Function at 0x140001000
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
rdtsc
mov r8, rdx
shl r8, 0x20
or r8, rax
rdtsc
shl rdx, 0x20
or rdx, rax
cmp r8, rdx
mov eax, 0x8f765832
mov ebx, 0xd08bb030
cmove ebx, eax
lea rsi, [rsp + 0x90]
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
mov eax, 0xa6ebb5c0
mov ecx, 0x3ef6ed52
cmove ecx, eax
xor ecx, ebx
xor ecx, 0xd8acd760
mov r13d, ebx
xor r13d, 0x2cc2f773
mov r12d, ebx
xor r12d, 0xa7fab3e7
mov edi, ebx
xor edi, 0xa8a11e5c
jmp 0x140001094
xor edx, edx
mov ecx, edi
mov ebp, ecx
mov rax, rdx
mov r8d, ecx
imul r8d, r13d
add r8d, r12d
mov edx, 0
mov ecx, edi
cmp r8d, 0xd0820f87
je 0x140001094
cmp r8d, 0x4020b05d
jne 0x14000127e
xor ebp, ebx
mov eax, ebp
xor eax, 0xd044aa25
mov ecx, dword [rsp + 0x34]
or ecx, eax
mov edx, dword [rsp + 0x34]
not edx
mov r8d, ebp
xor r8d, 0x19a5c5cc
imul r8d, edx
mov edx, dword [rsp + 0x34]
not edx
or edx, eax
mov r14d, ebp
xor r14d, 0xe65a3a33
imul edx, r14d
mov r9d, ebp
and eax, dword [rsp + 0x34]
xor r9d, 0xd044aa2a
not eax
mov r15d, ebp
xor r15d, 0xe65a3a30
imul eax, r15d
mov r10d, ebp
xor r10d, 0xe65a3a02
add r10d, r9d
sub r10d, ecx
add r10d, r8d
add r10d, edx
add r10d, eax
mov dword [rsp + 0x50], r10d
mov qword [rsp + 0x58], 0
mov eax, ebp
xor eax, 0xa07f63c8
mov ecx, dword [rsp + 0x44]
or ecx, eax
not ecx
mov edx, ebp
xor edx, 0xa07f63c9
mov r8d, ebp
xor r8d, 0xe65a3a72
add r8d, edx
add r8d, dword [rsp + 0x44]
and eax, dword [rsp + 0x44]
not eax
add eax, ecx
imul eax, r14d
add eax, r8d
inc eax
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x60], rsi
mov r8d, ebp
xor r8d, 0xe65a3a22
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.140092d50
mov eax, ebp
xor eax, 0xb5ba046c
mov edx, ebp
xor edx, 0x4a45fb93
mov ecx, ebp
xor ecx, 0xe6483ab9
add ecx, edx
sub ecx, dword [rsp + 0x40]
or eax, dword [rsp + 0x40]
imul eax, r15d
add eax, ecx
xor edx, dword [rsp + 0x40]
imul edx, r14d
add edx, eax
mov eax, ebp
xor eax, 0x7f3182d4
mov ecx, dword [rsp + 0x3c]
and ecx, eax
mov r8d, ebp
xor r8d, 0x80ce7d2b
and r8d, dword [rsp + 0x3c]
imul ecx, r14d
mov r9d, ebp
xor r9d, 0x80ce7d28
sub r9d, r8d
add r9d, ecx
xor eax, dword [rsp + 0x3c]
add eax, r9d
inc eax
mov ecx, ebp
xor ecx, 0xd3245b45
mov r8d, dword [rsp + 0x38]
or r8d, ecx
mov r9d, ebp
xor r9d, 0x2cdba4bb
mov r10d, dword [rsp + 0x38]
not r10d
imul r10d, r14d
and ecx, dword [rsp + 0x38]
xor ebp, 0xe65a3a2d
add ebp, r9d
add ebp, r8d
add ebp, r10d
add ecx, ebp
add ecx, 2
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x80]
call qword [sym.imp.ntdll.dll_NtOpenFile]
mov ebp, eax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test ebp, ebp
js 0x140001090
mov rdx, qword [rsp + 0x48]
mov ecx, edi
jmp 0x140001094
cmp r8d, 0xcdc89e1b
jne 0x1400012d0
mov qword [rsp + 0x48], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x90], xmm0
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x1400012d0