Function at 0x491480
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0xdc
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0x2c], eax
mov ebx, dword [esp + 0xf4]
lea edi, [esp + 0x30]
test ch, 0x20
je 0x4914b3
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp + 0x2c], eax
mov ebp, dword [esp + 0xf0]
test ebp, ebp
sete al
test ebx, ebx
sete dl
or eax, edx
test al, 1
mov edx, 0x10
jne 0x491842
test cl, 4
jne 0x491839
test cl, 1
jne 0x4914ef
test cl, 2
mov edx, 0x10
jne 0x491842
mov dword [edi + 4], ebx
mov eax, dword [esp + 0xf8]
mov edx, dword [esp + 0xf0]
mov dword [edi + 0x18], ecx
lea ebx, [ebx + eax*2]
mov dword [edi + 0x10], 0
xor eax, eax
mov dword [edi], edx
lea edx, [edi + 0x38]
mov dword [edi + 8], ebx
mov ecx, 0xa
mov dword [edi + 0xc], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], edx
mov dword [edi + 0x34], 0xa
mov dword [edx + eax*4], 0
inc eax
cmp ecx, eax
ja 0x49153b
mov dword [edi + 0x60], 0
xor esi, esi
xor ecx, ecx
mov dword [edi + 0x80], esi
mov esi, dword [esp + 0xf0]
xor edx, edx
mov dword [edi + 0x64], 0
xor eax, eax
xor ebx, ebx
mov dword [edi + 0x98], eax
mov word [edi + 0x68], 0xffff
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x84], ebx
mov dword [edi + 0x88], ecx
mov dword [edi + 0x94], edx
mov dword [esi], 0xfed7
mov dword [esi + 8], 0
mov dword [esi + 0xc], 2
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x5a4400
mov dword [esp], 0x928
call fcn.0043ce60
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esi + 0x14], eax
je 0x49184f
mov eax, dword [esp + 0x28]
mov ebp, 1
mov ebx, eax
mov dword [eax + 0x3c], 0x876
mov esi, eax
add ebx, 0x3c
mov dword [ebx + 8], 0xa
add esi, 0x54
mov ecx, eax
mov dword [ebx + 0xc], 0
add ecx, 0x11c
mov word [ebx + 0x10], 0
mov dword [eax + 0x10], 0
mov dword [ebx + 4], edi
mov dword [ebx + 0x14], esi
mov word [esi + 4], 0xffff
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [eax + 0x54], 0x10000
lea edx, [ecx + 0x400]
mov eax, 0xff
lea esi, [esi]
mov dword [ecx + eax*4], edx
dec eax
jns 0x491650
dec ebp
mov ecx, edx
test ebp, ebp
jg 0x491641
lea ecx, [ebx + 0x4e0]
mov eax, 0xff
nop
lea esi, [esi]
mov word [ecx + eax*2], 0
dec eax
jns 0x491670
mov dword [esi + 0x10], ecx
mov edx, dword [esp + 0x28]
xor eax, eax
mov dword [edi + 0x64], ebx
mov dword [edx + 0x920], eax
xor eax, eax
mov dword [edx + 0x924], eax
mov eax, edi
mov dword [edx + 0x14], 0
mov edx, ebx
mov dword [esp], 0
call fcn.0048b740
mov dword [edi + 0x60], eax
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491854
mov dword [esp], 0xa
mov edx, 0x14
mov eax, 0x64
call fcn.0048a5e0
mov dword [edi + 0x80], eax
test eax, eax
je 0x49184f
mov eax, edi
call fcn.0048a220
test eax, eax
jle 0x49186a
mov dword [esp], eax
xor edx, edx
xor eax, eax
call fcn.0048a5e0
mov dword [edi + 0x88], eax
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491854
call fcn.0048a5a0
mov dword [edi + 0x88], eax
mov ebp, eax
mov eax, dword [edi + 0x60]
call fcn.0048a330
mov dword [edi + 0x8c], eax
mov eax, dword [edi + 0x60]
call fcn.0048a330
mov dword [edi + 0x90], eax
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491854
xor eax, eax
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x18]
test eax, eax
jg 0x4917e8
jmp 0x49186d
mov edx, ebx
mov eax, ebp
call fcn.0048a590
mov eax, dword [edi + 0x60]
