Function at 0x4e9d6d
Capabilities:
Parse pe header

Disassembly:
pop esi
add dword [eax + 0x5d], 0x5f400768
push 0x41
pushal
imul eax, dword [edx + 0x61], 0x6e
inc esp
jb 0x4e9dc4
je 0x4e9dc7
je 0x4e9dc9
arpl word [eax + 0x40], si
pop esi
imul eax, dword [ecx - 0x7b9aa4c1], 0x822d2b22
xor dh, byte es:[edi]
xor dh, byte [edi]
and dword [esi], 0x33731
add byte [eax], al
sub al, 0x44
dec ebp
sub eax, 0x452d4d44
dec ebp
sub dword [0x2d824e45], 0x2d044f46
inc esi
push eax
sub eax, 0x472d5047
push ecx
inc edi
push ecx
dec eax
push ecx
sub dword [esi], 0x2e815248
dec ecx
sub dword [esi], 0x2e815349
dec edx
push ebx
sub dword [esi], 0x2e01544a
dec edx
push esp
add dword [esi], ebp
dec edx
push ebp
das
dec ebx
push ebp
sub dword [edi], 0x2f00564b
dec esp
push esi
sub dword [edi], 0x2f81574c
dec ebp
pop eax
and eax, 0x30594d2f
dec esi
pop ecx
push edi
sub dword [edi], 0x2f25584d
dec ebp
pop ecx
xor byte [esi + 0x59], cl
xor byte [esi + 0x5a], cl
xor byte [edi + 0x5b], cl
xor dword [ecx + 0x5d], edx
xor dl, byte [ebx + 0x5f]
xor al, 0x56
popal
pop ecx
cmp byte gs:[ebp + 0x69], bl
cmp esp, dword [ecx + 0x6d]
jb 0x4e9e47
insb byte es:[edi], dx
js 0x4e9e4f
jae 0x4e9e8a
dec edx
jnp 0x4e9d95
push eax
or dword [edi + 0x5c998d55], 0xffffff97
mov dword [0x6fb1a565], eax
mov ch, 0xc1
jne 0x4e9dde
retf
xor ebx, dword [ecx + 0x66]
xor dword [edi + 0x64], edx
xor byte [ebp + 0x62], dl
das
bound ebp, qword [edi]
push ebx
popal
push ebx
popal
sub dword [esi], 0x52
pushal
test dword [0x2c836052], ebp
push edx
pushal
sub byte [edx + edx*2], 0x61
test byte [ebx], ch
push edx
popal
add byte [ebx], ch
push edx
bound eax, qword [ecx - 0x7e9dacd5]
sub dl, byte [ebx + 0x62]
sub dword [edx], 0x2b0f6353
push esp
sub edx, dword fs:[ebp + 0x65]
sub al, 0x57
pop edx
push 0x2f
pop ebp
insd dword es:[edi], dx
xor dword [eax + 0x70], esp
xor al, 0x64
jne 0x4e9ec8
imul edi, dword [edx + 0x3a], 0x763e806f
xchg byte [ebx + 0x7d], al
mov cs, word [eax - 0x7a]
xchg esi, eax
dec esi
invalid
aaa
outsb dx, byte [esi]
jg 0x4e9f00
imul edi, dword [edx + 0x31], 0x612e7664
jae 0x4e9f02
pop esi
jo 0x4e9f03
pop ebx
insd dword es:[edi], dx
sub bl, byte [ecx + 0x6b]
sub dword [eax + 0x6a], ebx
sub byte [edi + 0x69], dl
sub byte [edi + 0x68], dl
test byte [eax], ch
push esi
push 0x67562800
sub dword [bx + si], 0x27816755
push ebp
and dword [bx], 0x27826655
push esp
xchg byte [edi], ah
push esp
xchg byte gs:[edi], ah
xchg byte [edi], ah
daa
push ebx
and dword gs:[edi], esp
push esp
sub byte gs:[ebp + 0x66], dl
sub byte [esi + 0x67], dl
sub bl, byte [eax + 0x69]
sub ebx, dword [edx + 0x6b]
sub eax, 0x612f6f5d
jb 0x4e9f4f
ja 0x4e9f55
