Function at 0x1eb0830
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, esi
mov dl, 0xf5
jmp 0x1e9b184
push eax
mov ebx, 0x7ea3e14b
mov edx, dword [esp]
neg dl
jno 0x1e9b1b3
jo 0x1e9b1c0
or byte [ebp + 0x2497641d], cl
lcall 0xe8e3, 0x26eb8c1e
jae 0x1e9b185
xchg byte [ebp - 0x49], dh
mul cl
lea edx, [esi*4]
jmp 0x1e9b22d
lea edx, [esi*4]
bswap ebx
jmp 0x1e9b22f
jmp fcn.01e9b1de
bswap ebx
neg esi
dec dx
jnp 0x1e9b1f4
mov ch, bh
mov dh, byte [esp]
mov edx, ebx
sub esp, 0xb
mov byte [esp + 5], ah
jmp fcn.01e9b213
movzx edx, byte [ebp]
jmp 0x1eb03cc
cmc
jp 0x1eb040b
xchg ecx, eax
mov cl, ch
jmp 0x1eb053c
mov ah, byte [esp]
xchg cx, ax
adc ecx, ecx
push bp
jmp 0x1eb0483
xchg ecx, eax
mov cl, ch
jmp 0x1eb03d8
mov ecx, 0x90a9671f
jmp 0x1eb044b
pop cx
mov ecx, 0x90a9671f
sub dl, bl
sub esp, 4
jns 0x1eb046c
js 0x1eb04cb
mov al, dl
mov cx, sp
lea ecx, [esi*4]
cmc
jmp 0x1eb0490
adc eax, eax
xchg ah, al
jmp 0x1eb0454
mov cx, 0x73b0
neg cx
jp 0x1eb0444
pop cx
jmp 0x1eb042e
jnp 0x1eb04a6
jp 0x1eb04a6
jmp 0x7d73ee12
call fcn.01eb04e7
lea esp, [esp + 4]
dec al
jmp 0x1eb04d1
mov ecx, esp
bt cx, bp
jmp 0x1eb0504
adc eax, eax
xchg ah, al
jmp 0x1eb0454
rol cl, cl
jb 0x1eb04b3
mov ecx, esp
bt cx, bp
mov cx, si
mov ecx, esi
jmp 0x1eb0509
bsr cx, di
jnp 0x1eb0523
mov ecx, dword [esp]
btc cx, bp
pushal
jmp 0x1eb0561
mov cx, si
mov ecx, esi
xor al, 0x1d
jmp 0x1eb04ee
pushal
xchg word [esp + 0x16], cx
pop ecx
xchg ch, cl
jmp 0x1eb0548
mov ecx, dword [esp]
btc cx, bp
jmp 0x1eb050d
mov ah, byte [esp]
xchg cx, ax
adc ecx, ecx
jmp 0x1eb03df
lea esp, [esp + 0x1c]
dec al
sub esp, 6
jl 0x1eb0569
jge 0x1eb0572
sub edi, dword [esi + reloc.KERNEL32.dll_FreeEnvironmentStringsA]
setbe byte [ecx]
rol byte [ebx + 0x4c87663a], 0x24
push ss
xchg word [esp + 0x16], cx
pop ecx
jmp 0x1eb0514
add esp, 4
jmp 0x1eb06dc
add esp, 4
mov word [esp], cx
neg cl
adc ch, ah
lea esp, [esp + 2]
jmp 0x1eb0669
mov ch, byte [esp]
jmp 0x1eb05c2
not cx
btc cx, bp
not cl
not cx
jmp 0x1eb059e
xor al, 0x9e
rol ecx, cl
jg 0x1eb0601
mov cl, byte [esp]
mov ecx, dword [esp]
mov cx, 0xba48
add cx, ax
jmp 0x1eb0633
mov ch, byte [esp]
mov cx, 0x5eff
mov ch, 0xd9
jmp 0x1eb05b4
mov ecx, dword [esp]
mov cx, 0xba48
add cx, ax
jmp 0x1eb0633
mov cl, byte [esp]
jmp 0x1eb05eb
jmp 0x1eb05e0
sub esp, 0x13
jmp 0x1eb0641
sub bl, al
dec ecx
jae 0x1eb061d
sub esp, 0x13
jmp 0x1eb0699
cmc
lea esp, [esp + 3]
inc ebp
bsr eax, ecx
jmp 0x1eb06b6
dec cx
rcr ecx, 0xa
mov ch, byte [esp]
jmp 0x1eb06a0
lea esp, [esp + 2]
not al
cmc
ja 0x1eb061b
mov ch, byte [esp]
mov cx, 0x5eff
mov ch, 0xd9
not cx
btc cx, bp
jmp 0x1eb05bb
mov ecx, 0x4765179b
pushfd
dec cx
rcr ecx, 0xa