call fcn.0048a330
mov esi, eax
mov eax, dword [edi + 0x64]
mov edx, ebx
call fcn.0048b0d0
mov ecx, dword [edi + 0x60]
mov dword [esp + 8], esi
mov edx, dword [edi + 0x8c]
cwde
mov dword [esp], eax
mov eax, ecx
mov dword [esp + 4], edx
mov edx, 0x70
call fcn.0048b520
mov edx, dword [edi + 0x64]
mov eax, dword [edi + 0x60]
call fcn.0048b8d0
mov eax, dword [esp + 0x20]
movzx edx, word [eax + 2]
mov eax, dword [edi + 0x64]
call fcn.0048b0d0
mov ecx, dword [edi + 0x60]
cwde
mov edx, dword [edi + 0x90]
mov dword [esp], eax
mov eax, ecx
mov dword [esp + 8], edx
mov edx, 0x70
mov dword [esp + 4], esi
call fcn.0048b520
mov edx, dword [edi + 0x64]
mov eax, dword [edi + 0x60]
call fcn.0048b8d0
inc dword [esp + 0x24]
mov edx, dword [esp + 0x24]
cmp dword [ebp + 0x18], edx
jle 0x49186a
mov esi, dword [esp + 0x24]
mov eax, ebp
mov esi, dword [ebp + esi*4 + 0x24]
movzx ebx, word [esi]
mov dword [esp + 0x20], esi
mov edx, ebx
call fcn.0048a530
test eax, eax
je 0x491752
mov ecx, dword [edi + 0x64]
mov edx, ebx
shr edx, 8
mov eax, dword [edi + 0x8c]
mov ecx, dword [ecx + edx*4 + 0xe0]
movzx edx, bl
movsx edx, word [ecx + edx*2]
mov dword [esp], edx
mov edx, 0x70
call fcn.0048a500
mov esi, dword [eax + 0xc]
jmp 0x49179b
test cl, 0xe3
je 0x4914dc
add esp, 0xdc
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0xc
mov eax, edi
call fcn.0048b440
add esp, 0xdc
mov edx, eax
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491854
mov ecx, dword [edi + 0x18]
test cl, 4
jne 0x4918a7
mov ebx, dword [edi + 8]
mov edx, dword [edi + 4]
mov eax, ebx
sub eax, edx
sar eax, 1
cmp eax, 3
jle 0x491899
cmp eax, 2
jle 0x491899
cmp word [edx], 0x2a
je 0x491c3f
mov eax, ecx
and eax, 3
cmp eax, 3
je 0x491bb9
test cl, 4
je 0x491ba4
mov dword [edi + 0x28], 3
mov dword [edi + 0x20], 0x6e
mov eax, edi
call fcn.0048e080
mov ecx, dword [edi + 0x18]
test cl, 0x40
jne 0x4918d1
test cl, cl
jns 0x4918ed
mov eax, dword [edi + 0x64]
mov edx, 0xa
call fcn.0048b0d0
mov word [edi + 0x68], ax
mov edx, dword [edi + 0x64]
mov eax, dword [edi + 0x60]
call fcn.0048b8d0
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491854
mov edx, dword [edi + 0x60]
mov eax, dword [edx + 8]
mov dword [esp + 8], eax
mov eax, dword [edx + 4]
mov edx, 0x65
mov dword [esp], 0x70
mov dword [esp + 4], eax
mov eax, edi
call fcn.00491270
mov dword [edi + 0x70], eax
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491854
mov eax, dword [edi + 0x60]
call fcn.0048aff0
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491854
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x49197c
mov dword [esp], 0x5c95b8
mov esi, dword [esp + 0x2c]
mov ebp, 0x1c
mov dword [esp + 8], ebp
mov ebx, 1
mov dword [esp + 4], ebx
mov dword [esp + 0xc], esi
call sub.msvcrt.dll_fwrite
mov eax, dword [edi + 0x70]
mov edx, esi
mov dword [esp], 1
call fcn.0048aae0
mov edx, dword [edi + 0x70]
mov eax, edi
call fcn.0048a240
mov eax, dword [edi + 0x70]
mov edx, 1
call fcn.0048a270
mov dword [edi + 0x7c], eax
mov eax, dword [edi + 0x70]
call fcn.0048a2b0
mov eax, edi
call fcn.0048a2e0
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x4919e6
mov dword [esp], 0x5c95d8
mov eax, dword [esp + 0x2c]
mov edx, 0x23
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [edi + 0x70]
mov dword [esp], 1
mov edx, dword [esp + 0x2c]
