Function at 0x4f9c56
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1d
xchg bh, ah
pop eax
mov eax, dword [esp + 6]
dec eax
rcl dx, cl
jmp 0x4f9c66
xchg dword [esp], ebx
mov dl, 0x95
not dl
dec dx
mov word [esp + 1], ax
jmp 0x4f9c3f
push dword [esp + 0x17]
xchg dword [esp + 0x13], ebp
lea edi, [ebx + ebp]
mov dword [esp + 0x1c], esi
rdtsc
stc
jmp 0x4fb8d1
not bh
xchg byte [esp + 0x10], al
dec esi
lea ebp, [ecx + edi]
lea ebp, [ecx + edi]
jmp 0x4fb6b2
bswap edi
not dl
push dword [esp + 0xd]
mov ebp, 0x498a7976
mov word [esp + 9], bp
mov byte [esp + 4], cl
jmp 0x4fb684
mov word [esp], bp
lea ebp, reloc.mscoree.dll__CorExeMain
mov bp, word [esp + 0xc]
push dword [esp + 2]
jmp 0x4fb763
xchg byte [esp + 0xf], bl
mov bl, cl
lea ebx, [ecx + edx]
mov dx, 0xfe66
pop dword [esp + 7]
xchg ah, al
jmp 0x4fb69a
neg cl
mov ch, ah
mov si, word [esp + 0xd]
xchg word [esp + 0x10], ax
bswap ecx
bsr si, bp
jmp 0x4fb733
cmp bl, 0xd9
mov dword [esp + 2], ebp
ror dh, 7
lea esi, [eax*4]
std
neg dh
jmp 0x4fb6e0
sete cl
push word [esp + 0xf]
pushal
cmc
dec dh
jmp 0x4fb747
xchg dword [esp], esi
mov dl, byte [esp + 5]
push word [esp + 8]
pop ax
sete ah
xchg edi, eax
jmp 0x4fb71d
push word [esp + 0x1c]
pushal
lea esp, [esp + 0x5b]
rdtsc
mov edx, dword [esp]
mov eax, esi
jmp 0x4fb774
cpuid
dec di
bts edx, edi
std
lea ebx, [ebx + edi]
mov edx, dword [esp + 5]
jmp 0x4fb707
not cl
or dl, 0x61
rdtsc
lea esi, reloc.mscoree.dll__CorExeMain
mov cx, 0x5067
setle bl
jmp 0x4fb897
not ebx
mov dword [esp + 0xc], edi
bsr si, bp
mov ah, byte [esp + 0x20]
add esp, 8
add esp, 6
jmp 0x4fb6cb
sub esp, 0x1e
cld
push word [esp + 0x11]
lea esp, [esp]
bsf cx, si
jmp 0x4fb7ee
neg eax
pushal
lea esp, [esp + 0x44]
cpuid
cpuid
sete cl
jmp 0x4fb7b2
lea esi, [ebx + ebp]
mov al, byte [esp + 0x1c]
mov byte [esp + 0xf], bl
pop word [esp + 6]
jmp 0x4fb826
mov edx, dword [esp]
pop word [esp + 4]
cpuid
and ch, ah
sub esp, 0x12
mov word [esp + 6], sp
jmp 0x4fb7d8
cmc
xchg ebp, esi
mov byte [esp + 0x12], ah
neg bl
push dword [esp + 1]
add cl, bh
jmp 0x4fb7c8
shr edi, cl
xchg dword [esp + 0x1b], ebp
mov eax, 0x4f9332fb
inc eax
cpuid
mov ax, word [esp + 3]
jmp 0x4fb87e
bsf ebx, esi
bswap eax
mov cx, 0x6400
pushal
lea eax, [edi*4]
mov dx, word [esp + 0x1f]
jmp 0x4fb815
mov edx, dword [esp + 4]
bswap ecx
mov dword [esp + 0x27], edi
mov eax, edi
mov di, sp
jmp 0x4fb8a7
shl cx, 0xd
mov bp, 0x1f9
mov edi, dword [esp + 0xe]
dec cx
bsr ecx, eax
jmp 0x4fb868
and eax, esp
xchg edi, ecx
seto bh
setp al
xchg edx, esi
mov cl, 0xfa
jmp 0x4fb850
cpuid
and bx, bx
mov bl, bh
not dl
lea esi, [edi*4]
neg ch
jmp 0x4fbe9d
rdtsc
mov ch, byte [esp + 2]
bsf edi, eax
sub ebx, edi
rdtsc
xchg byte [esp + 2], bl
jmp 0x4fb799
push esp
mov al, byte [0x66751ae3]
mov esi, eax
mov si, ax
neg ax
xchg ebp, esi
push word [esp]
xchg esi, edx
call fcn.004fb8e7
jno 0x4fb8f8
je 0x4fb927
out dx, al
inc edi
xchg edi, eax
dec cl
push 0xc187228b
xchg ecx, eax
rdtsc
pop dword [esp + 3]
lea ecx, [ebx*4]
add byte [eax], al
add byte [eax], al
mov al, byte [esp + 7]
add esp, 6
jmp 0x4fb8fd
inc dh
add esp, 0x1d
pop si
not eax
bsr bp, ax
pop si
jmp 0x4fb91c
mov bp, 0xab88
mov ebp, 0xb1ee0962
lea edx, [edx + edi]
mov eax, 0x4b8f3024
xchg dword [esp + 0x10], eax
cld
jmp 0x4fb9a0