Function at 0x140092fc0
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov qword [rsp + 0x98], rcx
rdtsc
mov rcx, rdx
shl rcx, 0x20
or rcx, rax
rdtsc
shl rdx, 0x20
or rdx, rax
cmp rcx, rdx
mov eax, 0x10d0f65b
mov r15d, 0xdc880f53
cmove r15d, eax
mov eax, dword [rsp + 0x64]
mov ebp, r15d
xor ebp, 0x2377f0ad
mov ecx, r15d
xor ecx, 0xb6472bf5
mov edx, dword [rsp + 0x64]
xor edx, ecx
add edx, eax
imul edx, ebp
mov r8d, dword [rsp + 0x64]
or r8d, ecx
mov esi, r15d
xor esi, 0xdc880f50
imul r8d, esi
mov r9d, dword [rsp + 0x64]
not r9d
or r9d, ecx
mov eax, r15d
xor eax, 0x49b8d40a
mov r12d, r15d
xor r12d, 0xdc880f52
add eax, r12d
add eax, r8d
add eax, edx
sub eax, r9d
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
cmp r8d, edx
je 0x1400930cb
movzx eax, word [rsp + 0x42]
xor ax, r15w
xor eax, 0x3383
mov ecx, r15d
xor ecx, 0xf52
movzx edx, word [rsp + 0x42]
not edx
add edx, eax
imul edx, ecx
mov eax, r15d
xor eax, 0x3382
mov ecx, r15d
xor ecx, 0xcc7c
or cx, word [rsp + 0x42]
mov r8d, r15d
xor r8d, 0xf51
imul r8d, ecx
mov ecx, r15d
xor ecx, 0xf14
add ecx, eax
add ecx, r8d
add ecx, edx
mov word [rsp + 0x68], cx
mov edx, r15d
xor edx, 0x612786a8
mov ecx, dword [rsp + 0x60]
xor ecx, edx
mov eax, r15d
xor eax, 0xa7d71ca5
mov r8d, dword [rsp + 0x60]
not r8d
mov r13d, r15d
xor r13d, 0xdc880f51
imul r8d, r13d
mov r9d, dword [rsp + 0x60]
not r9d
or r9d, edx
mov edx, r15d
xor edx, 0x2377f0ae
imul edx, r9d
add edx, r8d
mov r8d, r15d
xor r8d, 0x9ed87957
or r8d, dword [rsp + 0x60]
imul r8d, r12d
add eax, r12d
sub eax, ecx
add eax, edx
add eax, r8d
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
cmp r8d, edx
je 0x1400931a8
mov ecx, r15d
xor ecx, 0xb0a2
and cx, word [rsp + 0x40]
mov eax, r15d
xor eax, 0xf51
imul eax, ecx
mov ecx, r15d
xor ecx, 0x4f5d
movzx edx, word [rsp + 0x40]
or dx, cx
mov r8d, r15d
xor r8d, 0x4f5c
movzx r9d, word [rsp + 0x40]
not r9d
or r9d, ecx
mov ecx, r15d
xor ecx, 0xf52
imul ecx, r9d
mov r9d, r15d
xor r9d, 0xf21
add r9d, r8d
sub r9d, edx
add r9d, ecx
add r9d, eax
mov word [rsp + 0x6a], r9w
mov ecx, r15d
xor ecx, 0xcd4599d
mov edx, dword [rsp + 0x80]
xor edx, ecx
mov r8d, dword [rsp + 0x80]
or r8d, ecx
mov eax, r15d
mov r9d, r15d
xor r9d, 0xf32ba662
or r9d, dword [rsp + 0x80]
xor eax, 0x83cf5d31
add r9d, edx
or ecx, 1
add eax, r12d
add eax, ecx
add eax, r8d
sub eax, r9d
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
cmp r8d, edx
je 0x140093262
movzx ecx, word [rsp + 0x3e]
mov eax, r15d
xor eax, 0xf52
mov edx, r15d
xor edx, 0xffffc135
mov r8d, r15d
xor r8d, 0x3ec9
movzx r9d, word [rsp + 0x3e]
or r9w, r8w
not r9d
mov r10d, r15d
xor r10d, 0x6c65
add r10d, edx
and r8w, word [rsp + 0x3e]
not r8d
mov edx, r15d
xor edx, 0xf21
add edx, r10d
add r9w, cx
add r9d, r8d
imul r9d, eax
add r9d, edx
mov word [rsp + 0x6c], r9w
mov ecx, dword [rsp + 0x5c]
not ecx
mov edx, r15d
xor edx, 0xb8701594
and ecx, edx
mov eax, r15d
xor eax, 0xea87c520
