Function at 0x5167f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 6], ch
jmp 0x516803
mov cl, byte [esp + 2]
pop dword [esp]
push word [esp + 2]
rdtsc
pop bp
neg esi
jmp 0x516839
neg cx
shr bx, 9
setp ch
add esp, 0
sub dx, si
jmp 0x51695e
lea eax, [edi*4]
mov byte [esp + 1], bh
push dword [esp]
xchg cx, ax
bswap ebp
pop dword [esp]
jmp 0x516823
push dword [esp + 4]
xchg byte [esp + 6], bl
mov byte [esp + 0xb], dl
lea esi, [eax*4]
jmp 0x5168c2
sub esp, 0x13
mov dl, ch
mov dx, 0x836f
lea ebx, reloc.KERNEL32.dll_GetProcAddress
mov dh, bl
lea esp, [esp + 0xe]
jmp 0x51687b
setge bh
lea esi, [ebx*4]
xchg byte [esp + 7], cl
pop word [esp + 7]
call fcn.005168ac
dec eax
popal
jo 0x516920
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
pop dword [esp]
rdtsc
mov byte [esp], bh
rdtsc
xchg dx, ax
xchg dword [esp], eax
jmp 0x516895
mov ah, ch
mov ecx, edi
call fcn.005168f6
inc edi
je 0x51696c
je 0x51697c
jb 0x516991
jne 0x51698f
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add byte [edx - 0x1960f3c3], al
mov word [esp + 1], si
xchg dh, bl
xchg di, si
bt cx, ax
xchg ecx, esi
mov al, 0xc9
jmp 0x51690c
std
add esp, 0
pushfd
mov cx, sp
setle al
mov ah, 0x42
jmp 0x5168e4
je 0x51696d
invalid
invalid
bswap edi
mov word [esp], bp
clc
mov esi, 0x42c6e095
jmp 0x5169b1
mov word [esp + 4], dx
push esp
and al, 4
push di
add esp, 1
jmp 0x516970
mov ax, 0xcac0
call fcn.005169cb
push esp
insb byte es:[edi], dx
jae 0x5169ef
je 0x516a01
popal
insb byte es:[edi], dx
jne 0x516a14
add byte [edx + 0x24748766], cl
add eax, 0xb08de81b
mov eax, dword [reloc.KERNEL32.dll_GetProcAddress]
cmp al, 0xbd
add byte [eax], al
add byte [eax], al
xchg word [esp + 5], si
sbb ebp, eax
lea esi, reloc.KERNEL32.dll_GetProcAddress
lea edi, [edi*4]
ror bx, cl
std
jmp 0x51699b
inc esp
and al, 3
invalid
jmp 0x516a70
xchg bx, si
sub edi, ecx
bswap edi
mov byte [esp], al
setb ah
cpuid
jmp 0x516a99
xchg edx, edi
setae al
mov dh, byte [esp + 2]
cpuid
mov edx, 0x9c772620
dec esi
jmp 0x516a4a
lea ebx, [esp + ebp]
bsr bx, bp
cpuid
mov al, byte [esp]
setl cl
jmp 0x516ace
sub esp, 2
pop esi
cld
mov ax, si
stc
and bl, bh
jmp 0x516a83
xchg byte [esp + 5], cl
not esi
mov word [esp + 0xe], cx
xchg edx, esi
btc edx, ebp
jmp 0x516b50
bsr di, ax
inc cl
lea esp, [esp]
mov al, dh
sub esp, 0x14
push dword [esp + 7]
jmp 0x516ab8
mov word [esp + 0x10], sp
lea ecx, reloc.KERNEL32.dll_GetProcAddress
jmp 0x516b28
mov dh, byte [esp + 0xb]
mov dword [esp + 0xd], esi
mov dword [esp + 0x10], ebp
push dword [esp + 0x17]
mov ax, di
rdtsc
jmp 0x516ae2
xor edx, ebx
lea ebx, [ebp*4]
cpuid
push word [esp + 0x14]
pop ebx
xor ah, cl
jmp 0x516af8
