Function at 0xc1f7e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0xf20e7a2b
jmp 0xc1fc90
add eax, 0x3142d7ab
jmp 0xc1fcd2
push esp
xchg word [esp], ax
xchg byte [esp + 2], dl
mov ax, si
call fcn.00c1f76e
not ah
xchg dx, ax
lea eax, reloc.KERNEL32.DLL_WriteFile
jmp 0xc1f7ae
pop dx
call 0xc1f7e3
or dword [ecx], reloc.KERNEL32.DLL_WriteFile
and dword [edx + reloc.KERNEL32.DLL_WriteFile], ebp
dec ebx
loop 0xc1f7e1
insb byte es:[edi], dx
jg 0xc1f80d
movzx ecx, byte [ebp - 1]
jmp 0xc1f785
add eax, 0x24448bb4
add cl, byte [edi]
mov ebx, 0x8de176fa
and al, 2
jmp 0xc1f7f6
sub cl, bl
inc al
jmp 0xc1f831
rdtsc
rcl edx, cl
jmp 0xc1f81b
aam 0x4a
sub eax, 0x80c11fdc
inc ebx
cli
aad 0x66
pop edx
jmp 0xc1f7b0
mov al, cl
mov dx, word [esp]
xchg dl, dh
mov dh, 0x46
mov edx, dword [esp]
jmp 0xc1f84f
jp 0xc1f800
rdtsc
rcl edx, cl
jmp 0xc1f81b
jmp 0xc1fc36
lea edx, [ebp - 0xb9]
mov dx, bx
rol al, 0
inc dl
js 0xc1f839
mov dx, word [esp]
ror edx, cl
mov edx, edi
push dx
sub esp, 0x10
jmp 0xc1fbdf
mov dx, cx
lea esp, [esp + 7]
mov dl, 0xae
jmp 0xc1f8ad
jmp 0xc1f87f
rol al, 0
mov dx, 0x4149
not edx
mov dl, 0x37
push ebx
jmp 0xc1fa62
lea esp, [esp + 3]
jmp 0xc1f897
lea esp, [esp + 0x10]
neg al
lea edx, [ebx*4]
mov edx, dword [esp]
sub esp, 0xe
jns 0xc1f895
mov dx, cx
lea esp, [esp + 7]
mov dl, 0xae
lea esp, [esp + 3]
jmp 0xc1f897
bsr edx, esi
je 0xc1f906
mov edx, esi
lea edx, reloc.KERNEL32.DLL_WriteFile
btc edx, edi
jmp 0xc1f929
lea edx, [eax + ebp]
neg dx
jmp 0xc1f95b
mov edx, esi
lea edx, reloc.KERNEL32.DLL_WriteFile
call fcn.00c1f9af
sbb byte [ebx], 0x8b
out dx, al
sbb eax, 0x68c9fea8
jae 0xc1f94f
bts edx, edi
lea edx, [ecx + ebp]
jmp 0xc1f8fe
call fcn.00c1f9c1
inc al
jmp 0xc1f936
lea edx, reloc.KERNEL32.DLL_WriteFile
mov dl, 0x8b
lea eax, [esp - 0x57]
jmp 0xc1fa49
bts edx, edi
lea edx, [ecx + ebp]
lea edx, [eax + ebp]
neg dx
not al
mov dx, word [esp]
jmp 0xc1f8e8
dec ebp
rol dl, cl
jo 0xc1faa6
mov dx, di
sub esp, 0xb
add esp, 0xa
inc dx
bswap edx
jmp 0xc1fa77
mov dword [esp], eax
lea esp, [esp + 8]
neg al
not dh
btr edx, esi
jmp 0xc1f91c
bswap edx
not eax
lea esp, [esp + 1]
jmp 0xc1fb30
ror dword [edx - 0x7d], cl
in al, dx
