Function at 0x1408c46ac
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Get kernel32 base address

Disassembly:
push rbp
movzx bp, r12b
push rbx
sbb bx, r12w
push rsi
sal r8w, cl
shl ebx, 0xb0
jmp 0x1408c46c5
push rdi
sar dil, 0xe5
bts bp, r10w
push r12
and r8d, 0x62dd7db1
push r13
xor dil, 0x2d
push r14
ror bh, cl
setb bl
push r15
btc rdi, rsi
lea rbp, [rsp - 0x48]
sub rsp, 0x148
xor rdi, 0x6fe90e3f
rol r8b, cl
shl r8b, cl
mov rbx, rcx
mov edi, 0x40
add r8b, 0xce
ror ch, cl
rcl r8d, 0x4e
mov r8d, edi
lea rcx, [rbp]
sub edx, edx
jmp 0x1408c4724
call fcn.1408c78c6
mov rcx, qword [rbx]
movzx r9, di
mov r9b, dil
xor r8d, 0xc4b3f4a
lea r8, [rbp]
xor r9b, spl
xor r9b, 0xf8
neg r9
xor r13d, r13d
cmp al, r9b
movsx r9d, bx
sub r9d, 0x5efd3c92
mov qword [rbp], rdi
cmp sp, bx
mov r9d, edi
mov qword [rbp + 0xa8], r13
xor edx, edx
jmp 0x1408c4771
mov qword [rsp + 0x20], r13
jmp 0x1408c477b
call fcn.1405aea07
lea r12d, [rdi - 0x3f]
stc
shl dh, cl
bts dx, di
mov edx, eax
test eax, eax
js 0x1408c47b2
mov ecx, dword [rbp + 0x38]
jmp 0x1408c479e
shr ecx, 1
cmp r10, 0x3bfd44d1
test r9, r10
and cl, r12b
jmp 0x1408c47f8
mov rcx, qword [rbx]
setno dl
lea r8, [rbp + 0xa8]
mov r9d, 8
cmovne rdx, r14
cwd
mov qword [rsp + 0x20], r13
jmp 0x1408c47d8
lea edx, [r9 + 0x12]
jmp 0x1408c47e1
call fcn.1400f4eb6
cmp qword [rbp + 0xa8], r13
mov edx, r13d
setne cl
test bp, 0x4acb
test edx, edx
jmp 0x1408c47ff
js 0x1408c4ec5
test cl, cl
jmp 0x1408c480c
je 0x1408c4f39
mov rcx, rbx
jmp 0x1408c481a
call fcn.1408c5067
mov qword [rbp + 0xa0], r13
not r15d
cwde
rol r15b, cl
rdtsc
rcl r15b, 0x2c
cmp bp, r9w
shr r15b, cl
shl rdx, 0x20
bts r8w, r14w
movsx r8, r9w
xor dil, 8
lea r15, [rbx + 0x138]
adc ecx, 0x13c257b5
rcr rsi, 0xf0
cmp ebx, r10d
or rax, rdx
bts si, di
cwd
mov dword [rsp + 0x48], 0x20
movsx si, sil
mov rcx, rax
mov rsi, 0x762d3132
cdq
mov dword [rsp + 0x40], r13d
rcr sil, cl
mov rdx, rax
ror rax, cl
rcr dil, cl
stc
ror rcx, 3
cbw
xor rdx, rcx
sar r8b, 0x11
sub rcx, rax
add cl, 0xbf
movabs rsi, 0x7010008004002001
not r8b
cmp bl, r13b
mov rcx, qword [rbx + 0x108]
sar eax, 0x9e
mov rax, rsi
shl di, cl
ror r8, cl
movzx r8d, r12w
mul rdx
bt r8w, si
inc r8b
mov edi, 2
xor r9d, r9d
bt r8, r14
clc
xor rdx, rax
sar ah, cl
cmovne eax, ebx
cmp cl, 0x36
mov dword [rsp + 0x38], edi
and edx, 7
lea rax, [rbp + 0x98]
mov qword [rsp + 0x30], rax
add rdx, 8
rcl r8, cl
cmp bpl, 0x1c
movsx r8, di
shl rdx, 0xc
movsx r8d, r8w