call fcn.0048aae0
mov edx, dword [edi + 0x70]
mov eax, edi
mov esi, dword [esp + 0x2c]
mov dword [esp], esi
call fcn.0048d890
mov edx, dword [esp + 0xf0]
or dword [edx + 8], eax
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491854
cmp dword [edi + 0x98], 1
mov ebx, 1
jle 0x491a6d
mov esi, 0x44
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x491a40
mov dword [esp + 8], ebx
mov eax, 0x5c95fc
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edx, dword [edi + 0x94]
inc ebx
mov eax, dword [esp + 0x2c]
add edx, esi
add esi, 0x44
mov dword [esp], eax
mov eax, edi
call fcn.0048d7a0
cmp dword [edi + 0x98], ebx
jg 0x491a1f
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491854
mov eax, dword [edi + 0x70]
test byte [eax + 1], 2
je 0x491a7f
mov eax, dword [edi]
or dword [eax + 8], 0x2000
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x491aad
mov dword [esp], 0x5c961c
mov edx, dword [esp + 0x2c]
mov eax, 0x1f
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 0x60]
call fcn.0048cdb0
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491854
mov esi, dword [edi + 0x60]
mov eax, dword [esi]
mov dword [esp + 0x1c], esi
mov ebx, dword [eax + 0x14]
mov dword [esp + 0x18], eax
test ebx, ebx
mov ecx, ebx
je 0x491b77
movzx edx, word [esi + 0x24]
jmp 0x491aef
mov ebx, dword [ebx + 0x10]
test ebx, ebx
je 0x491b77
movzx eax, word [ebx + 4]
cmp ax, dx
je 0x491ae4
mov esi, dword [esp + 0x1c]
cmp ax, word [esi + 0x26]
je 0x491ae4
test ebx, ebx
je 0x491b77
mov eax, dword [esp + 0x18]
mov ebp, 0xffffffff
mov edx, dword [edi + 0x64]
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], 0x70
call fcn.0048b690
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov edx, 0x70
movsx eax, word [esi + 0x24]
mov dword [esp], eax
mov eax, esi
call fcn.0048b520
mov eax, dword [esp + 0x18]
mov edx, 0x70
mov dword [esp + 8], eax
mov dword [esp + 4], eax
movsx eax, word [esi + 0x26]
mov dword [esp], eax
mov eax, esi
call fcn.0048b520
mov edx, dword [esp + 0x18]
mov ecx, dword [edx + 0x14]
xor eax, eax
mov ebx, ecx
test ebx, ebx
je 0x491d10
mov ebp, dword [ebx + 0xc]
mov esi, dword [ebp + 0xc]
jmp 0x491b9b
mov edx, dword [esp + 0x18]
cmp dword [esi + 8], edx
jne 0x491cf0
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x491b8b
mov ebx, dword [ebx + 0x10]
jmp 0x491b7b
and ecx, 1
cmp ecx, 1
sbb eax, eax
not eax
add eax, 2
mov dword [edi + 0x28], eax
jmp 0x4918b7
mov eax, ebx
sub eax, edx
sar eax, 1
cmp eax, 2
jle 0x4918a7
dec eax
jle 0x4918a7
cmp word [edx], 0x28
jne 0x4918a7
cmp word [edx + 2], 0x3f
jne 0x4918a7
movzx eax, word [edx + 4]
mov dword [esp], eax
call fcn.00458bf0
test eax, eax
je 0x491e22
mov eax, dword [edi]
mov edx, dword [edi + 4]
or dword [eax + 8], 0x80
add edx, 4
cmp edx, dword [edi + 8]
mov dword [edi + 4], edx
jae case.0x491c38.100
movzx eax, word [edx]
mov dword [esp], eax
call fcn.00458bf0
test eax, eax
je 0x491cb9
mov edx, dword [edi + 4]
movzx eax, word [edx]
sub eax, 0x62
cmp eax, 0x16
ja case.0x491c38.100
jmp dword [eax*4 + 0x5c963c]
cmp word [edx + 2], 0x2a
jne 0x491899
cmp word [edx + 4], 0x2a
jne 0x491899
movzx eax, word [edx + 6]
cmp eax, 0x3d
je 0x491ece
jg 0x491eb2
cmp eax, 0x3a
je 0x491e98
mov dword [edi + 0x20], 0x65
mov dword [edi + 0x14], 0xd
jmp 0x4918c8
or dword [edi + 0x18], 0x20
add edx, 2
jmp 0x491c07
