Function at 0x140048b3f
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r9, 0x180000000
jmp 0x140048ca3
mov r8d, r12d
cpuid
not r11d
jmp 0x140048aa5
mov bp, sp
call fcn.1400489fb
xchg qword [rsp + 8], rdx
lea rsp, [rsp + 7]
lea rdi, [rdi + riz - 0x84]
inc r15
mov al, 0x30
mov r13d, 0xde54cb77
jmp 0x140048a8e
mov al, byte [rsp]
mov rbx, 0xac24504
jmp 0x140048a39
xchg qword [rsp + 0x18], rdi
mov edx, r8d
mov ax, sp
mov r11b, byte [rsp]
jmp 0x140048ad7
xor ebx, 0x5c2e152f
push dx
lea rsp, [rsp + 2]
jmp 0x140048a78
cmp r15, 0x270ab41b
jp 0x140048a6c
mov al, byte [rsp]
mov rbx, 0xac24504
mov bp, sp
call fcn.1400489e5
mov rbp, qword [rsp + 3]
btr r9, rdi
jo 0x140048afc
jno 0x140048afc
setae byte [rbx]
xchg bp, ax
push rdx
xchg esi, eax
add eax, eax
add dword [rdx + rcx*4 + 0x3c], 0x24
mov r15b, byte [rsp]
xchg rdx, r15
push qword [rsp + 0x18]
ret 0x20
lea rax, [rsp + 0x28]
bswap edx
mov r13, qword [rsp]
lea rdi, [r10 + r15]
jmp 0x140048b25
lea rsp, [rsp + 8]
xor r12d, 0x461920c7
jmp 0x140048ae6
call 0x140048b3f
mov al, 0x82
xchg r11d, edx
lea rsp, [rsp + 6]
jmp 0x140048c37
mov dx, sp
xor r12d, 0x3d289c27
bts r11, rsp
jbe 0x140048b0a
ja 0x140048b0a
sub dword [rdi + reloc.KERNEL32.dll_FindNextFileW], ebp
std
pop ax
jmp 0x140048b0f
jb 0x140048b9f
mov r14, 0xffffffffe80f1b49
mov edi, 0xda8b280f
call fcn.140048b69
jle 0x140048b93
jmp [rdi + 0xa]
outsd dx, dword [rsi]
or bh, cl
invalid
mov r14, 0xffffffffe80f1b49
mov edi, 0xda8b280f
jmp 0x140048e6a
add r12d, 0x3851a8a2
mov r9, r12
xchg r9w, r11w
mov r15d, esi
inc al
jmp 0x140048b7f
inc r11d
jmp 0x140048d45
adc r9, 0xffffffffebf8421c
add rsp, 0x1c
mov byte [rsp + 1], r9b
jmp 0x140048c4f
push r11w
je 0x140048c8d
lea r13, [rax + rbx]
lea rsp, [rsp + 2]
jmp 0x140048ccc
lea r13, [rax + rbx]
lea rsp, [rsp + 2]
jmp 0x140048ccc
mov r11, 0xffffffff820ae417
lea r14, [rdi + riz]
jmp 0x140048c77
add r12, qword [rsi + riz]
mov r9, r8
rdtsc
mov ebx, dword [rsp]
lea r15, [rbp + rbp]
jmp 0x140048ce0
add r12, r9
lea rbp, [r14 + riz]
rdtsc
mov r11d, 0x41c53a7c
mov eax, dword [rsp]
jmp 0x140048cb0
jmp 0x140048d11
rdtsc
jmp 0x140048dc1
xchg r9, rdx
mov r15b, r10b
mov r9d, 0xfb72e76
lea r13, [rsp + r14]
jmp 0x14004884a
movzx rdi, byte [r12]
shr bp, 0xc
ja 0x140048ce2
rdtsc
not bpl
sub rsp, 1
jmp 0x140048d8e
sub rsp, 0x1f
adc r9, 0xffffffffebf8421c
