Function at 0x48e414
Capabilities:
Check os version
Encode data using base64
Parse pe header

Disassembly:
fadd dword [ecx - 0x75]
pop esi
or byte [esi - 0x75], ah
inc esp
add eax, 0xc768d00
ja 0x484530
xchg esi, eax
je 0x499377
and eax, 0xd8880fbd
out dx, eax
add byte [eax], al
jns 0x4845aa
push 0x3c
jns 0x49357e
and eax, 0xa009e82b
add al, 0
test eax, eax
jb 0x4904d3
je 0x4c013e
jne 0x4845cb
sbb al, 0xd5
mov ebp, 0x8458b09
mov eax, dword [ebp + 8]
ja 0x48868a
jbe 0x4845da
shl byte [ecx - 0x79f00ab7], 0xaa
inc eax
add byte [eax], al
jbe 0x48868a
fmul dword [ecx + ecx*4]
neg byte [ebp - 0x3d]
into
inc byte [edi - 0x740a7812]
push es
xor ebx, ebx
jb 0x48377a
cmp ecx, ecx
jl 0x4886aa
dec edx
add byte [0xc004aad], ah
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ebx + 8], ah
dec ecx
add byte [esp + edx + 0x124d004b], bh
dec edx
add byte [ecx - 0x7a], ah
dec eax
add byte [esi + 0x4a124d17], ch
add byte [esp + edx - 0xdaffb5], bh
lea ebp, [ebp]
mov word [esi + 0xbc], di
mov edx, edx
call fcn.004b08a8
push 0x4bc2fb
ret
push eax
call fcn.0049fe77
add esp, 4
jne 0x4c0138
je 0x4886a1
xchg ebp, eax
je 0x490136
je 0x4c0138
add eax, dword [eax]
fmul dword [edx - 1]
push 0xfffffffffffffff4
lea ecx, [ecx]
ja 0x4b5e98
jbe 0x4886bb
jmp 0x48863f
jbe 0x4b5e98
and eax, 0x24648d5f
add al, 0xff
pop edx
ror byte [edi], 0x88
mov ecx, 0x79ffffec
add al, 0xf5
cpuid
ret
xor eax, 0x8436
jb 0x4ab813
add eax, 0
and ch, ch
sub eax, 0xe
stc
cmc
sub bp, 0
add cx, 0xf3e0
sub cx, 0xf3e0
xor eax, 0x5131
jb 0x499ae8
js 0x4bbe85
shr al, 0x40
jns 0x488a17
pushal
retf 0xc6cd
jns 0x4bbe85
add eax, 0x800f2dd2
xor eax, 0xe2c166ac
and byte [edi], cl
adc dword [ebx], 0
add byte [eax], al
pop dword [esp - 4]
inc esp
and al, 0xfc
mov al, byte [ebp + 0xb]
add esp, 0x30
add eax, 0
cmp bl, 1
shr di, 0x40
mov cl, cl
mov byte [esi + 0xba], bl
js 0x4b4340
jns 0x48e441
cpuid
pop edi
ret
jns 0x4b4340
fnstenv [ebx + 0x727415ff]
push ebx
add byte [ebp - 0x7b7df040], al
cmp eax, dword [eax]
add byte [esi + 0xffa86d7], al
mov byte [ebp + 0x7900017a], cl
add al, 0xf
dec esi
jno 0x48e415
fadd dword [edi]
pushfd
add esi, 4
jne 0x4847d0
je 0x4904e7
je 0x4847d0
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
imul dword [ebp + ebx]
shl ax, 0x20
lea esi, [esi + 0xc]
mov dword [ebp + ebx], eax
jmp dword [esi]
js 0x48e48c
jns 0x49581e
mov ch, 0xf
dec eax
loopne 0x49582e
jns 0x48e48c
mov dword [eax - 0x74], ebp
invalid
xor byte [ebp - 0x15], 0xff
cmc
push 0x49b05a
ret
stc
jb 0x499ade
jmp dword [esi]
push cs
call fcn.004a0aae
xor eax, 0x358c8950
xchg esp, eax
cld
invalid
dec esp
add ecx, dword [edi]
test dword [esi], esi
xor al, 1
add byte [esp + eax + 0xf], dh
mov byte [0x840fc3c5], al
sub dh, byte [ecx + eax]
add byte [ebx*4 - 0xb38277], dh
inc ecx
mov eax, dword [ebp - 4]
push 0x4a9349
ret
