Function at 0x1408b7caf
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Get kernel32 base address

Disassembly:
push rbp
test r15w, 0x53b4
movzx rbp, r11w
push rbx
push rsi
bsr bp, bx
push rdi
push r12
xor rbx, r15
push r13
rcr bp, 0xca
push r14
xor r8b, dl
push r15
lea rbp, [rsp - 0x48]
cmovg rdi, r10
and bh, 0x33
sub rsp, 0x148
mov rbx, rcx
or r8d, 0x13695b6e
rcl cx, 0xc
mov edi, 0x40
btr cx, 0x84
mov r8d, edi
sbb cl, r13b
xchg rcx, rcx
movsx cx, r9b
lea rcx, [rbp]
cmp ecx, 0x28f372f7
jmp 0x1408b7d1c
xor edx, edx
call fcn.1408bae9b
mov rcx, qword [rbx]
adc r9w, si
lea r8, [rbp]
sub r13d, r13d
add r9b, bpl
mov qword [rbp], rdi
mov r9d, edi
mov qword [rbp + 0xa8], r13
test ax, bx
xor edx, edx
mov qword [rsp + 0x20], r13
jmp 0x1408b7d51
call fcn.1405cfd1e
lea r12d, [rdi - 0x3f]
mov edx, eax
test eax, eax
jmp 0x1408b7d63
js 0x1408b7d77
mov ecx, dword [rbp + 0x38]
shr ecx, 1
cmc
and cl, r12b
jmp 0x1408b7dca
mov rcx, qword [rbx]
movzx r9, bp
mov r8b, 0x42
lea r8, [rbp + 0xa8]
movsxd rdx, eax
mov r9d, 8
not dh
movzx edx, r9w
mov qword [rsp + 0x20], r13
movzx edx, r8w
setns dl
lea edx, [r9 + 0x12]
jmp 0x1408b7dac
call fcn.14084b291
cmp qword [rbp + 0xa8], r13
not cl
movsxd rdx, r15d
mov edx, r13d
setne cl
test rcx, 0x18fa4411
test edx, edx
js 0x1408b855c
test cl, cl
jmp 0x1408b7dd9
je 0x1408b85bd
mov rcx, rbx
jmp 0x1408b7de7
call fcn.1408b86e9
mov qword [rbp + 0xa0], r13
stc
clc
ror r15b, 0xb
rdtsc
shl rdx, 0x20
clc
shl r8, 0xb2
bts r15, rbx
lea r15, [rbx + 0x138]
test r15w, r14w
stc
or rax, rdx
movzx rsi, r13w
jmp 0x1408b7e20
mov dword [rsp + 0x48], 0x20
cmovg ecx, edx
btc edx, 0xb3
movzx rdx, si
mov rcx, rax
cmova r8, r11
btr si, r8w
mov r8b, dil
mov dword [rsp + 0x40], r13d
ror edx, cl
cqo
mov rdx, rax
ror rcx, 3
xor rdx, rcx
cbw
xchg cx, r8w
movabs rsi, 0x7010008004002001
or r8b, 0xae
xadd rdi, rax
bswap ax
mov rcx, qword [rbx + 0x108]
mov rax, rsi
clc
mul rdx
sar dil, 0x62
btr r8d, 0xfc
rcr r8, cl
mov edi, 2
xor r9d, r9d
bsr r8d, ebp
sar r8d, 0xbc
xor rdx, rax
btr r8w, r8w
shld r8d, ebx, 0x55
sal rax, cl
mov dword [rsp + 0x38], edi
and edx, 7
xadd eax, r8d
sub eax, 0x3e115edd
lea rax, [rbp + 0x98]
sbb r8d, r11d
movzx r8d, r14w
mov qword [rsp + 0x30], rax
and r8w, 0x6bfb
shr al, 0xa5
add rdx, 8
sal r8b, 0xdf
shl rdx, 0xc
movzx eax, r13w
movzx rax, si
lea rax, [rbp + 0xa0]
not r8d
movsx r8w, dl
cmovle r8w, ax
mov qword [rbp + 0x98], rdx
cdq
mov r8, r15
cdq
movzx dx, r10b
mov rdx, qword [rbx]
jmp 0x1408b7f17
mov qword [rsp + 0x28], rax
jmp 0x1408b7f21
mov qword [rsp + 0x20], r13
