Function at 0x6129c3
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x7a09aad5
jmp 0x613007
add edx, 0x35ab8d8d
jmp 0x613093
movzx ebx, byte [edi]
setb ah
mov ax, word [esp]
mov ax, word [esp]
jmp 0x6127d9
clc
sbb ah, dl
lea esp, [esp + 3]
jmp 0x6127fe
mov ax, 0x2c02
mov dx, word [esp]
xchg edx, eax
sub esp, 3
jnp 0x6127c3
jp 0x6127f1
dec esi
rol dword [ecx + 0x20], 1
shl dword [edi - 0x30], cl
push ebx
clc
sbb ah, dl
lea esp, [esp + 3]
jmp 0x6127fe
add bl, cl
lea edx, [edx*4]
setg ah
xchg ah, dl
jmp 0x612843
mov dl, bl
push si
xchg word [esp], ax
call fcn.0061282d
lea esp, [esp + 0x24]
dec dl
jmp 0x612886
lea eax, [edi + ebp]
mov eax, ebx
lea eax, [ebx*4]
jmp 0x6128a2
bswap eax
bsf ax, sp
je 0x612870
lea eax, [edi + ebp]
jmp 0x6128b8
lea eax, [ebp + 0xb7]
jmp 0x612902
mov eax, ebx
lea eax, [ebx*4]
lea eax, [ebp + 0xb7]
jmp 0x612902
mov ah, cl
lea eax, [eax*4]
pushfd
jmp 0x612926
pushfd
call 0x6129f6
mov esi, 0x3ec3a436
lea ebp, reloc.ADVAPI32.DLL_DeregisterEventSource
into
pop ecx
mov eax, 0x80edf29b
ljmp 0x14b8
sub dl, 0x62
bswap eax
mov ax, 0xd914
lea eax, reloc.ADVAPI32.DLL_DeregisterEventSource
neg ah
jmp 0x612919
jp 0x6128da
mov ah, cl
lea eax, [eax*4]
jmp 0x6128ea
ror dl, 0
mov ax, bp
mov eax, ebp
mov ah, byte [esp]
jmp 0x6129b9
lea esp, [esp + 4]
neg dl
jmp 0x61299d
neg al
jo 0x6129d9
mov ah, bl
jmp 0x6129db
bswap eax
bsr ax, dx
jns 0x612991
js 0x612991
xchg al, ah
lea esp, [esp + 2]
jmp 0x6129e0
mov ah, bl
call 0x6129c3
add esp, 0
jae 0x612a40
lea esp, [esp + 2]
jmp 0x612a44
add cl, dl
jmp 0x612a5f
mov al, 0x81
lea eax, [edx*4]
bts ax, cx
jbe 0x612a08
ja 0x612a08
movsd dword es:[edi], dword [esi]
inc ebx
sal dword [esi + reloc.ADVAPI32.DLL_DeregisterEventSource], cl
lcall 0x3330, 0x31ca0cfd
sub al, byte [ebp - 0x73]
and al, 2
lea esp, [esp + 2]
rol dl, 0
jmp 0x612a1e
sub esp, 0xf
jae 0x612abf
mov dword [esp + 6], ebp
lea eax, reloc.ADVAPI32.DLL_DeregisterEventSource
jmp 0x612a72
mov dx, word [esp]
setle al
not ax
lea edx, reloc.ADVAPI32.DLL_DeregisterEventSource
inc edi
jmp 0x612a49
not ax
lea esp, [esp + 3]
not ax
jmp 0x612a97
not ax
lea esp, [esp + 3]
not ax
dec eax
jmp 0x612a9e
setae dl
lea edx, reloc.ADVAPI32.DLL_DeregisterEventSource
bswap eax
cmc
jo 0x612acb
jno 0x612acb
and al, 0xb8
dec ecx
mov eax, 0x5950a0f
insb byte es:[edi], dx
lahf
sub eax, dword [edi + esi - reloc.ADVAPI32.DLL_DeregisterEventSource]
insb byte es:[edi], dx
and al, 6
mov dword [esp + 6], ebp
lea eax, reloc.ADVAPI32.DLL_DeregisterEventSource
jmp 0x612a8d
jmp 0x612f13
push ebx
jmp 0x612eec
mov ax, word [esp + 1]
lea esp, [esp + 2]
jmp 0x612efc
mov dl, bh
lea eax, [eax*4]