mov r8d, dword [rsp + 0x5c]
or r8d, edx
mov r9d, dword [rsp + 0x5c]
not r9d
or r9d, edx
add r9d, ecx
add r9d, r8d
and edx, dword [rsp + 0x5c]
imul r9d, r12d
add eax, r12d
add eax, edx
add eax, r9d
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
cmp r8d, edx
je 0x140093329
movzx edx, word [rsp + 0x3c]
not edx
mov r8d, r15d
xor r8d, 0xc704
and edx, r8d
mov eax, r15d
xor eax, 0xfffff0ae
mov r9d, r15d
xor r9d, 0xffffc70b
mov ecx, r15d
xor ecx, 0xf3c
add ecx, r9d
sub cx, word [rsp + 0x3c]
imul eax, edx
movzx edx, word [rsp + 0x3c]
xor dx, r8w
mov r9d, r15d
xor r9d, 0xf51
imul r9d, edx
movzx edx, word [rsp + 0x3c]
not edx
or edx, r8d
mov r8d, r15d
xor r8d, 0xf52
imul r8d, edx
add ecx, eax
add ecx, r8d
add ecx, r9d
mov word [rsp + 0x6e], cx
mov ecx, dword [rsp + 0x7c]
imul ecx, r12d
mov eax, r15d
xor eax, 0x916bab9b
mov edx, dword [rsp + 0x7c]
xor edx, eax
mov r8d, dword [rsp + 0x7c]
or r8d, eax
imul r8d, ebp
or eax, 1
add eax, edx
add eax, ecx
add eax, r8d
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
cmp r8d, edx
je 0x1400933d2
mov ecx, r15d
xor ecx, 0xee0
movzx eax, word [rsp + 0x3a]
and ax, cx
movzx edx, word [rsp + 0x3a]
xor dx, cx
mov r8d, r15d
xor r8d, 0xf52
mov r9d, r15d
xor r9d, 0xfffff11f
movzx r10d, word [rsp + 0x3a]
not r10d
or r10d, ecx
add r10d, edx
imul r10d, r8d
movzx edx, word [rsp + 0x3a]
and dx, cx
not edx
mov ecx, r15d
xor ecx, 0xfffff0ad
imul ecx, edx
mov edx, r15d
xor edx, 0xf21
add edx, r9d
sub edx, eax
add edx, ecx
add edx, r10d
mov word [rsp + 0x70], dx
mov ecx, dword [rsp + 0x58]
not ecx
mov eax, r15d
xor eax, 0xc6789e8d
and ecx, eax
mov edx, r15d
xor edx, 0x39876172
and edx, dword [rsp + 0x58]
add ecx, dword [rsp + 0x58]
imul edx, r13d
mov r8d, dword [rsp + 0x58]
not r8d
or r8d, eax
imul r8d, r12d
mov eax, r15d
xor eax, 0xc6789e8c
add eax, r12d
sub eax, ecx
add eax, r8d
add eax, edx
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
cmp r8d, edx
je 0x14009342e
mov word [rsp + 0x72], 0
mov rdi, qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rbx, [rsp + 0xd0]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call rdi
lea r14, [rsp + 0xc0]
mov rcx, r14
mov rdx, qword [rsp + 0x98]
call rdi
mov eax, r15d
xor eax, 0x512a8c51
mov ecx, dword [rsp + 0x54]
and ecx, eax
imul ecx, r12d
mov edx, dword [rsp + 0x54]
not edx
and edx, eax
imul edx, r13d
mov r8d, dword [rsp + 0x54]
xor r8d, eax
mov r9d, r15d
xor r9d, 0xaed573ae
mov r10d, dword [rsp + 0x54]
not r10d
or r10d, eax
add r10d, r8d
add r9d, r12d
add r9d, edx
add r9d, ecx
sub r9d, r10d
mov dword [rsp + 0x84], r9d
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], rbx
mov ecx, r15d
movabs r8, 0xbc4674076db1edfa
xor r8, rcx
movabs rdx, 0x43b98bf8924e1204
xor rdx, rcx
mov eax, 0xdc880f43
mov r9, rcx
xor r9, rax
add r9, rdx
sub r9, qword [rsp + 0x90]
mov r10, qword [rsp + 0x90]
xor r10, r8
mov r11, qword [rsp + 0x90]
not r11
movabs rdx, 0xffffffff2377f0ad
