Function at 0x4c941c
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xchg edx, eax
retf 0xc01b
sbb eax, eax
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 6]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
or eax, 1
lea ecx, [ecx]
jmp 0x4f4d60
pushfd
pushfd
add ebp, 0x42
popfd
lea ebp, [ebp - 0x42]
xchg edi, eax
lea esp, [esp - 4]
mov dword [esp], edi
mov edi, eax
mov eax, dword [esp]
xchg edx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, edx
mov edx, dword [esp]
rdtsc
push ebx
mov ebx, dword [esp + 0xb]
pop ebx
and eax, 1
lea ebx, [ebx]
xchg edi, edx
xchg dword [esp], edi
xchg edi, edx
lea esp, [esp + 4]
xchg edx, eax
xchg dword [esp], edx
xchg edx, eax
lea esp, [esp + 4]
je 0x4d0d98
jne 0x4a2d4c
jmp 0x4d0d96
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x23]
xchg dword [esp + 4], eax
and al, 4
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
and al, 4
add eax, edi
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x7e]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
xchg dword [ebp + 0xc], edi
mov edi, eax
push dword [ebp + 0xc]
xchg dword [ebp + 0xc], edi
pop edi
cmp dword [edx + edi + 0x18], esi
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x69]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
jbe 0x4fe7b0
jmp 0x4c2be0
call fcn.0051aba0
jnp 0x49e6e4
js 0x49e76d
jae 0x49e6da
cmp edx, dword [0x71c9acc]
jnp 0x49e6ef
movq mm4, qword [edi]
lodsd eax, dword [esi]
push esi
mov dx, word [esp + 4]
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x67]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
mov ax, word [esp + 2]
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x67]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
div word [esp]
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x14]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
lea esp, [esp + 2]
push ecx
mov ecx, eax
pop ecx
mov word [esp], ax
push ebp
mov ebp, esp
leave
mov word [esp + 2], dx
push ebp
mov ebp, esp
leave
pushfd
mov eax, eax
add esi, 1
pushfd
add ebp, 0x69
popfd
lea ebp, [ebp - 0x69]
jmp fcn.004c6b4c
popfd
lea edi, [edi]
je 0x4d5e30
jne 0x4d5e30
jmp 0x4d5e2e
mov eax, dword [eax + esi*4]
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 1]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg ecx, eax
mov eax, ebx
push ecx
xchg ecx, eax
pop eax
add eax, edi
push edi
mov edi, ecx
pop edi
jmp 0x49dfdc
add byte [eax], al
sbb eax, eax
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x66]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
or eax, 1
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x79]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
jmp 0x4cde34
jmp 0x49e740
pushfd
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0xb]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
xchg edi, eax
lea esp, [esp - 4]
mov dword [esp], edi
mov edi, eax
mov eax, dword [esp]
xchg ecx, edx
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, edx
mov edx, dword [esp]
rdtsc
push ebx
mov ebx, eax
pop ebx
and eax, 1
push ebp
mov ebp, esp
leave
xchg ecx, edx
xchg dword [esp], ecx
xchg ecx, edx
lea esp, [esp + 4]
xchg edx, eax
xchg dword [esp], edx
xchg edx, eax
lea esp, [esp + 4]
je 0x4d20d8
jne 0x4eeb2c
jmp 0x4d20d6
add byte [eax], al
popfd
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0xa]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
je 0x4d8fc4
jne 0x4d8fc4
jmp 0x4d8fc2
add byte [eax], al
popfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 9]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
je 0x4f4d60
jne 0x4f4d60
jmp 0x4f4d5e
pushfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x52]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg edi, eax
lea esp, [esp - 4]
mov dword [esp], edi
mov edi, eax
mov eax, dword [esp]
xchg edx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, edx
mov edx, dword [esp]
rdtsc
lea edx, [edx]
and eax, 1
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x38]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
xchg ecx, edx
xchg dword [esp], ecx
xchg ecx, edx
lea esp, [esp + 4]
xchg ecx, eax
xchg dword [esp], ecx
xchg ecx, eax
lea esp, [esp + 4]
je 0x4fdc78
jne 0x4f9bcc
jmp 0x4fdc76
mov ch, 0x2f
test eax, eax
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x23]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
je 0x4e69f4
xchg ecx, edx
mov edx, dword [ebp + 8]
push ecx
xchg ecx, edx
pop edx
inc esi
push edx
mov edx, eax
pop edx
xchg edx, eax
mov edx, dword [ecx]
push eax
xchg edx, eax
pop edx
cmp esi, dword [eax + edi + 0x18]
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x19]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
xchg esi, eax
mov esi, dword [ebp + 0xc]
push eax
xchg esi, eax
pop esi
jb 0x4c2be0
jmp 0x4fe7b0
add byte [eax], al
mov dl, byte [eax]
lea eax, [eax]
cmp dl, byte [ecx]
push eax
mov eax, esi
pop eax
jne 0x4c44f4
test dl, dl
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x76]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
je 0x4fd21b
mov dl, byte [eax + 1]
pushfd
add ebp, 0x65
popfd
lea ebp, [ebp - 0x65]
cmp dl, byte [ecx + 1]
push ebp
mov ebp, esp
leave
jne 0x4c44f4
add eax, 2
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x62]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
add ecx, 2
pushfd
add ebp, 0x1b
popfd
lea ebp, [ebp - 0x1b]
test dl, dl
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x7e]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
jne 0x4d5e30
jmp 0x4fd21b
add byte [eax], al
mov dl, byte [eax]
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x56]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
cmp dl, byte [ecx]
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x3b]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
jne 0x4d3450
test dl, dl
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0xa]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
je 0x4fd21b
mov dl, byte [eax + 1]
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x77]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
cmp dl, byte [ecx + 1]
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x78]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
jne 0x4c44f4
add eax, 2
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x67]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
add ecx, 2
push esi
mov esi, dword [esp + 4]
lea esi, [esi]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
test dl, dl
lea ecx, [ecx]
jne 0x4d8fc4
jmp 0x4fd21b
add byte [eax], al
test esi, esi
push edx
mov edx, dword [esp + 7]
pop edx
js 0x4fe7b0
xchg edx, eax
mov edx, dword [ebp + 8]
push eax
xchg edx, eax
pop edx
xchg edx, esi
mov esi, dword [eax]
push edx
xchg edx, esi
pop esi
xchg ecx, eax
mov ecx, dword [edx + edi + 0x24]
push eax
xchg ecx, eax
pop ecx
lea eax, [eax + esi*2]
lea edx, [edx]
xchg esi, ebx
mov ebx, dword [ebp + 8]
push esi
xchg esi, ebx
pop ebx
movzx ebx, word [eax + edi]
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x52]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
jmp 0x4e6a40
pushfd
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x49]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
xchg ecx, eax
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, eax
mov eax, dword [esp]
xchg ecx, edx
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, edx
mov edx, dword [esp]
rdtsc
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x60]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
and eax, 1
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x7a]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
xchg esi, edx
xchg dword [esp], esi
xchg esi, edx
lea esp, [esp + 4]
xchg edx, eax
xchg dword [esp], edx
xchg edx, eax
lea esp, [esp + 4]
je 0x4fbdfc
jne 0x4e78ec
jmp 0x4fbdfa
add byte [eax], al
popfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x48]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
je 0x4e69f4
jne 0x4e69f4
jmp 0x4e69f2
xor eax, 0x9cf685fe
test esi, esi
pushfd
add ebp, 0x5e
popfd
lea ebp, [ebp - 0x5e]
js 0x4fe7b0
xchg edi, eax
mov edi, dword [ebp + 8]
push eax
xchg edi, eax
pop edi
xchg edx, ecx
mov ecx, dword [eax]
push edx
xchg edx, ecx
pop ecx
xchg ebx, eax
mov ebx, dword [edx + edi + 0x24]
push eax
xchg ebx, eax
pop ebx
lea eax, [eax + esi*2]
push edi
mov edi, dword [esp]
pop edi
xchg esi, eax
mov eax, dword [ebp + 8]
push esi
xchg esi, eax
pop eax
movzx ebx, word [eax + edi]
pushfd
add ebp, 0x6d
popfd
lea ebp, [ebp - 0x6d]
jmp 0x4e6a40
cmp ebx, 0xffffffff
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x7b]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
je 0x4fe7b0
cmp ebx, dword [edx + edi + 0x14]
pushfd
add ebp, 0x7c
popfd
lea ebp, [ebp - 0x7c]
jae 0x4fe7b0
xchg ecx, eax
mov ecx, dword [edx + edi + 0x1c]
push eax
xchg ecx, eax
pop ecx
lea eax, [eax + ebx*4]
mov edi, edi
xchg ecx, edx
mov edx, dword [eax + edi]
push ecx
xchg ecx, edx
pop edx
cmp ecx, edx
lea edi, [edi]
jb 0x4dc9e0
xchg ecx, eax
mov ecx, dword [esi + 4]
push eax
xchg ecx, eax
pop ecx
add eax, edx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x28]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
cmp ecx, eax
mov ecx, ecx
jae 0x514554
lea ebx, [ecx + edi]
pushfd
add ebp, 8
popfd
lea ebp, [ebp - 8]
push 0x2e
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x2e]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
xchg edx, ebx
lea esp, [esp - 4]
mov dword [esp], edx
mov edx, ebx
mov ebx, dword [esp]
pushfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x39]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
call 0x4e6b0b
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x4d]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0x1677b
xchg dword [esp], edx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 7]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg dword [esp + 4], edx
pushfd
add ebp, 0x5c
popfd
lea ebp, [ebp - 0x5c]
xchg dword [esp], edx
push ebp
mov ebp, esp
leave
popfd
push ebp
mov ebp, esp
leave
jmp fcn.00513590
popfd
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x12]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
je 0x4ff040
jne 0x4ff040
jmp 0x4ff03e
popfd
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x45]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
je 0x4d3ffc
jne 0x4d3ffc
jmp 0x4d3ffa
pushal
sti
test eax, eax
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x79]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
je 0x51c690
xchg ecx, eax
mov eax, dword [ebp + 8]
push ecx
xchg ecx, eax
pop eax
inc esi
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x59]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg edx, eax
mov edx, dword [ecx]
push eax
xchg edx, eax
pop edx
cmp esi, dword [eax + edi + 0x18]
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 3]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg ecx, eax
mov ecx, dword [ebp + 0xc]
push eax
xchg ecx, eax
pop ecx
jb 0x4c2be0
jmp 0x4fe7b0
popfd
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 2]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
je 0x49db74
jne 0x49db74
jmp 0x49db72
add byte [eax], al
popfd
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x38]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
je 0x514554
jne 0x514554
jmp 0x514552
xor eax, eax
jmp 0x4fd224
call fcn.004e7fa0
idiv al
invalid
fild dword [ebp - 0x63]
popfd
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x3b]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
je 0x4c44f4
jne 0x4c44f4
jmp 0x4c44f2
xchg edi, eax
xchg dword [esp], eax
xchg edi, eax
lea esp, [esp + 4]
xchg edi, esi
xchg dword [esp], edi
xchg edi, esi
lea esp, [esp + 4]
xor eax, eax
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x1e]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
xchg edx, ebx
xchg dword [esp], edx
xchg edx, ebx
lea esp, [esp + 4]
mov esp, ebp
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x76]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
xchg esi, ebp
xchg dword [esp], esi
xchg esi, ebp
lea esp, [esp + 4]
ret 8
fld qword [eax]
lea eax, [ecx + edi]
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x4a]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
xchg edi, eax
xchg dword [esp], eax
xchg edi, eax
lea esp, [esp + 4]
xchg ecx, esi
xchg dword [esp], ecx
xchg ecx, esi
lea esp, [esp + 4]
xchg edi, ebx
xchg dword [esp], edi
xchg edi, ebx
lea esp, [esp + 4]
mov esp, ebp
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x1f]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
xchg edi, ebp
xchg dword [esp], edi
xchg edi, ebp
lea esp, [esp + 4]
ret 8
nop
pop es
lea eax, [ecx + edi]
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x11]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
xchg ecx, edi
xchg dword [esp], ecx
xchg ecx, edi
lea esp, [esp + 4]
xchg ecx, esi
xchg dword [esp], ecx
xchg ecx, esi
lea esp, [esp + 4]
xchg ebx, eax
xchg dword [esp], eax
xchg ebx, eax
lea esp, [esp + 4]
mov esp, ebp
pushfd
add ebp, 0x13
popfd
lea ebp, [ebp - 0x13]
xchg esi, ebp
xchg dword [esp], esi
xchg esi, ebp
lea esp, [esp + 4]
ret 8
pushfd
lea eax, [eax]
xchg edx, eax
lea esp, [esp - 4]
mov dword [esp], edx
mov edx, eax
mov eax, dword [esp]
xchg ebx, edx
lea esp, [esp - 4]
mov dword [esp], ebx
mov ebx, edx
mov edx, dword [esp]
rdtsc
mov edx, edx
and eax, 1
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x25]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
xchg ebx, edx
xchg dword [esp], ebx
xchg ebx, edx
lea esp, [esp + 4]
xchg edx, eax
xchg dword [esp], edx
xchg edx, eax
lea esp, [esp + 4]
je 0x4e1fa8
jne 0xb1dbd4
jmp 0x4e1fa6
popfd
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x35]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
je 0x4d9550
jne 0x4d9550
jmp 0x4d954e