Function at 0xcf9b2e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0xb10b6e01
jmp 0xcfa2da
bt ebx, edx
mov bh, 0x9f
lea esp, [esp + 2]
jmp 0xcf9ba9
pop word [esp]
cmc
jmp 0xcf9b39
jno 0xcf9b18
bt ebx, edx
mov bh, 0x9f
jmp 0xcf9bd9
adc bh, 0x54
sub esp, 9
mov bl, byte [esp + 3]
jmp 0xcf9b8f
mov bl, 0xd0
jmp 0xcf9b5f
add cl, al
bsr eax, edx
ja 0xcf9bc1
jbe 0xcf9bc1
sbb al, 0x86
adc al, 0x73
invalid
push word [esp + 2]
mov ebx, dword [esp + 4]
lea esp, [esp + 3]
jmp 0xcf9b79
not al
stc
jae 0xcf9b75
mov bl, 0xd0
adc bh, 0x54
sub esp, 9
mov bl, byte [esp + 3]
push word [esp + 2]
jmp 0xcf9b94
dec edi
jmp 0xcf9c37
lea esp, [esp + 2]
jmp 0xcf9ba9
lea eax, [esp + edx]
xchg ebx, eax
xchg bx, ax
jmp 0xcf9c12
mov ah, byte [esp]
mov bh, 0xdc
jmp 0xcf9bdf
lea ebx, [esi + esi]
mov ax, bx
jmp 0xcf9e24
neg al
clc
jl 0xcf9bfc
lea ebx, [esi + esi]
jmp 0xcf9c20
mov ax, bx
call fcn.00cf9dcf
add al, 0xa6
xor al, 0x53
scasb al, byte es:[edi]
sub dword [edi - 0x25], edx
dec ebx
invalid
dec bh
jb 0xcf9bf5
mov ah, byte [esp]
mov bh, 0xdc
lea eax, [esp + edx]
xchg ebx, eax
xchg bx, ax
jmp 0xcf9c12
xchg ebx, eax
setp ah
btr bx, dx
jae 0xcf9c89
sub esp, 0xb
shl al, cl
jmp 0xcf9d10
sub esp, 7
add esp, 2
pop eax
lea esp, [esp + 1]
push dword [esp + 0x20]
ret 0x24
shl al, cl
lea eax, [esi*4]
mov dword [esp], esp
lea esp, [esp + 3]
call fcn.00cf9ca4
sbb eax, 0xeb0bec83
in eax, 0x87
adc al, 0x24
sub esp, 0xb
jmp 0xcf9c73
mov al, 0xb3
lea ebx, [esp + ebx]
mov bx, 0x61fb
shl ebx, 0x1b
jmp 0xcf9ce9
lea esp, [esp + 8]
sub dl, 0xc6
mov bx, dx
xchg ebx, eax
jmp 0xcf9d20
lea esp, [esp + 3]
xchg dword [esp], edx
mov ebx, dword [esp]
pushal
bswap ebx
setge bl
jmp 0xcf9d3a
lea edx, [edx + 0x35]
bsf eax, ecx
mov ah, al
sub esp, 0xb
add esp, 8
mov al, dh
jmp 0xcf9cd3
lea eax, [esi*4]
mov dword [esp], esp
lea esp, [esp + 3]
jmp 0xcf9cbd
lea eax, [ecx*4]
lea eax, [ebp*4]
lea ebx, [edx + esi]
setns bl
jmp 0xcf9d41
push dword [esp + 0x20]
ret 0x24
inc dl
setl bh
cmp bl, 0xd1
jl 0xcf9d8a
jge 0xcf9d70
fcomp dword [edx + esi*8 - 0x6b]
shr dword fs:[ecx], 1
dec eax
jmp 0xcf9d59
lea edx, reloc.ADVAPI32.DLL_RegCloseKey
mov eax, dword [esp]
mov bx, word [esp]
pushal
xchg dword [esp + 0x20], edx
jmp 0xcf9c61
bt bx, si
call fcn.00cf9da4
mov edx, 0x47b4ad3d
test byte [esi], cl
pushfd
sti
push ss
movsd dword es:[edi], dword [esi]
pop ds
xchg cx, ax
adc byte [ebx - 0xc5cf09a], dl
bt bx, si
neg dl
mov bl, cl
bswap ebx
mov ebx, 0x79a3e1b4
jmp 0xcf9e75
ror dl, 0
jmp 0xcf9c4a
xchg bx, ax
mov ax, word [esp]
jmp 0xcf9e9c
sub ah, 0x17
jp 0xcf9e5c
xchg bx, ax
mov ax, word [esp]
bts eax, eax
cmc
jmp 0xcf9ea0
bsf ebx, edi
lea eax, reloc.ADVAPI32.DLL_RegCloseKey
jmp 0xcfabe6
bts eax, eax
cmc
ror dl, 0
jmp 0xcf9ea9
jp 0xcf9e86
bsf ebx, edi
lea eax, reloc.ADVAPI32.DLL_RegCloseKey
jmp 0xcfabe6
mov ebx, dword [esp]
