Function at 0x765592
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
push eax
jmp 0x760005
call fcn.0076000a
call 0x7640da
jmp 0x7656bf
movzx ebx, word [eax + 0x3c]
jmp 0x7656a9
xchg di, cx
xchg ebx, ebp
mov ebp, dword [esp]
mov bx, 0xc55
bswap ecx
not ebp
jmp 0x76547f
mov cx, 0x5c39
stc
inc dl
ror ecx, 0xb
add esp, 0
add esp, 0
jmp 0x76519a
mov byte [esp], bh
btr ebp, edx
mov esi, ebp
sete ah
cpuid
rdtsc
jmp 0x765248
lea ebp, [edx + edi]
neg ecx
sete ch
mov al, ah
btc ecx, edi
mov ah, byte [esp]
jmp 0x7651d4
mov word [esp], bx
mov cl, ch
add esp, 1
mov esi, dword [esp]
sub bx, 0xf328
mov dx, 0x9d7f
jmp 0x7651eb
xchg bh, cl
and edx, ecx
mov di, 0x40af
mov eax, 0x517f9ce0
cpuid
call fcn.0076525a
imul esp, ecx, 0x71
adc bl, ah
xor eax, 0xd7b022ab
and cl, ch
jecxz 0x765260
jne 0x7652ac
lea esp, [esp]
rdtsc
add esp, 0
xchg di, si
btc eax, edi
mov ebp, eax
jmp 0x765224
dec esp
and al, 0xc
mov ebx, dword [esp + 1]
mov dl, 0xc4
cpuid
xchg ah, bl
pop edi
jmp 0x7652e0
mov di, 0x8103
mov dword [esp], ebp
xchg word [esp + 1], di
add esp, 3
xchg si, di
mov byte [esp], ch
jmp 0x76520d
push word [esp + 1]
cpuid
mov byte [esp], dh
not bh
mov dl, 0x94
jmp 0x7652c6
mov ax, 0xc90b
mov bh, byte [esp + 1]
neg cx
xchg word [esp + 1], cx
mov word [esp + 2], sp
mov di, dx
jmp 0x765295
xchg byte [esp + 3], al
neg di
rdtsc
bsf di, ax
xchg byte [esp + 1], cl
clc
jmp 0x7652f8
xchg dx, si
not dh
mov ax, word [esp + 7]
mov word [esp + 3], dx
mov dword [esp + 2], esi
add esp, 3
jmp 0x7652ac
push dword [esp]
mov bp, word [esp + 6]
mov dword [esp + 7], esi
xchg byte [esp + 9], al
mov byte [esp + 9], bh
call fcn.0076532b
dec ebx
lds edx, [ebp + 0x3c]
iretd
add al, dh
mov dl, 0x2c
mov edx, dword [esp]
lea esi, [ebx*4]
push esp
lea esp, [esp]
jmp 0x76527b
lea esi, [esp + esi]
cmc
cpuid
mov dl, dh
mov bh, byte [esp]
rdtsc
jmp 0x765352
mov word [esp], dx
pop word [esp]
push word [esp + 1]
lea esp, [esp + 1]
jmp 0x765557
mov word [esp], dx
lea esp, [esp + 3]
mov dword [esp + 0x28], esp
call 0x765569
jb 0x7655d0
mov dword [esp], ebx
mov dword [esp], ecx
lea esp, [esp + 1]
jmp 0x765584
jl 0x7655cd
salc
inc ecx
ret
lea esp, [esp]
push word [esp + 1]
and al, 1
call 0x765592
push ebp
mov byte [esp + 5], bh
mov dword [esp + 4], esi
pop dword [esp]
lea esp, [esp + 1]
jmp 0x765670
lea esp, [esp + 0xb]
add di, 0x21e
mov cx, sp
xchg bx, si
mov cl, ch
rdtsc
jmp 0x7651c2
sbb al, 0x24
jmp 0x76564b
jp 0x76557c
sub dword [ecx - reloc.KERNEL32.dll_CloseHandle], edi
dec edx
fdivr dword [edi - 0x7d945cb6]
cmp eax, 0x52e69f0c
push edx
pop word [esp]
call fcn.007655c1
adc al, 0x91
add dword [eax - 0x6d], esp
jno 0x76558a
adc al, byte [eax + 0x13fc12e7]
mov ah, byte [esi - 0x71]
inc esp
and al, 5
mov word [esp], sp
push word [esp]
mov word [esp], dx
lea esp, [esp + 3]
mov dword [esp + 0x2c], esi
jmp 0x7655e3
pushal
push word [esp + 0x17]
mov byte [esp + 0x21], dh
lea esp, [esp + 1]
mov dword [esp + 0x50], edi
lea esp, [esp + 0x50]
jmp 0x76569b
mov word [esp], dx
mov dword [esp + 0x28], ebp
call fcn.00765639
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x7640d5
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x76567d
add ebx, eax
jmp 0x7656ce
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x76581c
cmp word [ebx], 0x4550
je 0x75ffd6
jne 0x765822
int 0x5d
int 0x94
xchg dword [si], ebp
aas
push es
mov cl, 0x66
mov dword [esp + 0xf], edx
lea esi, [ebx + edi]
lea esp, [esp + 0x11]
mov word [esp + 6], bx
inc bp
xchg dh, al
jmp 0x7655a9
je 0x7640f6
sub eax, 0x10000
jmp 0x7656c3