Function at 0x4e7cbd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebp + 0x50]
mov edx, 0x9b9d9898
xchg ebx, edx
and bx, 0xc508
jmp 0x4dc988
mov edx, eax
mov bx, cx
mov edx, ebp
jmp 0x4dc95b
ja 0x4dc99e
xchg dx, bx
cmp edi, eax
jmp 0x4dc9c3
xchg dx, bx
cmp edi, eax
mov dx, 0xbfd6
lea edx, [ebx + ebx]
jmp 0x4dd118
mov dx, 0xbfd6
lea edx, [ebx + ebx]
jmp 0x4dd118
ja fcn.004dc9d0
sub al, bh
jmp 0x4dd14b
lea eax, [ebp + ebp]
lea edx, [eax*4]
mov bx, word [esp]
jmp 0x4dd1b4
jle 0x4dd126
lea eax, [ebp + ebp]
lea edx, [eax*4]
jmp 0x4dd15e
mov bx, word [esp]
call fcn.004dd192
ficomp word [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
fnstsw word [ebx]
mov edi, 0x24b94a2f
adc cl, byte [ebp - 0x42f099e4]
fucomi st(3)
push 0xffffffffffffff87
sub al, 0x24
lea eax, [esi*4]
lea eax, [esi + 0x7a]
bswap ebx
clc
jmp 0x4dd1ca
mov edx, ebp
lea ebx, [ebp - 0xa9]
xor al, 0xb7
js 0x4dd201
jns 0x4dd1eb
retf 0xd949
mov ebx, esp
lea ebp, [ebp + 0x4d]
not ax
mov ebx, esi
lea eax, reloc.WSOCK32.dll___WSAFDIsSet
jmp 0x4dd2e5
lea eax, [ebp + 0x40]
mov bl, 5
mov ebx, edx
jmp 0x4dd246
jmp 0x4dd1eb
mov bh, byte [esp]
dec bl
bt ebx, edx
jmp 0x4dd21b
jmp 0x4dd203
cmp bx, 0xf9ce
mov ebx, 0xd68f7e1e
lea ebx, [edi - 0x80]
jmp 0x4dd22e
push ebx
sub esp, 5
jl 0x4dd265
push dword [esp + 8]
jmp 0x4dd2a8
not ebx
setp bl
mov bl, 0xce
sub eax, edx
jo 0x4dd219
mov bh, byte [esp]
dec bl
bt ebx, edx
cmp bx, 0xf9ce
mov ebx, 0xd68f7e1e
salc
jmp 0x4dd225
push dword [esp + 8]
lea esp, [esp + 1]
and bl, 0xfc
push sp
sub esp, 0xa
jne 0x4dd292
je 0x4dd2c4
add byte [edi], 0x97
add ebp, ebp
cmp byte [eax + 0x4cb8492e], bh
adc eax, 0x245c8a84
add edi, edi
je 0x4dd2b2
mov bl, byte [esp + 3]
push dword [esp + 4]
ret 8
add al, 0xc2
or byte [eax], al
call fcn.004dd2ae
xor al, 0xbb
sub ecx, dword [esi - 0x43]
push ebp
sbb bl, byte [edx + esi + 0x6944a455]
mov byte [ebx], ch
inc edx
std
lea esp, [esp + 1]
jmp 0x4dd26d
add cl, cl
dec esi
fdivr qword [ebx - 0x1ca640aa]
jae 0x4dd2d3
in eax, 0x64
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x2d]
dec edx
sub ebx, eax
push edi
mov word [esp], cx
sub esp, 0x1d
jmp 0x4dd34a
pushfd
outsd dx, dword [esi]
mov ss, word [0x9e630496]
jl 0x4dd262
or ebx, dword [ebx + reloc.WSOCK32.dll___WSAFDIsSet]
cmp dword [eax], ebx
mov ax, word [esp]
xchg dword [esp], ebp
mov al, byte [esp]
setg bh
mov bh, 0xb1
push edi
jmp 0x4dd287
jno 0x4dd360
lea esp, [esp + 1]
call fcn.004deb0a