call fcn.00cfa310
sbb al, 0x93
add esp, dword [esi - 0x6b]
push edi
adc byte [edx + ecx*4], 0xed
sbb al, 0xa2
add eax, eax
mov bl, byte [esp]
jmp 0xcfa2c4
not ebx
lea ebx, [esi + ebp]
mov ebx, 0xa8b094ed
jmp 0xcf7b14
not ebx
lea ebx, [esi + ebp]
mov ebx, 0xa8b094ed
jmp 0xcf7b14
mov bx, word [esp]
shl eax, 2
xor bx, 0x9e6a
jb 0xcfa4fc
jae 0xcfa342
jmp 0xcfa6a9
rdtsc
jmp 0xcfa6cf
push dword [esp + 3]
lea esp, [esp + 3]
jmp 0xcfa6e5
bswap edx
xchg dx, ax
jmp 0xcfa713
lea ebx, [ebp + 0x50]
rcl dx, cl
jge 0xcfa693
rdtsc
bswap edx
xchg dx, ax
jmp 0xcfa713
lea edx, [ebp + 0x40]
clc
jae 0xcfa768
mov eax, ebx
mov eax, dword [esp]
mov ax, 0xd5c2
jmp 0xcfa76c
cmp esi, ebx
ja 0xcf99c5
rdtsc
call fcn.00cfa6f6
rdtsc
mov ebx, ebp
mov dx, 0xee7c
mov dx, 0x512a
mov ax, bx
jmp 0xcfa6fb
mov eax, dword [esp]
mov ax, 0xd5c2
jmp 0xcfa76c
mov eax, ebx
jmp 0xcfa752
sub edx, ebx
sbb eax, 0x7fc88199
jmp 0xcfa837
inc eax
bswap eax
jmp 0xcfa7c3
lea esp, [esp + 2]
jmp 0xcfa7f7
lea esp, [esp + 2]
jmp 0xcfa7f7
lea eax, [esi - 0x80]
push di
clc
jle 0xcfa79f
jg 0xcfa7a9
sub eax, edx
jmp 0xcfa7d5
sub esp, 2
ja 0xcfa814
sub esp, 0x12
push dword [esp + 7]
mov byte [esp + 1], ah
jmp 0xcfa81d
and al, 0xfc
cmc
jle 0xcfa7cd
jg 0xcfa7cd
mov byte [esp + 1], ah
jmp 0xcfa81d
sub esp, 0x12
push dword [esp + 7]
jmp 0xcfa7fe
mov esp, eax
pushfd
lea ebp, [eax + edx - 0x40]
jmp 0xcfa8e7
jno 0xcfa77a
inc eax
bswap eax
jmp 0xcfa7c3
sub esp, 0x15
jg 0xcfa860
lea esp, [esp + 1]
lea esp, [esp + 0x18]
jmp 0xcfa8a2
cld
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp]
jmp 0xcfa842
lea esp, [esp + 1]
lea esp, [esp + 0x18]
jmp 0xcfa8a2
mov esi, ebx
mov edi, eax
mov ecx, edx
jmp 0xcfa858
lea esp, [esp + 2]
jmp 0xcfa8c4
lea esp, [esp + 2]
mov edi, dword [esp + 0xc]
sub esp, 0xf
mov byte [esp + 6], ch
jmp 0xcfa8d1
bswap edi
mov di, bx
sub esp, 0xe
jae 0xcfa881
jb 0xcfa88b
lea esp, [esp + 3]
lea esp, [esp + 0x1c]
jmp 0xcfa942
mov edi, dword [esp + 0xc]
sub esp, 0xf
mov byte [esp + 6], ch
jmp 0xcfa8ae
lea esp, [esp + 3]
jmp 0xcfa8b2
push esi
push edi
push ecx
jmp 0xcfa879
lea ebx, [ecx*4]
jmp 0xcfa9c4
movzx edx, byte [edi - 1]
call 0xcfa8ec
lea ebx, [ecx*4]
mov byte [esp], al
bsr ax, di
jae 0xcfa8ee
lea ebx, [ecx*4]
not ax
mov eax, dword [esp]
jmp 0xcfa9ca
pop esi
popfd
jmp 0xcfa90f
jno 0xcfa960
setno bh
mov ah, 0x22
jmp 0xcfa996
setno bh
mov ah, 0x22
xchg ebx, eax
mov al, dl
bswap ebx
lea ebx, [ebp*4]
mov ebx, edx
jmp 0xcfa979
cmc
jo 0xcfa999
jno 0xcfa999
jmp 0xcfa9a8
xchg ebx, eax
jmp 0xcfa966
dec al
lea ebx, [ebx*4]
push ebp
call 0xcfa97e
xchg byte [esp + 1], bl
lea esp, [esp + 8]
not al
call fcn.00cfa980
cwde
push es
xchg esp, eax
push cs
mov cl, 0x2a
mov ebx, 0xfbd4e2b
push ds
not ax
mov eax, dword [esp]
add dl, cl
jmp 0xcfa94a
pushal
mov dword [esp + 0x1c], edx
popal
mov ebx, 0x1d42f0e1
not ebx
jmp 0xcfa654