Function at 0x10001106
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x10001024
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x10001036
salc
js 0x1000121c
jns 0x1000121c
rol ebx, 5
rol ebx, 5
ror ebx, 5
jp 0x10001254
jnp 0x10001254
pop ebx
call fcn.1000106a
jb 0x100010c6
imul esi, dword [bp + di + 0x74], 0x64657265
add byte [eax - 0x15], bl
pop eax
jmp 0x1000106f
adc ch, byte [eax]
call 0x100010b2
cdq
dec edi
idiv byte [edi + edi*8]
pop eax
jmp 0x1000106f
call 0x100010b2
cdq
dec edi
idiv byte [edi + edi*8]
nop
pop edi
push eax
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jl 0x10001093
jmp 0x307d6a
call 0x100010a3
jb 0x100010ff
imul esi, dword [bp + di + 0x74], 0x64657265
add byte [eax - 8], bl
je 0x1000114c
jne 0x1000114c
cmp ebp, dword [eax + 0x1d]
and al, 0
add byte [ebx - 0x3b7cfb3c], al
add al, 0xf
test byte [edi], al
add byte [eax], al
add byte [edi], cl
test dword [ecx], eax
add byte [eax], al
add byte [eax - 0x18], cl
or eax, dword [eax]
add byte [eax], al
jb 0x10001136
imul esi, dword [bp + di + 0x74], 0x64657265
add byte [eax - 0x15], bl
or esi, dword [edx + 0x65]
imul esi, dword [bp + di + 0x74], 0x64657265
add byte [ebp - 8], ah
jae 0x10001046
add byte [esp + edi*4 - 0x1748291a], ah
or eax, dword [eax]
add byte [eax], al
call 0x10001106
jb 0x10001162
imul esi, dword [bp + di + 0x74], 0x64657265
add byte [eax - 7], bl
jae 0x10001175
jb 0x10001169
add byte fs:[eax - 7], bl
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x10001118
push 0x5419
add esp, 4
salc
jp 0x100011f8
jnp 0x100011f8
pop eax
jmp 0x1000113f
and byte [bp + di + 0x65], dh
jb 0x100011a5
popal
insb byte es:[edi], dx
add cl, ch
cmp bh, bh
invalid
jmp 0x1000107c
call 0x10001152
xchg al, ch
add dword [eax], eax
add byte [eax], al
mov eax, 0x4244483
adc al, byte [ebx - 0x3cf5dbfc]
clc
push eax
push edx
rdtsc
xor ecx, eax
pop edx
xor ecx, eax
pop eax
push ecx
pop ecx
stc
jb 0x1000117c
add byte [eax], al
imul ebx, dword [ebp - 0x7e], 0x6b
jmp 0x1000118c
add byte [ebx + 0x5d], ch
sub byte [ebx - 0x15], 0xf
iretd
bswap edi
bswap edi
jo 0x1000105a
jno 0x1000105a
invalid
fcom qword [eax + 0x52]
push eax
push edx
rdtsc
xor ecx, eax
pop edx
xor ecx, eax
pop eax
push 0x4cef
add esp, 4
je 0x10001014
invalid
jne 0x10001014
or cl, byte [edi]
xor dword [ebx + 0x2b310fc8], ecx
enter 0xffffffffffffd1f7, 0xffffffffffffff81
stc
add byte [eax], dl
add byte [edi - 2], bh
jmp 0x100011cd
push 0xac27
add esp, 4
jl 0x1000118e
jge 0x1000118e
xchg esp, eax
push 0x475
add esp, 4
clc
jae 0x100010f6
add byte [ebx - 0x68836f73], bh
call 0x100011fe
ljmp 0x800
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x1000122c
call 0x1000123e
or eax, dword [eax]
add byte [eax], al
jb 0x1000129a
imul esi, dword [bp + di + 0x74], 0x64657265
add byte [eax + 0x68], bl
lahf
or al, 0
add byte [ebx - 0x77f0fb3c], al
xchg ebp, eax
invalid
jmp 0x10001261
js 0x1000126e
jns 0x1000126e
mov eax, dword [0xc7fc458b]
inc eax
dec esp
add byte [eax], al
add byte [eax], al
mov eax, dword [ebp - 4]
mov dword [eax + 0x4c], 0
jmp 0x1000142f
xadd eax, eax
push 1
pop eax
jmp 0x1000128e
imul eax, eax
inc eax
je 0x100012d7
jne 0x100012d7
cmp dword [eax], eax
add byte [eax], al
mov dword [0x1e8], eax
add byte [esi + 0x1e8], dh