lea edi, [ebx*4]
lea edx, reloc.KERNEL32.dll_GetProcAddress
mov byte [esp + 0xb], al
mov bl, al
mov bp, 0x6d14
pop di
jmp 0x516bd1
xchg edi, ebx
lea ebx, [edx + ebx]
not ecx
xchg dx, di
xchg ah, al
push si
jmp 0x516b13
mov cl, 0x23
mov bx, di
push ecx
add esp, 2
add esp, 1
neg al
jmp 0x516b9f
cmc
add esp, 3
adc bp, si
pop dx
pop ebx
lea ecx, [esi*4]
jmp 0x516b60
mov eax, dword [esp + 2]
shr esi, cl
rdtsc
mov ebx, esp
lea esp, [esp + 3]
jmp 0x516bb2
mov ecx, 0x24f36f6
xchg byte [esp], al
lea ecx, [ebx + esi]
dec di
seto ah
pushfd
jmp 0x516b89
lea ebx, [edx + ebx]
pushal
mov bp, di
lea eax, [esp + esi]
std
rdtsc
jmp 0x516c01
xchg dword [esp + 0xe], edi
pop dword [esp + 0x10]
mov word [esp + 0x13], bp
lea ebp, [ebx + ebx]
mov dword [esp + 0x11], ebp
lea esp, [esp + 0xe]
jmp 0x516b76
mov ah, byte [esp + 9]
ror bx, 0xa
xchg edx, edi
mov bl, dh
bt bx, sp
jmp 0x516c47
mov ecx, dword [esp + 0x20]
lea esi, [edi*4]
mov ax, 0x89f5
jmp 0x516beb
xchg byte [esp + 4], al
rcl ecx, 0xc
mov cx, word [esp + 6]
lea ecx, reloc.KERNEL32.dll_GetProcAddress
mov dl, 0x23
call fcn.00516ab2
mov word [esp + 0x19], si
pop word [esp + 0xd]
lea esp, [esp + 0xf]
mov edx, edi
jmp 0x516c75
pop word [esp + 0x17]
neg bl
pop word [esp + 0x13]
cpuid
neg al
setle dh
jmp 0x516c31
std
std
pop bx
adc eax, ecx
lea esp, [esp + 9]
lea edi, [eax*4]
jmp 0x516c18
mov cl, al
lea esi, [edi + 0x92]
call 0x516d53
inc edi
je 0x516cd9
je 0x516cec
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[esi - 0x77], ah
push esp
and al, 2
inc dh
bsf eax, ebp
mov eax, 0x63edf8b4
lea eax, [eax*4]
rol bh, 7
jmp 0x516c62
lea ebx, [esi + edi]
mov eax, 0x1cd90705
stc
mov ebp, dword [esp]
jmp 0x516d24
mov ebx, dword [esp + 3]
not dl
cpuid
rdtsc
shl ch, cl
not eax
jmp 0x516caa
outsd dx, dword [esi]
arpl word [eax], ax
pop bp
setbe dh
pop dword [esp]
mov dword [esp + 2], edi
cmc
xchg si, ax
jmp 0x516cc0
ror dword [ebx - reloc.KERNEL32.dll_GetProcAddress], cl
cmp al, 0x24
mov eax, dword [esp]
stc
mov edi, dword [esp]
xchg ebp, ebx
neg eax
xchg dl, ah
jmp 0x516d3c
lea esp, [esp + 1]
xchg word [esp], ax
mov al, ch
pop dx
xchg si, cx
setb ch
jmp 0x516ced
xchg word [esp + 8], dx
dec al
mov ch, 0x97
mov ax, 0x40b
mov bx, word [esp + 2]
lea esp, [esp + 8]
jmp 0x516d03
clc
rdtsc
xchg dx, ax
not dx
call fcn.00516da7
push eax
push ebx
inc ecx
push eax
dec ecx
inc esp
dec esp
dec esp
add byte [ebp + 0x75288b], cl
add byte [esi - 0x43], ah
jne 0x516daf
xchg ebp, ecx
mov byte [esp + 2], ch
jmp 0x516cdc
pop dword [esp + 3]
xchg word [esp + 1], dx
cld
bswap ecx
jmp 0x516dd0
mov word [esp + 0xc], cx
rol ebx, 4
mov byte [esp + 0xc], dh
xchg dword [esp + 9], ebp
