Function at 0x270a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00027bb8
das
dec ax
mov eax, dword [0x1e2b0]
pushal
call fcn.00022b82
push 0x178b2082
pushal
pushfd
mov byte [esp], dh
lea esp, [esp + 0x28]
je 0x18d41
call fcn.0003915b
clc
bt di, bp
cmp dword [0x1e518], eax
pushfd
call fcn.0002b352
call fcn.00038957
clc
pushal
clc
bt cx, 0xd
test eax, eax
pushfd
mov byte [esp], ch
lea esp, [esp + 0x24]
jne 0x33248
not dl
bswap dx
mov dx, bp
lea edx, [ebp - 0x38]
pushfd
mov dword [esp], edx
pushfd
pushfd
pushfd
pushal
mov dword [esp + 0x28], 0x2982f
pushfd
jmp loc.0001947d
stc
test al, 0x69
lea eax, [eax + ecx - 1]
clc
clc
call fcn.000138e6
push ecx
pushal
mov byte [esp], 0x15
mov dword [esp + 0x24], esi
mov byte [esp], cl
pushfd
mov byte [esp], bh
push dword [esp + 0x28]
ret 0x2c
jmp 0x2de0c
lea esp, [esp + 4]
je 0x38801
setne dl
pushal
call fcn.0003247a
cmc
sub esi, esi
cmp bl, ch
bt ebp, 0x1d
mov dword [ebp + 0xc], esi
pushal
cmp bh, dh
bt ebp, 0x19
stc
test esi, esi
mov byte [esp + 4], al
mov byte [esp], 0xc8
pushal
lea esp, [esp + 0x40]
jge 0x13d4e
jne 0x40fbb
add ax, ax
shr ah, 5
setno al
cmp dh, bl
mov eax, dword [edi + 0x50]
jmp 0x2168f
pushfd
pushfd
mov dword [esp + 0x28], eax
call fcn.000229dd
adc ebx, ebx
bswap ebx
call fcn.00026f0e
stc
movzx eax, word [edi + 6]
pushfd
cmc
jmp 0x334f0
test edx, edx
pushal
mov byte [esp + 0x14], 0x8a
lea esp, [esp + 0x24]
je 0x376be
stc
sal si, cl
btr si, sp
lea esi, [ebx + 0x784b4ea]
mov esi, dword [ebx - 8]
test al, dl
call fcn.00022dcd
lea esp, [esp + 0xc]
je 0x40870
pushfd
test eax, eax
pushal
pushal
mov dword [esp + 8], eax
lea esp, [esp + 0x44]
jl 0x40870
adc ah, 4
add ecx, dword [0x1e2a4]
movsx ax, cl
pushal
mov word [esp + 4], di
mov dword [ebp - 4], ecx
lahf
mov dword [0x1e2d8], ecx
pushal
xchg al, ch
not ch
movzx ecx, al
lea eax, [ebp - 4]
movsx ecx, bl
lea ecx, [ecx*4 - 0x4383de39]
mov dword [esp + 0x3c], eax
mov word [esp], cx
call fcn.000267f0
push edi
lea esp, [esp + 4]
call fcn.00018030
inc si
not esi
mov esi, eax
jmp 0x3e32d
pushfd
mov dword [esp + 0x24], ecx
mov word [esp + 4], sp
pushal
call fcn.0002cae1
pushal
pushfd
mov dword [esp + 0x40], ebx
push dword [esp + 0x10]
mov dword [esp + 0x40], eax
push 0xdeb3c56
push eax
jmp 0x3a5f8
lea esp, [esp + 4]
jb 0x376fd
btc ax, 0xc
bswap eax
btc ax, 8
lea eax, [edx + ecx - 1]
stc
xor edx, edx
jmp 0x3bba9
pushfd
pushfd
lea ecx, [ebp - 0xc]
jmp 0x285a0
lea eax, [esi - 0x718c79b2]
dec ah
mov eax, dword [0x1e4f0]
pushal
stc
stc
test eax, eax
push dword [esp]
lea esp, [esp + 0x24]
