Function at 0x6278f1
Capabilities:
Check for software breakpoints
Execute anti-debugging instructions
Parse pe header

Disassembly:
add edx, 0xa8324c89
jmp 0x627fc8
add edx, 0x8011d686
jmp 0x628095
cmc
ja 0x629085
mov eax, dword [esp + 1]
add esp, 3
bswap eax
lea esp, [esp + 1]
call fcn.00627dc8
jne 0x62794e
cmpsd dword [esi], dword es:[edi]
push ecx
cmp byte [ebx - 0x347faded], 0xb4
pop ecx
and byte [ecx], 0x48
push ebp
xor byte [edx - 0x407faf32], 0x7f
push esi
add byte [ebx - 0x6f7faca0], 0x96
push ecx
xor byte [esi - 0x517fad2c], 0xab
push eax
or byte [ecx - 0x6c7fad9b], 0x19
push eax
and ah, 0x42
push edi
xor byte [eax - 0x37faeed], 0x4e
push edx
sub byte [0x6b805126], 0x99
pop eax
sub byte [ecx], 0xf
push ecx
or byte [ebx - 0x39], 0x51
sub byte [eax + 0x6f], 0x50
sbb byte [esi + edi], 0x51
and byte [ebx + 0x3780528b], 0xca
push ebx
adc byte [ebp + 0xa8050a9], 0x75
pop ecx
sub byte [esi + 0x338050ab], 0x10
push edi
cmp byte [ebx], 0x92
push ebp
xor byte [ebx], 0xcc
push ebp
and byte [ecx + 7], 0x52
adc byte [ecx + 0x6c80515b], 0x4e
push edi
adc byte [ebx], 0x76
push ebp
sub dh, 0xa7
dec edi
and bh, 0x41
push ecx
adc byte [ebp - 0x2c7faf57], 0x8c
push esp
sbb byte [esi + 0x65805574], 0xc7
push eax
adc byte [esi], 0xd5
push edx
cmp byte [eax + 0x47], 0x5a
or byte [0xc6805806], 0x6e
push edx
sub byte [esi + 0xf805666], 0x9e
push ebp
add byte [eax - 0x117faee5], 0xdb
push ecx
cmp byte [edi + 0x2e8056d9], 0x18
push esi
adc al, 0x9c
push ecx
sub dl, 0xaf
push eax
adc byte [esi], 0xec
push esp
sub byte [edi - 0x647fad39], 0xba
push ebp
and byte [esi + 0x5980516d], 0x89
push ecx
sub byte [esi - 0x7e7faf55], 0xac
push eax
xor dh, 0x60
push ebp
or byte [eax + edx*2], 0x51
sub ch, 0x9f
push ecx
and byte [esi], 0xec
push esi
sbb byte [edx - 0x517faed0], 0xab
push eax
add byte [ecx*4 - 0x54517fab], 0x50
sub byte [ebp + ebx - 0x64f97fae], 0x51
sub byte [esi + 0x2f8050ab], 8
push edx
add dl, 0x8a
push ecx
adc byte [ebp - 0x257faf57], 0xdb
push ecx
xor byte [ebp + ebx + 0x52], 0x80
xchg ebp, eax
test eax, 0x4efc8050
pop eax
sub byte [edi + 0x7e], 0x51
add byte [ebx], 0xba
push eax
add byte [esi - 0x23], 0x50
sub byte [esi + 0x788050ab], 0xa2
push ecx
sub ah, 0x4d
push edi
and byte [ebx - 0x37faa97], 0xd1
push ebp
adc byte [ecx + eax*2 - 0x18ba7faa], 0x50
xor cl, 0x25
push edi
sub ah, 0xf7
push ebx
cmp byte [edi - 0x387fa7b5], 0x58
push ecx
sbb byte [esi], 0x6e
push ecx
or byte [edi + 0x88053c6], 0xda
push ebp
adc byte [ebp - 0x607faf57], 0x82
push ecx
xor byte [ebp - 0x517fadc4], 0xab
push eax
xor byte [eax - 0x5b], 0x54
sub bl, 0x65
push edx
sbb bl, 0x56
push edi
sbb byte [eax], 0xd8
push eax
cmp byte [edi - 0x587fadc7], 0xd7
push ebp
xor al, 0x4a
push ecx
adc byte [ebx + 0x56], 0x80
scasb al, byte es:[edi]
stosd dword es:[edi], eax
push eax
xor byte [edi], 0x2b