or eax, dword [ebx + reloc.KERNEL32.DLL_WriteFile]
sub esp, 0xb
add esp, 0xa
inc dx
jmp 0xc1fa75
mov dx, di
jmp 0xc1fa8b
lea esp, [esp + 4]
dec cl
dec ax
jbe 0xc1fae2
ja 0xc1fae2
jb 0xc1fa89
inc esi
and eax, edx
push edi
int 0x4d
frstor dword [edi + edx*2 + reloc.KERNEL32.DLL_WriteFile]
jnp 0xc1fb01
pushfd
mov byte [esp], dl
jmp 0xc1fb05
call fcn.00c1facc
jmp 0xc1fb07
pushfd
mov byte [esp], dl
jmp 0xc1faab
lea eax, reloc.KERNEL32.DLL_WriteFile
pop eax
lea esp, [esp + 2]
not cl
mov dx, word [esp]
sub esp, 0x1c
jl 0xc1fb79
bsr dx, si
jmp 0xc1fb5a
inc cl
mov dl, 0xf2
mov edx, 0xe314cb40
lea eax, [ebx - 0x2d]
dec ah
jmp 0xc1fac4
mov edx, dword [esp]
neg edx
mov ax, word [esp]
pushfd
xchg word [esp + 1], ax
jmp 0xc1fb7b
bsr dx, si
lea esp, [esp + 0x1c]
inc cl
cmc
jmp 0xc1fb91
mov ax, word [esp]
pushfd
xchg word [esp + 1], ax
jmp 0xc1fb7b
jmp 0xc1fb56
neg dx
jmp 0xc1fbb0
jo 0xc1fb40
mov edx, dword [esp]
neg edx
jmp 0xc1fb63
inc eax
jmp 0xc1fbc0
ror cl, 0
bsf dx, di
jne 0xc1fb9a
inc eax
jmp 0xc1fbc0
mov eax, ecx
mov edx, dword [esp]
mov dx, 0xeaf7
inc dx
ja 0xc1fbfe
jbe 0xc1fbe8
ret
push dx
sub esp, 0x10
lea esp, [esp + 2]
jmp 0xc1f8c4
shl eax, 2
dec edx
jp 0xc1fc16
mov dh, 0x88
mov dl, 0xc6
mov dl, 0x51
jmp 0xc1f3e0
jmp 0xc1fbe8
mov dl, 0xc6
mov dl, 0x51
call 0xc1fc1a
sub dword [ebp + reloc.KERNEL32.DLL_WriteFile], esp
pop ecx
salc
inc esp
and ebx, esi
sbb eax, 0xeb88b6c7
out 0x8d, al
adc al, 0xbd
add byte [eax], al
add byte [eax], al
mov dx, word [esp]
jmp 0xc1fcbc
mov dh, 0x88
jmp 0xc1fc00
mov dx, word [esp]
ror edx, cl
mov edx, edi
jmp 0xc1fbda
xchg dword [esp], edi
bsr dx, sp
xchg dh, dl
inc edx
push dword [esp]
ret 4
lea edi, reloc.KERNEL32.DLL_WriteFile
shl dl, 0
mov dh, byte [esp]
bsf edx, esi
neg dx
dec edx
jmp 0xc1fc40
bts edx, edi
mov edx, 0x58c0fe7e
mov edx, esp
mov eax, dword [eax + reloc.KERNEL32.DLL_WriteFile]
mov dx, 0xc321
lea edx, [edx + ebx]
bswap edx
jmp 0xc1fca3
cmc
jmp 0xc1fc97
jle 0xc1fc6b
bts edx, edi
mov edx, 0x58c0fe7e
jmp 0xc1fcee
sub esp, 0x1c
jo 0xc1fccd
jno 0xc1f431
cmp al, 0xae
cmp al, 0x5b
mov dh, 7
ret
not dx
xchg dword [esp], edi
mov dx, sp
clc
mov edx, edi
lea edx, [ebx + ebp]
jmp 0xc1fc56
jmp 0xc1f431
mov dx, 0xfec7