xor rdx, rcx
imul r11, rdx
add r11, r10
add r11, r9
mov r9, qword [rsp + 0x90]
not r9
or r9, r8
lea r8, [rax + 0xe]
xor r8, rcx
imul r9, r8
add r9, r11
mov qword [rsp + 0xb0], r9
lea r9, [rax + 0xf]
xor r9, rcx
imul r9, qword [rsp + 0x88]
movabs r10, 0x6e484d8f74f27e25
movabs r11, 0x91b7b2708b0d81d9
xor r11, rcx
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x88]
xor rbx, rcx
add rax, 0x1900
xor rax, rcx
xor rcx, r10
xor rdi, r11
inc r10
xor r10, rbx
imul r10, rdx
mov rdx, qword [rsp + 0x88]
not rdx
or rdx, r11
imul rdx, r8
add rax, rcx
add rax, r9
sub rax, rdi
add rax, r10
add rax, rdx
mov qword [rsp + 0xb8], rax
mov eax, r15d
xor eax, 0x695da088
mov edx, dword [rsp + 0x50]
and edx, eax
mov r8d, dword [rsp + 0x50]
or r8d, eax
mov ecx, dword [rsp + 0x50]
not ecx
add ecx, r8d
mov r8d, r15d
and eax, dword [rsp + 0x50]
xor r8d, 0x96a25f77
not eax
imul eax, ebp
mov r9d, r15d
xor r9d, 0x8c880f4b
add r9d, r8d
sub r9d, edx
imul ecx, r12d
add ecx, r9d
add ecx, eax
mov eax, r15d
xor eax, 0xa2971d13
mov edx, dword [rsp + 0x4c]
and edx, eax
mov r8d, r15d
xor r8d, 0x5d68e2ec
mov r9d, dword [rsp + 0x4c]
and r9d, r8d
add r9d, edx
mov edx, dword [rsp + 0x4c]
or edx, eax
imul edx, r12d
and eax, dword [rsp + 0x4c]
mov r10d, r15d
xor r10d, 0xdc880f57
add r10d, r8d
sub r10d, r9d
add r10d, eax
add edx, r10d
inc edx
mov eax, r15d
xor eax, 0x7530602e
mov r8d, dword [rsp + 0x48]
xor r8d, eax
imul r8d, ebp
mov r9d, dword [rsp + 0x48]
or r9d, eax
imul r9d, r12d
mov r10d, r15d
mov r11d, dword [rsp + 0x48]
not r11d
or r11d, eax
and eax, dword [rsp + 0x48]
xor r10d, 0x7530602d
not eax
imul eax, r13d
add esi, r10d
add esi, r8d
add esi, r9d
sub esi, r11d
add esi, eax
mov eax, r15d
xor eax, 0xb59e0d45
mov r8d, dword [rsp + 0x44]
and r8d, eax
mov r9d, dword [rsp + 0x44]
not r9d
and r9d, eax
add r9d, r8d
imul r9d, r12d
mov r8d, r15d
xor r8d, 0x4a61f2ba
lea r10d, [r12 + r8]
and r8d, dword [rsp + 0x44]
mov r11d, dword [rsp + 0x44]
not r11d
or r11d, eax
add r11d, r8d
sub r10d, r11d
add r10d, r9d
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r10d
lea r9, [rsp + 0xa0]
mov r8d, esi
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
test eax, eax
js 0x1400937ad
mov eax, dword [rsp + 0x74]
not eax
mov ecx, r15d
xor ecx, 0xe9b06672
and eax, ecx
mov edx, r15d
xor edx, 0x164f998c
xor r15d, 0x9c880f45
add r15d, edx
add r15d, dword [rsp + 0x74]
mov edx, dword [rsp + 0x74]
not edx
or edx, ecx
add edx, eax
imul edx, r12d
add edx, r15d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0x84], 0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x70], 0
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x78]
not eax
mov ecx, r15d
xor ecx, 0x781c69c3
and eax, ecx
or ecx, dword [rsp + 0x78]
mov edx, r15d
xor edx, 0x87e3963c
mov r8d, dword [rsp + 0x78]
xor r8d, edx
add r8d, eax
xor r15d, 0x9c880f45
imul r8d, r12d
add r15d, edx
add r15d, ecx
lea ecx, [r8 + r15]
inc ecx
int 0x29
int3