pop ss
add byte [eax], al
rcr dword [ebx - 0x35], cl
scasb al, byte es:[edi]
pop ebp
mov ebx, 0xcba8093e
bound ecx, qword [ebp - 0x74fedb9c]
jecxz 0x4dd352
lea esp, [esp + 1]
mov esp, ebx
jmp 0x4dd38a
and bl, byte [eax + 0x27d48d1d]
int3
invalid
pushfd
lea ebp, [eax + ebx - 0x40]
push esi
call fcn.004dd425
jo 0x4dd388
popal
add bl, dh
adc esi, dword [edx - 0xe]
pushal
pop es
push es
jo 0x4dd39a
add dh, cl
adc dword [edx - 0x7b], ebp
xor al, 0xff
je 0x4dd3d1
push eax
ret 0x54
add esp, 2
lea esp, [esp + 2]
xchg dword [esp + 0x1c], ebp
push ebx
push dword [esp + 0x20]
ret 0x24
lea ebp, reloc.WSOCK32.dll___WSAFDIsSet
cmc
push ecx
jmp 0x4dd3b1
popal
mov bx, word [esp]
bswap eax
dec bh
jno 0x4e7043
jo 0x4dc97f
add eax, 0x7d2cd4ee
jmp 0x4e80c3
inc ax
neg eax
jmp 0x4e7180
add eax, 0x79764f02
jmp 0x4e8043
jmp 0x4dc97f
inc ax
neg eax
and edx, 0xff0
xchg ecx, eax
call fcn.004e6ec6
mov word [esp], si
mov dx, 0x5211
lea esp, [esp + 2]
jmp 0x4e71b1
sub ecx, eax
jmp 0x4e731c
neg dl
xchg dx, ax
lea edx, [edx*4]
bswap eax
jmp 0x4e71ff
mov edx, eax
lea eax, [esi*4]
cmc
jno 0x4e717c
jo 0x4e6f82
mov dh, 0xcc
jmp 0x4e720e
add esi, 4
clc
jnp 0x4e71e9
mov dh, 0xcc
jmp 0x4e72aa
mov ax, 0x3477
sbb dh, bl
mov eax, 0x37ed03b9
rdtsc
call fcn.004e7237
fistp dword [edi - 0x31]
stosb byte es:[edi], al
pop ecx
test byte [edx], dh
sub eax, 0x1960f3c
lea edx, [edx*4]
bswap eax
jmp 0x4e71ff
rdtsc
jmp 0x4e721b
mov ax, 0x3477
sbb dh, bl
mov eax, 0x37ed03b9
jmp 0x4e724d
je 0x4e71b9
neg dl
xchg dx, ax
jmp 0x4e722c
jmp 0x4e6f60
mov ecx, dword [esp]
xchg ebx, edx
lea esp, [esp + 0x14]
jne 0x4e73bf
je 0x4e71d7
lea esi, [esi - 0x86]
mov ebx, 0x90f77a2f
shr al, 5
call fcn.004e7827
inc edi
out dx, al
stc
rdtsc
mov al, bh
xchg dword [esp], esi
lea ebx, reloc.WSOCK32.dll___WSAFDIsSet
mov dh, al
lea ebx, [ebx + edi]
jmp 0x4e77b7
movzx edx, byte [ebp - 1]
jmp 0x4e7b61
call 0x4e7b99
sub dword [esi + reloc.WSOCK32.dll___WSAFDIsSet], ebp
cmp ebx, eax
push ebx
lds eax, ss:[esi + eax - 0x4f]
mov al, 0xb3
stosb byte es:[edi], al
btr cx, si
je 0x4e7b4b
jne 0x4e7b4b
lds eax, [ebp - 0x2b]
mov esp, 0xf675ae4f
add edi, esi
sbb al, 0x65
jmp 0x4e7bf3
jbe 0x4e7c07
mov al, ah
mov ax, word [esp]
mov eax, dword [esp]
jmp 0x4e7c0d
mov al, ah
mov ax, word [esp]
jmp 0x4e7c23
neg cl
xchg al, ah
mov al, bl
mov al, 0xb3
push edx
pop eax
jmp 0x4e7c33
dec cl
mov eax, edi
bsf ax, di
jbe 0x4e7c6f
ja 0x4e7c59
pushfd