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0xb
push edi
mov dword [0x556089], 0xffffffff
call fcn.004a37b5
add esp, 8
mov eax, 1
pop edi
mov bx, bx
pop esi
push 0x4bebcc
ret
add ch, 0
js 0x499ad7
jns 0x4a7160
stc
pop ss
or dword [edi], 0xff297189
invalid
jns 0x499ad7
fmul dword [ecx]
jmp 0x4b420f
shr ebp, 0x40
push eax
push esi
push ebx
pop ebx
xchg cl, ah
shr bl, 0x40
xchg ah, cl
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
shl bh, 0x20
mov word [esi + 0xbc], dx
push edi
xchg di, di
pop edi
xchg ebp, ebx
xchg ebx, ebp
call fcn.004b126b
js 0x4a98b3
jns 0x4a71f6
loopne 0x4a726b
out 0xd3, al
jns 0x4a98b3
xor eax, 0x8768d00
shl si, 0x20
mov dword [ebp + 0x40], esp
jmp dword [esi]
inc eax
jmp 0x495812
sub ebp, dword [ecx - 0x40]
out dx, eax
inc eax
mov al, al
sbb dword [edi], ebx
jne 0x499ae6
je 0x4ab80d
mov al, 0x88
dec ebp
je 0x499ae6
and byte [ebx + 0x42], 0x66
cmp eax, 0xf688ffff
inc edx
cmp ax, 0xffff
mov dh, dh
jne 0x4b9510
je 0x4ab828
pop ds
mov eax, 0xedc1660d
inc eax
shr bp, 0x40
jmp 0x4a4af6
mov edi, dword [edx*8 + 0x556355]
sub esi, 0
test edi, edi
jb 0x484595
jne 0x4b7e3f
je 0x4ab855
out dx, eax
stc
call fcn.004a4af2
add eax, 0x57c8d9b
add al, ch
call 0xda4ab8a9
push esp
jmp 0x4ab868
push eax
call int.004b9ee6
jmp 0x4afa7a
or ecx, edx
jb 0x48d250
sub ebp, 0
xor cx, word [esi + 6]
jb 0x48d259
push 0x4b36c0
ret
sub eax, 0xa6
test edi, 0x180275d3
cmp bl, 2
mov ax, ax
shr bp, 0x40
jne 0x4a7152
je 0x4af39e
nop
cpuid
ret 0x8966
mov ax, di
mov al, al
mov bh, bh
shr di, 0x40
shr dx, 0x40
mov ecx, edi
xchg esi, ebx
shl dl, 0x20
shl ah, 0x20
xchg dx, ax
shl bh, 0x20
shl ch, 0x20
mov dl, dl
xchg dx, ax
mov di, di
xchg ebx, esi
lea edi, [edi]
shr ax, 0xc
mov edi, edi
mov dx, dx
mov dh, dh
shl ecx, 4
or eax, ecx
jb 0x4ab7f9
xor ax, word [esi + 6]
jb 0x4ab80a
stc
mov cx, cx
jb 0x4af3f3
cmpsd dword [esi], dword es:[edi]
mov ch, 0xe9
jb 0x4889d5
fiadd dword [edi]
jmp 0x4a624b
push esi
shl si, 0x20
push ebx
call fcn.004b41b1
add esp, 0x2c
test ax, ax
jb 0x494f4a
shl al, 0x20
je 0x4b5758
jne 0x4afaa3
dec edi
jl 0x4afaa2
pop ss
call fcn.004bfa5c
and eax, 0xeac16656
inc eax
mov ebx, dword [esi + 4]
push 0x48da65
ret
jmp 0x4b4210
push edx
push eax
xchg ebp, ebx
shl ch, 0x20
mov ecx, ecx
xchg ebx, ebp
mov si, si
call int.004b9ee6
mov al, byte [ebp + 0xc]
jne 0x48d599
je 0x4b4233
or bh, bl
into
adc dword [edi], ecx
test byte [eax - 0x6d], ah
std
inc dword [0xeec1660c]
je 0x48d599
add eax, 0xeec1660c
inc eax
mov dl, dl
shr cl, 0x40
jno 0x48c2f1
mov si, si
jo 0x4b4252
sub cl, byte es:[ecx]
jo 0x48c2f1
fldln2
lea esp, [esp + 4]
shr edx, 0x40
mov byte [eax + 2], 0
mov word [eax], 0
mov bp, bp
mov edi, dword [ecx]
add ecx, 4
mov dword [eax - 8], edi
sub ah, 0
add eax, 0xc
dec edx
jne 0x4b5963
je 0x4b428b
mov ecx, 0xd2840f7e
push ss
add byte [eax], al
je 0x4b5963
fst dword [edx + 0x660c768d]
