Function at 0x11eea14
Capabilities:
Execute anti-debugging instructions

Disassembly:
setbe ah
lea esp, [esp + 7]
xchg dword [esp + 6], eax
mov si, word [esp]
cld
mov bp, 0xd387
jmp 0x11eea22
lea edi, [eax + 0x31]
sub esp, 0xe
setne ah
cld
mov esi, ebp
jmp 0x11ee9be
xchg word [esp + 3], bx
mov si, dx
xchg edi, ecx
xchg dword [esp + 8], ecx
xchg edi, esi
jmp 0x11eea63
xchg word [esp + 1], si
mov ah, byte [esp + 1]
setno ch
cpuid
jmp 0x11eea8d
pop word [esp + 9]
pop dword [esp]
xchg dx, cx
xchg ah, bl
pop edx
mov edx, ebp
jmp 0x11eea4d
bswap ebx
mov eax, 0x18a20f78
stc
push dword [esp + 0x13]
rdtsc
jmp 0x11eea9f
push dword [esp]
add esp, 1
pushal
bswap ecx
btc esi, edi
mov ah, byte [esp + 0xd]
jmp 0x11eea75
mov ax, 0x2995
xchg word [esp + 0x1a], cx
pop word [esp + 0xb]
not bh
clc
mov al, 0xae
jmp 0x11eecff
lea esi, reloc.SHELL32.dll_SHGetSpecialFolderPathW
pop word [esp + 1]
rcr ah, 1
neg bp
lea eax, [edx + ebx]
stc
jmp 0x11eeb15
inc dx
lea esi, [ecx*4]
xchg ah, bl
mov word [esp], di
xchg dh, al
and cl, bh
jmp 0x11eeadb
rdtsc
bsr dx, cx
stc
push dword [esp]
mov ax, word [esp + 6]
mov word [esp + 4], dx
jmp 0x11eeb6f
rdtsc
mov eax, 0xaf0783f8
mov dword [esp], ebp
lea edx, [ecx + edx]
xchg word [esp + 3], bp
mov ah, byte [esp + 5]
jmp 0x11eeb00
push word [esp + 0xb]
pop cx
xchg ebp, esi
pop eax
mov dl, dh
pop dx
jmp 0x11eeb3b
xchg edx, eax
xchg dword [esp], ebx
sub esp, 0xc
sub esp, 6
setne ah
xchg word [esp + 1], dx
jmp 0x11eebce
pop word [esp + 9]
not ebx
setl dh
lea esp, [esp + 5]
bsf bp, si
pop word [esp + 3]
jmp 0x11eeb5f
inc dl
pop dword [esp]
sub esp, 4
mov edi, 0xd64ae1be
mov bh, byte [esp + 0x13]
setns ch
jmp 0x11eebe3
setp bh
mov cx, di
sub esp, 2
mov ebx, 0xbc3e144c
mov ah, byte [esp + 9]
cmc
jmp 0x11eeba6
mov esi, dword [esp + 0x15]
pop ax
mov byte [esp + 4], bh
mov dl, dh
rdtsc
call fcn.011eec45
pop word [esp + 3]
mov ebp, esi
mov byte [esp + 6], bh
jmp 0x11eec22
pop si
mov edi, 0xb47d90b4
rdtsc
xor dl, ch
rdtsc
lea esp, [esp + 0xa]
jmp 0x11eeb8d
lea ebx, [ecx*4]
mov dword [esp + 0xf], esi
lea ebp, [esp + ebp]
pop esi
xchg byte [esp + 9], dl
push edx
jmp 0x11eecc8
bsf ax, si
pop si
call 0x11eec4c
mov al, 0x8e
mov ecx, dword [esp + 7]
not dh
shr esi, 0xb
xchg dword [esp + 2], esi
xchg ah, bl
jmp 0x11eece0
mov eax, esi
mov bp, word [esp + 0xc]
push word [esp + 0x19]
cld
xchg byte [esp + 1], dl
mov di, word [esp + 0x1a]
jmp 0x11eec68
lea esp, [esp + 7]
pop esi
xchg bp, ax
xchg edx, ecx
lea ebx, [edx*4]
lea edi, [eax + edi]
jmp 0x11eed43
pop ebx
stc
mov dl, 0x24
bsf bp, ax
mov cl, ch
pop dword [esp + 0x10]
jmp 0x11eec0c
xchg ch, dl
push esp
mov ecx, 0xe918812a
mov si, 0xf3e7
lea edi, [edx + edx]
xchg ecx, eax
jmp 0x11eed85
bsr bp, bp
rcl dx, cl
xchg word [esp], si
xchg word [esp], ax
pop cx
jmp 0x11eed12
xchg dh, al
lea ebp, reloc.SHELL32.dll_SHGetSpecialFolderPathW
mov ebp, 0xd0f76456
btc ebp, edi
mov al, ah
mov bx, word [esp]
jmp 0x11eed2c
mov ah, byte [esp + 1]
lea esi, [eax + 0x69]
mov al, ah
pop word [esp]
inc edi
pop di
jmp 0x11ef1f0
lea edi, [ebx + edi]
xchg ebp, edi
sub di, 0xbff0
mov dword [esp + 3], esi
mov ah, byte [esp + 0x11]
sub esp, 0x12
jmp 0x11eee25
pop bp
xchg bx, ax
bswap esi
lea esi, [esp + esi]
mov edx, 0x96c62f98
lea ecx, [esi*4]
jmp 0x11eedb6
xchg word [esp + 3], bx
rdtsc
bsr cx, bp
pop word [esp + 0x15]
xor bx, 0xb0bc
pop cx
jmp 0x11eedd1
setle ch
lea esp, [esp + 0xb]
xchg byte [esp + 0x12], bl
rdtsc
mov ecx, dword [esp + 5]
push dword [esp + 0x12]
jmp 0x11eeed6
ror dh, 7
mov al, 0xde
push dword [esp + 0x12]
btr edi, edx
bsr si, bp
neg edi
jmp 0x11eee07
mov bp, 0xb211
mov edi, dword [esp + 7]
mov ch, byte [esp + 0xd]
pop di
inc ebx
inc bx
jmp 0x11eedee
mov dword [esp], ebp
sub esp, 0xc
pop ax
mov si, word [esp]
add esp, 7
mov ch, byte [esp + 6]
jmp 0x11eee89
lea esp, [esp + 1]
xchg byte [esp + 1], cl
mov esi, dword [esp + 3]
pop si
inc ebp
mov ch, byte [esp + 1]
jmp 0x11eee52
rdtsc
lea esp, [esp + 1]
lea ecx, [esi - 0xdd]
cpuid
mov bp, word [esp]
pop ebp
jmp 0x11eeee7
xchg word [esp], cx
push esp
pop word [esp + 1]
bsf dx, ax
not ebp
mov al, 0x3e
jmp 0x11eee74
mov edx, 0xe95f41f4
not bh
popal
inc dl
pop dx
mov dword [esp], ecx
jmp 0x11eeeae
lea edx, [ebx + ebp]
xchg dh, al
mov byte [esp], ah
mov edx, dword [esp]
bsr cx, bp
mov bh, byte [esp + 1]
jmp 0x11ef0d9
mov esi, dword [esp]
mov ax, 0xa56d
mov cx, 0xc0c3
mov si, word [esp]
pushal
mov esi, 0x7702a80c
jmp 0x11eee3f
pop di
push edx
rdtsc
pop word [esp + 1]
cpuid
pop dx
jmp 0x11ef036
lea esi, [esi - 0x75]
and ebp, ecx
rcl bx, cl
mov dx, word [esp]
mov ch, byte [esp + 3]
rcl dx, cl
jmp 0x11eef1c
mov ebx, 0x53e49ac8
mov si, dx
pop cx
sub esp, 0x18
push dword [esp + 0x10]
mov dword [esp + 0x1b], esi
jmp 0x11eefaa
mov cx, word [esp + 6]
mov bx, 0x5085
xchg word [esp + 1], cx
neg ah
xchg word [esp + 1], dx
neg cx
jmp 0x11eef59
mov word [esp + 0x12], dx
xchg edx, eax
xchg ah, bl
xchg byte [esp + 6], cl
pop dword [esp + 0x18]
jmp 0x11ef014
lea edi, [edx*4]
mov ecx, dword [esp + 0x21]
not ax
rdtsc
not edx
mov byte [esp + 1], dh
jmp 0x11eef91
lea esp, [esp + 3]
call 0x11eefc2
lea ebp, reloc.SHELL32.dll_SHGetSpecialFolderPathW
xchg bh, cl
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
popal
push edx
jmp 0x11eefe4
mov di, sp
mov bh, byte [esp + 3]
mov bl, 0xe0
xchg byte [esp + 1], cl
ror ah, 1
mov edi, esi
jmp 0x11eef77
xchg dh, al
xchg dh, al
bswap esi
xchg ecx, edx
mov word [esp + 6], sp
sub esp, 0
jmp 0x11eef44
mov word [esp + 2], sp
cpuid
push dword [esp]
bswap ebp
lea ebp, reloc.SHELL32.dll_SHGetSpecialFolderPathW
lea edi, [ebx*4]
jmp 0x11ef076
bswap ebp
push edx
bswap edi
btr ebx, edx
mov di, 0xa757
rcr bh, 3
jmp 0x11ef0b4
setp bh
neg esi
inc ecx
rdtsc
xchg ah, bl
xchg bp, bx
jmp 0x11eef02