sbb cl, byte [eax - 0x105e511]
jg 0x4e7c37
mov bh, byte [ecx + 0x6e]
ror byte [ebp - 0x4c], cl
out 0xf, eax
enter 0xffffffffffffd9f6, 0xffffffffffffffb0
push ebp
mov ah, 0xe7
bswap eax
neg cl
mov al, 0x55
inc ah
jmp 0x4e7bee
neg eax
lea eax, reloc.WSOCK32.dll___WSAFDIsSet
mov ah, 0xa8
jmp 0x4e7cd3
neg eax
lea eax, reloc.WSOCK32.dll___WSAFDIsSet
mov ah, 0xa8
sub al, 9
xor cl, 0x67
bt ax, dx
bt eax, edx
jg 0x4e7ca7
jle 0x4e7ca7
mov dword [reloc.WSOCK32.dll___WSAFDIsSet], eax
int3
mov cl, dl
mov eax, 0x9e0d166c
xchg ah, al
lea eax, [eax + eax]
mov al, byte [esp]
jmp 0x4e7c4d
call 0x4e7cbd
mov ecx, dword [ecx]
cdq
clc
or edi, ebp
sub ebp, dword [edx + reloc.WSOCK32.dll___WSAFDIsSet]
dec ebx
loop 0x4e7cd8
insb byte es:[edi], dx
jg 0x4e7c7f
fcomp dword [ebx]
jmp 0x4e7cd7
sub al, 9
jmp 0x4e7c7b
js 0x4e7ced
adc al, 0x66
mov eax, dword [esp + 3]
mov ax, word [esp + 3]
jmp 0x4e7cf2
mov ax, word [esp + 3]
ror cl, 0
jmp 0x4e7d6b
btc ax, cx
btc eax, ecx
not ah
mov ah, byte [esp]
mov ax, word [esp]
call fcn.004e7d43
std
jle 0x4e7cfc
mov eax, dword [esi - reloc.WSOCK32.dll___WSAFDIsSet]
not ax
jmp 0x4e7c96
add bl, cl
mov eax, edx
jmp 0x4e7dcf
mov ah, byte [esp]
mov ax, word [esp]
jmp 0x4e7d1e
jae 0x4e7cfb
btc ax, cx
not ah
jmp 0x4e7d36
sub esp, 0
mov ecx, ebx
btc ax, ax
jmp 0x4e7ddb
btc ax, ax
not cx
not cx
jmp 0x4e7de1
mov ah, 0xb1
mov ch, bl
mov ch, 0x62
dec ebp
bsr ecx, ebp
jmp 0x4e7df5
not cx
not cx
mov cx, 0x282e
mov cl, 0x1a
jmp 0x4e7dfe
jae 0x4e7da8
sub esp, 0
mov ecx, ebx
jmp 0x4e7db7
sub dl, 0x91
bsr ecx, ebp
jae 0x4e7e47
push esp
pop word [esp]
sub esp, 0xd
push dword [esp + 0xe]
jmp 0x4e7e4a
pop word [esp]
sub esp, 0xd
push dword [esp + 0xe]
jmp 0x4e7e60
push esp
jmp 0x4e7e28
xchg word [esp + 0xf], cx
call fcn.004e7e85
in al, 0x6b
sti
sahf
insd dword es:[edi], dx
test dword [esi], ecx
cdq
clc
invalid
xchg word [esp + 0xf], cx
xchg byte [esp + 0xa], ah
jmp 0x4e7eac
lea esp, [esp + 3]
jmp 0x4e7f47
je 0x4e7f15
mov eax, 0x604f2cbb
lea eax, [edx + ebp]
jmp 0x4e7f1d
mov eax, 0x604f2cbb
lea eax, [edx + ebp]
jmp 0x4e7f6d
mov ecx, esi
jmp 0x4e7f57
mov ecx, esi
mov al, byte [esp]
lea ecx, [edx*4]
mov cx, 0x3945
jmp 0x4e87c5
lea esp, [esp + 0x10]
add dl, 0x40
push esi
mov al, 0xe0
push dword [esp + 1]
jmp 0x4e7eff
mov al, byte [esp]
lea ecx, [edx*4]
mov cx, 0x3945
jmp 0x4e87c5
lea esp, [esp + 8]
dec dl
lea eax, [ecx + ebp]
bsr ecx, esi
jno 0x4e7f1f
jo 0x4e7f27
lodsb al, byte [esi]