add ecx, 0x816690ac
jmp 0x3d0d34e
mov byte [esi + 0xbb], al
xchg si, ax
xchg si, ax
push ecx
mov cx, 0xed91
pop ecx
mov word [esi + 0xbc], di
xchg bh, cl
xchg bl, ch
xchg ch, bl
xchg cl, bh
jne 0x4af382
je 0x4b436b
lodsd eax, dword [esi]
dec edx
sub al, 0x68
mov ah, ah
xchg dx, di
shl ebx, 0x20
xchg di, dx
mov cx, di
shl ax, 0x20
mov edx, edi
mov si, si
shr cx, 0xa
mov ecx, ecx
shl edx, 6
jmp 0x4abe33
pop ebp
ret
lea edx, [ebp - 0x110]
push 0
jmp 0x4b5761
push edx
shr esi, 0x40
call fcn.004ab482
lea eax, [ebp - 0x110]
push 0x80
jmp 0x4b5777
push eax
call fcn.00493363
js 0x4b0561
jns 0x4b578a
mov edi, 0xf331e6d
mov ecx, edx
lodsd eax, dword [esi]
invalid
jns 0x4b0561
xor eax, 0x4c26ffa9
jne 0x4b425e
je 0x4b596f
cpuid
nop
ret
js 0x4ba592
jns 0x4b597b
xor eax, 0xff5a4f2
mov dword [ecx], edx
dec esp
add byte [eax], al
jns 0x4ba592
fsubr dword [edi - 0x47]
xor ecx, dword [edx]
add al, byte [eax]
add byte [eax], al
xor byte [eax], al
add byte [eax], al
push esi
aas
dec ecx
add bh, cl
inc edi
dec ecx
add byte [edx + 0x73], bl
dec edx
add byte [ebx + 0x2c004b59], ah
or edi, ecx
lea ebp, [ebx - 0x5e]
dec edx
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
call 0x6b4ba4ea
mov byte [0x6100004a], al
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc al, byte [eax]
add byte [eax], al
inc edx
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
test byte [eax + ecx*2 + 0x492dec00], dh
add byte [eax + eax], cl
add byte [eax], al
xor byte [eax], al
add byte [eax], al
push edi
jge 0x4b5a45
add byte [eax + eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
lodsb al, byte [esi]
cmp eax, 0x380048
add byte [eax], al
xor byte [eax], al
add byte [eax], al
xchg esp, eax
dec ebp
dec ecx
add dh, dl
in eax, 0x4b
add byte [ebx - 0x5e], ch
dec edx
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
inc dword [eax]
add byte [eax], al
add byte [edx], dl
add byte [eax], al
add byte [edx], al
add byte [eax], bh
add byte [eax], al
add byte [esp + esi*4 - 0x62e9ffb8], al
dec eax
add byte [ebp], ch
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cld
in al, dx
dec edx
add byte [eax], bh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ebp + ecx*2 - 0x1a18ffb7], dl
dec ebx
add bl, al
popal
dec edx
add byte [eax], al
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [0x71004a73], dh
pop edx
dec ebx
add ah, al
inc esp
xor eax, 0x69004a73
inc edi
dec ecx
add cl, bl
or ebx, eax
popal
dec edx
add byte [eax], al
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [ebx], bh
sbb cl, byte [ebx]
xor byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
xchg esp, eax
dec ebp
dec ecx
add byte [edi - 0x10], bh
dec eax
add ah, dh
jp 0x4b5ae7
add byte [eax], ah
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ebx - 0x5e], ch
dec edx
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
