Function at 0x9fe854
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 1], di
xchg dh, bh
xchg bx, si
mov dx, bx
push eax
jmp 0x9fe87d
mov di, 0x563b
mov edi, dword [esp + 4]
mov cx, bp
mov ebp, edx
mov si, word [esp]
jmp 0x9fe83e
push word [esp + 1]
setge cl
cpuid
mov ebx, esi
btc edx, ebx
jmp 0x9fe964
mov edi, 0x6e37f931
xchg byte [esp + 5], dh
bswap eax
pop dx
xchg byte [esp + 2], bl
pop esi
jmp 0x9fe867
xchg ch, bl
mov esi, 0x81ba6fb5
mov eax, dword [esp]
mov ebx, edx
bsf eax, eax
pushal
jmp 0x9fe928
rdtsc
mov si, sp
stc
xchg dx, si
xchg dword [esp], esi
pop eax
jmp 0x9fe8b7
mov dword [esp + 0xe], ecx
mov word [esp + 8], dx
rdtsc
mov esi, eax
jmp 0x9fe90c
not ebx
xchg di, ax
xchg word [esp + 0x17], dx
mov dh, byte [esp + 7]
lea ecx, reloc.KERNEL32.dll_GetDriveTypeA
pop dword [esp + 9]
jmp 0x9fe8dc
mov ah, byte [esp + 3]
mov ebx, 0x86a3f3de
sete ch
push word [esp + 5]
jmp 0x9fe93e
mov si, di
mov ax, sp
mov ch, dh
bt dx, di
xchg word [esp + 0xf], bp
xchg bp, si
jmp 0x9fe8f2
mov ecx, 0x7d26f22b
xchg word [esp + 4], bp
push word [esp + 6]
lea ebp, reloc.KERNEL32.dll_GetDriveTypeA
mov edx, edi
mov dl, al
jmp 0x9fe9cd
mov ah, dl
add esp, 3
mov bp, word [esp]
push word [esp + 1]
xchg byte [esp + 1], bl
mov dh, byte [esp + 1]
jmp 0x9fe8cd
pop word [esp + 0x25]
pushal
lea esp, [esp + 0x56]
mov eax, 0x5d19ecd8
cld
jmp 0x9fe9ab
mov word [esp + 3], dx
cld
mov dword [esp + 0x13], ebx
mov word [esp + 2], si
sub esp, 0x1c
xchg ebp, ebx
jmp 0x9fe97f
setnp dl
btc ax, cx
lea esi, [esi*4]
sub esp, 0x11
stc
inc bx
jmp 0x9fe9fc
xchg byte [esp + 3], bl
pop dword [esp + 2]
push bx
lea ebx, [ebx*4]
pop si
mov dl, byte [esp + 4]
jmp 0x9fe995
bsf ax, sp
lea edi, [ebp*4]
jmp 0x9fea16
rcr bp, 0xc
mov ah, byte [esp + 2]
lea esp, [esp + 0xe]
lea edi, reloc.KERNEL32.dll_GetDriveTypeA
mov bp, si
mov bl, byte [esp]
jmp 0x9fe9e6
lea eax, [eax*4]
lea esp, [esp]
xchg byte [esp], bh
xchg byte [esp + 1], ah
mov bp, 0x2a6c
sub esp, 0x10
jmp 0x9feaca
xchg dx, bp
call fcn.009feaa0
push esi
imul esi, dword [edx + 0x74], 0x516c6175
jne 0x9fead2
jb 0x9feae8
add dh, dh
lea ebx, [eax + ebx]
bts ebx, ecx
setno bl
lea edi, [eax*4]
neg ebp
mov word [esp + 2], si
jmp 0x9fea5b
lea eax, [esp - 0x16]
xchg byte [esp + 4], ch
stc
pop word [esp + 8]
add esp, 0xc
lea ebx, [eax + edx]
jmp 0x9fea71
btr edi, eax
pop word [esp + 0xd]
jmp 0x9feb1e
add esp, 2
mov bl, dh
bswap ebp
mov bx, bp
bt ax, ax
jmp 0x9feb8b
neg ch
pop dword [esp + 3]
xor dh, 0xbc
pop di
mov bp, word [esp + 6]
xchg dword [esp + 3], eax
jmp 0x9feb08
lea esp, [esp + 8]
call fcn.009feb5d
not al
xchg si, ax
mov byte [esp], bh
xchg ch, ah
cpuid
mov ax, word [esp]
jmp 0x9febe2
stc
pop ax
lea ecx, [edx + edi]
xchg ebx, edi
lea edi, reloc.KERNEL32.dll_GetDriveTypeA
jmp 0x9febf6
xchg byte [esp], bl
bswap esi
lea esp, [esp]
mov bp, 0x3db4
setg dl
sub esp, 0x1a
jmp 0x9febcc
mov dword [esp + 0xc], edx
pop esi
lea esi, [esi*4]
neg di
inc al
pop ecx
jmp 0x9fedc9
pushal
mov cl, bh
xchg ebx, eax
mov edi, dword [esp + 0x10]
cmc
std
jmp 0x9fec1f
mov esi, 0x9f4ae994
xchg byte [esp], dh
mov byte [esp], ah
clc
mov edx, 0xe2cb3e9f
mov byte [esp], al
jmp 0x9fec35
and cl, 0x5d
add esp, 0xc
xchg esi, ecx
pop ebp
std
bsr ebp, esp
jmp 0x9fec64