sub bh, byte [eax - 0x3135d521]
dec edi
fistp qword [edx - 0x1f9b41b7]
jbe 0x4e7f9e
loopne 0x4e7ff6
popfd
in al, dx
dec dword [ebp + reloc.WSOCK32.dll___WSAFDIsSet]
add byte [eax], al
mov bh, ah
mov dword [edi], edx
not edx
push edi
jmp 0x4e77a2
rcl byte [edi - 0x17], cl
std
idiv edi
dec dword [ebx + reloc.WSOCK32.dll___WSAFDIsSet]
mov eax, edx
lea ecx, [ecx + ecx]
mov cl, byte [esp]
mov cx, si
mov cx, word [esp]
jmp 0x4e80f5
dec dl
mov ch, byte [esp]
not cl
pushal
mov byte [esp + 0x18], bl
jmp 0x4e7fa5
not cx
cmc
bt ecx, esp
jmp 0x4e7fbb
setl cl
jmp 0x4e6f75
inc edx
and eax, 0x38d934d4
setl cl
jmp 0x4e6f75
pop ecx
jmp 0x4e6f90
lea ecx, [edi*4]
mov eax, dword [eax - reloc.WSOCK32.dll___WSAFDIsSet]
mov cx, di
pushfd
jmp 0x4e8004
mov esp, edi
jmp 0x4e808c
not cl
btc cx, di
jb 0x4e802d
jae 0x4e802d
retf 0xd84a
dec cx
jmp 0x4e801a
push eax
ret
mov cx, si
jmp 0x4e805e
mov cx, bp
mov cx, 0x9593
ror cl, cl
jno 0x4e8074
mov cx, si
jmp 0x4e805e
xchg cl, ch
adc ecx, 0xa1090224
jno 0x4e805a
dec cx
lea ecx, [edi*4]
jmp 0x4e8021
shl eax, 2
xchg cl, ch
stc
jns 0x4e7ffc
js 0x4e7fe6
lea eax, [esp + edi]
jmp 0x4e8136
mov cx, 0x5573
jmp 0x4e8117
setne cl
dec eax
mov cl, dl
jmp 0x4e8217
dec al
shl ch, cl
jne 0x4e810c
mov cx, 0x5573
setne cl
dec eax
mov cl, dl
jmp 0x4e8217
mov ecx, edx
call fcn.004e814b
btc ax, si
mov ax, word [esp]
jmp 0x4e81b6
xchg cx, ax
stc
bswap eax
jmp 0x4e81ec
neg ecx
mov eax, ecx
sub esp, 0xb
je 0x4e81c3
add esp, 0xa
mov byte [esp], dh
jmp 0x4e81c8
bts eax, ebp
push dword [esp + 2]
lea esp, [esp + 8]
jmp 0x4e81a0
add esp, 0xa
jmp 0x4e81f1
mov eax, dword [esp]
neg ax
lea esp, [esp + 1]
jmp 0x4e81fe
mov ecx, 0x6e93daea
xchg cx, ax
stc
bswap eax
jmp 0x4e8167
mov byte [esp], dh
mov eax, dword [esp]
neg ax
lea esp, [esp + 1]
call fcn.004e82a0
mov edi, 0x38c9ae38
rcl dword [ebx + reloc.WSOCK32.dll___WSAFDIsSet]
lcall 0x6d8e, 0x73148604
mov bh, 0x9e
add edx, ebx
jb 0x4e81e1
mov ecx, 0x6e93daea
jmp 0x4e8198
jmp 0x4e7fdd
mov dx, 0x3e99
inc cx
jp 0x4e862e
xchg edx, ecx
xchg dx, ax
jmp 0x4e8646
xchg edx, ecx
xchg dx, ax
call fcn.004e8630
or eax, 0x8b781989
imul ebp, dword [ebp + reloc.WSOCK32.dll___WSAFDIsSet], 0x9d62cbc3
in al, dx
jmp 0x4e8615
lea edx, [edi + 0x50]
jmp 0x4e86a9
xchg cx, ax
jmp 0x4e86e0
lea eax, reloc.WSOCK32.dll___WSAFDIsSet
shl al, cl
jno 0x4e8693
xchg cx, ax
jmp 0x4e86e0
mov dh, 0xb3
mov ah, bl
call fcn.004e8717
int 0x4a
fdivr dword [edi - 0x10925cb6]