add rsp, 0x1c
mov byte [rsp + 1], r9b
inc r11d
mov rdi, rbx
mov r9d, edx
lea rsp, [rsp + 3]
not r12d
jmp 0x140048cfc
mov r11d, r10d
mov r14d, edi
mov r13, 0x7ce5e0dc
jmp 0x140048da8
mov r11, 0x5308840d
bt r14w, r10w
je 0x140048d55
mov r11d, r10d
jmp 0x140048d98
lea rsp, [rsp + 1]
mov r15d, ecx
jmp 0x140048dd0
mov r14d, edi
mov r13, 0x7ce5e0dc
jmp 0x140048da8
sub dil, r8b
sub rsp, 5
jns 0x140048df8
mov byte [rsp + 2], r13b
mov dword [rsp], r13d
jmp 0x140048e15
not bpl
sub rsp, 1
lea rsp, [rsp + 1]
mov r15d, ecx
mov cx, 0x1173
rdtsc
mov r13b, byte [rsp]
jmp 0x140048d6b
mov dword [rsp], r13d
neg dx
lea rsp, [rsp + 5]
jmp 0x140048dff
mov byte [rsp + 2], r13b
jmp 0x140048ddc
mov dl, dil
and rbp, 0xffffffffa9454dbc
jo 0x140048e35
jno 0x140048e1f
sbb dword [rax], 0xffffff8e
jmp 0x124fa6a2d
neg dx
lea rsp, [rsp + 5]
jmp 0x140048dff
mov r13d, 0x55da3ec9
mov bpl, 0xb1
not eax
jmp 0x140048e49
mov r13d, 0x55da3ec9
mov bpl, 0xb1
not eax
inc r9
jmp 0x140048ed0
inc r9
xchg cx, r9w
jmp 0x140048ed4
inc r12d
btr eax, edx
jge 0x140048d2e
sub rsp, 0x1f
jmp 0x140048c65
bswap rbx
mov rcx, 0xffffffffb925258f
mov r13, 0x72391adb
call fcn.140048e7f
jmp 0x140048f4b
jmp 0x140048efc
lea rsp, [rsp + 8]
not dl
mov r15d, 0x1c9baef9
bswap r15d
not r9d
jmp 0x140048edf
xchg cx, r9w
mov r13, qword [rsp]
not dl
xchg bpl, r15b
jmp 0x140048e95
mov al, byte [rsp]
cmc
ja 0x140048f20
xchg r13b, r9b
jmp 0x140048f0a
xchg rbx, rcx
mov eax, 0x792732c7
mov ax, 0x790d
jmp 0x140048eb2
mov bpl, byte [rsp]
dec ecx
jmp 0x140048f29
xchg r13b, r9b
mov bpl, byte [rsp]
dec ecx
inc dl
mov ax, word [rsp]
jmp 0x140048f35
bswap rbp
mov r9w, 0x464
btr rax, rsi
jmp 0x14004902f
ror dl, 0
mov ebx, dword [rsp]
mov bpl, spl
lea rbp, [r10 + r10]
bts rcx, r15
ja 0x140048eb0
xchg rbx, rcx
mov eax, 0x792732c7
mov ax, 0x790d
jmp 0x140048eb2
mov bx, 0x207f
neg dl
lea rax, [r8 + riz - 0x21]
jmp 0x140048fda
dec cx
jmp 0x140048fb1
sub r8b, dl
bswap eax
mov r15, 0xffffffffece7e887
lea r11, [rdx + riz - 0xadad]
bts r11w, r9w
jmp 0x140048fef
xchg r14b, cl
lea r15, [r8 + r13]
add r11d, 0x1c4b2c5b
jnp 0x140048f80
sub al, 0x4b
sbb al, 0x7b
xchg esi, eax
dec cx
jmp 0x140048fb1
jle 0x140049005
jg 0x140049005
jg 0x140048fe5
mov bh, byte [rcx + 0x32]
fist dword [rax - 0x3a]
movabs eax, dword [reloc.KERNEL32.dll_FindNextFileW]
inc r12
