Function at 0x6186bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebp
jmp 0x6186c4
xchg dword [esp + 0x10], eax
push edi
mov si, dx
mov word [esp + 0x24], dx
bt edi, ebx
cpuid
jmp 0x6187eb
not cl
xchg dword [esp], edx
mov cl, byte [esp + 1]
pop word [esp]
and dx, 0x67d8
jmp 0x61873e
lea esi, [edx*4]
rdtsc
mov byte [esp], bh
cpuid
mov word [esp], bp
push dx
jmp 0x6186f5
bts si, sp
pushal
lea eax, [edx + ebp]
lea esp, [esp + 5]
bsf cx, cx
pop dword [esp + 0xc]
jmp 0x61876e
mov edi, ebx
xchg byte [esp], al
lea edx, [ecx*4]
lea ebx, reloc.ADVAPI32.DLL_RegCloseKey
rdtsc
lea esp, [esp + 1]
jmp 0x618724
mov al, 0x36
xchg word [esp + 4], bx
call fcn.00618758
push edx
push edx
jae 0x6187f5
outsd dx, dword [esi]
jb 0x6187e9
dec ebx
jns 0x6187df
add byte [edi - 0x1e514035], al
mov ah, 0xd2
xchg ebx, ecx
mov edi, 0xd2b4e1ae
dec ebp
mov byte [esp], bl
not bh
add esp, 0
jmp 0x61870e
push ebx
popal
jbe 0x61884a
dec ebx
jns 0x618840
add byte [ebp - 0x4d], cl
sub al, byte [esi - 0xe42f029]
mov bl, 0x2a
xchg bh, dl
bsr esi, ecx
rol al, 4
lea esp, [esp + 0xe]
popal
jmp 0x618789
das
and dword ss:[eax - 0x7a], esp
invalid
call fcn.0061882e
push edx
push ebx
je 0x6188ac
popal
insb byte es:[edi], dx
jne 0x6188bf
inc ebp
js 0x6188b4
add byte [ebx - 0x3e99cef1], ah
iretd
mov byte [esp], ch
push dword [esp + 1]
inc bp
setno ch
pop dword [esp]
jmp 0x6188a7
mov edx, 0xa6ed622a
lea edx, reloc.ADVAPI32.DLL_RegCloseKey
xchg dword [esp], esi
mov dh, bh
xchg byte [esp + 2], al
xchg ebp, ebx
jmp 0x618878
lea esi, [ecx + edi]
pop edx
xchg ebp, edx
sub esp, 0x19
sub esp, 0x1a
mov dx, sp
aad 0x83
in al, dx
sbb dword [ebx - 0x7499e514], eax
aam 0xeb
xor eax, 0xe24b2889
sbb eax, 0x24648d6c
add eax, 0x8324b48d
invalid
mov edx, esp
jmp 0x6188ed
and al, 5
lea esi, reloc.ADVAPI32.DLL_RegCloseKey
mov ch, byte [esp + 2]
lea esp, [esp + 1]
xchg byte [esp], bh
cld
jmp 0x61888e
add esp, 0xe
mov dword [esp + 0x10], eax
xchg dword [esp + 5], esi
xchg bx, cx
not eax
jmp 0x61891c
mov eax, 0x866e6881
setge ch
lea edx, [ecx + esi]
xor ebp, 0xe1c328b8
sub esp, 0xa
lea ebx, [ebx + ebp]
jmp 0x6188d7
mov byte [esp], dh
xchg byte [esp], bh
xchg byte [esp + 3], al
pushfd
mov eax, esi
jmp 0x61896a
lea esp, [esp + 0x26]
btc dx, ax
pop bp
mov word [esp + 4], ax
lea ebp, [esi*4]
mov dword [esp + 3], ecx
jmp 0x618906
sub esp, 0xf
btr ax, bp
lea esi, [edx*4]
xchg dl, ch
jmp 0x6189a5
xchg dword [esp + 4], edi
sete cl
push edx
setne dh
push word [esp + 0xc]
xchg byte [esp + 0xf], dl
jmp 0x618954
not cl
call fcn.006189d0
mov di, 0xc0cb
lea esi, [ebx + ebp]
popal
mov byte [esp], al
xchg ebx, eax
sub esp, 2
jmp 0x6189ba
pop dword [esp + 2]
mov ah, 0xda
pop word [esp + 6]
xchg word [esp + 1], bp
pop ebx
mov dl, 0xcc
jmp 0x618980
xchg word [esp + 6], ax
pop dword [esp]
cld
lea edi, [esi + ebp]
pop word [esp]
jmp 0x618a2d
xchg esi, edi
add esp, 0
mov word [esp], dx
push eax
mov esi, dword [esp + 2]
btr ebx, esp
jmp 0x618a66
mov dx, word [esp + 1]
mov bh, byte [esp + 2]
xchg cx, bx
not di
or ax, dx
not bp
jmp 0x618a16
cpuid
std
bsr ax, si
mov dh, byte [esp + 9]
lea esp, [esp + 0xa]
sub esp, 5
jmp 0x618a76
neg cl
push dword [esp + 2]
mov eax, ebx
xchg di, ax
xchg si, cx
std
jmp 0x618a44
neg ch
cld
