Function at 0xcd49b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0xbcbaa15e
rdtsc
rdtsc
jmp 0xcd49ef
lea edx, [edi + ebp]
lea edx, [ebp - 0x5b]
mov edx, esi
mov ebx, 0x9a249d6c
rol bl, cl
jmp 0xcd49fc
sub esp, 0xb8
mov edi, esp
pushfd
xchg ecx, ebx
jmp 0xcd49d7
jne 0xcd4a12
mov ecx, esi
not bl
jmp 0xcd4a33
mov ecx, esi
not bl
clc
mov cx, 0x719f
xchg ch, cl
sub esp, 8
jmp 0xcd4a3c
clc
mov cx, 0x719f
xchg ch, cl
jmp 0xcd4a1d
lea ebx, [edx*4]
lea esp, [esp + 8]
sub esi, 0x3c29ce1e
rcr bx, cl
jmp 0xcd4aac
sete cl
cmp bx, si
jo 0xcd4a8a
pushfd
jmp 0xcd4a94
mov cl, byte [esp]
btr eax, esi
jmp 0xcd4b1a
pushfd
bsr ecx, esi
jmp 0xcd4acb
bsr ecx, esi
mov ebx, 0xe034959c
jmp 0xcd4ad0
ja 0xcd4b0f
neg cx
mov bh, 0x53
jmp 0xcd4a7f
jmp 0xcd4af8
mov ebx, 0xe034959c
rol esi, 0
bsf eax, ecx
jb 0xcd4ab5
xor ebx, esi
mov ecx, esi
mov ax, dx
mov bl, byte [esp]
stc
jmp 0xcd4b40
xor ebx, esi
mov ecx, esi
mov ax, dx
call fcn.00cd4b26
fadd qword [edx + ebx*8 - 0x43]
dec esp
cld
jno 0xcd4b7c
jae 0xcd4b78
test dword [esi - 9], esp
fnstenv [edi + 0x240c8a53]
neg cx
mov bh, 0x53
mov cl, byte [esp]
btr eax, esi
ror esi, 0
mov ax, word [esp]
jmp 0xcd4a62
bts ecx, ebx
jmp 0xcd4ba1
invalid
mov ch, byte [ebp - 0x1000000]
je 0xcd4ba8
or dl, al
or al, 0
fadd qword [edi - 0x29]
mov dl, 0x41
invalid
inc cx
jg 0xcd5c16
add byte [edi], cl
mov fs, word [edi + 0x10]
add byte [eax], al
jle 0xcd5c16
push edi
sti
imul ecx, dword [esi], reloc.kernel32.dll_LoadLibraryA
jl 0xcd4c14
fdiv qword [edx + 0x15]
in al, 0x5a
test al, 0x29
mov ecx, 0xc89d2bd8
imul eax, dword [edx - 0x48], 0x7f
dec edi
add eax, 0x9f4f7e22
rol byte [esi - 0x7c813ab1], 0x4f
out 0xd6, al
jge 0xcd4c26
inc edx
cmp byte [edi + 0x4f], 0xed
test al, 0x7c
dec edi
cmp ch, byte [edx - 0x1212b07e]
or byte [edi + 0x2e], 0xd3
jge 0xcd4c3a
stc
invalid
je 0xcd4c1f
or al, byte [eax - 0x7d8eddb1]
dec edi
retf 0x7dc5
or byte [edi + 0x22], 0x71
or byte [edi - 0x36], 0xc5
jge 0xcd4c6e
ret 0x82fb
dec edi
inc ebp
sub al, 0x7e
dec edi
retf 0x7dc5
dec edi
popfd
imul eax, dword [esi - reloc.kernel32.dll_LoadLibraryA], 0x4f
ror byte [ebp - 0x7c], 0x4f
adc bl, byte [edx + 0x45ee4f7e]
jg 0xcd4c9e
cwde
lcall 0x4f81, 0x6cae4f82
mov byte [0x824f7e11], al
add eax, 0xb5be4f86
jle 0xcd4cb2
push ds
