Function at 0x64647d47
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x64647adc
push ds
imul ecx, dword [eax + reloc.ADVAPI32.DLL_RegCloseKey], 0x617a35e9
dec esi
cmp dl, byte [0x65833784]
cld
add cl, ch
adc byte [ebp + 0x5a320007], ch
lds edx, [ebp + 0x3c]
iretd
pushal
push word [esp + 0x1f]
lea esp, [esp + 2]
jmp 0x64647f85
push ebx
jmp 0x6464823f
mov esi, dword [ebp - 0xc]
jmp 0x64647891
or eax, ebx
mov ax, word [esp]
mov ax, word [esp]
jmp 0x64647e95
jmp 0x64648cf4
test edx, edx
call 0x646482c5
fstp qword [eax - 0x37]
pop ecx
cmp bl, cl
or al, 0xfa
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffd4
or esp, dword [edx - reloc.ADVAPI32.DLL_RegCloseKey]
fadd dword [ebx + 0x68eb24ec]
mov dword [esp], eax
mov ah, cl
jmp 0x646479bf
mov eax, dword [ebp + 0xc]
lea esp, [esp + 4]
push esi
lea esi, [esi*4]
call fcn.646479a9
or eax, 0x8b781989
cmp byte [ebp + 0x2adfb82a], ch
call 0x5101dcae
dec dword [ebx - reloc.ADVAPI32.DLL_RegCloseKey]
dec esp
insd dword es:[edi], dx
call 0x6464797c
mov si, 0x21a9
pushal
lea esp, [esp + 0x24]
lea esi, [eax + ecx]
jmp 0x64647ab3
mov dword [ebp - 0xc], esi
call fcn.64647a4d
mov edx, dword [ebp - 4]
jmp 0x645ccd8c
mov dword [esp + 0x1c], ebp
pushfd
lea esp, [esp + 8]
popal
jmp 0x64647d7d
jne 0x6464787b
mov ax, bp
lea esi, [edx*4]
jmp 0x64647d9e
lea ecx, [ecx - 8]
mov eax, dword [ecx]
pop ecx
cmp eax, dword [ebp + 8]
jmp 0x64647d63
mov byte [ebp - 0x17], 0x50
lea eax, [ebx + ebx]
jmp 0x64647e4c
mov byte [ebp - 0x16], 0x3c
lea esi, [edx + edi]
mov al, byte [esp]
jmp 0x64647d88
mov ah, 0x6f
setg al
jmp 0x64647e1e
mov byte [ebp - 0x1a], 0xe
setge ah
dec ax
mov byte [ebp - 0x1b], 0x57
mov si, word [esp]
jmp 0x64647dc8
mov byte [ebp - 0x1e], 0x7a
clc
mov si, 0xe3c
jmp 0x64647e2f
bsf esi, esi
jmp 0x64647df1
mov byte [ebp - 0x1c], 0x49
mov ax, bp
mov byte [ebp - 0x1d], 0x5b
mov ax, word [esp]
jmp 0x64647e07
mov byte [ebp - 0x1f], 0x50
mov si, word [esp]
mov ax, si
jmp 0x64647e6e
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x19], 0x58
neg ah
jmp 0x64647dde
mov byte [ebp - 0x21], 0x4e
push ebp
push word [esp + 2]
lea esp, [esp + 2]
jmp 0x64647f40
mov byte [ebp - 0x20], 0x57
neg si
neg esi
mov al, 0xb0
jmp 0x64647e58
lea eax, [ebp + esi - 0x24]
sub esp, 0x1c
lea esp, [esp + 0x1c]
mov cl, byte [eax]
jmp 0x64647ea8
add cl, 3
jmp 0x64647ec7
not ah
xor esi, esi
jmp 0x646478d6
xor cl, 0x3f
inc esi
cmp esi, 0xf
call fcn.64647ed4
invalid
not eax
mov byte [ebp - 0x24], 0x71
mov ah, dh
bt ax, sp
mov si, bx
jmp 0x64647ebe
lea esp, [esp + 4]
mov byte [ebp - 0x22], 0x4a
mov ax, di
mov byte [ebp - 0x23], 0x57
jmp 0x64647eef
mov eax, dword [edx]
pop edx
jmp 0x64647f8d
push edx
mov edx, ebp
lea edx, [edx - 4]
jmp 0x64647f6f
mov esi, dword [eax + 0x10]
pushfd
mov dword [esp], ebx
lea esp, [esp + 0x24]
jmp 0x64647fbe
add esi, dword [ebp - 0xc]
cmp dword [esi], 0
je 0x646478b4
sub esp, 0xf
jmp 0x64649ceb
mov ebx, ebp
lea ebx, [ebx - 4]
mov edx, dword [ebx]
pop ebx
jmp 0x64648228
not eax
mov ah, byte [esp]
mov ax, word [esp]
jmp 0x64648252
lea esp, [esp + 4]
add dword [ebp - 4], 0x14
lea edx, reloc.ADVAPI32.DLL_RegCloseKey
mov dl, 0x6d
push ebx
jmp 0x6464821a
mov eax, dword [ebp - 0x14]
jmp 0x6464795c
pop edx
mov eax, dword [eax + 0x18]
lea ecx, reloc.ADVAPI32.DLL_RegCloseKey
call 0x64648392
cmp esi, edi
call fcn.64648c9e
fbld tbyte [esi]
push ecx
rcl byte [ebx]
mul ah
mov edx, 0xc0ede9d1
popfd
push ebx
retf 0x378b
lea ecx, [edx + edi]
xchg ah, ch
push edx
mov edx, 0x645d5fa0
mov eax, dword [edx]
jmp 0x64648aaf
dec ebp
fsubrp st(1)
fucom st(7)
pop ds
push edi
jle 0x64649d05
fldenv [esi]
and edi, esp
invalid
adc dword [eax + esi*2], 0x7d
dec esp
fisttp word [0xbd8be20]
adc esi, ebx
cli
dec esi
xor al, 0x26
push ecx
rcl byte [ebx + 0x59]
mov byte [ecx - 0x5f], al
mov ah, 0x32
mov ebx, 0x9465ca62
pop es
lea esp, [esp + 3]
lea esp, [esp + 0xc]
cmp dword [ebx], 0
je 0x646478b4
jne 0x64647911
scasb al, byte es:[edi]
mov ecx, 0x3a4b3898
cmp byte [ebx + 0x3a], cl
xor dl, ah
movsb byte es:[edi], byte [esi]
jno 0x64649c9a
movsd dword es:[edi], dword [esi]
mov ebp, dword [ebp - 0x19]
sbb byte [edx + 0x61], 0x43
pop dword [0xe648e296]
push esp
adc dword [esi + reloc.ADVAPI32.DLL_RegCloseKey], 0x6bacc6e2
in eax, dx
xchg ecx, eax
or esp, dword [edi]
and al, 0xb
stosd dword es:[edi], eax
js 0x64649dac
bound esp, qword [esi - 0x10128c6f]
aaa
sbb eax, 0xfb951be6
ror byte [ebp - 0x24], cl
jno 0x64649cca
invalid
xchg ebp, eax
mov dword [reloc.ADVAPI32.DLL_RegCloseKey], eax
wait
xchg esi, eax
invalid