Function at 0x7ff70b4ffdc0
Capabilities:
Access peb ldr_data
Encode data using xor
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov r15, rcx
xor ebx, ebx
mov dword [rsp + 0x60], ebx
mov dword [rcx], ebx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], rbx
mov dword [rsp + 0x60], 1
mov rcx, qword [0x7ff70b6921c8]
mov rax, qword [rcx + 0x2b0]
sub rax, qword [rcx + 0x2a8]
cmp rax, 2
jae 0x7ff70b500051
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
movabs rcx, 0xc6c4f696e8342593
mov qword [rbp - 0x70], rcx
movabs rdx, 0x57938323ed048fac
mov qword [rbp - 0x68], rdx
movabs rcx, 0xc6c4f696e83425cf
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdx
movdqa xmm0, xmmword [rsp + 0x70]
pxor xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x70], xmm0
movzx edi, word [rax + 0x58]
movzx esi, word [rax + 0x48]
mov r14, qword [rax + 0x50]
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x50]
call fcn.7ff70b54e850
lea rax, [rbp - 0x50]
mov qword [rbp + 0x1b0], rax
mov eax, edi
mov edi, esi
sub rdi, rax
and rdi, 0xfffffffffffffffe
sub rdi, 2
mov r8, rdi
mov rdx, r14
lea rcx, [rbp - 0x50]
call fcn.7ff70b54e1a0
mov rcx, qword [rbp + 0x1b0]
add rcx, rdi
mov qword [rbp + 0x1b0], rcx
lea rax, [rsp + 0x70]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x7ff70b4ffee0
add rdi, rdi
mov r8, rdi
lea rdx, [rsp + 0x70]
call fcn.7ff70b54e1a0
mov rsi, qword [rbp + 0x1b0]
add rsi, rdi
mov qword [rbp + 0x1b0], rsi
lea rax, [rbp - 0x50]
sub rsi, rax
sar rsi, 1
mov dword [rsp + 0x40], ebx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x20], ebx
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rbx
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x28]
call fcn.7ff70b4f8850
rdtsc
shl rdx, 0x20
or rax, rdx
mov r14, rax
mov dword [rsp + 0x20], r14d
mov r8, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
sub r8, rdi
sar r8, 1
add r8, r8
xor edx, edx
mov rcx, rdi
call fcn.7ff70b54e850
test rsi, rsi
je 0x7ff70b4fffa0
mov rdx, rbx
nop word [rax + rax]
movzx eax, bx
add ax, ax
lea ecx, [rax + rbx]
add cx, r14w
xor cx, word [rbp + rdx*2 - 0x50]
mov word [rdi + rdx*2], cx
inc ebx
movsxd rdx, ebx
cmp rdx, rsi
jb 0x7ff70b4fff80
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.7ff70b4f87b0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x7ff70b4ffff5
mov rax, qword [rsp + 0x38]
sub rax, rcx
sar rax, 1
add rax, rax
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b4fffef
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b5002b9
call fcn.7ff70b4dd700
nop
lea rdx, [rsp + 0x48]
lea rcx, [r15 + 8]
call fcn.7ff70b4f87b0
mov eax, dword [rsp + 0x40]
mov dword [r15], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x7ff70b500294
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 1
add rax, rax
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b500046
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b5002bf
call fcn.7ff70b4dd700
nop
jmp 0x7ff70b500294
add rcx, 0x2a0
lea rdx, [rbp - 0x70]
call fcn.7ff70b4fbe90
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x7ff70b5000a9
mov rax, qword [rbp - 0x60]
sub rax, rcx
sar rax, 1
add rax, rax
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b500097
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b5002c5
call fcn.7ff70b4dd700
nop
mov qword [rbp - 0x70], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, qword [0x7ff70b6921c8]
add rcx, 0x2a0
lea rdx, [rsp + 0x70]
call fcn.7ff70b4fbe90
mov rsi, qword [rax]
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x50]
call fcn.7ff70b54e850
lea rax, [rbp - 0x50]
mov qword [rbp + 0x1b0], rax
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x7ff70b5000f0
add rdi, rdi
mov r8, rdi
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.7ff70b54e1a0
mov rsi, qword [rbp + 0x1b0]
add rsi, rdi
mov qword [rbp + 0x1b0], rsi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x7ff70b500161
mov rax, qword [rbp - 0x80]
sub rax, rcx
sar rax, 1
add rax, rax
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b500154
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b5002cb
call fcn.7ff70b4dd700
nop
mov rsi, qword [rbp + 0x1b0]
lea rax, [rbp - 0x50]
sub rsi, rax
sar rsi, 1
mov dword [rsp + 0x40], ebx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x20], ebx
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rbx
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x28]
call fcn.7ff70b4f8850
rdtsc
shl rdx, 0x20
or rax, rdx
mov r14, rax
mov dword [rsp + 0x20], r14d
mov r8, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
sub r8, rdi
sar r8, 1
add r8, r8
xor edx, edx
mov rcx, rdi
call fcn.7ff70b54e850
test rsi, rsi
je 0x7ff70b5001f0
mov rdx, rbx
movzx eax, bx
add ax, ax
lea ecx, [rax + rbx]
add cx, r14w
xor cx, word [rbp + rdx*2 - 0x50]
mov word [rdi + rdx*2], cx
inc ebx
movsxd rdx, ebx
cmp rdx, rsi
jb 0x7ff70b5001d0
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.7ff70b4f87b0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x7ff70b500245
mov rax, qword [rsp + 0x38]
sub rax, rcx
sar rax, 1
add rax, rax
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50023f
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b5002d1
call fcn.7ff70b4dd700
nop
lea rdx, [rsp + 0x48]
lea rcx, [r15 + 8]
call fcn.7ff70b4f87b0
mov eax, dword [rsp + 0x40]
mov dword [r15], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x7ff70b500294
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 1
add rax, rax
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50028e
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b5002b3
call fcn.7ff70b4dd700
nop
mov rax, r15
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.7ff70b5526b4
nop
call fcn.7ff70b5526b4
nop
call fcn.7ff70b5526b4
int3
call fcn.7ff70b5526b4
int3
call fcn.7ff70b5526b4
nop
call fcn.7ff70b5526b4
int3