push ecx
jle 0xcd4cb6
loopne 0xcd4c13
or byte [edi - 9], 0xac
or byte [edi + 0x5c], 0xd3
jle 0xcd4cc2
dec edi
pop esp
sar dword [esi + 0x4f], cl
out 0xd6, al
jge 0xcd4cc6
retf 0x7dc5
dec edi
push eax
or bh, byte [edi + 0x4f]
invalid
dec edi
out 0xd6, al
jge 0xcd4d06
dec edi
pushal
pushal
or dword [edi + 0x56], 0xff4f8113
call 0x427c9c44
dec edi
scasd eax, dword es:[edi]
inc ecx
jle 0xcd4d16
dec edi
out 0xd6, al
jge 0xcd4d1a
jno 0xcd4cf1
test byte [edi + 0x4c], cl
jge 0xcd4d22
lahf
jno 0xcd4d55
dec edi
inc edi
mov al, byte [eax + 0x7f049c4f]
dec edi
lsl eax, word [ebx - 0x7f6012b1]
dec edi
test dword [ecx + eax*4], edx
dec edi
xor dword [eax + 0x7e], 0x4f
pop ecx
mov bh, 0x82
dec edi
sahf
mov ebp, 0x27194f7e
or byte [edi - 0x62], 0xbd
jle 0xcd4d46
sbb dword [edi], esp
jg 0xcd4d4a
mov byte [ecx - 0x28cab082], 0x83
dec edi
cmpsd dword [esi], dword es:[edi]
cmp eax, 0x333e4f84
jle 0xcd4d5a
dec edi
xor edi, dword ds:[esi + 0x4f]
test byte [esi - 0x80], ch
dec edi
in al, 0x94
or byte [edi + 0x3c], 0x4b
jle 0xcd4d66
dec edi
std
invalid
dec edi
mov byte [0xca4f7cd1], al
fidivr word [esi + 0x4f]
dec edi
jns 0xcd4d67
jle 0xcd4d76
out 0xd6, al
jge 0xcd4d7a
dec eax
call 0xd7b39cb4
jge 0xcd4d82
adc bh, ah
or dword [edi - 0x36], 0xb44f7dc5
cmp dword [edi + 0x4f], 0x4f80e96c
mov byte [0x744f8101], al
test byte [ebx + 0x7f74894f], 0x4f
insb byte es:[edi], dx
jmp 0x26f9cc5
dec edi
je 0xcd4d3f
or dword [edi - 0x77], 0x74
dec edi
mov dword [edi + edi*2 + 0x4f], esi
jg 0xcd4d9e
retf 0x7dc5
jge 0xcd4da6
ret
dec edi
pop ebx
pop edx
jg 0xcd4dae
out dx, eax
nop
jge 0xcd4db2
jp 0xcd4dc4
xchg byte [edi + 0xe], cl
dec edi
push cs
fild word [ebx + 0x7f0e874f]
dec edi
mov edx, dword [ebx]
jle 0xcd4dc2
cmpsd dword [esi], dword es:[edi]
add dword [ecx - reloc.kernel32.dll_LoadLibraryA], eax
dec edi
ljmp 0x7df5
dec edi
aas
cmc
jge 0xcd4dce
sar dword [ebx - 0x7c], cl
dec edi
wait
adc al, 0x85
dec edi
loopne 0xcd4d4d
jl 0xcd4dda
retf 0x7dc5
dec edi
mov dword [reloc.kernel32.dll_LoadLibraryA], eax
adc al, byte [ebp + 0x7eec814f]
dec edi
dec ebp
ret
dec edi
sub esp, 0xc34d4f7e
jle 0xcd4dfe
dec edi
mov ebx, 0xda4f839c
or byte fs:[edi - 0x69], 0xf4
jle 0xcd4e0a
dec edi
fisub dword [eax + eax*4 + 0x4f]
xchg edi, eax
hlt
sub cl, al
jle 0xcd4e0e