jg 0x4e86f7
jmp 0xf28a0952
cmp esi, edx
ja 0x4e7b2c
mov edx, 0x158e759d
neg ah
jmp 0x4e870b
pushal
mov ax, sp
bswap ebp
jmp 0x4e8769
jbe 0x4e86ca
mov dh, 0xb3
mov ah, bl
jmp 0x4e86f1
rdtsc
btc cx, bp
jle 0x4e87aa
mov dword [esp + 0x18], edi
jmp 0x4e8794
popal
dec dh
bswap eax
call fcn.004e888f
in al, dx
push 0xfffffffffffffff8
lahf
push 0xffffffffffffff8a
or esp, dword [edx + reloc.WSOCK32.dll___WSAFDIsSet]
mov dword [esp + 0x18], edi
popal
dec dh
bswap eax
mov eax, edi
xchg edx, eax
jmp 0x4e8833
inc dl
mov eax, esi
lea ecx, reloc.WSOCK32.dll___WSAFDIsSet
add ecx, 0x8c2b2bea
jae 0x4e8437
not cx
cmc
bt ecx, esp
jmp 0x4e7fbb
lea eax, [edi + 0x40]
neg edx
jmp 0x4e8877
btc edx, ebp
mov dx, 0xd844
bswap edx
jmp 0x4e88d3
bswap edx
jmp 0x4e88d3
js 0x4e883e
btc edx, ebp
mov dx, 0xd844
jmp 0x4e8861
add edx, ebp
mov edx, esp
lea edx, [ebx*4]
jmp 0x4e8905
bsr dx, dx
add edx, ebp
mov edx, esp
lea edx, [ebx*4]
call fcn.004e88dd
popfd
sbb cl, byte [eax - 0x40ce511]
ror byte [ebp - 0x24], cl
sub eax, ecx
jl 0x4e88b5
bsr dx, dx
jmp 0x4e889f
lea edx, [esi - 0x80]
push si
mov byte [esp], al
lea esp, [esp + 2]
jmp 0x4e8962
and dl, 0xfc
call 0x4e896b
inc esi
sub edx, eax
jmp 0x4e899c
push esi
jmp 0x4e89a5
mov esp, edx
pushfd
lea edi, [eax + edx - 0x40]
jmp 0x4e8986
sub esp, 2
jae 0x4e8a19
lea esp, [esp + 2]
jmp 0x4e8a1d
mov eax, 0x9b15b797
mov esi, ebx
mov ecx, dword [esp]
mov dword [esp], edx
call fcn.004e89f8
add byte [ebx - 6], 0xd5
push ecx
mov esi, ecx
pushal
jmp 0x4e89c6
lea esp, [esp + 2]
push edi
jmp 0x4e89dc
call fcn.00566e79
pushal
lea edx, reloc.WSOCK32.dll___WSAFDIsSet
mov dword [esp + 0x1c], esi
popal
jmp 0x566e63
lea eax, [eax + 8]
mov dword [eax], ebx
pop eax
setl bl
lea ebx, reloc.WSOCK32.dll___WSAFDIsSet
jmp 0x566e92
mov dword [esi + 4], ecx
not ebx
jmp 0x5679bc
not bx
lea ebx, reloc.WSOCK32.dll___WSAFDIsSet
jmp 0x566e7c
mov bh, bl
lea edx, [eax + esi]
lea eax, reloc.WSOCK32.dll___WSAFDIsSet
jmp 0x566ebf
and ecx, 0xff0
mov ax, word [esp]
jmp 0x566e9d
cmp ecx, 0xfe0
lea ecx, [esp + ebx]
mov eax, dword [esp]
not dl
bswap edx
jmp 0x566ef7
not dh
stc
jge 0x566eb3
jl 0x566eb3
xchg edx, eax
lea edx, [ebx + edi]
mov dx, word [esp]
jmp 0x4e85ec
jne 0x566fee
xor byte [esi + 0xc], 0x20
jmp 0x566fee
lea esp, [esp + 0x14]
jne 0x566fee
mov ecx, eax
jmp 0x566eda
popal
jmp 0x566ee1
mov dword [esi], edx
xchg ch, bh
lea ecx, [edi + ebp]
mov ecx, ebp
mov bx, word [esp]
jmp 0x566f52