push esi
and byte [eax], 0xdf
push esi
adc byte [ebp + 0x598050a9], 0xed
pop eax
cmp byte [edi], 0xb6
push esi
add ch, 0xbc
push eax
adc byte [edx], 0x5e
push edx
add byte [edi + 0x20], 0x51
cmp byte [eax + 0x21], 0x53
sub byte [esi + 0x2e8050ab], 0x28
push ebx
adc dl, 0xb
push ecx
sbb ch, 0x85
push ebp
sub byte [esi + 0x708050ab], 0xd8
push eax
and byte [ecx + 4], 0x5a
and byte [ebp + 0x3d], 0x53
and byte [ecx + 0x288058d2], 0xaf
push ebx
sbb ah, 5
pop edx
add byte [esi], 0x73
push ecx
add ah, 0x44
push ecx
or byte [ecx - 0x7f], 0x56
and byte [esi], 0x81
push edx
sub byte [ebx + 0x3f805584], 0x5f
push edx
adc byte [ebx - 0x67], 0x51
cmp byte [esi], 0xc0
pop eax
adc byte [ebp - 0x137faf57], 0xba
push esp
sbb byte [ebp - 0x7a7fa922], 0xa0
push ecx
cmp byte [esi], 0xcc
push edx
and byte [edx + ecx*2 + 0x56], 0x80
scasd eax, dword es:[edi]
or edx, dword [edx - 0x80]
or al, 0x76
push ecx
sub byte [esi + 0xd], 0x54
sbb byte [esp + edx*2], 0x59
sbb byte [edi - 0x7c], 0x51
sub byte [edi - 0x767faceb], 0x94
push edi
sub byte [edx + edi*8 + 0x2f408050], 0x52
cmp byte [edi - 0xe], 0x53
add byte [edi + 0x3180513d], 0xbe
push ecx
add byte [edx + 0x6a], 0x55
adc byte [ebp + 0x3e8050a9], 0xf8
push ebp
or byte [esi], 0xca
push ebp
add byte [ebx + edx*4 + 0x51], 0x80
out dx, eax
aam 0x56
and byte [ebp + 0x6e], 0x52
adc byte [edx + 0x2c], 0x51
adc byte [edi - 0x54], 0x57
sub byte [esi - 0x1b7fa8ff], 0x39
push edx
or byte [0x95805719], 0xa9
push eax
xor byte [eax - 0xe7fae15], 0x68
push ecx
sub ah, 0x22
push edx
sbb byte [esi], 0xdc
push ebx
cmp dh, 0x7c
push ebx
or cl, 0x2a
push edi
sbb byte [ebp - 0x1f7fa8d4], 0x58
push edi
cmp byte [esi + ecx], 0x54
or byte [eax + ebp*2 + 0x6f858051], 0x52
xor byte [ebx - 0x2c], 0x53
sub bl, 0xd8
push ecx
cmp byte [edx - 0x607fa82b], 0x3c
push edx
xor byte [ebp - 0x60], 0x51
sbb bh, 0x59
push edx
add byte [ebp + 0x2280513a], 0x2a
push ebx
cmp byte [esi], 0x41
push ebp
adc byte [ebp + 0x708050a9], 0x22
push ebx
sub byte [ebx], 0xf7
pop eax
adc byte [eax - 0x23], 0x54
or byte [0xf38052f3], 0xc4
push esi
cmp cl, 0xb4
push esi
adc byte [ebp + 0x258050a9], 0xae
pop eax
or byte [eax], 7
push ecx
and byte [ecx], 0x2a
push edx
or byte [ecx], 0x4e
push edx
and dh, 0xf1
push edx
adc byte [ebx - 0x4c], 0x56
and dl, 0xa4
push esi
add byte [ecx], 0xbf
push esi
adc byte [ebp + 0xa80518f], 0xd8
push eax
add byte [esp + ebx*2 - 0x4647fa9], 0x51
and byte [ebx + 0x19], 0x54
adc byte [ebp + 0x4e8050a9], 0x94
push esp
adc byte [ebx - 0x517fa8fc], 0xab
push eax
sub byte [esi - 0x7f7faf55], 0x45
push ebx
xor byte [ebp + 0x36], 0x57
and byte [esi], 0x77
push ecx
and ch, 0xc4
push ebx
adc byte [edi + 0x7805194], 0xc8
push eax
and byte [eax + 0x6e], 0x51
sub byte [esi - 0x617faf55], 0x5e
push ecx
xor byte [eax - 0xe], 0x53
cmp byte [edx + 0xa], 0x54