pop ax
jmp 0x612ad6
neg bl
rdtsc
bsf dx, di
jnp 0x613078
jp 0x612fae
int3
add bl, 0x4f
setne dl
rol edx, 3
js 0x612ad0
push ebx
mov dl, bh
lea eax, [eax*4]
pop ax
mov ax, word [esp + 1]
jmp 0x612adb
mov edx, 0x30085637
mov edx, 0x3e1d682d
rdtsc
dec edx
jmp 0x612f91
mov ax, 0xeb3
jmp 0x613082
dec edx
jmp 0x612f91
mov edx, 0x30085637
mov edx, 0x3e1d682d
rdtsc
jmp 0x612f57
setg ah
jmp 0x612fcc
xor bl, 0xff
bsf edx, edx
jnp 0x612f7b
setg ah
pushal
mov ax, 0x795b
mov edx, 0x99d24c87
jmp 0x612fb6
cmp edx, esp
xor al, ch
xchg edx, eax
jmp 0x612f4e
lea esp, [esp + 0x20]
neg bl
xchg ah, dl
mov ah, 0xd8
sub dx, 0x183a
jmp 0x612fd8
pushal
mov ax, 0x795b
mov edx, 0x99d24c87
jmp 0x612fb6
jl 0x612ffc
jge 0x612ffc
pushal
lea esp, [esp + 0x10]
lea esp, [esp + 0x30]
popal
mov ah, byte [esp]
lea eax, [ecx + esi]
jmp 0x61301d
pushal
pushal
mov dword [esp + 0x34], ebx
mov ax, bx
jmp 0x612fdc
jmp 0x613045
mov ah, byte [esp]
mov ax, word [esp]
shl edx, 2
mov ah, 0xc1
push ebx
jmp 0x611d99
rcl dword [ebx - 0x17], 0x6a
in eax, dx
invalid
call 0x613057
jnp 0x613028
add byte [ebx - 0xe], bh
pushal
pop es
aaa
jg 0x613033
add dh, cl
dec edx
push 0xffffffffffffff85
xor al, 0x27
dec esi
mov ax, 0x9b16
neg eax
jae 0x61302f
jb 0x61302f
aam 0x59
leave
test al, 0x5b
cwde
cmp byte [ebx], bl
stc
jmp 0x613905
mov edx, dword [edx - reloc.ADVAPI32.DLL_DeregisterEventSource]
bts eax, ecx
jge 0x613377
jl 0x6130f8
insd dword es:[edi], dx
jl 0x6130c5
salc
inc ecx
cmp edx, esp
xor al, ch
xchg edx, eax
mov ax, 0xeb3
xor bl, 0x49
rcl edx, cl
jne 0x612f38
je 0x612f6d
call 0x6130c8
int 0x47
xlatb
mov dl, 0x41
mov dword [ebp - 8], esi
outsb dx, byte [esi]
or eax, edi
inc esi
push ebp
les esi, [edi + 0x5e]
test eax, 0x124648d
jmp 0x611dc7
or al, 0x9f
out 0xff, al
je 0x6130ef
add bh, byte [ecx - 0x1c]
bsf eax, ebp
jmp 0x6131b5
mov esp, ebp
lea eax, [edx + edi]
mov ax, 0xb5aa
sub esp, 0x12
jmp 0x613126
bound edx, qword [ecx + 0x54258a5a]
invalid
sub esp, 0xd
jmp 0x61337a
ja 0x613157
lea esp, [esp + 2]
jmp 0x61315b
lea esp, [esp + 2]
push edx
ret
dec eax
jmp 0x6130d8
sub esp, 0xd
call 0x6130a9
neg dl
mov al, 0x9a
bsf ax, dx
jmp 0x613634
mov ah, dh
not bl
bts dx, ax
jae 0x6134f8
bts dx, ax
sub esp, 0
rdtsc
jmp 0x6133d8
rol ax, cl
jmp 0x6133e7
and ebx, 0x3c
cmc
jge 0x6133be
rol ax, cl
jmp 0x613470
not dh
dec edx
sub esi, 4
ror ax, 1
jmp 0x613478
mov al, byte [esp]
mov dx, ax
jmp 0x6134af
bts dx, ax
sub esp, 0
rdtsc
jmp 0x6133d8
not dh
dec edx
call fcn.00613444
jo 0x6133f6
mov al, byte [esp]
mov dx, ax
jmp 0x6134af
stc
jmp 0x6134d9
mov eax, dword [ebx + ebp]
sub esp, 0x1c
jne 0x613499
stc
mov ebx, ecx
mov word [esp + 6], dx
