Function at 0x140098e0b
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x638
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140098e2d
call fcn.1400996bc
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
cmp byte [rax + 2], 1
jne 0x140098e46
call fcn.1400996bc
mov al, byte [0x140353270]
mov edx, 0x60
xor ecx, ecx
call fcn.140190370
test rax, rax
je 0x140099693
mov rsi, rax
lea rax, [0x14029b5a9]
mov qword [rsi], rax
mov eax, 0xa
mov qword [rsi + 8], rax
lea rcx, [0x14029b572]
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], 7
lea rcx, [0x14029b579]
mov qword [rsi + 0x20], rcx
mov qword [rsi + 0x28], 9
lea rcx, [0x14029b582]
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], 0x12
lea rcx, [0x14029b594]
mov qword [rsi + 0x40], rcx
mov qword [rsi + 0x48], 0xb
lea rcx, [0x14029b59f]
mov qword [rsi + 0x50], rcx
mov qword [rsi + 0x58], rax
mov word [rsp + 0x27], 0x202
mov dword [rsp + 0x23], 0x2020202
mov word [rsp + 0x20], 0x101
mov byte [rsp + 0x22], 1
mov dword [rsp + 0x29], 0x1010101
mov eax, dword [0x140353274]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xe8], 0
je 0x140098f35
mov eax, dword [0x140353274]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov r14, qword [rax + 0xf0]
mov r15, qword [rax + 0xf8]
jmp 0x140098f7d
xorps xmm0, xmm0
lea rdi, [rsp + 0x160]
movaps xmmword [rdi], xmm0
mov edx, 0x10
mov rcx, rdi
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov r14, qword [rdi]
mov r15, qword [rdi + 8]
mov eax, dword [0x140353274]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf8], r15
lea rax, [r14 + 1]
mov ecx, dword [0x140353274]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0xf0], rax
mov al, byte [0x140353270]
mov edx, 0x56410
xor ecx, ecx
call fcn.140190370
test rax, rax
je 0x1400996a2
mov rdi, rax
add rdi, 0x56000
mov r8d, 0x410
mov rcx, rdi
mov dl, 0xff
call fcn.140230bc0
mov al, byte [0x140353270]
mov r12d, 9
mov edx, 9
xor ecx, ecx
call fcn.140190370
test rax, rax
je 0x1400996ac
movabs rcx, 0x5043206c61746f54
mov qword [rax], rcx
mov byte [rax + 8], 0x55
xorps xmm0, xmm0
lea rbx, [rsp + 0x160]
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0xc0], xmm0
movups xmmword [rbx + 0xd0], xmm0
mov qword [rbx], r12
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r12
xor eax, eax
mov qword [rbx + 0x18], rax
mov ecx, 1
mov qword [rbx + 0x20], rcx
mov qword [rbx + 0x38], rcx
mov qword [rbx + 0x40], rax
movabs rcx, 0x8000000000000000
mov qword [rbx + 0x48], rcx
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], 0
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x78], 8
mov qword [rbx + 0x80], rax
mov byte [rbx + 0x88], 0
mov qword [rbx + 0x90], rdi
mov qword [rbx + 0x98], 0x3ff
mov qword [rbx + 0xa0], 0x380
mov qword [rbx + 0xa8], rax
mov qword [rbx + 0xb0], r14
mov qword [rbx + 0xb8], r15
mov qword [rbx + 0xe0], rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140198006
lea r14, [rsp + 0x30]
mov r8d, 0x120
mov rcx, r14
mov rdx, rbx
call fcn.140230440
mov word [rbx + 7], 0x202
mov dword [rbx + 3], 0x2020202
mov word [rbx], 0x101
mov byte [rbx + 2], 1
mov dword [rbx + 9], 0x1010101
lea rdx, [rsp + 0x160]
mov rcx, r14
call fcn.140198006
mov rdi, qword [r14 + 0x90]
mov rbx, qword [r14 + 0xa8]
movdqa xmm0, xmmword [rdi]
pmovmskb ebp, xmm0
not ebp
lea r14, [rdi + 0x10]
sub rbx, 1
jb 0x140099192
test bp, bp
jne 0x140099142
movdqa xmm0, xmmword [r14]
pmovmskb ebp, xmm0
add rdi, 0xffffffffffffea80
add r14, 0x10
cmp ebp, 0xffff
je 0x140099124
not ebp
mov eax, ebp
lea ebp, [rax - 1]
and ebp, eax
bsf eax, eax
neg rax
imul r15, rax, 0x158
add r15, rdi
mov r12d, 8
mov r8, qword [r15 - 0x130]
cmp r8, qword [rsi + r12]
jne 0x140099186
mov rcx, qword [r15 - 0x138]
mov rdx, qword [rsi + r12 - 8]
call fcn.140230ac0
test eax, eax
jne 0x140099186
call fcn.1400996bc
add r12, 0x10
cmp r12, 0x68
jne 0x14009915f
jmp 0x140099119
mov rbx, qword [rsp + 0xc8]
test rbx, rbx
je 0x140099348
mov r14, qword [rsp + 0xd8]
test r14, r14
je 0x140099311
mov r12, qword [rsp + 0xc0]
movdqa xmm0, xmmword [r12]
pmovmskb eax, xmm0
not eax
lea r13, [r12 + 0x10]
mov rbp, qword [sym.imp.KERNEL32.dll_HeapFree]
test ax, ax
jne 0x1400991f7
movdqa xmm0, xmmword [r13]
pmovmskb eax, xmm0
add r12, 0xffffffffffffea80
add r13, 0x10
cmp eax, 0xffff
je 0x1400991d9
not eax
mov edi, eax
bsf eax, edi
neg rax
imul rax, rax, 0x158
lea r15, [r12 + rax]
cmp qword [r12 + rax - 0x140], 0
je 0x140099227
mov r8, qword [r15 - 0x138]
mov rcx, qword [0x1403531b0]
xor edx, edx
call rbp
mov rcx, qword [r15 - 0x120]
mov rdx, qword [r15 - 0x118]
call fcn.140032fea
cmp qword [r15 - 0x128], 0