add byte [eax - 0x7d], bh
call 0x100012a5
mov dh, 0xe8
add dword [eax], eax
add byte [eax], al
js 0x1000122f
inc esp
and al, 4
adc al, byte [ebx - 0x3cf5dbfc]
inc eax
call 0x100012c6
jb 0x10001322
imul esi, dword [bp + di + 0x74], 0x64657265
add byte [eax + 0x6a], bl
pop ebx
pop eax
jp 0x10001417
jnp 0x10001417
cmp ebp, ebx
or esi, dword [edx + 0x65]
imul esi, dword [bp + di + 0x74], 0x64657265
add byte [edi], cl
mov cl, byte [edi + 0xf000000]
mov ecx, dword [ecx + 0x50000000]
jmp 0x100012e4
jp 0x10001379
jnp 0x10001379
push eax
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x10001301
push 0x84d5
add esp, 4
rol ebx, 5
ror ebx, 5
inc ecx
jmp 0x1000148f
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jl 0x10001336
enter 0x310f, 0x2b
enter 0xffffffffffffd1f7, 0xffffffffffffff81
stc
add byte [eax], dl
add byte [ebp + eax - 0x17], bh
fstp xword [esp + ebp]
dec esp
jmp 0x5c2c5011
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x10001346
jmp 0x1000134c
mov eax, eax
je 0x100013e1
jne 0x100013e1
call 0x10001369
add byte [eax], al
call 0x1000136b
jb 0x100013c7
imul esi, dword [bp + di + 0x74], 0x64657265
add byte [eax + 0xf], bl
mov word [ecx + 1], gs
add byte [eax], al
jge 0x100014db
cwde
call 0x1000137f
bnd call 0x10001385
test al, 0x83
inc esp
and al, 4
adc al, byte [ebx - 0x3cf5dbfc]
invalid
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x100013cf
xadd eax, eax
je 0x1000129f
jne 0x1000129f
dec ecx
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x100013f1
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x10001403
jmp 0x10001408
mov eax, eax
call 0x100013ab
mov eax, dword [0xb73cf9bf]
ret
rol ebx, 5
ror ebx, 5
imul eax, eax
not eax
stc
jb 0x100012f1
add dl, cl
cmpsb byte [esi], byte es:[edi]
add al, 9
in eax, 0xf
xor dword [ebx + 0x2b310fc8], ecx
enter 0xffffffffffffd1f7, 0xffffffffffffff81
stc
add byte [eax], dl
add byte [edi - 2], bh
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x1000143f
rol ebx, 5
ror ebx, 5
stc
jp 0x10001285
jnp 0x10001285
das
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x10001465
call 0x10001477
jb 0x100014d3
imul esi, dword [bp + di + 0x74], 0x64657265
add byte [eax - 0x15], bl
add dword [esi + 0xfcf0f65], edx
iretd
jmp 0x1000149e
jo 0x1000131f
jno 0x1000131f
in eax, dx
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x100014bb
jmp 0x100014cc
mov al, al
je 0x1000135b
dec dword [edi]
test dword [ecx + 0x63fffffe], eax
jne 0x1000135b
arpl bx, bp
or esi, dword [edx + 0x65]
imul esi, dword [bp + di + 0x74], 0x64657265
add byte [edi], cl
iretd
jmp 0x100014e8
bswap edi
bswap edi
rdtsc
mov ecx, eax
rdtsc
sub ecx, eax
not ecx
cmp ecx, 0x5000
jg 0x100014fd
push eax
push edx
rdtsc
xor ecx, eax
pop edx
xor ecx, eax
pop eax
mov al, al
inc ecx
jo 0x100013bf
jno 0x100013bf
xor al, 0x8b
dec ebp
cld
mov dword [ecx], 0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x50], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x48], 0
push 0x20
push 0
mov edx, dword [ebp - 4]
add edx, 8
push edx
call sub.MSVCR71.dll_memset
add esp, 0xc
push 0x20
push 0
mov eax, dword [ebp - 4]
add eax, 0x28
push eax
call sub.MSVCR71.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, 0x54
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret