Function at 0x1165cd0
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol dh, cl
bswap edx
jmp 0x1165d24
mov dx, 0x13c0
lea eax, [ecx + edi]
push ebp
lea ebp, [edi*4]
jmp 0x1165d4a
mov dl, al
mov dx, si
mov dword [esp], eax
cmc
mov eax, dword [esp]
rdtsc
jmp 0x1165d0e
lea ebp, [esi + ebp]
lea eax, [ebp*4]
clc
mov dx, 0x7ac8
jmp 0x1165d5c
push dx
bswap eax
btc dx, si
mov ebp, dword [esp]
cld
add ax, 0xda86
jmp 0x1165d34
add esp, 1
mov ah, byte [esp]
rdtsc
mov eax, 0xa615d7a7
bswap eax
lea eax, [esi*4]
jmp 0x1165e33
mov byte [esp], ch
push edi
bsf edx, edx
mov dh, bh
mov dh, 0x8e
mov dx, 0xa81b
jmp 0x1165e00
add edx, ebp
not ax
mov byte [esp], ah
mov dl, bh
cld
xchg byte [esp], dh
jmp 0x1165d98
cmp edx, 0xf20fe96d
neg ah
mov dl, ch
bsr dx, di
jmp 0x1165de4
stc
xchg byte [esp], al
mov edx, ebp
mov dx, 0x40d
dec dh
rdtsc
jmp 0x1165dbe
add esp, 0
mov dh, 0x11
push ax
xchg word [esp], ax
stc
sub eax, 0xb7e8c304
jmp 0x1165e14
xchg word [esp + 1], bp
bt ax, sp
bsf ebp, edx
xchg byte [esp + 2], dl
pop edx
clc
jmp 0x1165dd4
mov eax, dword [esp]
xchg byte [esp], dh
bsf edx, ebx
std
lea ebp, reloc.kernel32.dll_WriteFile
rdtsc
jmp 0x1165e89
mov dx, 0xb626
mov ax, word [esp]
rdtsc
xchg byte [esp], dh
rcl ah, 3
mov dx, bp
jmp 0x1165dae
mov eax, esp
cld
sub esp, 8
xchg byte [esp + 6], dh
mov eax, dword [esp + 4]
jmp 0x1165ec9
mov bp, 0xe48b
mov edx, ebp
mov dl, ah
bt ax, bp
xchg dh, dl
setne al
jmp 0x1165e4b
xchg edx, eax
std
pop ax
bsr dx, si
bswap ebp
clc
jmp 0x1165e61
mov byte [esp + 0x16], al
mov dword [esp + 0x1a], eax
mov edx, dword [esp + 0xe]
xchg al, ah
jmp 0x1165edb
sub esp, 0x11
neg al
rol dh, cl
xchg dword [esp + 0x14], eax
xchg dx, ax
mov byte [esp + 0x1d], dh
jmp 0x1165e96
mov ax, dx
sub esp, 0x11
pop ebp
xchg dh, al
pop word [esp + 1]
xor dh, bh
jmp 0x1165eac
btr edx, edi
mov edx, dword [esp + 0x11]
mov ebp, edx
xchg byte [esp + 3], al
mov eax, 0xe194151f
clc
jmp 0x1165f1c
push dword [esp + 0x24]
neg ebp
neg dx
lea ebp, [ebp*4]
jmp 0x1165f7d
sub esp, 0x15
not dx
xchg dword [esp], eax
adc dx, bx
pop ax
mov al, byte [esp + 0x37]
jmp 0x1165f06
mov dh, byte [esp + 0x20]
btr ebp, esp
mov ax, word [esp + 0x23]
stc
jmp 0x1165f59
xchg dword [esp + 0x2a], eax
pop edx
lea edx, reloc.kernel32.dll_WriteFile
bswap eax
push di
neg dh
jmp 0x1165f30
xchg word [esp + 0x34], dx
add esp, 0x1b
bswap eax
mov word [esp + 5], di
mov ax, word [esp + 0xe]
mov dword [esp + 0x14], eax
jmp 0x1165fba
push di
lea esp, [esp + 7]
mov word [esp + 0x2f], sp
push dword [esp + 0x32]
mov word [esp + 0xf], ax