mov ch, byte [esp]
jmp 0x1eb06a0
cmc
lea esp, [esp + 3]
jmp 0x1eb0646
lea ecx, [esi + 0xcb]
not ecx
mov cx, 0xe46a
not cx
jmp 0x1eb06c0
jbe 0x1eb0683
mov ecx, 0x4765179b
pushfd
jmp 0x1eb064c
mov ax, word [esp]
inc dl
dec ax
jno 0x1eb084d
jo 0x1eb07fe
jno 0x1eb06c6
add ax, si
inc ecx
insd dword es:[edi], dx
jl 0x1eb0743
mov word [esp], cx
mov dword [esp], ecx
neg cl
adc ch, ah
jmp 0x1eb0665
rol dl, 0
xchg ch, cl
mov ax, 0x842a
neg eax
je 0x1eb076e
not al
xchg cl, ah
call 0x1eb0749
dec edi
salc
inc ecx
ret
mov ch, byte [esp]
stc
jmp 0x1eb0859
not al
xchg cl, ah
lea ecx, [ebx*4]
jmp 0x1eb0770
neg ecx
lea ecx, [edx + esi]
lea edx, [edx + 0xd]
bsr ax, di
rol al, 3
jmp 0x1eb07ba
jbe 0x1eb07b0
cmp byte [0xee8a9f0c], 0x8d
add dword [ecx - 1], 0xc8bffff
and al, 0x87
adc al, 0x24
neg cx
jmp 0x1eb0733
jmp 0x1eb0722
inc dl
bswap ecx
mov ecx, 0xd48439a
dec cx
jmp 0x1eb07e3
add esp, 2
lea esp, [esp + 2]
push dword [esp]
ret 4
inc eax
bswap eax
jmp 0x1eb07cd
setne ah
push edi
jmp 0x1eb0821
push edi
xchg ch, ah
mov ax, bx
jmp 0x1eb0826
xchg esi, eax
push ds
mov ebx, gs
in al, 0xef
mul cl
and dl, dl
fld dword [edi - 0x137cdbec]
add ah, byte [esi + 0x48]
rcr cl, cl
xchg dword [esp], edx
sub esp, 2
dec ax
mov byte [esp], dh
push word [esp]
jmp 0x1eb0786
add dl, 1
inc eax
jo 0x1eb0798
setne ah
jmp 0x1eb07a2
jne 0x1eb0793
inc eax
bswap eax
jmp 0x1eb0796
neg ch
bts ecx, esp
mov ah, byte [esp]
jmp 0x1eb0703
xchg ch, ah
mov ax, bx
lea esp, [esp + 4]
call 0x1eb0830
mov cl, 0xf
xchg ebx, eax
shl dword [esi - 0x47], 0x32
cmp dword [esi - 9], esp
ror dword [edi], 1
enter 0x3c87, 0x24
jmp 0x1eb09cf
neg ch
bts ecx, esp
mov ah, byte [esp]
mov ch, byte [esp]
stc
setge ch
bswap ecx
lea ecx, [ebx + esi]
jmp 0x1eb06e9
not cx
mov cx, word [esp]
mov cx, word [esp]
cmp ecx, 0xe162488d
lea edi, [edi - 0x24]
neg ch
call fcn.01eb0880
js 0x1eb0a03
mov edx, dword [esp]
jmp 0x1eb0a06
mov edx, dword [esp]
add esi, 4
mov ax, 0xbd0d
jmp 0x1eb0a2a
push edi
mov dx, word [esp]
jmp 0x1eb0a36
mov dl, ch
xor edx, 0xaa92c67a
jg 0x1eb0a0f
jle 0x1eb0a0f
xchg dl, bl
mov di, word [esp]
jmp 0x1eb0b32
xchg cx, di
jmp 0x1eb0ab7
js 0x1eb0aaa
mov ebx, dword [esp]
lea edx, [edi*4]
jmp 0x1eb0a5b
push esi
sub esp, 0x1f
jmp 0x1eb0ad7
mov edi, 0xdb53f225
rdtsc
lea esp, [esp + 3]
cpuid
mov ax, bp
mov al, bl
jmp 0x1eb0b62
mov ebx, dword [esp]
lea edx, [edi*4]
xchg cx, di
push ebp
lea ecx, [ebx + ebp]
mov dx, 0x15ee
jmp 0x1eb0a7f
je 0x1eb0a89
mov edi, 0xdb53f225
rdtsc
call fcn.01eb0b02
adc byte [esi - 0x79], ah
fimul dword [ebp - reloc.KERNEL32.dll_FreeEnvironmentStringsA]
movsd dword es:[edi], dword [esi]
lea esi, [esi - 0x24]
mov dh, dl
jmp 0x1eb0b14
bsf dx, dx