fadd st(3), st(0)
test byte [edi + 0x5c], cl
dec edi
pop esp
xchg edi, eax
jle 0xcd4e16
sub eax, dword [edi - 0x7f]
dec edi
movsb byte es:[edi], byte [esi]
test al, 0x7f
dec edi
xchg esp, eax
sub byte [ebp - 0x79c4a3b1], al
dec edi
mov byte [ecx - 0x5721b082], dh
jle 0xcd4e2e
dec edi
fisubr word [eax - 0x6e66b082]
cdq
xchg ecx, eax
jg 0xcd4e32
sal dl, 1
test dword [edi + 0x53], ecx
jmp 0xcd4e67
dec edi
jge 0xcd4e51
test byte [edi - 0x1a], cl
salc
dec edi
out 0xd6, al
jge 0xcd4e56
sub eax, 0x174f84e2
dec edi
pop ss
mov dl, 0x82
dec edi
or eax, 0x224f7e3b
xor byte [edi + 0x7f82a94f], al
dec edi
out 0xd6, al
dec edi
test eax, 0xe64f7f82
salc
jge 0xcd4e6e
cmpsb byte [esi], byte es:[edi]
leave
jle 0xcd4e72
xor al, 0xb0
xchg byte [edi - 0x6c], cl
mov bl, 0x7f
dec edi
retf 0x803d
dec edi
xchg esp, edx
jg 0xcd4e82
dec edi
jmp 0xcd4e70
jg 0xcd4ea2
pop ss
mov ch, 0x82
dec edi
cli
push eax
jge 0xcd4eaa
ftst
test dword [edi - 0x36], ecx
lds edi, [ebp + 0x4f]
setge byte [esi + 0x4f]
inc eax
or byte [edi - 0x4f], 0x58
jle 0xcd4ebe
dec edi
pop ss
push 0x132c4f7f
dec edi
sub al, 0x13
or byte [edi + 0x57], 0x4a
jle 0xcd4eca
in eax, dx
jge 0xcd4e02
dec edi
call 0xd91cccf4
cmpsb byte [esi], byte es:[edi]
jl 0xcd4ed6
jle 0xcd4ed2
dec edi
fsub dword [esi + reloc.kernel32.dll_LoadLibraryA]
or byte [edi - 0x5a], 0x3e
jle 0xcd4ede
lds eax, [eax + eax*4 + 0x4f]
cmpsb byte [esi], byte es:[edi]
jle 0xcd4ede
retf 0x7dc5
dec edi
sub ah, byte [eax - 0x7e]
dec edi
out 0xd6, al
jge 0xcd4efa
dec edi
iretd
dec edi
retf 0x7dc5
dec edi
mov dl, 0x4d
jge 0xcd4f1e
retf 0x7dc5
dec edi
and eax, 0xdf4f80d8
aas
dec edi
fistp qword [edi]
jg 0xcd4f2a
xchg esi, eax
daa
or byte [edi - 0x1a], 0xd6
dec edi
out 0xd6, al
jge 0xcd4f32
je 0xcd4e81
or byte [edi + 0x7e], 0xbb
or byte [edi - 0x36], 0xc5
jge 0xcd4f3e
inc eax
xchg ecx, eax
jle 0xcd4f42
mov bl, 0x72
xchg byte [edi + 0x1f], cl
dec edi
pop ds
adc byte [esi + 0x4f], bh
dec edi
out 0xd6, al
jge 0xcd4f4e
cli
sub al, byte [edi + ecx*2 + 0x4f850428]
add esi, dword [ebx + 0x7e]
dec edi
test dword fs:[ebp - reloc.kernel32.dll_LoadLibraryA], 0x827f4d4f
dec edi
ret
dec edi
leave
ja 0xcd4fa1
dec edi
cmp ebx, edx
jge 0xcd4f76
jne 0xcd4f69
jle 0xcd4f7a
dec edi
shr esp, 1
jg 0xcd4f7e
pop eax
xchg edx, eax
