Function at 0x101cec81
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
jmp 0x101cf15f
lea ecx, [edx*4]
mov cl, 0x21
pushal
mov dword [esp + 0x10], ebp
pop ecx
jmp 0x101cecd1
dec al
mov eax, ecx
cmc
shl ecx, 0x11
mov dx, si
mov eax, ecx
jmp 0x101cecac
mov dword [esp + 1], ebx
bts ecx, esp
btr ax, bx
lea ecx, reloc.KERNEL32.dll_GetCurrentProcess
mov dword [esp + 0x17], edi
jmp 0x101cecfd
lea edx, [ecx + 0x18]
lea eax, [edx + edi]
xchg ch, dh
mov dl, 0x72
cmc
not ax
jmp 0x101cecc2
push word [esp + 0x11]
pop ax
xchg ecx, eax
mov ax, 0xc71b
mov cx, 0xda91
xchg word [esp + 0x15], dx
jmp 0x101ced45
neg ax
xchg cl, dh
bsf cx, bp
mov dx, 0xc3d7
bts cx, sp
mov edx, dword [esp]
jmp 0x101ceced
mov ah, bh
lea esp, [esp + 0xe]
bt ecx, eax
pop ecx
bsr cx, ax
jmp 0x101cee20
mov edx, esp
rdtsc
pop dx
pop dx
mov dx, 0x552a
pop dx
jmp 0x101ced2f
sub esp, 1
push word [esp + 0x13]
sub esp, 0x1f
lea esp, [esp + 0x4b]
rdtsc
rcl cx, 0xc
jmp 0x101ced19
lea esp, [esp + 0x44]
btc eax, edx
ror eax, cl
lea ecx, [ebx*4]
jmp 0x101cedba
xchg dword [esp], edx
lea esp, [esp + 5]
setp dh
xchg dh, al
pushal
pushal
jmp 0x101ced7e
inc edx
mov ecx, 0xf47fee53
rdtsc
mov ax, 0xf57e
sete cl
jmp 0x101cedc8
mov cl, 0xb3
std
mov ah, 0xeb
xchg dx, cx
dec dx
mov dh, 0xac
jmp 0x101ceda4
mov ax, word [esp]
mov ah, 0x65
mov cl, 0x6a
bswap ecx
cmc
mov ax, word [esp]
jmp 0x101ceddd
mov ax, 0x878f
sub esp, 0x13
mov byte [esp], dl
xchg word [esp + 7], ax
jmp 0x101cee06
lea edx, [esp + edx]
mov word [esp], bp
cmp ax, 0xc8c5
pushfd
mov byte [esp + 1], ah
std
jmp 0x101ced94
push dword [esp + 4]
pop edx
add esp, 1
neg ah
mov byte [esp + 1], bh
xchg byte [esp + 9], ah
jmp 0x101cee85
xchg word [esp + 1], ax
push dword [esp]
add esp, 1
bswap ecx
pop dx
lea edx, [ecx + edi]
jmp 0x101cedf3
std
add esp, 8
mov ah, byte [esp + 6]
xchg cl, dh
mov dword [esp + 4], edi
mov dx, 0x7591
jmp 0x101cee6f
mov word [esp + 7], bp
btc edx, ecx
xchg dword [esp + 8], ecx
xchg dword [esp + 4], ecx
xchg word [esp + 7], ax
setnp dl
jmp 0x101cee34
cld
cld
sub esp, 0x10
pushfd
sub esp, 7
push dword [esp + 0x21]
jmp 0x101ceeae
neg ecx
neg al
mov dh, ah
mov dl, byte [esp + 0x11]
push ax
pop word [esp + 1]
jmp 0x101cee55
cmc
mov ch, byte [esp + 0x1c]
xchg cx, ax
xchg word [esp + 0x23], cx
jmp 0x101ceeda
setbe ch
xchg dword [esp], edx
mov cx, 0x9376
mov cx, 0x30ab
mov edx, 0x8cb3a5c9
std
jmp 0x101cee98
mov cl, byte [esp + 5]
rdtsc
bsf ecx, eax
add esp, 9
inc ecx
lea edx, [edx + esi]
jmp 0x101cefc9
mov dword [esp + 5], edi
mov edx, 0x842f1467
bsf cx, si
push word [esp + 0x16]
jmp 0x101ceec4
mov ax, 0xc694
xchg cx, ax
mov al, dh
sub esp, 0x11
ror edx, 0x1d
mov dx, word [esp + 0x18]
jmp 0x101ced67
mov byte [esp + 0x12], al
mov byte [esp], ch
mov dx, 0xf76b
mov dh, cl
jmp 0x101cef65
rdtsc
lea eax, [ebx*4]
neg al
xchg ecx, eax
cmc
lea esp, [esp + 5]
jmp 0x101cef0d
neg dh
dec ax
lea eax, [ecx + edi]
mov edx, ebx
pushfd
mov ax, dx
jmp 0x101cef23
setne cl
pop edx
bswap ecx
mov dx, 0xb601
add esp, 0x10
pop dword [esp]
jmp 0x101cef9f
xchg byte [esp + 0xf], dl
xchg dword [esp + 0x17], eax
mov dword [esp + 0x1c], edx
bt ax, bx
rdtsc
pop dword [esp + 8]
jmp 0x101cef4f
add cl, dl
sbb eax, edi
mov dl, cl
lea eax, [edx*4]
pop dword [esp + 0xf]
mov al, cl
jmp 0x101cef40
inc ecx
not edx
mov ah, cl
mov cx, word [esp + 4]
mov dx, bp
stc
jmp 0x101cefb3
xchg dx, cx
pop edx
inc eax
lea esp, [esp + 2]
add esp, 0
jmp 0x101cf03e
bswap eax
push word [esp + 6]
xchg byte [esp + 2], dh
push dword [esp + 0x17]
lea edx, [edi*4]
bswap ecx
jmp 0x101cef8a
not ah
pop eax
rcr ecx, cl
mov cl, byte [esp]
sub esp, 9
lea ecx, [ecx*4]
jmp 0x101cf017
mov cx, ax
lea eax, reloc.KERNEL32.dll_GetCurrentProcess
pop edx
mov eax, dword [esp]
bswap ecx
mov cx, word [esp]
jmp 0x101cefe3
lea esp, [esp + 1]
mov ecx, dword [esp + 0xa]
lea esp, [esp + 0x10]
popfd
lea esp, [esp + 4]
jmp 0x101cf09b
mov eax, 0xa14af2f0
xchg edx, eax
bswap eax
lea esp, [esp + 1]
mov ecx, 0x81153188
rdtsc
jmp 0x101cf002
push ebp
pop word [esp]
push edx
pop word [esp + 1]
mov dword [esp], eax
call fcn.101cf069
push dword [esp + 0x13]
pop dword [esp + 0x13]
pop dword [esp + 0x12]
pop ecx
lea edx, [ebx*4]
mov edx, 0xb008ce72
jmp 0x101ceef5