je 0x140099256
mov r8, qword [r15 - 0x120]
mov rcx, qword [0x1403531b0]
xor edx, edx
call rbp
mov rcx, qword [r15 - 0xf8]
mov rdx, qword [r15 - 0xf0]
call fcn.1401397bc
mov rax, qword [r15 - 0xd8]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x140099296
test rax, rax
je 0x140099296
mov r8, qword [r15 - 0xd0]
mov rcx, qword [0x1403531b0]
xor edx, edx
call rbp
mov rcx, qword [r15 - 0x108]
mov rdx, qword [r15 - 0x100]
call fcn.140032fea
cmp qword [r15 - 0x110], 0
je 0x1400992c5
mov r8, qword [r15 - 0x108]
mov rcx, qword [0x1403531b0]
xor edx, edx
call rbp
mov rcx, qword [r15 - 0xc0]
mov rdx, qword [r15 - 0xb8]
call fcn.1401397bc
mov rcx, qword [r15 - 0xa0]
mov rdx, qword [r15 - 0x98]
call fcn.1401397bc
mov rax, qword [r15 - 0x60]
test rax, rax
je 0x140099303
lock dec qword [rax]
jne 0x140099303
mov rcx, qword [r15 - 0x60]
call fcn.140195aca
lea eax, [rdi - 1]
and eax, edi
dec r14
jne 0x1400991d4
lea rax, [rbx + 1]
mov ecx, 0x158
mul rcx
add rax, 0xf
and rax, 0xfffffffffffffff0
add rbx, rax
cmp rbx, 0xffffffffffffffef
je 0x140099348
mov r8, qword [rsp + 0xc0]
sub r8, rax
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x30], 0
je 0x140099364
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x78]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x140099394
test rax, rax
je 0x140099394
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x48], 0
je 0x1400993b0
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x60], 0
je 0x1400993cc
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
call fcn.140195bb5
cmp qword [rsp + 0xa0], 0
je 0x140099403
mov r8, qword [rsp + 0xa8]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x110]
test rdi, rdi
je 0x14009957c
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
lea rbx, [rdi + 0x10]
mov r14, qword [rsp + 0x128]
mov r15, qword [sym.imp.pdh.dll_PdhRemoveCounter]
sub r14, 1
jb 0x140099474
test ax, ax
jne 0x140099458
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
add rdi, 0xfffffffffffffe00
add rbx, 0x10
cmp eax, 0xffff
je 0x14009943c
not eax
lea ebp, [rax - 1]
and ebp, eax
bsf eax, eax
shl eax, 5
mov rcx, rdi
sub rcx, rax
mov rcx, qword [rcx - 8]
call r15
mov eax, ebp
jmp 0x140099431
mov rcx, qword [rsp + 0x148]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140099496
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140099496
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x140]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400994ae
call qword [sym.imp.pdh.dll_PdhCloseQuery]
mov rdi, qword [rsp + 0x118]
test rdi, rdi
je 0x14009957c
mov rbx, qword [rsp + 0x128]
test rbx, rbx
je 0x140099549
mov r14, qword [rsp + 0x110]
movdqa xmm0, xmmword [r14]
pmovmskb r13d, xmm0
not r13d
lea r15, [r14 + 0x10]
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
test r13w, r13w
jne 0x140099513
movdqa xmm0, xmmword [r15]
pmovmskb r13d, xmm0
add r14, 0xfffffffffffffe00
add r15, 0x10
cmp r13d, 0xffff
je 0x1400994f2
not r13d
bsf ecx, r13d
shl ecx, 5
mov rax, r14
sub rax, rcx
cmp qword [rax - 0x20], 0
je 0x140099537
mov r8, qword [rax - 0x18]
mov rcx, qword [0x1403531b0]
xor edx, edx
call r12
dec rbx
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
test rbx, rbx
jne 0x1400994ec
mov rax, rdi
shl rax, 5
lea rcx, [rdi + rax]
add rcx, 0x20
cmp rcx, 0xffffffffffffffef
je 0x14009957c
add rax, 0x20
mov r8, qword [rsp + 0x110]
sub r8, rax
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1403531b0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rsi, [rsp + 0x160]
mov r8d, 0x4d0
mov rcx, rsi
xor edx, edx
call fcn.140230bc0
mov dword [rsi + 0x30], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x140099641
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov eax, 0x535f4f4b
cmovne eax, ecx
xor edx, edx
lea rsi, [rsp + 0x150]
mov qword [rsi], rdx
mov dword [rsi + 8], eax
mov qword [rsp + 0x20], rsi
lea rax, case.0x140137cc1.1905
mov qword [rsp + 0x28], rax
lea rax, [0x14029b5e0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], rdx
lea rax, [rsp + 0x20]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call fcn.140180d10
mov rcx, qword [rsi]
test rcx, rcx
je 0x140099641
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [rsp + 0x1a8], 0
jne 0x14009966d
cmp qword [rsp + 0x1b0], 0
jne 0x14009966d
cmp qword [rsp + 0x1b8], 0
jne 0x14009966d
cmp qword [rsp + 0x1c0], 0
je 0x140099672
call fcn.1400996bc
mov ecx, 0x4e20
xor edx, edx
call fcn.140176400
nop
add rsp, 0x638
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x60
call fcn.1402316b0
mov ecx, 0x56410
call fcn.1400697b0
mov ecx, 1
mov edx, 9
call fcn.140231690
int3