lea rax, [rbp + 0xa0]
movsxd r8, eax
jmp 0x1408c4928
mov qword [rbp + 0x98], rdx
movsx r8w, spl
movzx rdx, r15w
movsxd rdx, ebp
mov r8, r15
mov dx, 0x7fcf
movzx dx, r8b
movsx rdx, bx
mov rdx, qword [rbx]
jmp 0x1408c4953
mov qword [rsp + 0x28], rax
jmp 0x1408c495d
mov qword [rsp + 0x20], r13
call fcn.14018a9dc
mov ecx, eax
cmc
test eax, eax
js 0x1408c4fa8
mov rax, qword [rbp + 0x98]
bt r8w, 0xc7
bt edx, esp
mov qword [rbx + 0x140], rax
mov qword [rbp + 0xa0], 0x10000
rdtsc
shl r8b, cl
btc cx, cx
and r8b, r9b
shl rdx, 0x20
lea r8, [rbx + 0x130]
sal ch, cl
xchg cx, cx
or rax, rdx
mov dword [rsp + 0x48], 4
rol ch, 0x9b
cqo
mov ecx, r9d
mov rcx, rax
clc
btc rdx, 0x6f
btr dx, r8w
mov dword [rsp + 0x40], r13d
rcl dl, cl
bswap edx
mov rdx, rax
bts rax, r15
mov ax, di
ror rcx, 3
xor rdx, rcx
mov dword [rsp + 0x38], edi
mov rcx, qword [rbx + 0x108]
bts ax, ax
test r10w, 0x1af3
mov rax, rsi
cmc
test cl, ah
cmp r14b, 0x53
mul rdx
xor r9d, r9d
stc
test ax, 0x4f10
xor rdx, rax
lea rax, [rbp + 0x98]
clc
test r11b, 0x8a
cmp r11b, r15b
and edx, 7
mov qword [rsp + 0x30], rax
rcl eax, cl
setl ah
add rdx, 8
lea rax, [rbp + 0xa0]
cmp r8b, 0xf5
shl rdx, 0xc
jmp 0x1408c4a4c
mov qword [rbp + 0x98], rdx
movsx rdx, r10w
mov dl, 0xde
mov rdx, qword [rbx]
jmp 0x1408c4a61
mov qword [rsp + 0x28], rax
jmp 0x1408c4a6b
mov qword [rsp + 0x20], r13
jmp 0x1408c4a75
call fcn.1406fbc93
mov ecx, eax
test eax, eax
jmp 0x1408c4a83
js 0x1408c5005
mov rcx, qword [rbx + 0x118]
mov qword [rbx + 0x128], rcx
bts r14w, r8w
sar r14d, cl
bts eax, edx
add rcx, qword [rbp + 0xa0]
test r14, rsp
mov qword [rbx + 0x120], rcx
test r13b, 0xed
sal ch, cl
mov rax, qword gs:[0x60]
shrd cx, r14w, 0x79
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
sal cl, cl
rol cx, 0xd1
mov cl, dl
mov rcx, qword [rax]
mov r14, qword [rcx + 0x30]
jmp 0x1408c4ae9
test r14, r14
jne 0x1408c4afa
mov rcx, r13
jmp 0x1408c4b09
movsxd rcx, dword [r14 + 0x3c]
jmp 0x1408c4b06
add rcx, r14
call fcn.140007ca0
mov rsi, rax
stc
test edx, esi
test rax, rax
jmp 0x1408c4b1c
je 0x1408c4c0a
mov r8d, dword [rax + 0x10]
test r8d, r8d
jmp 0x1408c4b2e
jne 0x1408c4b39
mov r8d, dword [rax + 8]
stc
rdtsc
bt r9d, 0xe3
sal r9w, 0x49
neg di
mov r9, qword [rbx + 0x140]
shr cx, cl
bsf rcx, rsp
not di
movabs r10, 0x7010008004002001
shr di, 0xad
mov rdi, qword [rbx + 0x128]
shl rdx, 0x20
adc cx, 0x47
and ecx, r14d
or rax, rdx
mov rcx, rax
mov rdx, rax
ror rcx, 3
rcl eax, cl
