, [rsp + 8]
xchg qword [rbp + 0x68], rbx
mov rbx, rax
push qword [rbp + 0x68]
xchg qword [rbp + 0x68], rbx
pop rbx
cmp dword [rbp + 0x48], 0x41
lea rcx, [rcx]
jl 0x41ce0
cmp dword [rbp + 4], 0x5a
mov rax, rax
jg 0x41ce0
mov rax, rcx
mov ecx, dword [rbp + 4]
push rax
xchg ecx, eax
pop rcx
add eax, 0x20
push rcx
mov rcx, qword [rsp + 8]
lea rcx, [rcx + 0x30]
xchg qword [rsp + 8], rcx
mov qword [rsp + 8], rcx
mov rcx, qword [rsp]
lea rsp, [rsp + 8]
mov dword [rbp + 4], eax
push rsi
mov rsi, qword [rsp + 8]
lea rsi, [rsi + 0x3b]
xchg qword [rsp + 8], rsi
mov qword [rsp + 8], rsi
mov rsi, qword [rsp]
lea rsp, [rsp + 8]
jmp 0x41ce0
popfq
push rbp
mov rbp, rsp
leave
je 0x1b6a0
jne 0x1b6a0
jmp 0x1b69e
pushfq
push rdi
mov rdi, qword [rsp + 8]
lea rdi, [rdi + 0x29]
xchg qword [rsp + 8], rdi
mov qword [rsp + 8], rdi
mov rdi, qword [rsp]
lea rsp, [rsp + 8]
xchg rdx, rax
lea rsp, [rsp - 8]
mov qword [rsp], rdx
mov rdx, rax
mov rax, qword [rsp]
xchg rdx, rax
lea rsp, [rsp - 8]
mov qword [rsp], rax
mov rax, rdx
mov rdx, qword [rsp]
rdtsc
push rcx
mov rcx, qword [rsp + 8]
lea rcx, [rcx + 0x64]
xchg qword [rsp + 8], rcx
mov qword [rsp + 8], rcx
mov rcx, qword [rsp]
lea rsp, [rsp + 8]
and rax, 1
push rsi
mov rsi, qword [rsp + 8]
lea rsi, [rsi + 7]
xchg qword [rsp + 8], rsi
mov qword [rsp + 8], rsi
mov rsi, qword [rsp]
lea rsp, [rsp + 8]
xchg rcx, rdx
xchg qword [rsp], rcx
xchg rcx, rdx
lea rsp, [rsp + 8]
xchg rcx, rax
xchg qword [rsp], rcx
xchg rcx, rax
lea rsp, [rsp + 8]
popfq
push rax
mov rax, qword [rsp + 8]
lea rax, [rax + 0x6b]
xchg qword [rsp + 8], rax
mov qword [rsp + 8], rax
mov rax, qword [rsp]
lea rsp, [rsp + 8]
je 0x47688
jne 0x47688
jmp 0x47686