jmp 0x6134e0
mov ebx, 0x8bb9ebd8
fldenv [esi - 0x77]
push esp
and al, 6
mov ebx, ecx
mov word [esp + 6], dx
mov dword [esi], eax
call fcn.0061351c
insd dword es:[edi], dx
cmc
or al, 0xff
dec esi
jge 0x6134d5
je 0x613504
out dx, al
pop edx
xchg edi, eax
dec cl
push 0xff12e98b
invalid
jmp 0x61340f
and al, 2
jmp fcn.00613534
jmp 0x61355c
bswap eax
rcr dx, cl
rcr edx, cl
jge 0x61351e
btr ax, si
jmp 0x613560
jmp 0x6135d7
mov eax, ebp
not ebx
or bl, dl
ja 0x613580
jbe 0x61356a
sbb dl, ah
jbe 0x613537
aam 0x76
in al, 0x83
jle 0x61354f
cmp dword [esi - 7], reloc.ADVAPI32.DLL_DeregisterEventSource
push cs
out 0xe, eax
cdq
clc
invalid
btr ax, si
lea ebx, [ebp + 0x50]
rcl ah, 3
jae 0x613541
jb 0x6135d7
not edx
jmp 0x613582
not edx
lea ebx, [ebp + 0x40]
mov dh, byte [esp]
clc
jno 0x6135a5
jo 0x6135bb
lea edx, [esi - 0x80]
call fcn.006135eb
pop ss
xchg ebp, eax
add eax, 0x875c9f6c
push es
xchg esp, eax
push cs
mov edi, 0x88691e37
jmp 0x6135bb
sub ebx, eax
mov dx, 0xe5e
bswap edx
mov dx, word [esp]
stc
jmp 0x613601
cmp esi, ebx
ja 0x612776
mov dx, 0xf235
mov eax, dword [esp]
jmp 0x613546
ja 0x61358d
jbe 0x61358d
and dl, 0xfc
call fcn.0061361d
lea ecx, [ebx]
wait
dec byte [0x22ac25b8]
inc ebp
mov ah, 0x71
cmp dword [eax], ebx
jmp 0x613605
mov eax, ebp
jmp 0x6133a5
jne 0x61305e
je 0x61305e
sbb ah, 0x31
jmp 0x61395a
or dx, 0x37d8
jmp 0x6139d7
je 0x61391f
or dx, 0x37d8
jmp 0x6139d7
mov edx, esi
mov eax, dword [edx]
mov edx, esp
inc dx
jmp 0x613944
call fcn.0061397e
jg 0x6139af
lea esp, [esp + 1]
jmp 0x6139b3
lea esp, [esp + 1]
add esi, 4
mov ax, dx
jmp 0x6139bf
lea eax, [edi + ebp]
add bh, bh
jo 0x613b10
mov bx, word [esp]
jmp 0x613aaa
mov dword [ebx + ebp], eax
lea ebx, [ecx + ebx]
inc ebx
jno 0x613994
jo 0x613994
mov eax, 0x5c45f9ce
popal
jmp 0x613a28
bt eax, ebx
jnp 0x6139e2
mov eax, 0x5c45f9ce
popal
movzx ebx, byte [edx]
mov edx, dword [esp]
lea eax, [eax*4]
call fcn.00613ab7
push ds
test dword [reloc.ADVAPI32.DLL_DeregisterEventSource], edx
cmpsd dword [esi], dword es:[edi]
into
pop ecx
movzx ebx, byte [edx]
mov edx, dword [esp]
lea eax, [eax*4]
call 0x613a3b
mov eax, 0x4866c0fe
clc
bsf eax, ebp
sub esp, 0xf
jmp 0x613a82
pushal
not ax
xchg bx, cx
mov dword [esp + 0x14], edi
not eax
jmp 0x613a01
lea ebp, [ebp - 0x50]
mov dx, 0x8c57
ror dh, cl
ror edx, 5
jmp 0x613ad6
lea esp, [esp + 3]
xchg dword [esp + 0xc], ebp
xchg ah, dl
not al
lea edx, [edx + edi]
lea edx, [edx + edi]
jmp 0x613a6c
jmp 0x613a5d
lea esp, [esp + 3]
push dword [esp + 0x1c]
ret 0x20
xchg dword [esp + 0xc], ebp
cmc
mov dx, sp
push ebp
sub esp, 0xf
adc ax, 0xa1f5
jmp 0x613aac
mov bx, word [esp]
jmp 0x613aaa