jmp 0x1408b7f2b
call fcn.14045af14
mov ecx, eax
test eax, eax
jmp 0x1408b7f39
js 0x1408b8620
mov rax, qword [rbp + 0x98]
cmp r12w, 0x7a76
mov qword [rbx + 0x140], rax
and edx, 0x51d70221
btr rax, 0xaa
bt r8, 0x43
mov qword [rbp + 0xa0], 0x10000
sete dl
btc r8d, 1
rdtsc
bswap r8d
sets cl
shl rdx, 0x20
lea r8, [rbx + 0x130]
xor cl, 0xc5
neg cx
or rax, rdx
mov dword [rsp + 0x48], 4
rcl ch, 0x4d
mov cx, 0x35cc
btr dx, r12w
mov rcx, rax
bt edx, r9d
rol dx, 0xae
mov dword [rsp + 0x40], r13d
mov dx, di
bts edx, r8d
not dh
mov rdx, rax
mov rax, r11
btr ax, 0x13
ror rcx, 3
sar ax, cl
sar rax, 0x89
xor rdx, rcx
clc
shld cx, dx, 0x43
mov dword [rsp + 0x38], edi
movzx rcx, r11w
bswap ecx
mov rcx, qword [rbx + 0x108]
rcr al, cl
mov rax, rsi
mul rdx
stc
cmp r15d, 0x366738e0
cmc
sub r9d, r9d
test ax, 0x2052
xor rdx, rax
lea rax, [rbp + 0x98]
jmp 0x1408b8016
and edx, 7
mov qword [rsp + 0x30], rax
add ax, 0x4997
bts ax, cx
rol ax, cl
add rdx, 8
ror al, 0xce
sub eax, 0x255504db
adc ax, di
lea rax, [rbp + 0xa0]
stc
shl rdx, 0xc
mov qword [rbp + 0x98], rdx
movzx edx, r8w
mov rdx, qword [rbx]
jmp 0x1408b8057
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call fcn.140256e05
mov ecx, eax
test r8b, r8b
cmp r12b, spl
test eax, eax
jmp 0x1408b8075
js 0x1408b8679
mov rcx, qword [rbx + 0x118]
rcl al, cl
bts r14w, bp
mov qword [rbx + 0x128], rcx
lahf
shr eax, 0x27
add rcx, qword [rbp + 0xa0]
sal r14b, cl
movzx r14d, dx
mov qword [rbx + 0x120], rcx
cmp r10b, 0xe7
movzx rcx, cx
mov rax, qword gs:[0x60]
sbb r14, 0x5d4373f3
mov ch, 0x7a
bsf cx, r10w
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
setl cl
xadd cx, cx
movzx r14w, cl
mov rcx, qword [rax]
and r14w, 0x5549
mov r14, qword [rcx + 0x30]
test r14, r14
jne 0x1408b8100
mov rcx, r13
jmp 0x1408b80fb
jmp 0x1408b810d
movsxd rcx, dword [r14 + 0x3c]
cmc
add rcx, r14
jmp 0x1408b810d
call fcn.140007ca0
mov rsi, rax
cmp r15b, 0x77
stc
clc
test rax, rax
je 0x1408b826a
mov r8d, dword [rax + 0x10]
cmp r11b, 0x2e
cmp r8w, bp
stc
test r8d, r8d
jmp 0x1408b8139
jne 0x1408b8152
mov r8d, dword [rax + 8]
xadd r9w, ax
sbb dl, r12b
adc r9d, 0x7a120fc3
rdtsc
xchg edi, edi
btr edi, ebp
btc r9d, 0x2f
mov r9, qword [rbx + 0x140]
sub cl, r10b
movabs r10, 0x7010008004002001
btr cx, r13w
mov rdi, qword [rbx + 0x128]
sal rcx, 0x1c
xadd cl, cl
xor cx, r8w
shl rdx, 0x20
or rax, rdx
btc cx, 0x74
rcr dl, cl
mov rcx, rax
btr rdx, r12
mov rdx, rax
cbw
movzx rax, r11w
cmovnp ax, r13w
ror rcx, 3
lahf
not al
cwde
mov rax, r10
clc
cmp r8d, 0x34c45c37
xor rdx, rcx