lea edx, [eax + ecx]
cmc
mov ax, sp
xchg dword [esp], esi
call fcn.01eb0b5d
push esi
retf
mov bx, bp
sets ah
mov eax, 0xa45534b4
movsb byte es:[edi], byte [esi]
push ecx
shr dx, 0xd
jmp 0x1eb0a71
bt bp, bp
jp 0x1eb1cc6
jnp 0x1eb1cc6
jecxz 0x1eb0b8e
jne 0x1eb0bda
xchg edi, eax
invalid
or byte [eax], al
fisttp dword [ecx - 0x27]
mov eax, 0xea7b8c4b
js 0x1eb0ba8
ljmp 0xbfac:0x5d228b59
lodsb al, byte [esi]
mov edi, 0x5f80714e
mov eax, 0x7ca07f8e
adc byte [ecx - 0x35713de9], dl
jmp 0xf0a71c04
out dx, eax
inc ebx
adc dword [eax + esi*2 - 0x6f], eax
inc esp
jo 0x1eb0b3c
pop ss
mov ebx, 0x22e7859a
mov edi, dword [eax + reloc.KERNEL32.dll_FreeEnvironmentStringsA]
jnp 0x1eb0ba5
lcall 0x6eb7, 0xc3831791
mov edx, 0x55ea68e7
sbb byte [edi - 0x6e91c8eb], dl
pop ss
fst dword [ecx - reloc.KERNEL32.dll_FreeEnvironmentStringsA]
hlt
xchg esp, eax
pop ss
cmp byte [edi + 0x648a043b], bh
wait
xor dword [ebx - 0x65], edi
into
pop eax
jne 0x1eb0b7d
pop ss
invalid
cpuid
jmp 0x1eb1ba8
cpuid
call fcn.01eb1bd4
pop word [esp]
jmp 0x1eb1bb7
mov esi, dword [esp + 4]
xchg dx, ax
mov bh, 0x5d
jmp 0x1eb1c24
pop edi
mov bx, word [esp]
mov ah, 0x1e
rcr ebx, 7
js 0x1eb1ba6
jns 0x1eb1b90
sub esp, 5
jmp 0x1eb1c27
pop eax
sub esp, 0x11
jmp 0x1eb1c39
bsr cx, bx
xchg bx, dx
push word [esp + 0xb]
lea esp, [esp + 3]
jmp 0x1eb1c78
sub esp, 5
mov bl, dh
lea esp, [esp + 1]
lea esp, [esp + 0xc]
mov ax, 0xf77d
mov al, 0xdc
jmp 0x1eb1c01
jp 0x1eb1c0b
bsr cx, bx
xchg bx, dx
jmp 0x1eb1c48
push word [esp + 0xb]
lea esp, [esp + 3]
jmp 0x1eb1c78
jmp 0x1eb1bee
pop ebp
jmp 0x1e9b167
add esp, 0x10
jl 0x1eb1c62
jge 0x1eb1c62
add esp, 0x1c
jae 0x1eb1c60
jb 0x1eb1c60
neg dh
jmp 0x1ec2a34
mov eax, edi
mov edx, dword [eax]
lea ecx, reloc.KERNEL32.dll_FreeEnvironmentStringsA
jmp 0x1ec2a1e
mov cl, 0xc0
bsr ecx, esi
jnp 0x1ec2a4e
sub esp, 0x1a
jmp 0x1ec2a38
jnp 0x1ec29fe
jp 0x1ec29fe
lea esp, [esp + 2]
jmp 0x1ec2a55
sub esp, 0x1a
lea esp, [esp + 2]
mov eax, dword [edi + 4]
mov cx, di
not edx
jmp 0x1ec2a63
sub esp, 0x1e
jge 0x1ec2b40
mov ch, byte [esp + 0x10]
lea ecx, [edi + 0x21]
mov cl, byte [esp + 1]
lea esp, [esp + 2]
jmp 0x1ec2aef
mov ecx, dword [esp]
bswap ecx
call fcn.01ec2a97
push eax
push esp
lea esp, [esp]
push word [esp + 7]
jg 0x1ec2ad1
jle 0x1ec2b12
fist dword [ecx - 0x3f]
mov al, byte [0xd3509353]
or edx, eax
jmp 0x1ec2ab7
lea esp, [esp + 2]
jmp 0x1ec2af3
mov cl, byte [esp + 1]
lea esp, [esp + 2]
not eax
jmp 0x1ec2aad
mov dword [edi + 4], edx
mov ecx, dword [esp]
mov ecx, esp
mov ecx, esi
jmp 0x1ec2b18
lea esp, [esp + 2]
jmp 0x1ec2af3
pushfd
pop dword [edi]
jmp 0x1eb03ae
mov ch, byte [esp + 0x10]
lea ecx, [edi + 0x21]
jmp 0x1ec2ae7