je 0x38801
pushfd
mov byte [esp], 0xde
cmp eax, dword [0x1e2c4]
mov dword [esp], 0xcfcb2870
mov byte [esp], ch
jmp 0x23727
imul esi, ecx
cmc
test eax, eax
pushfd
pushal
lea esp, [esp + 0x2c]
jbe 0x259c2
pushal
sar bl, 2
or ebx, edx
ror ax, cl
lea ebx, [edi + 0x108]
bsf edx, edx
shrd dx, dx, 8
dec dh
clc
lea ecx, [ecx]
sub esp, 0xffffffe0
bt dx, di
aad 0x7c
not al
rdtsc
mov eax, dword [ebx]
xor dl, 0x44
xor edx, 0x18b69191
mov edx, dword [ebx + 4]
test ax, 0xddcc
bt sp, cx
jmp 0x34919
sar dh, cl
mov dh, 0xfa
mov edx, dword [ebx - 4]
cmc
cmp di, 0x84d7
pushfd
jmp 0x27394
add edx, eax
cmc
cmc
cmp ch, 0x3b
cmp edx, dword [ebp + 0xc]
push eax
lea esp, [esp + 4]
jo 0x36ceb
push ebp
push dword [esp]
lea esp, [esp + 8]
ja 0x259bf
jmp 0x34243
pushfd
mov byte [esp], 0x43
push dword [esp]
lea esp, [esp + 8]
ja 0x259bf
ror dh, cl
push ecx
sbb dl, ch
dec dl
mov edx, dword [ebx - 4]
test sp, 0xac36
test edx, edx
pushfd
call fcn.0003aad9
bts dx, di
sbb dx, 0xc45c
clc
pushal
mov edx, dword [ebx - 8]
cmc
cmp edx, eax
mov dword [esp + 8], ebx
lea eax, [eax + ecx - 1]
lea esp, [esp + 0x20]
jae 0x3a846
push 0xa630467e
mov byte [esp], 0x73
lea esp, [esp + 4]
jb 0x376fd
aaa
daa
aam 0xee
cwde
lea eax, [edx + ecx - 1]
call fcn.000312f8
bsr eax, edi
test al, ah
mov eax, dword [0x1e52c]
pushal
pushal
cmp eax, ebx
lea esp, [esp + 0x40]
jo 0x2143f
je 0x18d41
pushal
jmp 0x28f4d
push 0xa4f0a432
mov dword [esp + 0x48], 0x23cad
call fcn.000354bb
mov dword [esp], esi
push esp
call fcn.0002966a
movzx si, al
push 0xf7e2b41e
mov edi, dword [esp + 4]
push dword [esp + 4]
lahf
mov esi, dword [esp + 0xc]
lahf
mov eax, 2
movsx bx, cl
mov ebx, dword [esp + 0x10]
jmp 0x38493
pushfd
jmp 0x2ca46
push 0x3e10f2d7
div ecx
not dl
clc
imul eax, ecx
shr dl, 4
clc
rol dx, 7
add esi, eax
dec eax
mov eax, dword [ebp - 4]
call fcn.0002d920
mov dword [esp + 0xc], 0x3be61
push 0x5b1d9ab8
push dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
pop dword [esp + 0xc]
mov word [esp + 8], 0x5191
pushal
pushfd
push dword [esp + 0x30]
ret 0x34
pushfd
test esi, esi
call fcn.0002ae5a
push dword [esp]
push dword [sym.imp.ntoskrnl.exe_KeCancelTimer]
pop dword [esp + 0x40]
mov byte [esp + 8], ah
push edx
push dword [esp + 0x44]
ret 0x48
pushal
lea eax, [ecx - 0x128de9dc]
mov byte [esp + 4], 0xf1
lea eax, [ebp - 4]
movzx ecx, cl
mov dword [esp + 0x1c], eax
jmp 0x22727
setb cl
mov ch, 0xdf
pushal
movsx ecx, dl
mov ecx, dword [ebp + 0xc]
call fcn.00040771
pushal
mov byte [esp], 0xe4
mov dword [esp + 0x24], edx
mov word [esp + 0xc], si
jmp 0x26806