mov rax, r10
cmc
jmp 0x1408c4b92
xor rdx, rcx
or cl, 0x48
movzx ecx, bx
add cx, r13w
mov ecx, r8d
mul rdx
sub rcx, r9
xor rax, rdx
sub rcx, 0x10
test bl, sil
xor edx, edx
div rcx
not ah
add al, ah
movsxd rax, eax
mov eax, dword [rsi + 0xc]
add rdx, rax
and rdx, 0xfffffffffffffff0
lea rdx, [rdx + r14]
test rdi, rdi
jmp 0x1408c4bd4
je 0x1408c4c32
test rdx, rdx
jmp 0x1408c4be2
je 0x1408c4c32
test r9, r9
je 0x1408c4c32
mov rsi, rdx
not cl
mov rcx, r9
jmp 0x1408c4bfe
rep movsb byte [rdi], byte [rsi]
jmp 0x1408c4c05
jmp 0x1408c4c32
mov edx, dword [rbx + 0x140]
not ecx
movsx cx, dil
mov rcx, qword [rbx + 0x128]
jmp 0x1408c4c23
call fcn.1408a25b5
movabs r10, 0x7010008004002001
rdtsc
cmp si, cx
shl rdx, 0x20
sub cx, 0x2e02
sbb ch, 0x8c
xchg cl, cl
or rax, rdx
stc
bts rcx, rbp
mov rcx, rax
movsx dx, bl
bswap dx
ror dh, 0xd6
mov rdx, rax
ror rax, 0xb4
xchg al, ah
movzx ax, r8b
ror rcx, 3
movzx eax, r12w
sal ah, cl
mov rax, r10
xor rdx, rcx
mov rcx, qword [rbx + 0x140]
mul rdx
cmp r13b, r10b
cmc
sub rcx, 0x2000
xor rax, rdx
cmc
jmp 0x1408c4c97
sub edx, edx
clc
jmp 0x1408c4ca0
div rcx
movsx rcx, r15w
shrd rcx, rdi, 0x55
bsr ecx, dword [r15]
cmc
add rdx, 0x1000
jmp 0x1408c4cc2
shl r12d, cl
and rdx, 0xfffffffffffffff0
jmp 0x1408c4cce
mov rcx, rbx
jmp 0x1408c4cd6
mov qword [rbx + 0x158], rdx
jmp 0x1408c4ce2
mov dword [rbx + 0x170], r12d
jmp 0x1408c4cee
call fcn.1408c596f
mov rcx, qword [rbx + 0x120]
movzx rdx, r14w
jmp 0x1408c4d03
mov edi, 0x2e8
add rcx, rdi
mov dx, r11w
mov edx, 0x4000
jmp 0x1408c4d19
call fcn.1408a25b5
mov eax, dword [rbx + 0x170]
sar rcx, 0x5e
mov rcx, qword [rbx + 0x120]
cmp r14d, eax
not eax
cmp sil, 0x4e
and dword [rdi + rcx], eax
add rdi, 4
test rax, 0x245f02fd
cmp rdi, 0x42e8
jb 0x1408c4d1e
mov r8, qword [rbx + 0x120]
inc r9b
clc
lea rax, [rsp + 0x50]
btr cx, ax
mov rdx, qword [rbx + 0x148]
add r8, 0x160
not rcx
jmp 0x1408c4d7c
mov rcx, qword [rbx]
movzx r9w, r10b
bswap r9
mov r9d, 0x188
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x20], rax
call fcn.1405423b0
mov ecx, eax
jmp 0x1408c4da3
test eax, eax
jmp 0x1408c4daa
js 0x1408c4e75
mov rax, qword [rbx + 0x120]
jmp 0x1408c4dc0
mov rcx, qword [rbx + 0x150]
sal r13w, 0xfc
dec dil
add rcx, qword [r15]
or r14w, 0xe9d
not r13b
rcr bpl, 0xb
mov qword [rax + 0x160], rcx
movsx r13w, r14b
sbb bp, 0x75cd
jmp 0x1408c4df5
mov rcx, qword [rbx + 0x120]
or ax, bp
sbb r12b, 0xb0
mov dil, 0xe4
mov rax, qword [rbx + 0x148]
mov qword [rcx], rax