push word [esp + 4]
mov dl, bl
mov dword [esp], ecx
mov ecx, edx
jmp 0x618ba8
xchg byte [esp + 6], bh
sub esp, 0x16
xor edi, ebx
rdtsc
xchg byte [esp + 3], ch
mov ebx, ebp
jmp 0x618b0a
or di, 0x4725
xchg dword [esp + 2], ebx
push word [esp + 1]
lea eax, reloc.ADVAPI32.DLL_RegCloseKey
mov bp, word [esp + 8]
mov bl, dh
jmp 0x618ab3
setae ah
mov word [esp + 0xc], bp
xchg cx, si
mov dword [esp + 0x16], esp
jmp 0x618b38
mov dx, word [esp + 0x1b]
xchg byte [esp + 0x19], bl
pop cx
inc cl
xchg word [esp + 0x14], di
mov di, 0x1e7b
jmp 0x618af4
mov bl, 0xf4
xchg si, dx
mov di, 0xcd9a
mov word [esp + 4], bx
jmp 0x618b6f
not di
cpuid
xchg word [esp + 0x10], di
pop dword [esp + 0x18]
mov word [esp + 0x15], cx
rcr ax, cl
jmp 0x618b22
neg edi
sub esp, 0x1c
bts ecx, eax
bswap esi
push dword [esp + 0xf]
rdtsc
jmp 0x618b8a
pop word [esp + 0x12]
mov eax, 0x6c438ab5
mov ebp, 0xc7848c0e
lea esp, [esp + 0xf]
sub esp, 0xa
add esp, 0xb
jmp 0x618b50
xchg si, dx
pop edx
call fcn.00619942
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x618bf9
jb 0x618bff
push ebx
je 0x618c0f
imul ebp, dword [esi + 0x67], reloc.ADVAPI32.DLL_RegCloseKey
stc
fdivr dword [ebx]
adc cl, byte [edx - 0x2a089911]
mov ch, bh
not bp
rol ch, 1
mov edi, dword [esp + 4]
lea edi, reloc.ADVAPI32.DLL_RegCloseKey
pushfd
jmp 0x618ad7
sete dh
xchg edx, edi
mov dx, 0xf559
xchg word [esp + 1], dx
mov si, di
sub esp, 0x1a
jmp 0x618c1b
mov dword [esp + 0xb], edx
adc dx, 0xb9bc
mov dl, 0x1d
mov bx, si
jmp 0x618bff
add al, 0xf7
fprem
jmp 0x618bbf
push word [esp + 0x1d]
add esp, 0x21
bswap ecx
mov esi, edx
pop si
stc
jmp 0x618cb0
popfd
add byte [eax], al
add byte [ebp + 0x6c], al
insb byte es:[edi], dx
imul esi, dword [eax + 0x73], 0xd5c00065
add eax, 0xfc28766
mov ebx, 0xbd0f66ca
hlt
rcl ch, 5
xchg dx, ax
btc edx, ecx
bsr si, sp
mov di, 0xfcbe
lea esi, [ecx + edx]
jmp 0x618bd5
xchg byte [esp + 4], bh
cld
push dword [esp + 4]
mov edx, ebx
add esp, 5
jmp 0x618c77
cpuid
neg bp
cpuid
sub esp, 8
inc si
mov ebx, esp
jmp 0x618c31
stc
push word [esp + 3]
xchg dl, ch
pop dx
xchg byte [esp + 1], bl
cpuid
jmp 0x618c88
lea edi, [esi + 0xa]
pop cx
mov si, 0xab1b
cmc
clc
mov di, 0x5410
jmp 0x618c57
mov ax, word [esp]
xchg dword [esp], eax
rdtsc
mov bx, cx
mov word [esp + 3], cx
bswap ebp
jmp 0x618cc4
cpuid
mov word [esp], bx
add esp, 1
xchg cx, si
lea esp, [esp]
lea edx, [edx + ebp]
jmp 0x618c47
mov dword [esp], edi
btc edi, ecx
xchg di, bx
btr edi, edi
mov di, word [esp]
mov bl, 3
jmp 0x618d28
cpuid
xchg word [esp + 1], si
shl dh, cl
xchg ecx, eax
cld
inc dl
jmp 0x618d59
cmp eax, 0x3550ba51
mov dh, ah
sbb dh, 0x4f
pop word [esp]
bsf edx, ebp
mov dword [esp], ebx
jmp 0x618cf0
mov bl, byte [esp + 3]
setno dh
pushfd
xchg word [esp + 7], ax
std
pop word [esp + 1]
jmp 0x618d06
xchg dword [esp], eax
push dword [esp]
mov bh, 0xff
neg si
setae al
call 0x618d3d
lea esp, [esp + 8]
popal
sub esp, 0x1f
pop word [esp + 8]
jmp 0x618dad
mov byte [esp + 6], bl
lea esp, [esp + 0x19]
call fcn.00618d97
inc esi
imul ebp, dword [esi + 0x64], 0x6f736552
jne 0x618e36
arpl word [ebp + 0x57], sp
add byte [ebp - 0xc], al
push cx
mov dword [esp + 5], ebx
lea edx, reloc.ADVAPI32.DLL_RegCloseKey
call fcn.00618ce4
add byte [ebp + 0x61082464], cl