Function at 0x9a033d
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
bswap ecx
pop edi
jmp 0xa64eb4
pop ebx
cbw
dec ebp
arpl si, si
dec eax
not ecx
dec ebp
add ecx, esi
inc esp
movsx esi, cl
inc ecx
jmp ecx
push 0x15932f00
mov dword [esp], 0xe9246236
lea esp, [esp + 4]
jmp esi
add edi, eax
sar edx, 7
xadd dl, dh
lea eax, [edx - 0x1072e278]
mov eax, dword [ebp]
bts edx, 0x2c
adc edi, ecx
lea ecx, [eax + edx*2 - 0x2cc70b59]
rdtsc
xor ecx, ecx
bswap ecx
lea esi, [esi + ecx*4 - 8]
mov dword [esi + ecx*8 + 4], eax
mov eax, ecx
and cl, cl
mov dword [esi + ecx*2], edx
jno fcn.00bd8a38
mov edx, 0x7a14240e
push edx
lea eax, [edx + edx - 0x65cb87db]
mov ecx, dword [edx + edi - 0x7a14240e]
xchg byte [esp + edx - 0x7a14240c], al
add dword [esp + edx - 0x7a14240e], 0x1394bbad
push edx
xor ecx, ebx
jmp 0xade9a9
mov dword [esp], 0x508cd43a
push 0xacb31305
cmp ebp, ecx
jmp 0xac9da0
inc eax
xor bh, bl
sal dword [esp + 2], 0x7f
dec eax
not dword [esp]
inc ecx
xadd al, cl
inc eax
not bh
inc eax
xor bh, 0x8c
inc cx
shr edi, 0xf
inc eax
not bh
rol eax, 0x49
inc eax
neg bh
jmp 0xacc1eb
jnp 0xb07105
dec esp
mov dword [esp + esi - 0x2c32e098], ecx
ret 0x10
jb 0x96254e
dec ebp
adc ecx, eax
inc sp
xor ebp, esi
inc ebp
movsx edi, bp
inc esi
mov eax, dword [ebp + esi*2]
call fcn.00a878ca
not cl
sal edx, 0x28
adc cl, 0x18
rol cl, 1
sar edx, 0x73
and dl, dl
xor bl, cl
add ecx, esp
neg edx
dec edx
sets dl
mov byte [ecx + edx*2 - 0x1800], al
movsx ecx, dx
movsx eax, dx
ror dl, 4
lea edx, [ebp + edx*8 - 0x5ffe]
bts eax, eax
cbw
mov dword [ebp + ecx*4 - 0x3002], edx
lea edx, [ecx - 0x2a74eb43]
lea ebp, [ebp + ecx - 0xc02]
mov eax, dword [esi + ecx*2 - 0x1805]
lea esi, [esi + ecx*8 - 0x6005]
xor eax, ebx
bswap eax
bt edx, ecx
bswap edx
sbb ecx, 0x878d1115
not eax
dec dx
jo 0x992d85
lea eax, [ecx + eax - 0x59d06cc2]
rol dl, 0xe3
inc cx
ror edx, 0x73
bswap eax
or dl, 0x81
xor eax, 0xdcb8789f
btc cx, 0xb3
setb cl
xor ebx, eax
add edi, eax
jmp fcn.009fa672
mov edx, 0xd818ce81
mov ebx, ecx
pop edx
push ebx
mov esi, dword [esp + ecx - 0x395efffc]
mov ebp, ebx
lea ebp, [ebp - 0x60c2ea70]
mov ebp, dword [esp + ecx - 0x395efff8]
push ecx
push ebx
mov eax, dword [esp + ecx*2 - 0x72bdffec]
mov ebx, dword [esp + ebx - 0x395effe8]
call fcn.00b2d84c
mov ecx, 0xd6932b3f
sar ecx, 0x5c
movsx edx, cx
mov edx, dword [esi]
jne 0x9e9052
sbb al, 0x1b
adc ebp, 6
neg eax
mov word [edx + eax - 0x1e214d23], cx
mul eax
mov ecx, 0xb7195305
xadd cl, ah
jmp edi
sal dword [esp + ecx - 0x37c08987], cl
not eax
sal dl, 0x26
sub edx, edx
dec eax
btc cx, dx
setae dl
xchg edx, ecx
bswap eax
and ecx, 0x6d0753b1
imul edx, ecx
adc eax, 0x82096b35
jmp 0xae3ec6
push 0x7bb04e18
lea esp, [esp + 0x14]
ja 0x98bedc
mov eax, esp
mov ecx, 0xf83d12a3
movsx edx, cl
mov ecx, 0x54
inc edx
and edx, edx
rol dx, 0xe
lea edx, [ebp - 0x80]
jb 0xba30b2
inc ebp
movsx ebp, ah
dec ebp
arpl ax, ax
jae 0xa26f8e
jmp 0xab0656
inc cx
or eax, 0x1a41b4a9
invalid
cdq
sub eax, dword [esp + 3]
add ecx, edx
or al, byte [esp + 2]
jno 0xc0bf70
mov esi, dword [ebp]
call fcn.00b21c7a
sub esi, 0xfffffffa
mov dword [esp + 4], 0x86172b8b
mov ecx, dword [edi]
add edi, 4
rol byte [esp + 7], 0x82
xor ecx, ebx
push 0xb1e3a92
xor ecx, 0xbd2d9ebc
mov eax, dword [esp + 8]
call fcn.00b211ce
mov ecx, 0xde88421e
mov ecx, dword [ebp]
xor ecx, ebx
dec ecx
ror ecx, 1
mov eax, 0x9c19809c
inc al
jo 0x9915ed
lea ecx, [eax + ecx + 0x10f81710]
or ax, ax
mov edx, eax
btr eax, eax
ror ecx, 1
and dl, ah
dec edx
xor ax, 0xce36
xor ebx, ecx
xor edx, 0x11136db5
push edx
sub dword [esp], 0xda38a7ad
add esi, ecx
dec dl
movzx ax, byte [edi]
neg byte [esp]
movsx ecx, word [esp]
shr ecx, cl
mov dl, byte [ecx + edi - 0x8da]
sbb dword [esp + ecx*4 - 0x2370], 0x6507cc16
push ecx
shr cx, 0xac
add al, dl
neg dword [esp + ecx*2 + 4]
movsx edx, byte [esp + ecx*8 + 3]
mov word [ecx + edi + 2], ax
call fcn.00b460ce
mov ecx, 0xe431f516
mov eax, ecx
sub esi, 4
cdq
xor cl, ch
bt edx, eax
mov edx, dword [esi]
xor edx, ebx
inc cx
xor edx, 0x4c9c76bd
rol eax, 0x7d
not edx
setae cl
rol eax, 7
sal eax, cl
neg edx
sub ax, ax
inc edx
sal ax, 0xe4
rol edx, 3
lea edx, [edx + eax*2 - 0x164da3e6]
cbw
dec ax
call fcn.00bc3965
mov edi, 0xa4a15f39
movsx ecx, di
jmp 0xb2b485
neg eax
xor ebx, eax
sub dx, dx
adc esi, eax
pop edx
mov eax, dword [ecx + edi]
btc ecx, edx
sal ecx, cl
mov cx, word [edi + ecx*2]
inc edx
call fcn.00aa87e0
mov eax, dword fs:[edx]
lea edx, [ecx*2 + 0x6c9432a1]
mov dword [edx + esi - 0x6c94329b], eax
movsx eax, cl
mov eax, dword [edi + edx - 0x6c94329b]
sub ecx, 0x3f85d3b9
shl ecx, cl
sar ecx, 0x3c
lea edi, [ecx + edi + 4]
bts edx, 0x23
and cx, cx
dec cx
xor eax, ebx
ror cl, 0xc1
not eax
not dl
xor eax, 0x421acf14
sub edx, edx
rol eax, 1
neg cx
sar cx, 0xe2
lea ecx, [edx + ecx*8 + 0x198d9630]
inc eax
dec edx
ror eax, 3
lea eax, [eax + ecx*2 - 0x26647a4e]
rol edx, cl
xor eax, edx
sub ecx, edx
xor ebx, eax
neg cl
sbb dl, cl
lea ecx, [edx + edx*8 - 0x5e465acc]
adc ebp, eax
call fcn.00bf3d9c
mov edx, 0xc28d1cac
neg edx
push edx
mov edx, dword [esi + edx - 0x3d72e354]
mov eax, dword [esp]
lea esi, [esi + eax - 0x3d72e350]
movzx ecx, ax
add dword [esp + eax - 0x3d72e354], ecx
xor edx, ebx
rol edx, 1
xor dword [esp + eax - 0x3d72e354], 0x41a89aaf
xor edx, 0x8ea6ff01
lea edx, [edx + eax*2 - 0x395d15f8]
neg eax
setb cl
xor edx, 0xb2899aad
sub cl, byte [esp + ecx*8 - 0x71805]
btc cx, ax
xor ebx, edx
btc cx, cx
cmovae eax, dword [esp + ecx - 0xf3a5]
jae 0xc4966e
push 0x71a953b3
shr byte [esp + 3], 0x42
jns 0xb389be
mov esp, ebp
popfd
jmp 0x702a6e
mov eax, dword [ebp]
mov ecx, 0x9194d6b9
shr dword [esp], 0x8f
setbe byte [esp]
adc ebp, 3
xor word [esp], cx
lea edx, [ecx*4 - 0x29fa4568]
xor eax, ebx
lea eax, [ecx + eax + 0x6a91ac59]
bt ecx, 0x89
cmovae cx, word [esp + edx*4 - 0x716455ee]
add cx, cx
