Function at 0x4e9cd0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov edi, ecx
xor eax, eax
xor ecx, ecx
mov esi, ebx
cpuid
xchg ebx, esi
test eax, eax
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ecx
je 0x4e9fda
mov ebp, eax
xor ebx, ebx
xor ecx, ecx
mov eax, 1
mov esi, ebx
cpuid
xchg ebx, esi
mov dword [esp], edx
mov eax, 0
mov edx, 0
mov dword [esp + 0x18], ecx
mov dword [esp + 8], 0
mov dword [esp + 0x2c], ebp
cmp ebp, 6
mov ebp, 0
jbe 0x4e9d52
mov eax, 7
xor ecx, ecx
mov ebx, ebx
cpuid
xchg ebx, ebx
mov dword [esp + 8], ecx
mov ebp, edx
mov eax, 7
mov ecx, 1
mov esi, ebx
cpuid
xchg ebx, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], edi
mov eax, 0x80000000
xor ecx, ecx
mov esi, ebx
cpuid
xchg ebx, esi
test eax, eax
mov dword [esp + 0x14], 0
je 0x4e9d8c
mov eax, 0x80000001
xor ecx, ecx
mov esi, ebx
cpuid
xchg ebx, esi
mov dword [esp + 0x14], ecx
mov edi, dword [esp + 0x18]
mov ebp, dword [esp]
mov eax, edi
mov esi, edi
mov ecx, edi
mov edx, edi
and ebp, 0x10
and eax, 1
and esi, 0x202
shr ecx, 9
and edx, 0x2000
shl eax, 8
shl edx, 0xf
or esi, eax
mov eax, ecx
and ecx, 0x800
and eax, 0x400
or eax, esi
mov esi, edi
or ecx, eax
mov eax, edi
and esi, 0x800000
and eax, 0x400000
shl eax, 9
or eax, edx
mov edx, edi
shr edi, 0x1c
shr edx, 0x19
and edi, 4
mov dword [esp + 4], eax
mov eax, ebx
and edx, 1
or ebp, edx
mov edx, dword [esp]
or ebp, edi
mov edi, dword [esp]
shr edx, 0x12
and edi, 0x1000000
and edx, 0x20
or edi, esi
mov esi, ebx
mov ebx, dword [esp + 8]
or edx, ebp
shr esi, 0x10
shr edi, 1
and esi, 0x2000
add edi, dword [esp + 4]
shl ebx, 0x16
mov ebp, ebx
and ebx, 0x80000000
and ebp, 0x40000000
or ebp, esi
mov esi, eax
or ebx, ebp
mov ebp, eax
and esi, 0x100
and ebp, 8
shl esi, 0xb
shl ebp, 0xf
or esi, ebp
mov ebp, dword [esp + 8]
shr ebp, 0xa
mov dword [esp + 0x24], ebp
and ebp, 1
or esi, ebp
mov ebp, dword [esp]
shr ebp, 0x13
and ebp, 0xc0
or ebp, ecx
mov ecx, eax
shr ecx, 0xf
or ebp, edx
and ecx, 8
or ebp, ecx
mov ecx, dword [esp + 0x18]
or ebp, ebx
mov ebx, eax
mov edx, ebx
shr edx, 9
mov eax, ecx
mov ecx, ecx
and edx, 1
and eax, 0x20000000
not ecx
mov dword [esp], edx
shr eax, 0xd
or edi, eax
mov eax, ebx
and eax, 0x80000
shl eax, 0xa
or edi, eax
mov eax, ebx
and eax, 0x800
shl eax, 0x13
or edi, eax
or edi, esi
test ecx, 0xc000000
jne 0x4e9f3d
call fcn.00494790
mov ecx, eax
not ecx
test cl, 6
jne 0x4e9f3d
mov ecx, edi
mov dword [esp + 0x1c], eax
and eax, 0xe0
or ecx, 0x1000000
cmp dword [esp + 0x2c], 0xc
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], ecx
jbe 0x4ea003
mov dword [esp + 4], 0
mov eax, 0xd
mov ecx, 1
or edi, 0x3000000
mov esi, ebx
cpuid
xchg ebx, esi
test al, 1
mov ecx, dword [esp]
cmove edi, dword [esp + 0xc]
cmove ebp, ebp
cmove ecx, ecx
mov dword [esp], ecx
mov ecx, eax
and eax, 8
and ecx, 2
shl eax, 0x17
shl ecx, 0x1a
or eax, ecx
mov ecx, ebp
or eax, edi