add ah, 0xd3
bts ecx, eax
cmc
mov rcx, qword [rbx + 0x120]
rcr dil, cl
setp bh
dec bh
mov rax, qword [r15]
neg dil
mov qword [rcx + 8], rax
bt r14w, r9w
cmc
add rsp, 0x148
movsx esi, si
jmp 0x1408c4e45
pop r15
pop r14
movsx bx, dil
pop r13
not r12w
pop r12
movzx rdi, sp
movzx bx, bpl
movsx ebp, r8w
pop rdi
movsx rbp, bp
mov bpl, dil
not rsi
pop rsi
pop rbx
mov bpl, spl
pop rbp
ret
sub eax, eax
mov dword [rbp - 0xc], ecx
mov qword [rbp - 0x20], rax
lea rdx, [0x140068a88]
xchg ch, cl
movzx rcx, r8w
movsx ecx, sp
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x28]
movzx ax, r15b
setle al
lea rax, [0x14005b4d8]
jmp 0x1408c4eaa
mov dword [rbp - 0x10], 0xd0001b06
mov qword [rbp - 0x28], rax
jmp 0x1408c4eba
call 0x14032d402
int3
xor eax, eax
mov dword [rsp + 0x74], edx
cwd
jmp 0x1408c4ed5
mov qword [rsp + 0x60], rax
movsx rcx, sp
not cl
lea rdx, [0x140068a88]
not cx
movsx ecx, cx
movzx rcx, r14w
mov qword [rsp + 0x68], rax
movsxd rcx, r10d
lea rcx, [rsp + 0x58]
mov al, r15b
movsx ax, bpl
cmovbe ax, r9w
lea rax, [0x14005b4d8]
jmp 0x1408c4f17
mov dword [rsp + 0x70], 0xd0001b15
jmp 0x1408c4f24
mov qword [rsp + 0x58], rax
jmp 0x1408c4f2e
call 0x1401e60c2
int3
sub eax, eax
jmp 0x1408c4f42
mov dword [rbp - 0x70], 0xd0001500
mov rcx, 0x682d2c1f
setge dl
bswap ecx
mov qword [rbp - 0x80], rax
movsx rcx, r14w
lea rdx, [0x140068a88]
setbe cl
mov rcx, r15
mov qword [rbp - 0x78], rax
movzx rax, sp
sets al
mov ax, 0x4d9d
lea rcx, [rsp + 0x78]
lea rax, [0x14005b4d8]
jmp 0x1408c4f8a
mov dword [rbp - 0x6c], r13d
jmp 0x1408c4f93
mov qword [rsp + 0x78], rax
jmp 0x1408c4f9d
call 0x140298fe9
int3
xor eax, eax
mov dword [rbp - 0x4c], ecx
cwd
movsx ecx, r14w
mov qword [rbp - 0x60], rax
movzx dx, sil
movzx rdx, dx
xchg rcx, rcx
lea rdx, [0x140068a88]
mov qword [rbp - 0x58], rax
movzx cx, r14b
cbw
lea rcx, [rbp - 0x68]
lea rax, [0x14005b4d8]
jmp 0x1408c4fe5
mov dword [rbp - 0x50], 0xd0001d01
jmp 0x1408c4ff1
mov qword [rbp - 0x68], rax
jmp 0x1408c4ffa
call 0x140457cbd
int3
sub eax, eax
cwd
movsx edx, r12w
mov dword [rbp - 0x2c], ecx
bswap dx
xchg ch, dl
cdq
mov qword [rbp - 0x40], rax
xchg dl, ch
setp dh
mov cl, sil
lea rdx, [0x140068a88]
bswap ecx
mov cl, 0x10
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x48]
mov ax, 0xaa6
mov ah, bl
lea rax, [0x14005b4d8]
jmp 0x1408c5047
mov dword [rbp - 0x30], 0xd0001d01
jmp 0x1408c5053
mov qword [rbp - 0x48], rax
jmp 0x1408c505c
call 0x14049a825
int3