Function at 0x6bb4e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, reloc.ADVAPI32.DLL_DeregisterEventSource
neg bx
bswap ebx
cld
rdtsc
bts dx, bx
jmp 0x6bb2f7
xchg word [esp + 6], bx
mov ebx, 0x9242aa7a
not ax
pop word [esp + 1]
bswap ebx
pop dword [esp]
jmp 0x6bb2af
xchg byte [esp + 4], bl
lea ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
xchg word [esp + 4], bx
jmp 0x6bb313
push word [esp + 2]
mov word [esp + 3], bx
mov dx, word [esp + 2]
lea esp, [esp + 1]
xchg dword [esp], ebx
mov byte [esp + 2], cl
jmp 0x6bb2e1
lea eax, [esp + edi]
lea eax, [ecx + esi]
inc ax
stc
lea eax, reloc.ADVAPI32.DLL_DeregisterEventSource
jmp 0x6bb501
pop dword [esp + 3]
adc edx, esp
pop eax
pop dword [esp + 2]
push dword [esp]
mov word [esp + 9], ax
jmp 0x6bb2c8
shr ah, 6
bswap eax
neg ah
xchg byte [esp + 0xa], ah
mov dword [esp + 9], eax
jmp 0x6bb3a3
lea ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
push ax
bsf bx, dx
mov edx, 0xb35f65c2
lea edx, [esp + ebp]
bswap ebx
jmp 0x6bb33f
pop bx
mov dx, 0xb58e
mov dx, word [esp]
sub esp, 0x15
lea edx, reloc.ADVAPI32.DLL_DeregisterEventSource
dec ebx
jmp 0x6bb355
sbb bh, 0x92
setae bh
push dword [esp + 7]
push bx
jmp 0x6bb3d2
push dword [esp + 0xd]
mov dword [esp + 0xa], edx
xchg dword [esp + 1], ebx
mov bh, byte [esp + 0x19]
lea edx, [eax + esi]
mov bx, 0x6296
jmp 0x6bb38d
and ax, cx
call fcn.006bb40d
push edx
dec edi
jo 0x6bb42f
outsb dx, byte [esi]
dec ebx
jns 0x6bb414
js 0x6bb412
add byte [esi - 0x71], ah
inc esp
and al, 0xa
pop word [esp + 0xa]
mov ebx, edi
lea ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
push dword [esp + 6]
cmc
mov al, byte [esp + 0x16]
jmp 0x6bb3bc
pop edx
setne bh
mov byte [esp], bh
add esp, 3
mov ax, 0xb02e
neg dh
jmp 0x6bb377
and al, 5
rdtsc
pop ebx
rdtsc
jmp 0x6bb486
mov byte [esp], ah
mov bh, byte [esp + 1]
xchg byte [esp + 8], bh
rol al, 1
mov edx, 0x6dabd2d6
mov bx, dx
jmp 0x6bb3f8
mov edx, 0x64e885f3
bswap edx
pop dword [esp + 0x21]
lea esp, [esp + 0x17]
jmp 0x6bb469
mov word [esp + 0x10], ax
ror edx, cl
mov ah, bh
pop word [esp + 3]
setl dh
cld
jmp 0x6bb43f
push word [esp + 0xa]
sub esp, 3
xchg dword [esp + 0xd], edx
mov bx, 0xf327
xchg word [esp + 0x13], ax
jmp 0x6bb4b3
sub esp, 0x16
mov bx, word [esp + 0x1e]
btc ebx, esp
ror dl, cl
mov edx, 0x69644965
xchg bx, ax
jmp 0x6bb455
pop dword [esp + 0x12]
pushfd
call fcn.006bb4db
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x6bb511
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[eax + 0x6617247c], cl
pop dword [esp + 0x17]
mov byte [esp + 0x17], bh
pop word [esp + 0x17]
rdtsc
mov edx, esp
mov bh, 0xcd
dec ebx
jmp 0x6bb49d
jmp 0x6bb533
lea esp, [esp + 0x4f]
neg eax
mov dx, di
pushal
bswap eax
mov byte [esp + 0x19], dl
jmp 0x6bb51b
btr dx, cx
mov byte [esp + 1], dl
sub esp, 7
rdtsc
mov dword [esp + 2], ecx
pop dword [esp + 1]
jmp 0x6bb428
add cl, byte [edi - 0x16fedbbc]
or eax, 0x88ffffff
push esp
and al, 0xd
mov byte [esp + 0xd], dl
xchg dword [esp], ebx
pop edx
mov bx, 0xc6c9
not ebx
xchg dword [esp + 0x13], ebx
jmp 0x6bb5ce
mov ebx, dword [esp + 0xe]
mov dword [esp + 0x25], eax
sub esp, 0xa
mov dl, byte [esp + 0xc]
mov eax, edi
sub esp, 0x19
jmp 0x6bb4e4
mov ebx, esp
sub esp, 0x1a
pop bx
bsr eax, esp
mov byte [esp + 0x10], bl
jmp 0x6bb59c
pop dword [esp + 0xe]
push dword [esp + 6]
xchg word [esp], bx
mov dword [esp + 0xa], ebx
lea eax, reloc.ADVAPI32.DLL_DeregisterEventSource
mov al, cl
jmp 0x6bb549
mov ebx, 0xb4f33da7
lea ebx, [ebx*4]
push ebp
rdtsc
lea esp, [esp + 0x15]
mov word [esp + 0xf], ax
jmp 0x6bb5b0
pop dword [esp + 0x24]
xchg byte [esp + 0x1e], bl
rdtsc
pushfd
mov ah, byte [esp + 0x11]
not ax
jmp 0x6bb579
mov ax, word [esp + 0x16]
sub esp, 8
pop word [esp + 0x28]
sub esp, 0xd
pop ax
mov bl, cl
jmp 0x6bb631
mov ebx, dword [esp + 0x12]
mov byte [esp], bh
push di
xchg byte [esp + 0x13], bh
xchg dx, ax
lea ebx, [eax*4]
jmp 0x6bb55f
lea edx, [ecx*4]
lea edx, [eax*4]
jmp 0x6bb615
mov bl, cl
adc dh, 0xa1
mov bx, 0xb621
neg dx
bsr ebx, esi
mov dx, word [esp + 0x1d]
jmp 0x6bb5e9
lea ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
rdtsc
mov word [esp + 0x1b], sp
stc
call fcn.006bb642
push esp
insb byte es:[edi], dx
jae 0x6bb66d
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
push bp
push sp
xchg word [esp + 0x16], ax
not al
dec ax
mov dh, bl
jmp 0x6bb5ff
and al, 0xfd
mov bh, 0x9c
xchg bx, dx
mov byte [esp + 0xd], bl
bsr eax, edx
jmp 0x6bb32a