Function at 0x1e9d902
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf1e8a278
jmp 0x1e9d921
pushal
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x1e9d93f
dec dh
jmp 0x1e9d945
bt ax, di
mov eax, 0xbef278d3
rdtsc
jmp 0x1e9d952
pushfd
jmp 0x1e9ce03
jns 0x1e9d929
bt ax, di
mov eax, 0xbef278d3
jmp 0x1e9d9b1
mov esi, dword [esp + 0x2c]
mov ebp, eax
mov edi, dword [esp]
mov bp, cx
jmp 0x1e9d98d
lea ebp, [esp]
sub esp, 8
jmp 0x1e9da0c
mov ax, 0xd9aa
mov byte [esp + 4], bh
jmp 0x1e9d9cb
rdtsc
jmp 0x1e9d952
jmp 0x1e9d9e2
sub esp, 0xb8
mov edi, esp
neg cx
jg 0x1e9d9b5
lea ecx, [esp + edi]
pushfd
jmp 0x1e9d9e6
lea ecx, [esp + edi]
pushfd
mov ebx, esi
btr ax, bx
jmp 0x1e9da47
mov cl, bl
mov ecx, dword [esp]
mov dx, si
clc
mov edx, ecx
lea eax, [esp - 0x31]
call fcn.01e9da18
jb 0x1e9da75
jl 0x1e9da59
salc
inc ecx
jnp 0x1e9d999
mov ax, 0xd9aa
mov byte [esp + 4], bh
jmp 0x1e9d9cb
mov dx, si
clc
mov edx, ecx
jmp 0x1e9d9fd
jnp 0x1e9d9f2
mov cl, bl
mov ecx, dword [esp]
jmp 0x1e9da2e
not esi
mov dl, byte [esp]
jmp 0x1e9da64
mov ax, 0xaab8
mov eax, dword [esp]
sub esp, 0x1e
jnp 0x1e9e022
jp 0x1e9df9b
mov ah, byte [ecx]
add eax, 0x8a130000
insd dword es:[edi], dx
pop edi
inc ecx
mov cl, 8
add dword [ecx - 0x4f], eax
xor al, 0xba
inc ebx
mov cl, 0x88
arpl word [esi - 0x4f], ax
xchg edi, eax
adc ecx, dword [edx - reloc.KERNEL32.dll_FreeEnvironmentStringsA]
or byte [ecx], al
inc ecx
mov cl, 0x34
mov edx, 0x6388b143
inc esi
mov cl, 0x97
cmp al, 0x41
mov cl, 0x24
sahf
inc ebp
mov cl, 0xb
stc
inc eax
mov cl, 0x82
arpl word [ecx - 0x4f], ax
pop esi
jne 0x1e9dae2
mov cl, 0xf8
les eax, [ecx - 0x4f]
int3
inc ecx
mov cl, 0xfb
push esp
inc ebx
mov cl, 0x38
cmp eax, 0xf90bb145
inc eax
mov cl, 0xd
mov ch, 0x45
mov cl, 0xf5
push ecx
inc ecx
mov cl, 0xba
in al, dx
inc eax
mov cl, 0x9d
jno 0x1e9db41
mov cl, 0x11
pop eax
inc ebx
mov cl, 0x88
out 0x42, al
mov cl, 0x5c
out 0x40, al
mov cl, 0x95
xchg esp, eax
inc ecx
mov cl, 0x92
scasd eax, dword es:[edi]
inc esi
mov cl, 0x7c
pop edi
inc edx
mov cl, 0x49
dec edi
inc ebx
mov cl, 0xb5
push esi
inc ebx
mov cl, 0x68
lea eax, [ebx - 0x4f]
dec edx
imul eax, dword [ebx - 0x4f], 0x5c
out 0x40, al
mov cl, 0x80
push es
inc ebx
mov cl, 0xd8
push cs
inc esi
mov cl, 0xde
nop
inc edi
mov cl, 0x75
xor dword [ebx - 0x4f], eax
add dword [ebx + eax*2 - 0x4f], esi
pop esp
out 0x40, al
mov cl, 0xb0
insb byte es:[edi], dx
inc ebx
mov cl, 0xe2
inc ebx
mov cl, 0x55
insd dword es:[edi], dx
dec ecx
mov cl, 0x84
stc
inc edi
mov cl, 0xfd
mov dword [ebx - 0x4f], 0xb147bf2f
or edi, ecx
inc eax
mov cl, 0x5c
out 0x40, al
mov cl, 0xe8
mov al, byte [0x6b61b143]
inc ebx
mov cl, 0x3c
or al, 0x44
mov cl, 0x6b
or al, 0x43
mov cl, 0xe0
dec ebx
inc edx
mov cl, 0xee
add dword [edx - 0x4f], 0xb1478d3a
sbb byte [edi + eax*2], dh
mov cl, 0x8b
cld
inc ecx
mov cl, 0x3e
inc byte [eax - 0x4f]
sbb dh, byte [esi]
inc esp
mov cl, 0xa1
ljmp 0xb144
rcl dl, 4
bswap edx
bsr eax, edi
jmp 0x1e9deb6
mov dl, byte [esp]
rcl dl, 4
bswap edx
bsr eax, edi
call 0x1e9dee2
test byte [esi], bl
mov ebx, gs
xchg edx, eax
div byte [ebx - 0x1d]
xchg byte [ebp - 0x3a], dh
mul cl
and byte [ebx - 0x66], ah
setb al
rdtsc
mov dword [esp + 1], edx
push word [esp + 1]
jmp 0x1e9def1
lea esi, [esi - 0x3f]
xchg dl, ch
not ax
mov ax, word [esp]
cmc
stc
jmp 0x1e9df47
mov cx, word [esp]
bsr cx, cx
jge 0x1e9deab
mov dl, byte [esp]
jmp 0x1e9de92
xchg dword [esp + 0xc], esi
mov cl, byte [esp]
bsr ax, si
bsf cx, bp
push dword [esp + 0xc]
ret 0x10
lea eax, reloc.KERNEL32.dll_FreeEnvironmentStringsA
lea esp, [esp + 2]
jmp 0x1e9e02c
lea eax, reloc.KERNEL32.dll_FreeEnvironmentStringsA
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
xor esi, 0x2bfa9ffa
jmp 0x1e9df14