Function at 0x9af56e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 0x16]
bts bp, bx
jmp 0x9af57c
add esp, 0x11
cld
pushal
add esp, 3
xchg bp, ax
mov dword [esp + 0x12], esi
jmp 0x9af5c8
lea esp, [esp + 0x46]
lea edx, [esp - 0x5e]
lea edx, reloc.KERNEL32.dll_GetStartupInfoA
mov ax, dx
neg dh
mov bh, 0x89
jmp 0x9af5f7
xor ecx, 0x323f67db
mov byte [esp + 0x23], cl
mov word [esp + 0xd], bp
lea ebx, [edx + 0x6f]
rdtsc
sub esp, 0x14
jmp 0x9af5a6
xchg ebp, ebx
inc si
cpuid
bsf si, sp
btc ebp, eax
bswap ecx
jmp 0x9af606
bsr ebx, ecx
mov bl, 0x2e
mov bh, 0xa0
xchg bh, dl
xchg cl, dl
inc bp
jmp 0x9af5e1
rdtsc
lea edx, [eax*4]
mov ebx, eax
and ebx, 0x5f13af3e
lea esi, [edi - 0xf2]
mov ch, byte [esp]
jmp 0x9af781
mov dword [esp + 5], edi
xchg dword [esp + 3], ebp
add bl, bh
rdtsc
cld
jmp 0x9af67d
mov bl, 0x96
xchg edi, eax
neg ecx
mov bl, al
cpuid
sub esp, 0x10
jmp 0x9af643
mov bl, dl
lea ebp, [edi*4]
call 0x9af6d8
push ebx
je 0x9af6c6
outsb dx, byte gs:[esi]
jne 0x9af67d
xchg byte [esp + 0xb], dl
xchg byte [esp + 2], ah
push sp
lea edx, [ecx + edi]
and bp, bx
xchg dword [esp + 8], eax
jmp 0x9af667
xchg dl, ah
mov edi, dword [esp]
not bx
lea edx, [ebx + edi]
neg eax
neg bx
jmp 0x9af659
xchg bx, di
dec di
mov si, word [esp + 4]
mov ch, byte [esp + 0x10]
sub esp, 0x12
not ah
jmp 0x9af73b
popal
imul esi, dword [ebx + 0x65], 0x65637845
jo 0x9af744
imul ebp, dword [edi + 0x6e], reloc.KERNEL32.dll_GetStartupInfoA
lea ecx, [si]
sbb ebp, esi
mov dword [esp + 0xa], ebx
mov ax, word [esp + 0xc]
jmp 0x9af6b0
xchg ebp, ecx
pop dword [esp + 0x13]
mov di, 0x639b
call fcn.009af6fd
arpl ax, bp
mov bl, 0xff
invalid
mov ch, dh
ror cl, cl
cmc
bswap edx
mov ebx, 0x6d817234
xchg ebp, eax
jmp 0x9af7c8
mov al, dl
xchg edx, eax
bswap ecx
inc ebp
mov bp, si
mov dh, 0x10
jmp 0x9af69e
dec di
pop bx
bswap eax
pop dword [esp + 0xa]
pop word [esp + 0xa]
jmp 0x9af7de
cpuid
shr al, cl
setnp dh
lea eax, [esi + edi]
mov eax, esp
sub esp, 0x10
jmp 0x9af792
mov si, ax
xchg byte [esp + 2], ch
push dword [esp + 2]
mov ecx, edx
inc bl
push word [esp + 5]
jmp 0x9af7a8
xchg word [esp + 0xd], bx
or dl, 0xee
push dword [esp + 0xe]
pushfd
mov bl, ch
jmp 0x9af820
xchg ecx, ebx
call fcn.009af84d
push ebx
je 0x9af868
je 0x9af87b
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[edi + ebx*8 + 0x66], cl
xchg dword [esp + 0x14], eax
xchg word [esp + 0x14], ax
bswap ebp
cmp eax, 0xbe39b158
rdtsc
setns al
push dword [esp + 8]
jmp 0x9af80a
push dword [esp + 0x1d]
pop dword [esp + 0x18]
mov word [esp + 0x21], cx
jmp 0x9afa78
pop es
scasb al, byte es:[edi]
sub esp, 0x1b