jg 0xcd4f82
dec edi
sub dword [eax + 0x7e], eax
dec edi
jl 0xcd4ef6
jle 0xcd4f8a
mov ebp, 0xb14f82df
xor eax, dword [eax + reloc.kernel32.dll_LoadLibraryA]
dec edi
dec edi
mov cl, 0x33
or byte [edi - 0x50], 0x7a
dec edi
mov al, 0x7a
jg 0xcd4f96
in al, dx
mov dword [reloc.kernel32.dll_LoadLibraryA], eax
test byte [edi + 0x18], cl
je 0xcd4ed6
dec edi
sbb byte [esp + eax*4 + 0x4f], dh
dec edi
out 0xd6, al
jge 0xcd4fa6
invalid
or dword [edi - 0x1a], reloc.kernel32.dll_LoadLibraryA
push ebp
or dword [edi - 0x28], 0x9d4f82e6
dec edi
popfd
outsd dx, dword [esi]
jg 0xcd4fca
dec edi
mov cs, word [ebp - 0x7c]
dec edi
add byte [esi], al
jle 0xcd4fd2
dec edi
push ebx
int1
jge 0xcd4fd6
cdq
or word [edi - 0x1a], 0xffd6
dec edi
out 0xd6, al
jge 0xcd4fde
out dx, eax
jge 0xcd4fe2
fist word [eax + 0x7e]
dec edi
cmc
cli
or dword [edi + 0x47], 0xd24f8005
mov eax, 0xc5ca4f7e
jge 0xcd4ff6
jle 0xcd4ff2
retf 0x7dc5
dec edi
dec eax
lodsb al, byte [esi]
or byte [edi - 0x16], 0xe1
jle 0xcd4ffe
retf 0x7dc5
inc al
mov bl, byte [esp]
jmp 0xcd4fe4
add byte [eax], 0x96
int1
add byte [edx + 0x342dbd3e], dh
mov dword [ebx], reloc.kernel32.dll_LoadLibraryA
sub eax, 0xc03c734
lahf
or al, 0x9f
out 0xf, al
bswap ebx
bsr ebx, esi
retf
ja 0xcd4fc3
inc al
jmp 0xcd500f
add esi, dword [ebp]
mov ah, dl
xchg ecx, eax
xchg cx, ax
cmc
jmp 0xcd502a
nop
adc ecx, dword [edx + reloc.kernel32.dll_LoadLibraryA]
and al, 0x8b
jmp 0xcd5014
sbb eax, 0x8b24048a
or al, 0x24
xchg al, cl
not eax
jmp 0xcd573e
enter 0xffffffffffffd0f7, 0xffffffffffffffe9
cmp byte [edi], al
add byte [eax], al
and dword [ebp + reloc.kernel32.dll_LoadLibraryA], esp
push esp
invalid
mov bl, byte [esp]
jmp 0xcd4fe4
movzx ebx, byte [esi - 1]
inc eax
jle 0xcd5056
jg 0xcd5040
jl 0xcd5018
imul ecx, dword [eax], reloc.kernel32.dll_LoadLibraryA
dec eax
das
fisubr dword [edx - 0x45]
js 0xcd4ff5
jns 0xcd5014
xchg ebp, eax
adc byte [esi + 0x5a110e1], al
lea ebx, reloc.kernel32.dll_LoadLibraryA
out dx, eax
mul cl
and byte [ebx - 0x75], ah
or al, 0x24
mov ecx, dword [esp]
pushfd
xchg byte [esp + 1], cl
jmp 0xcd50e3
mov ecx, dword [esp]
pushfd
xchg byte [esp + 1], cl
mov ah, bh
xchg cl, ch
bts eax, esi
call fcn.00cd5094
add byte [eax], al
je 0xcd5068
xchg edx, eax
cmc
add al, 0xb2
dec ecx