mov dword [esp + 0xc], eax
jmp 0x4ea00d
mov dword [esp + 4], 0
mov esi, dword [esp + 0x14]
mov ebx, dword [esp]
and esi, 0x20
shl esi, 0xf
or esi, edi
lea edi, [esp + 0x38]
push 0xc
push 0xf951c5
push edi
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x4e9f80
push 0xc
push 0xf951d1
push edi
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4e9fa0
mov edx, dword [esp + 0x14]
mov eax, edx
mov ecx, edx
shr edx, 0xa
and eax, 0x40
and ecx, 0x200000
and edx, 2
shl eax, 6
or esi, ecx
or ebx, edx
or ebp, eax
push 0xc
push 0xf951dd
push edi
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
mov edi, ebp
mov ecx, ebp
mov edx, esi
and edi, 0x4000
and ecx, 0xffffbfff
and edx, 0xfff3ffff
or edi, eax
mov edi, dword [esp + 0x34]
cmovne edx, esi
mov esi, dword [esp + 4]
cmovne ecx, ebp
jmp 0x4e9fe2
xor ecx, ecx
xor edx, edx
xor ebx, ebx
xor esi, esi
mov eax, ecx
or eax, 0x80000000
mov dword [0xfd5204], eax
mov dword [edi + 0xc], esi
mov dword [edi + 8], ebx
mov dword [edi + 4], edx
mov dword [edi], ecx
mov eax, edi
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, ebp
mov dword [esp + 4], 0
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
mov edx, ebx
and edx, 0x20
shl edx, 0xa
mov eax, esi
shr esi, 0xe
and esi, 0x4000
and eax, 0x1000
or edx, esi
mov esi, ebp
shl eax, 5
and esi, 0x10
shl esi, 4
or esi, eax
mov eax, ebp
shl ebp, 0x10
shr eax, 0x11
and eax, 0x40
or eax, esi
mov esi, ebp
and ebp, 0x60000
and esi, 0x10000
or esi, edx
or ebp, esi
mov esi, dword [esp + 0x30]
or ebp, ecx
mov edx, esi
mov ecx, esi
and edx, 0x10
and ecx, 0x20
shl edx, 6
lea edi, [edx + ecx*4]
mov edx, esi
and edx, 0x400
shr edx, 1
or edi, edx
or edi, eax
or edi, dword [esp + 0xc]
cmp dword [esp + 0x20], 0xe0
jne 0x4e9f45
mov ecx, ebx
mov eax, ebx
and dword [esp + 0x1c], 0x60000
shl ecx, 7
and eax, 0x10000
and ecx, 0x1000000
lea eax, [ecx + eax*8]
mov ecx, ebx
shl ecx, 5
and ecx, 0x4000000
or ecx, eax
mov eax, ebx
shr eax, 4
and eax, 0x400000
or eax, ecx
mov ecx, ebx
shr ecx, 6
and ecx, 0x200000
or ecx, eax
mov eax, ebx
shr eax, 8
and eax, 0x100000
or eax, ecx
mov ecx, ebx
shr ecx, 7
and ecx, 0x800000
or ecx, eax
or ebp, ecx
mov eax, ebp
or eax, 0x2000000
test ebx, ebx
mov ebx, dword [esp + 0x24]
cmovns eax, ebp
mov ebp, dword [esp + 8]
and ebx, 6
mov ecx, ebp
mov edx, ebp
shl ebp, 0xe
and ecx, 2
and edx, 0x40
and ebp, 0x10000000
shl ecx, 0x1a
shl edx, 0x17
or edx, ecx
mov ecx, dword [esp + 0x10]
or ebp, edx
mov edx, dword [esp + 0x28]
or ebp, eax
and ecx, 0x20
mov eax, edx
shr ecx, 2
shr eax, 0x12
and eax, 0x20
or ecx, eax
mov eax, edx
shr eax, 4
and eax, 0x10
or ebx, eax
or ebx, ecx
or edi, ebx
cmp dword [esp + 0x1c], 0x60000
jne 0x4e9f45
mov ecx, dword [esp + 0x10]
mov eax, edx
and edx, 0x400000
and esi, 0x100
and eax, 0x3000000
shr edx, 9
shl esi, 7
shr eax, 0xd
or edx, eax
and ecx, 0x200000
shr ecx, 7
or ecx, edx
or esi, ecx
or edi, esi
jmp 0x4e9f45