Function at 0x6cde5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp + 3]
sub dx, 0xb258
inc ebp
jmp 0x6cdec8
lea ebp, [ebx*4]
bsf bp, ax
lea ebp, reloc.KERNEL32.dll_DuplicateHandle
jmp 0x6cded9
mov bp, word [esp]
mov eax, dword [esp]
mov bp, 0xab53
rol dx, cl
lea ebp, [edx + edi]
bswap ebp
jmp 0x6cde91
pop bp
mov ah, byte [esp + 1]
neg ebp
pop dx
sub ebp, eax
mov ebp, dword [esp]
jmp 0x6cdea8
mov al, byte [esp]
xchg ebp, eax
btr ebp, edx
mov ebp, dword [esp]
seto dh
jmp 0x6cdf27
xchg bp, ax
btr edx, edx
mov ebp, 0xaa9c3742
mov ebp, dword [esp + 3]
mov bp, di
mov ax, 0xe087
jmp 0x6cdf91
or bp, 0xe6d8
not dh
lea eax, reloc.KERNEL32.dll_DuplicateHandle
rdtsc
rdtsc
push esp
jmp 0x6cdf09
mov byte [esp + 1], dh
push word [esp + 3]
pop bp
setle dh
mov al, ah
setne dh
jmp 0x6ce14b
lea eax, [edi*4]
mov dword [esp], eax
xchg ah, dh
mov ebp, esp
bsf ax, ax
not dh
jmp 0x6cdf51
setle ah
bsr ax, cx
mov ebp, 0xa528ed62
rdtsc
mov bp, sp
jmp 0x6cdf75
xchg byte [esp + 2], al
btc ebp, ebx
lea ebp, [ecx*4]
mov dword [esp], ecx
jmp 0x6ce062
pop word [esp + 0x12]
pop dword [esp + 8]
push esp
mov al, ah
mov dword [esp + 0x13], ecx
cld
jmp 0x6cdfbd
lea esp, [esp + 0xa]
pushal
mov ebp, 0xdc482d66
mov ebp, 0x91255e0a
bsr dx, bp
pop bp
jmp 0x6cdfd5
push dword [esp]
mov byte [esp + 3], ah
xchg byte [esp], al
clc
sub esp, 0x14
lea ebp, [eax - 0x59]
jmp 0x6cdff3
invalid
sub esp, 0x1e
lea esp, [esp + 0x51]
sete dh
bsf bp, ax
call fcn.006ce02d
loopne 0x6ce0cc
out 0x81, al
jo 0x6ce037
in eax, dx
cld
mov dh, byte [esp + 0x2e]
rdtsc
push dword [esp + 0x2d]
rdtsc
adc edx, esi
and ebp, ecx
jmp 0x6ce047
xchg dh, dl
add esp, 3
lea ebp, [ecx*4]
add al, dh
xchg word [esp], bp
bts ebp, ebx
jmp 0x6ce01a
inc ebp
mov dx, word [esp]
add esp, 6
pop ebp
xchg byte [esp], al
mov bp, di
jmp 0x6ce0fe
cmp dword [eax - 0x55], ebx
sbb al, 0x48
jmp 0x6ce127
push esp
btr ebp, esp
mov byte [esp + 7], ah
cld
lea ebp, [ecx - 0x93]
xchg bp, ax
jmp 0x6ce0b9
mov ebp, esp
lea ebp, [edx + edi]
mov byte [esp + 5], bh
inc dh
mov dx, bp
xchg edx, ebp
jmp 0x6ce0d2
not dh
mov byte [esp + 1], ch
setl dh
not ah
bsf ax, si
not ebp
jmp 0x6ce12c
inc esp
and al, 3
jmp 0x6ce0ec
mov dx, di
mov al, 0xb6
bswap eax
mov dx, di
mov bp, word [esp]
pushal
jmp 0x6ce224
mov dword [esp], ebp
push dword [esp + 2]
btr eax, edx
not ax
rdtsc
xchg dword [esp + 2], edx
jmp 0x6ce09f
rcl dh, 3
push dword [esp + 9]
mov bp, word [esp + 9]
not edx
mov al, 0x86
mov eax, ecx
jmp 0x6ce196
setl ah
rcr edx, 0x1b
xchg ebp, edx
lea ebp, [ecx + 0x4b]
rcl dh, 3
mov byte [esp + 0x1b], dh
call fcn.006ce163
lea edx, reloc.KERNEL32.dll_DuplicateHandle
mov dx, 0xbf0f
pop word [esp + 8]
push word [esp + 4]
push word [esp + 8]
call fcn.006ce1d5
push es
sahf
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
adc dword [edi + 0x76], ebp
popal
mov al, byte [0x448f66e3]
and al, 0x1b
mov word [esp + 0x23], sp
mov byte [esp + 0x21], dh
add esp, 0x20
cld
not dh
jmp 0x6ce165
bswap edx
pop edx
bswap ebp
mov dword [esp + 0xc], eax
sub esp, 0xc
push dword [esp + 0x1a]
jmp 0x6ce17f
bsf ax, ax
btc ebp, edi
mov ax, word [esp + 0x13]
lea ebp, [ebp*4]
rcr ebp, 5
pop edx
jmp 0x6ce1ed
xchg word [esp + 0xf], bp
xchg dword [esp + 0xc], ebp
mov ebp, esp
mov ah, byte [esp + 0xd]
mov eax, 0xe5935582
mov bp, 0xe025
jmp 0x6ce204