pop dword [esp + 0x14]
mov dl, al
sub esp, 0x1c
pop dword [esp + 0x14]
jmp 0x9af936
mov cx, word [esp + 2]
lea eax, [ecx*4]
mov ebx, esp
pop dword [esp + 4]
mov ebx, ecx
pop esi
jmp 0x9af899
neg ebp
bswap ebx
neg esi
rdtsc
mov ebp, 0x1a0f797d
setbe ch
jmp 0x9af91f
not ebp
clc
shr cx, cl
rcr bp, cl
xchg dword [esp + 0x28], ebx
bswap esi
jmp 0x9af8c6
lea ebx, [eax + ecx]
lea ebp, reloc.KERNEL32.dll_GetStartupInfoA
xchg word [esp + 0x26], cx
setne dl
mov word [esp + 0x22], sp
pop word [esp + 0x34]
jmp 0x9af8dc
mov ch, byte [esp + 0x15]
mov edx, dword [esp + 0x1d]
xchg ebx, esi
add esp, 6
rcr dh, cl
jmp 0x9af94f
mov byte [esp + 0x2c], al
xchg dword [esp + 0x1c], edx
push word [esp + 0x1f]
xchg word [esp + 0x1c], dx
setp cl
xchg ebp, ebx
jmp 0x9af902
bts eax, esi
cmc
popal
lea esp, [esp + 8]
pop word [esp + 2]
pushal
jmp 0x9af9c7
push word [esp + 0x1f]
bsf eax, ecx
lea ebp, [edx + esi]
cpuid
mov edx, ebx
jmp 0x9af9a0
mov bp, bx
mov ch, byte [esp + 2]
mov bl, byte [esp + 3]
inc bx
cmc
pop esi
jmp 0x9af8af
bt edx, edi
setl dl
mov word [esp + 0xa], di
pop cx
jmp 0x9af9ef
lea edx, [ecx + ebx]
lea esp, [esp + 0xa]
push esp
pop dword [esp + 0x15]
xchg word [esp + 0x13], dx
bsf ebx, edx
jmp 0x9af98a
rdtsc
rdtsc
bt edi, eax
mov bp, dx
mov bh, byte [esp + 8]
cpuid
jmp 0x9af960
cpuid
not bp
lea esp, [esp + 0xd]
not bp
pop si
pop edx
jmp 0x9afa03
bsf ax, cx
mov ah, 0xa5
mov ecx, 0x35ad34e9
bswap ebp
xchg cx, di
xchg edx, eax
jmp 0x9af9d9
add esp, 6
lea edx, [eax*4]
pop ebx
lea ecx, [ecx*4]
sub esp, 3
mov word [esp], si
jmp 0x9afa4a
pop dx
std
not edi
neg edx
xchg ebx, edx
push dword [esp + 3]
jmp 0x9af976
mov dl, 0xa4
rdtsc
xchg byte [esp + 1], dh
lea eax, [ebx*4]
jmp 0x9afa5c
lea esi, [esi + edi]
not ch
lea ecx, [ebp + ebp]
rcr dh, 2
inc bh
xchg bl, ch
jmp 0x9afa34
not edi
shr si, cl
inc ebp
push word [esp + 2]
xchg bx, dx
mov dh, byte [esp + 3]
jmp 0x9afe4c
adc bx, si
xchg word [esp + 0x23], ax
mov si, word [esp + 3]
push word [esp + 0x25]
push word [esp + 0x2d]
add esp, 0x1f
jmp 0x9afa22
btc bp, dx
not bh
lea edx, [edx + edi]
neg al
pop word [esp + 0x14]
mov di, word [esp + 0xb]
call fcn.009afa94
shl al, cl
mov dh, byte [esp]
mov al, dh
mov edi, dword [esp]
mov edi, 0xd7a17c8
mov di, dx
jmp 0x9afb1e
std
xchg si, ax
bsf ebp, edi
cld
mov di, ax
btr di, si
jmp 0x9afb08
mov edx, dword [esp]
neg ax
inc eax
lea esi, [edi*4]
cpuid
jmp 0x9afb33
mov bx, bp
mov si, di
rol edx, 0x19
mov esi, 0xc834f606
mov bh, byte [esp]
xchg dl, dh
jmp 0x9afae3
bswap eax
shl al, 3
mov ebx, dword [esp]
mov di, 0x871b
lea edx, [edx + ebx]
mov bx, 0x81b3
jmp 0x9afb89