mov cl, byte [rsp]
shl r15d, cl
jmp 0x14004909f
bswap r13
inc r13w
setno r9b
xchg bpl, r14b
mov r9b, 0x7a
lea rax, [rsp + r13]
jmp 0x14004903e
jl 0x140048f73
mov bx, 0x207f
jmp 0x140048f77
bswap ebx
xchg r14b, r9b
call fcn.140049076
mov ah, 0x3c
sal byte [rbp + 0x2889fa44], cl
loop 0x140049070
insb byte [rdi], dx
setno r9b
xchg bpl, r14b
mov r9b, 0x7a
jmp 0x140049025
jmp 0x140049264
ja 0x140049014
bswap r13
inc r13w
jmp 0x140049054
jmp 0x1400491f7
lea rsp, [rsp + 0x18]
dec dil
mov ax, 0x77f4
mov edx, 0x83f05722
mov dx, di
push bp
jmp 0x140049231
jb 0x140049247
dec r9d
lea rsp, [rsp + 2]
jmp 0x140049275
dec r9d
lea rsp, [rsp + 2]
jmp 0x140049275
neg r9d
sub rsp, 0x11
lea rsp, [rsp + 1]
jmp 0x1400491e1
inc dil
rdtsc
lea r9, [r15*4]
bts bp, r11w
jbe 0x140049345
bts rbp, rsp
jmp 0x1400492b4
mov dx, word [rsp]
neg r13
xchg r14b, r13b
setle r15b
jmp 0x1400492dc
lea r15, [rbx + rsi]
jmp 0x140049308
setle r15b
rol dx, 0xd
jmp 0x1400492e0
mov dx, word [rsp]
neg r13
xchg r14b, r13b
jmp 0x1400492ba
rol dx, 0xd
neg dil
mov r11, rbx
mov r15d, dword [rsp]
jmp 0x140049328
bts rbp, rsp
lea r15, [rbx + rsi]
sub dil, 0x9e
neg eax
jo 0x14004929e
jno 0x1400492d0
mov ebp, dword [rsp]
jmp 0x1400493c8
inc cx
jg 0x140049312
mov ebp, dword [rsp]
jmp 0x1400493c8
jmp 0x140049300
mov r11, rdi
call fcn.140049365
jge 0x1400493e6
mov ebp, dword [rsp]
mov r13w, 0xf8ef
call fcn.140049487
lodsd eax, dword [rsi]
and dword [rcx - reloc.KERNEL32.dll_FindNextFileW], esi
mov ebp, dword [rsp]
mov r13w, 0xf8ef
bsf rbp, rsp
xchg r13, r14
jmp 0x14004941d
mov r9, r13
mov r11d, dword [r11 + riz + reloc.KERNEL32.dll_FindNextFileW]
bswap ecx
bsr rbp, r12
jmp 0x14004a10c
call fcn.1400498f9
bsr r13d, ecx
je 0x1400496a1
mov r14b, 0x3b
jmp 0x1400496a4
mov r14b, 0x3b
call fcn.140049663
push word [rsp]
jmp 0x140049743
mov dword [rsp], ecx
call fcn.1400496e4
mov byte [rsp + 3], dl
push word [rsp + 0xb]
jmp 0x1400497af
lea rsp, [rsp + 5]
lea rsp, [rsp + 3]
mov qword [rsp], r8
call fcn.140049784
rcl byte [rbx - 0x36]
jmp 0x14004976c
mov word [rsp + 7], si
push word [rsp + 5]
jge 0x140049782
lea rsp, [rsp + 5]
lea rsp, [rsp + 3]
mov qword [rsp], r8
jmp 0x14004977a
jb 0x1400494c8
jae 0x1400494c8
dec r10b
mov dx, 0xbd68
clc
not r12b
xchg qword [rsp], rsi
mov r12d, 0x63595b47
jmp 0x14004a745
mov r15, rbp
call 0x14004a671