imul edi, dword [ecx + edi + 0x70], 0xffffff82
cmp eax, 0x7f428877
nop
inc edi
mov byte [ecx + 0x54a2914d], bl
pushfd
lodsd eax, dword [esi]
pop ebp
stosd dword es:[edi], eax
mov esp, 0x6dcdbc68
invalid
inc edx
jg 0x4e9ee3
cmp eax, 0x72398a78
test byte [esi], dh
insb byte es:[edi], dx
cmp dword [edx - 0x7c], esi
insb byte es:[edi], dx
jle 0x4e9f8f
push 0x7664307a
pushal
jb 0x4e9f91
pop ebp
jo 0x4e9f93
pop ebx
insd dword es:[edi], dx
sub bl, byte [ecx + 0x6c]
sub dword [ecx], 0x29836a58
push edi
imul eax, dword [ecx + 0x685729], 0x82685629
sub dword [esi + 0x67], edx
sub byte [ecx], 0x55
add word [ecx], bp
push ebp
sub dword gs:[ebp - 0x7e], edx
sub dword [esp - 0x7f], edx
sub dword fs:[ecx], 0x2a016353
sub dword [ebx + 0x63], edx
add dword [edx], ebp
arpl word [ecx], ax
sub dl, byte [ebx + 0x63]
sub dl, byte [ebx + 0x62]
sub dword [edx], 0x2a826252
push edx
popal
push ebx
arpl word [edx], bp
push ebx
bound eax, qword [ecx - 0x7d9dadd6]
sub dl, byte [edx + 0x61]
sub dword [edx], 0x51
pushal
sub dword [edx], 0x2b005f51
push ecx
pop edi
sub byte [ebx], 0x50
pop edi
add dword [ebx + 0x64], 0x67440373
jns 0x4ea001
push 0x7d
inc edi
insd dword es:[edi], dx
or byte [edx + 0x73], 0x8b
or dword [ebx + 0x75], 0x6e48018f
test byte [edx + 0x62], al
outsd dx, dword [esi]
cmp dword [edi], 0x2184655b
inc edx
bound ebp, qword [edi - 0x7f]
aas
pop ebx
test byte gs:[ecx], ah
sub ch, byte [0x36312684]
test byte [esi], ah
xor dword [esi], esi
add byte [eax], al
add byte [eax], al
sub dword [esp + eax*2], 0x452d004d
dec ebp
sub dword [0x2d004e45], 0x2d814f45
inc esi
dec edi
add dword [0x472d5046], ebp
push eax
sub dword [0x2e025147], 0x482e5148
push ecx
dec eax
push edx
dec ecx
push edx
sub dword [esi], 0x2e815349
dec edx
push esp
add dword [esi], ebp
dec edx
push ebp
das
dec ebx
push ebp
sub dword [edi], 0x2f81564b
dec esp
push edi
sub byte [edi], 0x4d
das
dec ebp
pop eax
and eax, 0x30594e2f
dec esi
pop ecx
xor byte [edi + 0x5a], cl
xor byte [eax + 0x5b], dl
xor dword [ecx + 0x5d], edx
xor edx, dword [ebx + 0x5f]
xor al, 0x56
bound esi, qword [esi]
pop edx
cmp byte gs:[ebp + 0x69], bl
cmp esp, dword [edx + 0x6e]
aas
je 0x4ea088
outsb dx, byte [esi]
jp 0x4ea090
jne 0x4e9fcc
dec esp
jge 0x4e9fd7
push edx
xchg dword [ebx + 0x5f9d9158], edx
popfd
test eax, 0x6fb5a967
mov dh, 0xc2
jbe 0x4ea020
int 0x76
ret 0x70ce
pop edx
xor dword [bx + 0x65], edx
xor byte [ebp + 0x63], dl
das
push esp
bound ebp, qword [edi]
push ebx
popal
sub dword [esi], 0x53
popal
add byte [esi], ch
push edx
popal
test dword [0x2c866152], ebp
push edx
popal
sub dword [ebx], 0x2b846152
push ebx
bound eax, qword [eax]
sub edx, dword [ebx + 0x63]
sub dword [edx], 0x2a236353