Function at 0x4f9bd0
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
movzx ebx, byte [esi]
lea eax, [ebx - 9]
cmp eax, 0x75
ja case.0x4f9bed.11
movzx eax, byte [eax + 0x4fa190]
jmp dword [eax*4 + 0x4fa128]
movzx eax, byte [esi + 1]
mov edx, 1
test byte [eax + 0x569040], dl
je 0x4f9c1f
nop word [eax + eax]
movzx ecx, byte [esi + edx + 1]
inc edx
test byte [ecx + 0x569040], 1
jne 0x4f9c10
mov dword [edi], 0x95
mov eax, edx
pop edi
pop esi
pop ebx
ret
cmp byte [esi + 1], 0x2d
jne 0x4f9c5b
movzx eax, byte [esi + 2]
mov ecx, 2
test eax, eax
je 0x4f9c4f
nop
cmp eax, 0xa
je 0x4f9c4f
movzx eax, byte [ecx + esi + 1]
inc ecx
test eax, eax
jne 0x4f9c40
mov dword [edi], 0x95
pop edi
pop esi
mov eax, ecx
pop ebx
ret
mov dword [edi], 0x57
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x16
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x17
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov dword [edi], 1
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x56
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x58
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp byte [esi + 1], 0x2a
jne 0x4f9cf2
mov cl, byte [esi + 2]
test cl, cl
je 0x4f9cf2
mov eax, 3
movzx ecx, cl
nop word [eax + eax]
cmp ecx, 0x2a
lea ecx, [eax + esi]
jne 0x4f9cdd
cmp byte [ecx], 0x2f
je 0x4f9ce7
movzx ecx, byte [ecx]
test ecx, ecx
je 0x4f9ce8
inc eax
jmp 0x4f9cd0
inc eax
mov dword [edi], 0x95
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x59
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x5a
mov eax, 1
pop edi
pop esi
pop ebx
ret
xor eax, eax
mov dword [edi], 0x4c
cmp byte [esi + 1], 0x3d
pop edi
sete al
pop esi
inc eax
pop ebx
ret
mov al, byte [esi + 1]
cmp al, 0x3d
jne 0x4f9d3a
mov dword [edi], 0x4e
mov eax, 2
pop edi
pop esi
pop ebx
ret
cmp al, 0x3e
je 0x4f9dad
cmp al, 0x3c
jne 0x4f9d51
mov dword [edi], 0x54
mov eax, 2
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x4f
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov al, byte [esi + 1]
cmp al, 0x3d
jne 0x4f9d76
mov dword [edi], 0x50
mov eax, 2
pop edi
pop esi
pop ebx
ret
cmp al, 0x3e
jne 0x4f9d89
mov dword [edi], 0x55
mov eax, 2
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x4d
mov eax, 1
pop edi
pop esi
pop ebx
ret
cmp byte [esi + 1], 0x3d
je 0x4f9dad
mov dword [edi], 0x94
mov eax, 2
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x4b
mov eax, 2
pop edi
pop esi
pop ebx
ret
cmp byte [esi + 1], 0x7c
je 0x4f9dd1
mov dword [edi], 0x53
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x5b
mov eax, 2
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x19
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x52
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x5d
mov eax, 1
pop edi
pop esi
pop ebx
ret
movzx edx, byte [esi + 1]
mov ecx, 1
test edx, edx
je 0x4f9e38
nop word [eax + eax]
cmp edx, ebx
jne 0x4f9e2e
movzx eax, byte [ecx + esi + 1]
cmp eax, ebx
jne 0x4f9e38
inc ecx
movzx edx, byte [ecx + esi + 1]
inc ecx
test edx, edx
jne 0x4f9e20
cmp edx, 0x27
jne 0x4f9e4a
mov dword [edi], 0x5e
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
ret
test edx, edx
je 0x4f9e5b
mov dword [edi], 0x1a
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
ret
mov dword [edi], 0x94
mov eax, ecx
pop edi
pop esi
pop ebx
ret
movzx eax, byte [esi + 1]
test byte [eax + 0x569040], 4
jne case.0x4f9bed.48
mov dword [edi], 0x75
mov eax, 1
pop edi
pop esi
pop ebx
ret
xor ecx, ecx