mov dword [esp], edx
mov byte [esp + 0xf], al
jmp 0x516e5c
xchg byte [esp + 0xa], bl
xchg cl, bl
mov word [esp + 0xa], cx
pop dword [esp + 1]
jmp 0x516e37
add ch, ah
std
lea edi, [eax + eax]
bsr ebp, edx
std
mov ah, bl
jmp 0x516dfc
mov si, sp
bswap eax
lea ebp, [edi*4]
rdtsc
bswap eax
jmp 0x516e8e
lea esp, [esp + 6]
inc ah
inc ch
cpuid
mov byte [esp + 5], ch
mov edi, esp
jmp 0x516e21
cld
push bx
std
mov dword [esp + 1], edx
pop edi
mov eax, 0x8b305c0a
jmp 0x516e13
bswap eax
mov bl, 0xf1
lea esp, [esp]
lea esp, [esp + 2]
lea esp, [esp + 4]
popal
jmp 0x516eb9
mov esi, eax
setge bl
xchg bp, ax
mov dl, byte [esp + 2]
lea esp, [esp + 1]
not bl
jmp 0x516e6c
sub esp, 1
lea esp, [esp + 1]
popfd
jmp 0x516f3d
push 0x9b85b794
add dword [esp], reloc.KERNEL32.dll_GetProcAddress
call fcn.00516f1b
push dword [esp + 5]
pop word [esp]
pop word [esp]
call fcn.00516f8a
dec ecx
jae 0x516fa4
popal
inc ebx
outsd dx, dword [esi]
push eax
je 0x516fdd
add cl, dh
pop word [esp + 3]
jmp 0x516f4e
lodsd eax, dword [esi]
movsb byte es:[edi], byte ss:[esi]
ret
dec esp
inc ebx
dec ebp
popal
jo 0x517036
je 0x517057
imul ebp, dword [esi + 0x67], reloc.KERNEL32.dll_GetProcAddress
push sp
pushfd
pop word [esp + 2]
lea esp, [esp + 1]
mov word [esp], sp
call 0x516f6d
push dword [esp + 3]
push si
call 0x517042
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax + 0x6604246c], cl
push dword [esp + 3]
pop dword [esp]
mov byte [esp + 1], ah
call 0x517001
mov word [esp + 8], bx
call fcn.0051705a
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x5170a0
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add bl, ch
call 0x24a5f9ae
mov word [esp + 0x14], dx
invalid
je 0x517070
adc byte [esi + 0x50], ah
jmp 0x517068
cld
iretd
mov word [esp + 0x16], bp
mov word [esp + 0x1a], bp
and al, 0x1a
mov word [esp + 0xb], si
lea esp, [esp + 0xd]
push dword [esp + 0xc]
jmp 0x517438
jmp dword [esi - 1]
push 0
pushfd
mov dword [esp], ebx
call fcn.005170be
mov word [esp + 2], bp
lea esp, [esp + 1]
pop word [esp]
mov word [esp], si
lea esp, [esp + 2]
jmp 0x517177
pushal
pop word [esp + 7]
push dword [esp + 0x19]
pop word [esp]
jmp 0x51719d
push 0
pushal
push bx
push word [esp + 0x20]
mov dword [esp + 0x14], ebx
jmp 0x517161
not bh
mov edx, dword [esp]
call fcn.005171f5
push ebx
dec eax
inc ebp
dec esp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx - 0x72d0dbac], cl
adc al, 0x39
mov dword [esp + 0x2f], edx
lea edx, [ecx + edi]
not bl
lea edx, [eax*4]
mov dword [esp + 0x14], ebp
mov bl, byte [esp]
jmp 0x517187
mov word [esp + 4], si
pushfd
lea esp, [esp + 7]
lea esp, [esp + 3]
lea esp, [esp + 0x10]
jmp 0x51711f