call 0x2daaf281
adc ecx, ebp
clc
jmp 0xcd51de
mov ah, bh
xchg cl, ch
jmp 0xcd5062
not ebx
not ax
mov ecx, ebx
jmp 0xcd5076
not ebx
not ax
mov ecx, ebx
adc ecx, ebp
clc
lea esp, [esp + 4]
neg esi
jmp 0xcd4fd9
xchg cl, ah
lea ecx, [ebx + edi]
not eax
mov ax, di
not bl
jmp 0xcd5781
xchg ecx, eax
lea eax, [ebx + 0xe9]
xchg cx, ax
xchg cx, ax
jmp 0xcd578f
lea eax, [ebx + 0xe9]
xchg cx, ax
xchg cx, ax
jmp 0xcd578f
lea ecx, reloc.kernel32.dll_LoadLibraryA
shl ax, 1
jle 0xcd574c
xchg ecx, eax
jmp 0xcd576b
ror bl, 0
ja 0xcd590f
bsr ax, dx
jmp 0xcd58d5
lea esp, [esp + 3]
jmp 0xcd57d5
lea esp, [esp + 3]
lea esp, [esp + 0x1c]
add bl, 0xf1
sbb ax, 0x2805
jmp 0xcd57f9
not eax
mov al, 0x39
not cx
sub esp, 0x1f
jne 0xcd57d1
je 0xcd57bb
jno 0xcd580f
mov ax, 0x6215
btc ax, si
jmp 0xcd5817
mov ax, 0x6215
btc ax, si
call 0xcd5833
adc ax, bx
jle 0xcd5839
mov word [esp], bx
xchg cx, ax
lea esp, [esp + 2]
jmp 0xcd589c
mov word [esp], bx
xchg cx, ax
jmp 0xcd5845
lea esp, [esp + 2]
jmp 0xcd589c
bt eax, ecx
jmp 0xcd5921
btr cx, si
rcl ecx, cl
jmp 0xcd5881
btr cx, si
rcl ecx, cl
and ebx, 0x3c
btr ecx, ebp
jmp 0xcd58bf
rol bl, 0
mov cx, word [esp]
neg ecx
js 0xcd587b
jns 0xcd5865
mov cl, byte [esp]
lea eax, reloc.kernel32.dll_LoadLibraryA
jmp 0xcd58e5
jg 0xcd58a9
mov cl, byte [esp]
lea eax, reloc.kernel32.dll_LoadLibraryA
jmp 0xcd58e5
mov al, dh
not ch
lea eax, [ecx*4]
jmp 0xcd585d
sub ebp, 4
bsf cx, bx
jmp 0xcd596e
mov ah, dl
lea eax, reloc.kernel32.dll_LoadLibraryA
jmp 0xcd5946
bsr ax, dx
mov al, dh
not ch
lea eax, [ecx*4]
bt eax, ecx
push edi
lea eax, [edi - 0x16]
lea esp, [esp + 4]
not bl
jmp 0xcd57eb
mov ecx, dword [ebx + edi]
call fcn.00cd5930
mov dword [ebp], ecx
mov ebx, edx
not cl
lea ebx, [esi + edi]
xchg ch, cl
jmp 0xcd5990
jns 0xcd58f2
mov ah, dl
lea eax, reloc.kernel32.dll_LoadLibraryA
jmp 0xcd5946
lea ebx, [ecx - 0x77]
lea eax, [eax + 0x54]
mov ebx, dword [esp]
jmp 0xcd5992
jmp 0xcd597a
lea ebx, [edi + 0x50]
not ah
mov eax, dword [esp]
setp al
jmp 0xcd5ba3
jp 0xcd59ea
lea esp, [esp + 3]
jmp 0xcd59ee
bswap ecx
mov ecx, dword [esp]
cmc
jno 0xcd5ac6
jo 0xcd5ac6
arpl word [ebx], ax
xchg ebx, eax
test byte [0x5ac45bb6], 0x3d
int3
lea esp, [esp + 3]
mov eax, edi
xchg bx, cx
jmp 0xcd59c9
lea ebx, [eax - 0xce]
lea ebx, [edx + edi]
