Function at 0x4b6800
Capabilities:
Check os version
Encode data using base64
Parse pe header

Disassembly:
pop edi
pop esi
lea esi, [esi]
jmp 0x4bd249
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
sbb word [ebx], ax
call fcn.004be6ee
add eax, 0x870f5677
pop edi
jg 0x4873c1
add byte [esi + 2], dh
jbe 0x4873c5
insb byte es:[edi], dx
push cs
jbe 0x49f320
add eax, 0x85e8bf6
js 0x4a5671
jns 0x4873dc
and byte [ebx - 0x76f0bbb8], bl
invalid
jns 0x4a5671
jmp 0x48a035
push esi
mov ebx, ebx
call fcn.0049210b
add esp, 4
add eax, esi
jmp 0x48a047
push eax
call int.004b9ee6
jmp 0x4a8e67
sar eax, 2
sub edi, ebx
add eax, esi
pop ebx
lea esi, [eax + edi]
pop edi
mov esi, esi
lea eax, [esi - 0xb2408]
pop esi
jmp 0x4a736f
call fcn.0049210b
inc eax
js 0x4b45f0
jns 0x49f330
mov ch, 0xc3
jns 0x4b45f0
and eax, 0x16478aee
invalid
shl al, 0x20
mov al, byte [ebp + eax]
lea edi, [edi]
push 0x48a801
ret
xor al, 0x95
ja 0x4a28fb
jbe 0x4a567d
nop
cpuid
ret
jbe 0x4a28fb
xor al, 0xf
mov edx, 5
mov ax, word [ecx + 0x42]
xor ecx, ecx
jb 0x48958b
test al, 1
jb 0x4bd9a3
je 0x4a56aa
jne 0x4a56a9
jg 0x4a56dc
add byte [ecx - 0x2f], 0xf8
inc ecx
sar eax, 1
shl ebp, 0x20
dec edx
jne 0x4a5696
je 0x4a56ba
sub eax, 0x1f981e4
add byte [eax], al
add byte [edi], cl
invalid
cmp ecx, 1
jg 0x4b9e37
jle 0x4a56cc
loop 0x4a5679
dec edi
inc ecx
test ecx, ecx
jb 0x4a22f1
je 0x4b9e37
jne 0x4a56e0
adc al, 0xfa
add eax, 0xe2c1665f
and byte [eax + 1], bh
shl dx, 0x20
mov eax, 1
pop ebp
ret
cld
or ah, byte [esi - 0x3f]
loop 0x4a6972
mov eax, dword [esi + 4]
jmp 0x4873aa
pop ebp
ret
add esp, 0xc
shr edx, 0x40
mov eax, esi
jno 0x484cf7
jo 0x4a8e7e
nop
cpuid
ret
jo 0x484cf7
imul esp, dword [edx + 0x6100004a], 0
xor byte [eax + eax], 0
add byte [eax], al
and dword [eax], eax
add byte [edx], bh
adc al, byte [eax]
add byte [eax], al
inc edx
add byte [eax], al
xor byte [eax], al
add byte [eax], al
test byte [eax + ecx*2 + 0x4a322200], dh
add byte [0x3d000000], bh
add byte [eax], al
add byte [ecx + 0x1004a33], bh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [esp + edi*2 + 0x30004b], dl
add byte [eax], al
xor byte [eax], al
add byte [eax], al
push esi
aas
dec ecx
add byte [edx + 0x5a004a8f], cl
jae 0x4a8f21
add al, ah
mov cs, word [edx]
nop
cpuid
ret
add byte [eax], al
add byte [ebp - 0x6bffb5d8], cl
dec ebp
dec ecx
add byte [0xf0004b04], al
dec edi
dec ecx
add byte [edx + 0x30000084], dl
add byte [eax], al
add byte [ebp + ecx*2 - 0x308dffb7], dl
dec ebx
add byte [eax + 0x4943], al
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
and eax, 0xd8004a97
dec esi
add byte [eax], al
xor byte [eax], al
add byte [eax], al
lea edx, [ecx + 0x4a]
add byte [eax], dh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ebx - 0x50], ah
dec edx
add bh, bh
inc dword [eax]
add byte [eax], dh
add byte [eax], al
add byte [ebp + ecx*2 - 0x3077ffb7], dl
dec ebx
add byte [ebp + 0x440048fa], ch
add byte [eax], al
add byte [esi + edi], al
dec ecx
add byte [edi + 0x6e], dh
mov ecx, 0x2004a33
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [esi + 0x3f], dl
dec ecx
add byte [ebp - 0x67], cl
dec ebx
add byte [edx + 0x73], bl
dec edx
add byte [edx - 0x6fffb571], ch
cpuid
ret 0xa26b
clc
lodsb al, byte [esi]
call fcn.004a38d0
add eax, 0x24648dec
add al, 0xf5
sub word [ebp + ebx], ax
jmp dword [esi]
jmp 0x4b45f1
push eax
push esi
mov esi, dword [ebp + 0xc]
jmp 0x4b45f9
push esi
call int.004b9ee6
mov dh, dh
push esi
call fcn.0049210b
add eax, 0x17
add esp, 0x14
cmp eax, 0x104
jae 0x4bd251
lea esi, [esi]
jb 0x4b4627
sub bh, byte [0x176ad405]
push 0x17
push str.hlrus_license_file.alf
jmp 0x48a034
pop dword [esp - 4]
je 0x4bd1a8
jne 0x4b680f
pop ebx
out 0x6e, al
xor eax, eax
jb 0x4ac4c9
pop esi
mov esp, ebp
jne 0x4bd1a1
je 0x4b6824
sahf
dec dword [edi]
test byte [edi + 0x69], dh
add byte [eax], al
je 0x4bd1a1
invalid
ja 0x4c2670
jbe 0x4b9e43
int1
and al, 0xf8
mov ebp, 0x8827860f
add byte [eax], al
jbe 0x4c2670
or byte [eax - 0x15], 0xff
test byte [ecx - 0x7937791a], 0xc1
pop ebp
ret
shr bh, 0x40
mov al, byte [ebp - 0x62]
cmp al, 1
jne 0x4bd1fd
je 0x4bd1ba
cwde
dec esp
mov cl, byte [ebp - 0x60]
xor eax, eax
jb 0x4ac4d2
sub cl, 0x34
shl eax, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x4aedaa
add dl, 0x58
mov bp, bp
mov byte [ebp + eax - 8], dl
lea ecx, [ecx]
inc eax
cmp eax, 8
jl 0x4bd1cb
jge 0x4bd1f6
in eax, dx
mov ch, 0xe9
xor dword [ecx - 1], esp
push dword [0x89023cb3]
imul al
or cl, byte [edx]
add bh, al
dec esp
xchg ecx, edx
xchg edx, ecx
mov eax, edx
shr bl, 0x40
shr eax, 0x1f
add edx, eax
shr ah, 0x40
mov eax, ecx
shr eax, 0x40
mov edi, edx
shl bl, 0x20
cdq
and edx, 3
jb 0x4a694c
jmp fcn.004b332c
cmp al, 2
mov esi, esi
call 0x4c1c10
invalid
add eax, edx
sar ebx, 2
jne 0x496267
je 0x4bd241
shr bl, 0x70
clc
je 0x496267
invalid
mov esp, ebp
mov dl, dl
pop ebp
ret
pop edi
xor eax, eax
jb 0x496770
push edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
jb 0x4a51c6
pop ebp
ret