add byte [edi + 0x3480537a], 0x59
push ecx
add byte [ebx - 0x217fab5c], 0x97
push ecx
sub byte [esi + 0x708050ab], 0x6a
push edx
adc byte [esi - 0x707faf02], 0x65
push esi
and byte [eax + 0x37], 0x51
xor byte [esi - 0x417fad34], 0xc0
push ecx
and cl, 2
push edx
xor byte [ebx], 0x9c
push edi
adc byte [ebp - 0x207faf57], 0x60
push edx
sub byte [esi - 0x587faf55], 0x1f
push ecx
xor byte [ebp + 0x7e], 0x55
adc byte [ebp - 0x137faf57], 0xb8
push esp
add byte [ebp + 0x805299], 0x95
push edi
xor cl, 0x5f
push ecx
adc byte [ebp + 0x678050a9], 0xe
push edx
xor byte [ebx + ebp*8 + 0x50], 0x80
nop
ficom word [ebx - 0x80]
mov ch, byte [0x6cb58051]
push esi
sub al, 0x30
pop eax
and byte [esi], 0x44
pop eax
adc bl, 0xc7
push ebp
or byte [0x95805558], 0xa9
push eax
or byte [ebp + 0x84a9b], 0
adc dh, al
lea edx, [ebx*4]
jmp 0x627d82
jmp 0x627d9f
xor ax, dx
jns 0x627d89
bswap eax
mov eax, dword [esp]
mov dx, word [esp]
mov ah, byte [esp]
xchg dx, ax
call fcn.00627e62
xor dword [eax], esi
xor ebp, dword [edx]
inc ebp
hlt
rdtsc
call fcn.00627d4e
bswap eax
mov eax, dword [esp]
jmp 0x627dab
cmp eax, 0x2150aa93
bsr eax, esp
inc cl
jmp 0x627d63
mov dx, word [esp]
mov ah, byte [esp]
xchg dx, ax
jmp 0x627f68
rcr dl, 4
js 0x627e3c
clc
mov eax, edx
neg eax
dec dx
sub esp, 6
call fcn.00627ebc
cmp dword [edx], reloc.SHELL32.dll_SHGetPathFromIDListA
sbb al, 0x24
mov al, byte [esp]
call fcn.00627dfc
clc
mov eax, edx
jmp 0x627e45
neg eax
dec dx
sub esp, 6
jmp 0x627f03
rdtsc
mov dx, sp
jmp 0x627f2d
bsr ax, si
jae 0x627ed3
rdtsc
mov dx, sp
lea eax, reloc.SHELL32.dll_SHGetPathFromIDListA
jmp 0x627f34
xchg dx, ax
lea edx, [edi*4]
pop ax
lea esp, [esp + 4]
sub cl, 0x96
jmp 0x627ee9
setge dl
lea edx, [ebp*4]
jmp 0x627f52
lea eax, reloc.SHELL32.dll_SHGetPathFromIDListA
neg cl
mov edx, ebx
inc ah
jmp 0x627f40
jns 0x627f17
setge dl
lea edx, [ebp*4]
jmp 0x627f52
mov edx, ecx
mov eax, dword [esp]
bsf eax, ecx
jne 0x627f94
je 0x627f78
jbe 0x627f57
add dh, cl
inc ecx
push 0xffffffffffffff85
xor al, 0x27
mov dx, word [esp]
mov eax, 0x58b4d657
inc cl
jmp 0x627e1b
mov ax, 0x8f2f
jmp 0x627f98
mov ah, byte [esp]
jmp 0x625529
mov ax, 0x8f2f
shl edx, 2
mov al, bl
mov eax, 0x4ffcb19b
bsf eax, edi
jmp 0x627ff6
btc ax, dx
lea esp, [esp + 2]
jmp 0x625538
mov ax, sp
mov edx, dword [edx + reloc.SHELL32.dll_SHGetPathFromIDListA]
call fcn.00627fa7
pop ax
cmc
jl 0x627fa9
btc ax, dx
jmp 0x62810c
jp 0x627f7e
mov ah, byte [esp]
jmp 0x625529
mov ax, bp
xchg ah, al
push edx
ret
xchg ah, al
mov ah, al
lea eax, [edi*4]
mov esp, ebp
jmp 0x628057
lea esp, [esp + 2]
jmp 0x625538
lea esp, [esp + 1]
neg cl
lea eax, reloc.SHELL32.dll_SHGetPathFromIDListA
bswap edx
bsr eax, esp
jp 0x627d61
cmp eax, 0x2150aa93
bsr eax, esp
jmp 0x627da7
mov eax, dword [esp + 1]
add esp, 3
bswap eax
jmp 0x628150
jmp 0x62896f