mov ecx, r8d
mul rdx
test dl, r11b
clc
jmp 0x1408b81d1
sub rcx, r9
cmc
cmp dl, r8b
xor rax, rdx
cmp r11, 0x6bad4256
test dil, 0x7f
clc
sub rcx, 0x10
cmp bp, ax
cmp r11b, 2
sub edx, edx
stc
div rcx
neg ax
bt ax, 0xc7
mov eax, dword [rsi + 0xc]
add rdx, rax
jmp 0x1408b8211
and rdx, 0xfffffffffffffff0
test r11, 0x53ee0011
lea rdx, [rdx + r14]
test rcx, 0x22b52f3e
test rdi, rdi
jmp 0x1408b822f
je 0x1408b8298
test rdx, rdx
je 0x1408b8298
test r9, r9
jmp 0x1408b8246
je 0x1408b8298
mov rsi, rdx
jmp 0x1408b825b
mov rcx, r9
jmp 0x1408b8263
rep movsb byte [rdi], byte [rsi]
jmp 0x1408b8298
mov edx, dword [rbx + 0x140]
cmovns cx, r10w
movzx cx, r11b
bswap cx
mov rcx, qword [rbx + 0x128]
jmp 0x1408b8289
call fcn.140895b1b
movabs r10, 0x7010008004002001
rdtsc
adc cx, r10w
shl rdx, 0x20
movzx rcx, ax
or rax, rdx
movzx edx, r14w
bt dx, r9w
mov cl, r8b
mov rcx, rax
mov rdx, rax
btr ax, 0xc2
movsx ax, cl
ror rcx, 3
or ah, 0xb3
mov rax, r10
clc
test r12w, 0x55b9
xor rdx, rcx
bsr cx, r11w
shl rcx, 0x15
movzx rcx, ax
mov rcx, qword [rbx + 0x140]
cmc
test di, di
mul rdx
clc
cmc
sub rcx, 0x2000
cmc
xor rax, rdx
test r8d, 0x7f7b61d4
sub edx, edx
cmc
div rcx
clc
bsr ecx, r11d
bsr ecx, dword [r15]
add rdx, 0x1000
shl r12d, cl
xchg cl, ch
shld cx, cx, 0xaa
not ch
and rdx, 0xfffffffffffffff0
setl cl
mov rcx, rbx
jmp 0x1408b8338
mov qword [rbx + 0x158], rdx
jmp 0x1408b8344
mov dword [rbx + 0x170], r12d
jmp 0x1408b8350
call fcn.1408b8f6f
mov rcx, qword [rbx + 0x120]
cmovb edi, esi
movsx dx, r14b
jmp 0x1408b8369
mov edi, 0x2e8
bt edx, eax
add rcx, rdi
cwd
mov rdx, 0x41901031
mov edx, 0x4000
jmp 0x1408b8387
call fcn.140895b1b
mov eax, dword [rbx + 0x170]
mov rcx, qword [rbx + 0x120]
not eax
clc
test r14b, cl
and dword [rdi + rcx], eax
cmp r13w, 0x7303
add rdi, 4
stc
test r9b, 1
cmp rdi, 0x42e8
jmp 0x1408b83bd
jb 0x1408b838c
mov r8, qword [rbx + 0x120]
lea rax, [rsp + 0x50]
cdq
cmp r10w, bp
mov rdx, qword [rbx + 0x148]
rcr r9w, 0xfc
movsxd rcx, edx
add r8, 0x160
mov rcx, qword [rbx]
movzx r9w, dl
cmovne r9d, ecx
mov r9d, 0x3aac1c4b
mov r9d, 0x188
mov qword [rsp + 0x50], r13
jmp 0x1408b840c
mov qword [rsp + 0x20], rax
jmp 0x1408b8416
call fcn.140086d5e
mov ecx, eax
cmp dh, 0x14
test spl, r15b
test eax, eax
jmp 0x1408b842a
js 0x1408b84f2
mov rax, qword [rbx + 0x120]
btr r14w, 0xed
sub cl, sil
cmovns si, r8w
mov rcx, qword [rbx + 0x150]
cmp bpl, 1
sub di, 0x55ba
add rcx, qword [r15]
adc si, ax
bsf rbp, rsp
bts r12w, dx
mov qword [rax + 0x160], rcx
setb sil
shl sil, 0xc7
clc
mov rcx, qword [rbx + 0x120]