add esp, 0
push dword [esp + 2]
xchg dword [esp], edi
push word [esp + 2]
setl bl
sub esp, 0x1b
jmp 0x9afab5
rdtsc
pop eax
std
push dword [esp + 3]
pop ecx
mov si, sp
jmp 0x9afbb6
neg dx
pushfd
mov dx, word [esp + 3]
adc dl, 0x9d
push dword [esp]
lea eax, [ecx - 0xd8]
jmp 0x9afb73
mov ecx, 0xd211b02f
bsf bp, ax
btr si, di
std
mov eax, edi
jmp 0x9afe0f
add esp, 2
lea ecx, [ecx*4]
lea esp, [esp + 1]
rdtsc
xchg byte [esp], dl
std
jmp 0x9afba0
ror dh, 2
neg esi
bsf si, ax
cpuid
mov ebp, eax
mov dl, cl
jmp 0x9afb59
lea edi, reloc.KERNEL32.dll_GetStartupInfoA
mov al, 0xb3
xchg bl, ch
call 0x9afce0
rdtsc
setp cl
bsr edx, ebp
add esp, 7
jmp 0x9afda7
rdtsc
xchg byte [esp + 0x19], bl
push dword [esp + 0x13]
not ah
bts bp, bp
jmp 0x9afde7
mov edi, 0xa9e65afc
pushfd
mov byte [esp + 0x22], cl
clc
mov word [esp + 8], ax
xchg word [esp + 0x1b], bx
jmp 0x9afd91
bswap edi
mov word [esp + 0xd], di
mov ebx, eax
mov ah, cl
cmc
jmp 0x9afe20
setne bh
sub esp, 5
mov byte [esp + 5], cl
lea esp, [esp + 0x1c]
xchg byte [esp + 9], dh
rdtsc
jmp 0x9afdd1
mov al, byte [esp]
xchg bl, ah
dec ah
dec edi
add esp, 0
std
jmp 0x9afd5c
pop word [esp + 1]
mov dl, bh
xchg word [esp + 5], bx
bswap eax
xchg word [esp + 3], di
mov bx, word [esp + 0xe]
jmp 0x9afec1
pushfd
mov dx, ax
lea esp, [esp + 4]
mov ecx, 0xada7eab2
and bx, 0x8dd1
mov si, 0x4716
jmp 0x9afbd6
mov dl, 0x35
mov esi, esp
xchg byte [esp + 6], ch
xchg ecx, esi
sub esp, 0xc
jmp 0x9afe95
xchg bp, di
push word [esp + 1]
mov di, 0xdb05
pop dword [esp + 8]
mov si, di
lea edx, [eax + esi]
jmp 0x9afe67
pop word [esp + 0x10]
lea ecx, [ecx*4]
lea esp, [esp + 0x16]
rdtsc
push word [esp + 2]
not ecx
jmp 0x9afeda
mov bl, 0xd4
lea edi, [ebp*4]
xchg byte [esp + 0xb], ch
mov ch, al
push dword [esp + 0xe]
mov bx, 0xf409
jmp 0x9afe7d
lea edi, [esp + ecx]
lea ebp, [eax + edi]
cpuid
pop word [esp + 1]
bsr bp, ax
mov dword [esp], ecx
jmp 0x9b068f
lea esp, [esp + 4]
popal
call fcn.009aff6b
pop dword [esp + 1]
pop dword [esp + 1]
lea esp, [esp + 6]
push si
jmp 0x9affe2
lea esp, [esp]
mov word [esp], sp
push dword [esp + 2]
mov byte [esp + 2], ah
jmp 0x9b0030
lea edx, reloc.KERNEL32.dll_GetStartupInfoA
pop cx
mov cl, 0x8c
not bl
mov word [esp + 2], dx
lea esp, [esp + 1]
jmp 0x9affc0
mov word [esp + 2], si
call fcn.009b000f
mov byte [esp + 0x21], dh
pop word [esp + 0x14]
lea esp, [esp + 0x13]
jmp 0x9b007a
mov byte [esp + 0xa], ch
lea esp, [esp + 0x11]
mov dword [esp], edi
mov byte [esp], ch
push dword [esp + 3]
pushal
call fcn.009b0064
invalid
pushfd
xchg dx, cx
pop si
neg ecx
mov dx, 0x9cc8
xchg word [esp + 4], di
jmp 0x9afff8