jmp 0xcd5a91
inc bx
js 0xcd59f5
lea ebx, [eax - 0xce]
lea ebx, [edx + edi]
jmp 0xcd5a91
jae 0xcd5a43
jb 0xcd5a43
lea esp, [esp + 2]
jmp 0xcd5a63
lea esp, [esp + 2]
jmp 0xcd5a63
lea ebx, [ebp - 0x80]
sub esp, 0x16
jae 0xcd5a1e
jb 0xcd5a28
jmp 0xcd5a77
and bl, 0xfc
sub ebx, ecx
sub esp, 0x1e
jne 0xcd5a4d
push dword [esp + 6]
jmp 0xcd5aa3
push dword [esp + 6]
lea esp, [esp + 2]
jmp 0xcd5b65
sub ecx, eax
mov bx, 0x92fc
bswap ebx
mov bh, cl
shr ebx, 0x12
jmp 0xcd5a1a
lea esp, [esp + 2]
jmp 0xcd5b65
push esi
push edi
push ecx
jmp 0xcd5b0b
lea ecx, [edi + 0x40]
jmp 0xcd5a0b
cld
rep movsb byte es:[edi], byte [esi]
pop ecx
call 0xcd5aee
out dx, al
call fcn.00cd5b2d
lea esp, [esp + 3]
lea edi, [edi - 0x1f]
pushfd
add esp, 2
mov word [esp], si
jmp 0xcd5b13
mov esi, eax
mov edi, ebx
mov ecx, ecx
jmp 0xcd5ae4
mov byte [esp], ah
lea esp, [esp + 1]
lea esp, [esp + 1]
xchg dword [esp + 8], edi
clc
push dword [esp + 8]
ret 0xc
mov esp, ebx
pushfd
lea edi, [ecx + ebx - 0x40]
jmp 0xcd5aac
cmp ebp, ebx
ja 0xcd5014
mov eax, dword [esp]
sub esp, 0xf
jmp 0xcd59c1
rol esi, 0
jp 0xcd51d4
jnp 0xcd512f
jmp 0xcd5d6a
je 0xcd5c6a
dec cl
lea ecx, [edi*4]
jmp 0xcd5ca5
dec cl
lea ecx, [edi*4]
mov ch, 0xd9
rol al, 0
mov cl, byte [esp]
mov cx, sp
mov ch, 0x8e
jmp 0xcd5c87
neg ecx
jp 0xcd5ca9
lea ecx, [esi*4]
mov cx, word [esp]
jmp 0xcd5cba
mov ch, 0xd9
jmp 0xcd5c75
lea ecx, [esi*4]
mov cx, word [esp]
jmp 0xcd5cba
not al
shl ch, 7
jge 0xcd5d01
stc
pushfd
lea ecx, [ecx + edi]
jmp 0xcd5d1c
lea esp, [esp + 4]
neg al
lea ecx, [ebp*4]
lea ecx, reloc.kernel32.dll_LoadLibraryA
shl ecx, cl
jmp 0xcd5c54
pushfd
lea ecx, [ecx + edi]
jmp 0xcd5d1c
stc
jmp 0xcd5ceb
lea ecx, reloc.kernel32.dll_LoadLibraryA
jmp 0xcd5d2b
lea esp, [esp + 4]
sub al, 0x79
mov ecx, dword [esp]
lea ecx, [ecx + esi]
cmc
jmp 0xcd5d45
add dl, al
js 0xcd5d4f
dec ecx
jmp 0xcd5d99
jp 0xcd5d04
lea ecx, reloc.kernel32.dll_LoadLibraryA
jmp 0xcd5d2b
dec ecx
mov ah, ch
mov cl, ch
neg ax
jmp 0xcd5d78
not ch
add ch, 0x23
lea esp, [esp + 2]
jmp 0xcd5cd1
dec esi
rcl ah, cl
jmp 0xcd5db8
inc ax
xchg ecx, eax
call fcn.00cd5da2
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
pop ds
dec esp
int3
mov ah, ch
mov cl, ch
neg ax
jmp 0xcd5d78
jae 0xcd5d81
inc ax
xchg ecx, eax
jmp 0xcd5d84