or al, 0
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add al, ch
and cl, byte [ebx]
lodsd eax, dword [esi]
cli
dec eax
add byte [eax + eax], al
add byte [esi + edi], al
dec ecx
add ah, bl
out 0xc1, eax
dec cx
add byte [eax + 0x30000006], ch
add byte [eax], al
add byte [ebp + 0x440048fa], ch
add byte [eax], al
dec eax
add byte [eax + eax], al
add byte [esi + 0x34004abc], dh
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
add al, 0x3e
dec ecx
add byte [ecx + ebp*8 - 0x73], dh
lea esp, [esp - 0x68]
fidiv dword [edx - 0xd002d78]
jge 0x4b5eab
jl 0x4b5ea4
lds ecx, [edi]
mov byte [0x8768dc3], al
lea esi, [esi + 8]
jmp dword [esi]
xchg bl, al
xchg al, bl
mov esi, dword [esi + 4]
mov esi, dword [ebp + esi]
mov esi, dword [esi]
jmp dword [esi]
mov ebx, dword [ebp - 4]
test dx, 0xf22f
test ebx, ebx
jb 0x4b5e49
jne 0x48753c
je 0x4b7e5b
cdq
adc dh, byte ss:[eax]
xchg ebp, ecx
xchg ecx, ebp
push esi
call fcn.004ac365
add esp, 4
test al, al
jb 0x49a256
jne 0x48753c
je 0x4b7e7f
mov edx, dword [0x66f6ffc5]
mov ecx, ecx
push esi
mov cx, cx
call fcn.004a0d50
add esp, 4
test al, 1
jb 0x4a2f93
jne 0x48753c
je 0x4b7ea3
aam 0x5a
mov ecx, ecx
mov eax, dword [ebp - 0x44]
ja 0x4903f3
jbe 0x4b7eb2
xchg dword [edi], ecx
mov byte [0x3b860fc3], al
test ebp, edi
invalid
jbe 0x4903f3
fnstenv [ebx + 0x66]
mov edx, dword [ebp + 0x10]
js 0x4a71b6
jns 0x4b7eca
cpuid
ret
jns 0x4a71b6
or byte [eax + 0x56], 0x3f
dec ecx
add byte [ecx - 0x71], ch
dec ecx
add byte [edx + 0x73], bl
dec edx
add dh, ah
jle 0x4b7f2c
add byte [ebx + 0x79], al
mov ah, 0xdc
and eax, 0xc004aad
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [edi - 0x1d], bh
dec ebx
add ch, cl
mov byte [ebx], cl
out dx, eax
imul ecx, dword [edx], 0x35
mov bl, 0x66
pop dword [ebx + edx]
mov al, al
mov dword [ebp + 0x40], esp
jmp dword [esi]
cmp dword [eax], 0x70fffebd
add al, 0x90
cpuid
ret
cmp ax, word [ebp + 8]
je 0x4ab836
jne 0x4b9520
inc esi
sar dword [edi + 0x418b668b], cl
or byte [ecx + 0x8c1], al
add byte [edi], cl
xchg ebp, esp
and bh, bh
mov ax, word [ecx + 8]
add ecx, 8
ja 0x4ab815
push dword [esi + 4]
jbe 0x4b9536
jno 0x4b9548
dec esp
mov byte [0x22d9860f], al
invalid
jbe 0x4ab815
fnstenv [ebx]
mov ebx, dword [ebp + 0x44]
mov edx, dword [esi + 8]
shr bh, 0x40
mov eax, dword [esi + 4]
lea esi, [esi + 0xc]
inc esi
add al, 0x8d
jbe 0x4b9559
mov byte [ebx + edx], al
jmp dword [esi]
invalid
add byte [ecx], al
add byte [eax], bh
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
inc esi
add byte [eax], al
add byte [edi], bh
js 0x4ad6a1
jns 0x4bbe90
fsubr st(4), st(0)
imul ecx, dword [edi], 0xff180b89
inc edi
jecxz 0x4bbe26
jns 0x4ad6a1
invalid
invalid
pop ebp
ret
shr ch, 0x40
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b4f41
add bp, 0
add esp, 4
jne 0x4b4f3d
je 0x4c0161
invalid
je 0x4b4f3d
invalid