neg eax
lea ecx, [edx + edx*8 + 0x389ec82b]
lea eax, [eax + ecx + 0x764c7d99]
jmp 0xaa54ed
mov dword [esi + ecx*2 + 4], eax
bswap edx
sub edx, ecx
lea esi, [esi + ecx + 5]
movzx eax, cl
jmp ebp
jb 0xa6d636
mov eax, ebp
mov ecx, 0xa93c6c0d
call fcn.00ae6a4f
lea edi, [edi + eax - 0x17979280]
xor ecx, ebx
inc ecx
movsx edx, ax
rol ecx, 3
neg ecx
cdq
imul eax, eax
not ecx
mul dx
xor ebx, ecx
cwde
btc edx, eax
adc ebp, ecx
mov ecx, 0xb59d7821
add eax, 0xc393e5a4
ror cx, cl
movzx ax, byte [esi + edx - 1]
neg ecx
xor cl, dl
imul dx, dx
mov cl, byte [esi + edx*2]
sar edx, 0x64
or al, cl
sar dl, 0x41
not al
mov ecx, edx
mov word [esi + edx*2 + 2], ax
movsx eax, dx
add eax, dword [edx + esi + 2]
xchg edx, ecx
btc cx, cx
or edx, dword [esi + edx*2 + 6]
add eax, edx
mov edx, ecx
jmp 0xb4cdca
rol ecx, 1
push eax
xor al, 0x99
sbb ax, dx
neg ecx
cwde
lea ecx, [eax + ecx - 0x188cecb2]
rol byte [esp + eax - 0x402], 0x47
xor ebx, ecx
add esi, ecx
shr dword [esp + eax*4 - 0x101c], 0x2f
movzx eax, byte [edi + eax*2 - 0x80c]
sal dword [esp + 2], 0x15
xor al, bl
pop ecx
xadd byte [esp + 5], ch
jb 0xb115ad
xor al, dl
and cx, dx
rol al, 1
lea ecx, [edx + ecx - 0xf4688f6]
ror dl, 4
bt edx, 0x99
sbb al, 0x2e
add ecx, 0x85b0ef29
sal dword [esp + 1], 0xc8
xor al, dl
xor bl, al
lea eax, [esp + eax + 8]
add ecx, ecx
mov edx, dword [eax]
sal cx, 0xe5
mov dword [ebp - 4], edx
and word [esp + 1], cx
movzx eax, byte [edi + 5]
rol cl, 0x23
xadd word [esp + 1], cx
lea edx, [ecx + ecx*4 - 0x44f8287b]
lea edi, [edi + edx - 0x5b35eb7f]
not ecx
push ecx
xor al, bl
xor byte [esp + edx - 0x5b35eb81], cl
bt cx, 0x80
rol al, 1
xadd dword [esp + edx - 0x5b35eb85], edx
sbb ecx, edx
xor al, 2
lea ecx, [edx*4 + 0x5e059e15]
not cl
add al, dl
not dl
or dword [esp + edx*4 - 0x4ca7ebfa], 0x1eb81d9c
ror al, 1
call fcn.00a8bd88
dec ecx
mov esi, dword [edx]
mov edi, 0xeaa08c9d
inc esp
mov esp, dword [esi]
dec eax
lea eax, [edi + edi*4 - 0x12ea3dd9]
inc ebp
mov dword [edx + 4], esp
push edi
mov esi, dword [ebp]
xchg word [esp + 2], di
mov ecx, edi
inc esp
mov esp, eax
xor esi, ebx
dec esp
lea eax, [eax + 0x27be6b10]
dec eax
xchg dword [esp], eax
rol esi, 1
inc esp
mov edi, edi
neg esi
inc sp
bt edi, esp
inc edx
lea esi, [esi - 0x21a07118]
ror esi, 3
bswap esi
dec ebp
lea esi, [edi + 0x410c8a12]
dec eax
shr dword [esp], cl
ror esi, 1
dec eax
cdq
dec eax
mov dword [esp + edx], ebx
xor dword [esp + edx*8], esi
pop ebx
bts edx, 0xb5
dec eax
arpl si, si
dec ecx
idiv esp
dec esp
add ecx, esi
inc ecx
mov edx, dword [edx + edx*2 - 0x4ba0b9a6]
inc ecx
push esp
inc sp
or eax, dword [esp + 5]
dec ecx
adc edx, 8
dec esp
bts ecx, edi
movzx edi, byte [ebp + 4]
dec eax
sub dword [esp], eax
dec eax
adc ebp, 4
jmp 0x9c5320
adc edi, edx
dec dword [esp + eax - 0x7cdb5c07]
mov edx, ebp
call fcn.00958fef
add edi, ecx
or byte [esp + eax - 0x17fffffb], al
neg eax
pop edx
pop edx
or edx, edi
jmp edx