push bp
jmp 0x1165f46
lea edx, [ecx*4]
mov eax, 0xf2aba563
mov word [esp], si
rcl eax, cl
rdtsc
push word [esp + 0x12]
jmp 0x1165fe8
mov ax, word [esp + 0xc]
pop dword [esp + 8]
mov ebp, 0x99e292d1
clc
xchg dword [esp + 0x15], ebp
lea eax, [ecx + ebx]
jmp 0x1165f95
pop dx
rdtsc
neg ax
mov ah, dl
mov dword [esp + 5], esi
xchg ah, dh
jmp 0x116641a
xchg edx, ebp
mov bp, 0x5e6d
lea eax, [ebx*4]
mov word [esp + 9], sp
jmp 0x1165fd2
mov dl, byte [esp + 6]
mov dl, 0x19
sub esp, 0x18
lea edx, [esi + ebp]
adc ax, 0x10f1
call fcn.0116605d
mov word [esp + 6], si
seto ah
xchg edx, eax
rcl al, 2
pop ax
pop eax
jmp 0x11660f1
mov word [esp + 6], dx
rcl ah, 3
cld
push dword [esp + 4]
shr al, 2
rdtsc
jmp 0x11661c8
lea ebp, reloc.kernel32.dll_WriteFile
cld
dec dl
pop bp
pop ax
jmp 0x116618e
add esp, 0xa
std
sub esp, 0x15
add esp, 8
mov eax, edi
sub esp, 0x1c
jmp 0x1166128
rdtsc
cld
mov ax, word [esp + 8]
pop dword [esp + 5]
mov eax, 0x6196288b
shl dl, 6
jmp 0x116613e
mov dh, 0x4e
bsr bp, di
xchg word [esp + 0x35], dx
push dword [esp + 0x20]
jmp 0x11661a2
add esp, 0x11
xchg dx, ax
bt edx, edi
pushal
or dl, 0x52
mov eax, 0xeb19dfe9
jmp 0x1166178
rdtsc
add esp, 0x18
cmc
mov ax, 0xf7b5
lea edx, [eax + eax]
mov dh, 0x9c
jmp 0x11661fc
xchg dword [esp + 1], eax
mov ah, byte [esp]
mov bp, word [esp + 0xf]
xchg byte [esp + 8], dh
mov ah, byte [esp + 0xe]
mov word [esp + 9], si
jmp 0x1166162
btc ebp, ebx
pop eax
pop word [esp + 1]
inc ax
inc eax
mov word [esp + 2], bp
jmp 0x1166230
push esp
lea edx, [esi*4]
push dword [esp + 0x15]
rdtsc
pop dword [esp + 0x24]
pop eax
jmp 0x11661e6
mov eax, 0x384a55cf
not ebp
xchg dword [esp + 0xb], eax
pop dword [esp + 2]
mov bp, 0x8d74
mov ah, byte [esp + 3]
jmp 0x1166362
mov bp, 0x5e57
neg dh
mov dx, word [esp + 0x1a]
mov ah, byte [esp + 0x15]
ror bp, cl
setg al
jmp 0x1166211
mov edx, dword [esp + 0x17]
mov edx, dword [esp + 0xd]
mov ebp, 0x8f5e0755
add eax, esp
bswap eax
xchg dword [esp + 0x11], eax
call fcn.01166291
je 0x11661f0
lea eax, reloc.kernel32.dll_WriteFile
add eax, 0x584ca0e8
shl ebp, cl
setge dl
lea eax, [eax + edi]
mov dl, byte [esp + 0xf]
mov bp, word [esp + 2]
jmp 0x1166247
mov dh, byte [esp + 0x17]
lea ebp, reloc.kernel32.dll_WriteFile
mov al, 0xfa
mov dword [esp + 0xa], esp
mov eax, 0x9394e92f
btc edx, ebx
jmp 0x1166262
cld
neg ax
cld
mov al, byte [esp]
mov ax, 0xfda0
lea ebp, reloc.kernel32.dll_WriteFile
jmp 0x11660b0
rdtsc
mov dword [esp + 3], esi
xchg al, ah
pop word [esp + 0xa]
mov al, byte [esp + 6]
mov dword [esp + 0x14], edx
jmp 0x11663d6