rcl r12b, 0xe2
shrd r13, rcx, 0xb9
mov rax, qword [rbx + 0x148]
dec r13
test r11b, al
mov qword [rcx], rax
mov rcx, qword [rbx + 0x120]
rol ax, 4
mov rax, qword [r15]
mov rbx, r8
stc
mov qword [rcx + 8], rax
rcr bpl, cl
add rsp, 0x148
mov r14w, bx
pop r15
pop r14
not sil
cmovns ebp, eax
sete bh
pop r13
mov rbx, 0x6a724baa
movsxd rbx, ebp
pop r12
movzx rdi, r13w
pop rdi
pop rsi
movsx ebp, r10w
mov bp, r11w
not bx
pop rbx
movsx ebp, cx
not bp
movzx bp, r8b
pop rbp
ret
sub eax, eax
movsx rdx, di
movsx edx, r9w
mov dword [rbp - 0xc], ecx
movzx dx, dl
movsx cx, spl
mov qword [rbp - 0x20], rax
movsx rcx, r15w
lea rdx, [0x140068a88]
movsx cx, r8b
jmp 0x1408b8521
mov qword [rbp - 0x18], rax
cbw
mov cl, bpl
bswap ecx
lea rcx, [rbp - 0x28]
lea rax, [0x14005b4d8]
jmp 0x1408b853c
mov dword [rbp - 0x10], 0xd0001b06
jmp 0x1408b8548
mov qword [rbp - 0x28], rax
jmp 0x1408b8551
call 0x140797531
int3
xor eax, eax
movzx ecx, bp
mov cl, 0x3e
mov dword [rsp + 0x74], edx
movsxd rcx, r15d
mov dx, si
mov cx, 0x1141
mov qword [rsp + 0x60], rax
xchg dl, ch
lea rdx, [0x140068a88]
movsx cx, al
not cx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x58]
movsxd rax, edi
movsx ax, dh
not ah
lea rax, [0x14005b4d8]
mov dword [rsp + 0x70], 0xd0001b15
jmp 0x1408b85ad
mov qword [rsp + 0x58], rax
call 0x140359d4c
int3
xor eax, eax
movsxd rdx, r10d
not dh
mov dword [rbp - 0x70], 0xd0001500
mov qword [rbp - 0x80], rax
movsx rcx, r13w
movsxd rdx, ebp
lea rdx, [0x140068a88]
xchg cx, cx
mov qword [rbp - 0x78], rax
movsx eax, cx
lea rcx, [rsp + 0x78]
jmp 0x1408b85f6
lea rax, [0x14005b4d8]
jmp 0x1408b8602
mov dword [rbp - 0x6c], r13d
jmp 0x1408b860b
mov qword [rsp + 0x78], rax
jmp 0x1408b8615
call 0x140225b91
int3
sub eax, eax
movsx edx, r13w
movzx edx, r15w
xchg dl, dh
mov dword [rbp - 0x4c], ecx
mov qword [rbp - 0x60], rax
cmovs rcx, rsp
lea rdx, [0x140068a88]
mov qword [rbp - 0x58], rax
cdqe
lea rcx, [rbp - 0x68]
jmp 0x1408b8652
lea rax, [0x14005b4d8]
jmp 0x1408b865e
mov dword [rbp - 0x50], 0xd0001d01
mov qword [rbp - 0x68], rax
jmp 0x1408b866e
call 0x1403c5b8c
int3
sub eax, eax
jmp 0x1408b8680
mov dword [rbp - 0x2c], ecx
movsx edx, r9w
movsx rcx, bp
mov qword [rbp - 0x40], rax
xchg rcx, rdx
movzx rcx, dx
cmovp cx, r8w
lea rdx, [0x140068a88]
movzx ecx, r14w
mov qword [rbp - 0x38], rax
movzx rcx, dx
movsx eax, bp
lea rcx, [rbp - 0x48]
movzx rax, cx
movsx rax, bp
lea rax, [0x14005b4d8]
jmp 0x1408b86c9
mov dword [rbp - 0x30], 0xd0001d01
jmp 0x1408b86d5
mov qword [rbp - 0x48], rax
jmp 0x1408b86de
call 0x14070961b
int3