f000:fff0  ljmp 0xf000:0xe05b
f000:e05b  jmp 0xf46c
f000:f46c  cli
f000:f46d  cld
f000:f470  smsw ax       ; read CR0
f000:f473  test al, 1    ; test Protected Mode Enable
f000:f475  je 0xf480
[assuming PE is zero – jump:]
f000:f480  jmp 0xe043
f000:e043  mov al, 0x8f
f000:e045  out 0x70, al  ; CMOS controller: disable NMI, set index 0xf
f000:e047  out 0xeb, al  ; this port is presumably unoccupied: just a delay mechanism
f000:e049  in al, 0x71   ; read 0xf (CMOS Shutdown Status)
f000:e04b  out 0xeb, al  ; more delay
f000:e04d  or al, al
f000:e04f  jmp 0xf483
f000:f483  jne 0xf488
[assuming status ≥ 0x0D (cold boot) – jump:]
f000:f488  mov ax, 0x40
f000:f48b  mov es, ax
f000:f48d  cmp word es:[0x72], 0x1234
f000:f494  je 0xf49b

[Scenario 1: we find word 0x1234 at 0040:0072:]
f000:f49b  test byte es:[0xba], 1
f000:f4a1  je 0xf4c8
[Scenario 1.1: byte at 0040:00BA is 1 → f000:f4c8]
[Scenario 1.2: byte at 0040:00BA is other than 1:]
f000:f4a3  mov esi, dword es:[0xa3]
f000:f4a9  mov eax, esi
f000:f4ac  shr eax, 0x10
f000:f4b0  mov ds, ax
f000:f4b2  mov ax, word [0]
f000:f4b5  cmp ax, 0xaa55
f000:f4b8  jne 0xf4c8
[Scenario 1.2.1: word at [0040:00A5]:0000 is other than 0xAA55 → f000:f4c8]
[Scenario 1.2.1: word at [0040:00A5]:0000 is 0xAA55:]
f000:f4ba  xor ax, ax
f000:f4bc  mov ds, ax
f000:f4be  mov dword [0x40], esi
f000:f4c3  mov ax, 3
f000:f4c6  int 0x10
[CS:IP now f000:f4c8]

[Scenario 2: 0040:0072 does not return 0x1234:]
f000:f496  jmp 0x3253
f000:3253  jmp 0xf499
f000:f499  jmp 0xf4c8

[All cases now converge HERE]    <<<   This is the interesting bit
f000:f4c8  mov ax, 0x30
f000:f4cb  mov ss, ax
f000:f4cd  mov sp, 0x100
f000:f4d0  mov al, 0x8f
f000:f4d2  call 0xe415