and dword [edi + 0x18], 0xffffffdf
jmp 0x491c88
and dword [edi + 0x18], 0xffffff3f
jmp 0x491c88
mov ecx, dword [edi + 0x18]
or ecx, 1
and ecx, 0xfffffff9
mov dword [edi + 0x18], ecx
jmp 0x491c88
and dword [edi + 0x18], 0xfffffff7
jmp 0x491c88
and dword [edi + 0x18], 0xfffffff8
jmp 0x491c88
mov edx, dword [edi + 4]
cmp edx, dword [edi + 8]
jae case.0x491c38.100
cmp word [edx], 0x29
je 0x491e35
mov dword [edi + 0x20], 0x65
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491e4e
mov dword [edi + 0x14], 0x12
jmp 0x4918c5
test esi, esi
je 0x491b9f
mov esi, dword [ebp + 0x1c]
test esi, esi
jne 0x491b9f
mov dword [ebp + 0x1c], eax
mov ebx, dword [ebx + 0x10]
mov eax, ebp
jmp 0x491b7b
mov ebp, eax
test ebp, ebp
je 0x491d7a
mov eax, dword [esp + 0x1c]
call fcn.0048a330
mov dword [esp + 0x14], eax
mov edx, ebp
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
call fcn.0048bbc0
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x491d6c
mov eax, dword [esp + 0x18]
mov esi, dword [ebx + 0x14]
cmp dword [ebx + 8], eax
je 0x491d68
mov edx, dword [esp + 0x14]
mov dword [esp + 4], edx
mov eax, dword [ebx + 8]
mov edx, ebx
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
call fcn.0048bb10
mov eax, dword [esp + 0x1c]
mov edx, ebx
call fcn.0048b230
mov ebx, esi
jmp 0x491d34
mov esi, dword [ebp + 0x1c]
mov dword [ebp + 0x1c], 0
mov ebp, esi
jmp 0x491d12
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491854
mov edx, dword [esp + 0x28]
mov eax, dword [edi + 0x60]
add edx, 0x14
call fcn.0048d4f0
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x491854
mov eax, dword [edi + 0x2c]
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0xf0]
mov dword [edi], 0
mov dword [edx + 4], eax
mov dword [esi], 0xfed9
mov eax, dword [edi + 0x18]
mov dword [esi + 4], eax
mov eax, dword [edx + 8]
mov dword [esi + 8], eax
mov eax, dword [edx + 4]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x70]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x7c]
mov dword [edi + 0x70], 0
mov dword [esi + 0x38], eax
mov eax, 0x491f30
test byte [edi + 0x18], 8
jne 0x491df1
mov eax, 0x491ef0
mov edx, dword [esp + 0x28]
xor ebx, ebx
mov dword [edx + 0x91c], eax
mov eax, dword [edi + 0x94]
mov dword [edx + 0x920], eax
mov eax, dword [edi + 0x98]
mov dword [edi + 0x94], ebx
mov dword [edx + 0x924], eax
xor edx, edx
jmp 0x491854
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x4918c8
jmp 0x4918a7
mov ecx, dword [edi + 0x18]
lea eax, [edx + 2]
mov dword [edi + 4], eax
test cl, 4
je 0x491e25
and ecx, 0xffffff1f
mov dword [edi + 0x18], ecx
jmp 0x491e25
mov ecx, dword [edi + 0x18]
jmp 0x491e28
mov ecx, dword [edi + 0x18]
or ecx, 4
and ecx, 0xfffffffc
jmp 0x491ca8
mov ecx, dword [edi + 0x18]
or ecx, 0x40
and ecx, 0xffffff7f
jmp 0x491ca8
or dword [edi + 0x18], 0xc0
jmp 0x491c88
or dword [edi + 0x18], 8
jmp 0x491c88
mov ecx, dword [edi + 0x18]
and ecx, 0xffffffbf
or ecx, 0x80
jmp 0x491ca8
mov eax, dword [edi]
or ecx, 3
add edx, 8
mov dword [edi + 0x18], ecx
mov dword [edi + 4], edx
or dword [eax + 8], 0x80
jmp 0x491899
cmp eax, 0x3f
jne 0x491c71
mov dword [edi + 0x20], 0x65
mov dword [edi + 0x14], 2
jmp 0x4918c8
mov eax, dword [edi]
or ecx, 4
add edx, 8
mov dword [edi + 4], edx
and ecx, 0xffffff1c
mov dword [edi + 0x18], ecx
or dword [eax + 8], 0x80
jmp 0x4918a7