mov dword [edi], 0x81
test byte [ebx + 0x569040], 4
je 0x4f9eaf
nop dword [eax]
nop dword [eax + eax]
movzx eax, byte [esi + ecx + 1]
inc ecx
test byte [eax + 0x569040], 4
jne 0x4f9ea0
cmp byte [ecx + esi], 0x2e
jne 0x4f9ee5
movzx eax, byte [ecx + esi + 1]
inc ecx
test byte [eax + 0x569040], 4
je 0x4f9edf
nop dword [eax]
nop dword [eax + eax]
movzx eax, byte [esi + ecx + 1]
inc ecx
test byte [eax + 0x569040], 4
jne 0x4f9ed0
mov dword [edi], 0x82
mov al, byte [ecx + esi]
cmp al, 0x65
je 0x4f9ef0
cmp al, 0x45
jne 0x4f9f45
mov dl, byte [ecx + esi + 1]
movzx eax, dl
test byte [eax + 0x569040], 4
jne 0x4f9f18
cmp dl, 0x2b
je 0x4f9f0a
cmp dl, 0x2d
jne 0x4f9f45
movzx eax, byte [ecx + esi + 2]
test byte [eax + 0x569040], 4
je 0x4f9f45
movzx eax, byte [ecx + esi + 2]
add ecx, 2
test byte [eax + 0x569040], 4
je 0x4f9f3f
nop dword [eax]
movzx eax, byte [esi + ecx + 1]
inc ecx
test byte [eax + 0x569040], 4
jne 0x4f9f30
mov dword [edi], 0x82
movzx eax, byte [ecx + esi]
test al, al
js 0x4f9f63
cmp eax, 0x1f
jbe 0x4f9c55
cmp byte [eax + 0x568540], 0
je 0x4f9c55
mov dword [edi], 0x94
inc ecx
jmp 0x4f9f45
mov eax, 1
movzx edx, byte [eax + esi]
test edx, edx
je 0x4f9f7f
inc eax
cmp edx, 0x5d
jne 0x4f9f71
mov esi, 0x1a
cmp edx, 0x5d
mov ecx, 0x94
cmove ecx, esi
mov dword [edi], ecx
pop edi
pop esi
pop ebx
ret
movzx eax, byte [esi + 1]
mov edx, 1
mov dword [edi], 0x85
test byte [eax + 0x569040], 4
je 0x4f9fbf
nop dword [eax]
movzx ecx, byte [esi + edx + 1]
inc edx
test byte [ecx + 0x569040], 4
jne 0x4f9fb0
pop edi
pop esi
mov eax, edx
pop ebx
ret
movzx eax, byte [esi + 1]
mov edx, 1
test byte [eax + 0x569040], 4
je case.0x4f9bed.36
nop word [eax + eax]
movzx ecx, byte [esi + edx + 1]
inc edx
test byte [ecx + 0x569040], 4
jne 0x4f9fe0
cmp edx, 1
jle case.0x4f9bed.36
mov dword [edi], 0x84
mov eax, edx
pop edi
pop esi
pop ebx
ret
movzx ecx, byte [esi + 1]
xor edx, edx
mov dword [edi], 0x85
lea eax, [edx + 1]
test ecx, ecx
je 0x4fa04b
test cl, cl
js 0x4fa038
cmp ecx, 0x1f
jbe 0x4fa025
cmp byte [ecx + 0x568540], 0
jne 0x4fa038
cmp ecx, 0x28
je 0x4fa055
cmp ecx, 0x3a
jne 0x4fa043
cmp byte [eax + esi + 1], cl
jne 0x4fa043
inc eax
jmp 0x4fa039
inc edx
movzx ecx, byte [eax + esi + 1]
inc eax
test ecx, ecx
jne 0x4fa013
test edx, edx
jne 0x4fa124
mov dword [edi], 0x94
pop edi
pop esi
pop ebx
ret
test edx, edx
jle 0x4fa045
nop dword [eax]
mov dl, byte [eax + esi + 1]
inc eax
movzx ecx, dl
test dl, dl
je 0x4fa07a
test byte [ecx + 0x569040], 1
jne 0x4fa07a
cmp ecx, 0x29
jne 0x4fa060
cmp dl, 0x29
jne 0x4fa04b
pop edi
pop esi
inc eax
pop ebx
ret
cmp byte [esi + 1], 0x27
jne case.0x4f9bed.11
movzx eax, byte [esi + 2]
mov ecx, 2
mov dword [edi], 0x83
test eax, eax
je 0x4fa0c7
nop dword [eax]
cmp eax, 0x27
je 0x4fa0be
test byte [eax + 0x569040], 8
jne 0x4fa0b4
mov dword [edi], 0x94
movzx eax, byte [ecx + esi + 1]
inc ecx
test eax, eax
jne 0x4fa0a0
test cl, 1
jne 0x4fa0c7
test eax, eax
jne 0x4fa0d1
mov dword [edi], 0x94
test eax, eax
je 0x4fa0d2
inc ecx
pop edi
pop esi
mov eax, ecx
pop ebx
ret
test bl, bl
js 0x4fa0f9
cmp ebx, 0x1f
jbe 0x4fa0ea
cmp byte [ebx + 0x568540], 0
jne 0x4fa0f9
mov dword [edi], 0x94
mov eax, 1
pop edi
pop esi
pop ebx
ret
mov ebx, 1
nop
movzx eax, byte [ebx + esi]
test al, al
js 0x4fa116
cmp eax, 0x1f
jbe 0x4fa119
cmp byte [eax + 0x568540], 0
je 0x4fa119
inc ebx
jmp 0x4fa100
mov edx, ebx
call fcn.004fa220
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret