Function at 0x4fc8c2
Capabilities:
Parse pe header

Disassembly:
push 0x5148634e
dec ecx
dec esp
dec ebp
dec esp
push ebx
dec bp
js 0x4fc917
jnp 0x4fc928
push eax
push dword [esp]
add dword [esp], 0xfffb66d7
add dword [esp + 4], 0xc1
ret
inc ebx
insd dword es:[edi], dx
pop eax
pop ecx
inc edx
pop ebp
push 0x4a
js 0x4fc985
js 0x4fc97b
inc eax
pop ebp
dec esp
jnp 0x4fc98d
push edx
dec edi
imul edx, dword [ebp + 0x69], 0x52796c5e
inc edi
jns 0x4fc99c
outsb dx, byte [esi]
push ebp
dec ecx
dec eax
inc ebp
dec ecx
jns 0x4fc9a7
dec edi
push edx
inc edi
inc edx
popal
inc ebx
push 0x684e4559
pop ebp
push edi
pop eax
dec ebp
pop esp
inc esp
inc ebx
inc esp
cmp ebx, 0x336a8b63
jne 0x4fc975
push ebx
push 0x61
pop edi
imul ecx, dword [ecx + edx*2 + 0x63], 0x4d
insb byte es:[edi], dx
pop ecx
inc ebp
pop ecx
imul edi, dword [ecx + 0x57], 0x57585561
imul eax, dword [eax + 0x68], 0x54475463
push esp
dec eax
add esp, 0xc
cmp dword [ebx + edi], 0
je 0x4fcd5d
add byte [edi], cl
test bl, bl
add eax, dword [eax]
add byte [ecx - 0x249bdb84], al
fisttp dword [ebx - 0x2f]
cmp dword [esp + 0x64], 0xd14bdbdb
fcmovnu st(0), st(3)
dec ebx
ror dword [edi], 1
inc esp
sti
cmove edi, ebx
push dword [edi]
cmp edi, 0x65361ca1
jne 0x4fc9bf
insb byte es:[edi], dx
dec ecx
popal
inc edi
push esi
push esp
inc edi
imul eax, dword [eax + 0x48], 0x45
inc edx
push edx
pop esp
push ebx
bound edx, qword [ebp + edx*2 + 0x4e]
push ecx
insb byte es:[edi], dx
push esp
imul esp, dword [esi + 0x50], 0x4f
arpl word [ecx + 0x5f], sp
dec eax
pop esp
imul ecx, dword [ebp + 0x49], 0x6e5b5d5a
push dword [ebp - 4]
push dword [ebx + edi]
cmp edx, 0x904cd841
jne 0x4fca15
dec ebx
pop esi
popal
inc edi
outsd dx, dword [esi]
pop ebx
outsb dx, byte [esi]
push ecx
inc esi
insb byte es:[edi], dx
dec ebp
popal
push 0x79545d4f
push ebx
dec esp
pop esp
inc eax
push eax
popal
push ecx
dec ebp
push eax
insb byte es:[edi], dx
pop ecx
push 0x6c42656c
dec ecx
push esi
dec eax
push ecx
push edi
pushal
pushal
inc ecx
inc eax
dec esi
pop ecx
popal
imul ebx, dword [ebx + 0x48], 0x6b4a6959
push 0x52
dec esp
push edx
pop ebp
inc ebx
inc ebx
pop ebx
inc ecx
insb byte es:[edi], dx
push 0x455c5162
insd dword es:[edi], dx
push esi
call fcn.004fca94
dec edi
xor esi, esi
ret
cmp ebp, 0x359a81af
jne 0x4fcd77
popal
pop edi
mov edi, edi
je 0x4fcd76
imul ebp, dword [esi - 0x75], 0xc650ec
add al, ch
sub eax, 0x54000000
call 0x4fcda9
push esp
push esi
push eax
pop edx
dec edi
push 0x4d
dec edx
bound eax, qword [esi + 0x6e]
pop esi
push esi
js 0x4fcdee
push ebx
pop esi
inc si
push eax
pop ecx
pop esi
popal
inc edi
inc edx
pop edi
inc ebp
push ebx
dec ebx
popal
pop ecx
pop esi
pop ecx
bound edx, qword [esi + 0x5d]
insb byte es:[edi], dx
push 0x4d
outsd dx, dword [esi]
imul edx, dword [edi + 0x55], 0x78
inc esp
push dword [esp]
add dword [esp], 0xfffb282e
add dword [esp + 4], 0x73
ret
jmp 0x59a627c6
pop ebp
cmp ebx, 0x412f4cd3
jne 0x4fce38
push ecx
dec ebx
js 0x4fce43
xor ecx, ebp
pop ebp
je 0x4fce1d
push ecx
dec cx
dec ebx
dec ecx
add al, byte [eax]
inc ebx
dec eax
mov eax, esi
push 0x14
cmp dword [edi], ecx
add esp, 0x18
push 0x85454778
fild dword [ecx + 0x7ffe1]
add byte [esi - 1], dl
adc eax, sym.imp.KERNEL32.dll_GetConsoleMode
add byte [eax], al
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [ebp + 0x20]
push esp
pushal
push ebx
dec ebx
imul esi, dword [ebx + ebx - 9], 0xfffffff1
push ebx
mov eax, dword [ebp + 8]
imul esi, dword [ebx], 0x7c8150c0
and al, 0x24
sti
sub dword [eax + 2], eax
xor eax, eax
push eax
cmp dword [esp + 0x24], 0x24029fb
jne 0x4fce5c
push ebx
jnp 0x4fcdd8
dec ebp
or al, 0x5d
dec esi
test ebx, ebx
inc edx
pop ebp
pop esp
dec esp
pop esp
push 0x50
push eax
push eax
cmp ebx, 0xd66c48db
cmove ecx, edx
push eax
cmp edx, 0xedec014d
je 0x54fa94
push eax
cmp eax, 0xb4a7d15f
mov ah, 0xf
inc esp
fucomi st(0)
popal
add byte [eax], al
add byte [ecx + 0x4f], cl
inc edx
pop edx
pop ebx