pushfd
mov esp, edi
jmp 0xc1fd12
mov edx, esp
jmp 0xc1fc75
stc
not dh
jmp 0xc1fcfb
push eax
ret
bsf edx, ebp
jge 0xc1fcf2
stc
not dh
jmp 0xc1fcfb
add esp, 1
push bx
mov dx, 0x708f
jmp 0xc3e1c6
lea esp, [esp + 3]
jmp 0xc3e29f
jmp 0xc3e1b6
jmp 0xc3e21b
sub ah, 0x36
js 0xc3e1e0
sbb ch, cl
mov eax, edx
mov al, byte [esp]
jmp 0xc3e24b
cmc
setl al
lea edx, [edi*4]
cmp esi, ecx
mov edx, dword [esp]
jmp 0xc3e309
sbb ch, cl
mov eax, edx
mov al, byte [esp]
jmp 0xc3e24b
ja 0xc3e204
cmc
setl al
call fcn.00c3e26d
adc al, 0x96
add al, 0x63
sahf
pop eax
xchg dword [esi], ebp
cmp dword [eax], ebx
jnp 0xc3e28d
mov dword [esi], ecx
xchg al, ah
mov dx, 0xcdbb
rdtsc
jmp fcn.00c3e1f6
lea ecx, [edi + 0x50]
rdtsc
not dx
inc eax
jmp 0xc3e224
adc al, 0x24
jmp 0xc3e309
sub esi, 4
mov dx, bp
xchg edx, eax
lea eax, [ebp*4]
call fcn.00c3e26b
mov ah, byte [esp]
bswap eax
mov eax, dword [esp]
not eax
lea edx, [edx + 0x54]
push cx
jmp 0xc3e3a7
in al, 0x85
xchg ecx, eax
sbb edx, ebx
xchg ecx, eax
imul esp, dword [esi + 0x16], 0x57c6088d
inc ecx
sbb dword [ebp + 0xc8b703b], ebx
and al, 0x36
mov ecx, dword [esi]
sub esp, 2
jne 0xc3e1de
add esp, 1
push bx
mov dx, 0x708f
lea esp, [esp + 3]
jmp 0xc3e29f
mov edx, dword [esp]
mov dh, byte [esp]
ja 0xc1f7c7
not ch
xchg ecx, eax
jmp 0xc3e341
call fcn.00c3e36a
dec esi
fnstcw word [eax]
movsb byte es:[edi], byte [esi]
push cs
popfd
pop eax
sub edi, dword [ebp - 0x51]
sub dword [eax], eax
sti
sbb esi, dword [edx + 0x6d]
jl 0xc3e2cd
mov eax, edi
xchg cl, ch
sub esp, 8
jle 0xc3e32b
mov dword [esi + reloc.KERNEL32.DLL_WriteFile], 0xdf7fe17e
jg 0xc3e32b
lea edx, [edi + 0x40]
mov ecx, 0xb5907762
cmp ecx, edi
jge 0xc3e385
jl 0xc3e36f
dec edi
salc
inc ecx
ret
mov ecx, 0xc3113940
bswap ecx
jmp 0xc3e38c
mov ecx, 0xc3113940
bswap ecx
sub edx, eax
mov ecx, 0xf08981e0
jmp 0xc3e419
push cx
bswap eax
pop eax
xchg dword [esp + 4], edx
setbe dh
mov dh, al
call fcn.00c3e329
jbe 0xc3e3d2
stc
pushal
jmp 0xc3e3f5
stc
pushal
pop word [esp + 0xb]
lea esp, [esp + 2]
and cl, 0xfc
call fcn.00c3e400
push esp
invalid
pop word [esp + 0xb]
lea esp, [esp + 2]
jmp 0xc3e3dd
not ch
lea ecx, [ebx*4]
pushfd
lea ecx, [esi - 0x80]
clc
jmp 0xc3e3ba