Function at 0x491905
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x491c59
xor edx, edx
call fcn.0049289b
xor eax, eax
mov dword [esp + 0x20], 0x52444849
mov byte [esp + 0x24], al
lea ebx, [esi + 0x11c]
mov dword [esp + 0x10], 0x54414449
mov byte [esp + 0x14], al
mov dword [esp + 0x28], 0x444e4549
mov byte [esp + 0x2c], al
mov dword [esp + 0x18], 0x45544c50
mov byte [esp + 0x1c], al
mov dword [esp + 0x30], 0x44474b62
mov byte [esp + 0x34], al
mov dword [esp + 0x38], 0x4d524863
mov byte [esp + 0x3c], al
mov dword [esp + 0x40], 0x414d4167
mov byte [esp + 0x44], al
mov dword [esp + 0x48], 0x54534968
mov byte [esp + 0x4c], al
mov dword [esp + 0x80], 0x50434369
mov byte [esp + 0x84], al
mov dword [esp + 0x50], 0x7346466f
mov byte [esp + 0x54], al
mov dword [esp + 0x58], 0x4c414370
mov byte [esp + 0x5c], al
mov dword [esp + 0x68], 0x73594870
mov byte [esp + 0x6c], al
mov dword [esp + 0x70], 0x54494273
mov byte [esp + 0x74], al
mov dword [esp + 0x60], 0x4c414373
mov byte [esp + 0x64], al
mov dword [esp + 0x88], 0x544c5073
mov byte [esp + 0x8c], al
mov dword [esp + 0x78], 0x42475273
mov byte [esp + 0x7c], al
mov dword [esp + 0x90], 0x74584574
mov byte [esp + 0x94], al
mov dword [esp + 0x98], 0x454d4974
mov byte [esp + 0x9c], al
mov dword [esp + 0xa0], 0x534e5274
mov byte [esp + 0xa4], al
mov dword [esp + 0xa8], 0x7458547a
mov byte [esp + 0xac], al
mov ecx, esi
call fcn.004927ad
mov ecx, dword [ebx]
mov edi, eax
lea eax, [esp + 0x20]
cmp ecx, dword [eax]
jne 0x491a63
push edi
xor edx, edx
mov ecx, esi
call fcn.00492ce9
jmp 0x491c4e
mov eax, dword [ebx]
lea ecx, [esp + 0x28]
cmp eax, dword [ecx]
mov ecx, esi
jne 0x491a7a
push edi
call fcn.00492f8a
jmp 0x491c4e
mov edx, ebx
call fcn.00490cc7
test eax, eax
lea ecx, [esp + 0x10]
mov eax, dword [ebx]
je 0x491aca
cmp eax, dword [ecx]
jne 0x491aa8
test edi, edi
jne 0x491a9c
test dword [esi + 0x68], 0x2000
je 0x491aa8
mov edx, str.Too_many_IDATs_found
mov ecx, esi
call fcn.004923d0
push edi
xor edx, edx
mov ecx, esi
call fcn.0049477f
mov eax, dword [ebx]
pop ecx
lea ecx, [esp + 0x18]
cmp eax, dword [ecx]
jne 0x491c4f
or dword [esi + 0x68], 2
jmp 0x491c4f
cmp eax, dword [ecx]
jne 0x491af5
test edi, edi
jne 0x491adb
test dword [esi + 0x68], 0x2000
je 0x491ae7
mov edx, str.Too_many_IDATs_found
mov ecx, esi
call fcn.004923d0
mov edx, edi
mov ecx, esi
call fcn.0049289b
jmp 0x491c4f
lea ecx, [esp + 0x18]
xor edx, edx
push edi
cmp eax, dword [ecx]
jne 0x491b0c
mov ecx, esi
call fcn.00492e36
jmp 0x491c4e
lea ecx, [esp + 0x34]
cmp eax, dword [ecx]
jne 0x491b20
mov ecx, esi
call fcn.00493c70
jmp 0x491c4e
lea ecx, [esp + 0x3c]
cmp eax, dword [ecx]
jne 0x491b34
mov ecx, esi
call fcn.004931f5
jmp 0x491c4e
lea ecx, [esp + 0x44]
cmp eax, dword [ecx]
jne 0x491b48
mov ecx, esi
call fcn.00492fc6
jmp 0x491c4e
lea ecx, [esp + 0x4c]
cmp eax, dword [ecx]
jne 0x491b5c
mov ecx, esi
call fcn.00493e13
jmp 0x491c4e
lea ecx, [esp + 0x54]
cmp eax, dword [ecx]
jne 0x491b70
mov ecx, esi
call fcn.00493faf
jmp 0x491c4e
lea ecx, [esp + 0x5c]
cmp eax, dword [ecx]
jne 0x491b84
mov ecx, esi
call fcn.0049404e
jmp 0x491c4e
lea ecx, [esp + 0x64]
cmp eax, dword [ecx]
jne 0x491b98
mov ecx, esi
call fcn.0049427b
jmp 0x491c4e
lea ecx, [esp + 0x6c]
cmp eax, dword [ecx]
jne 0x491bac
mov ecx, esi
call fcn.00493f12
jmp 0x491c4e
lea ecx, [esp + 0x74]
cmp eax, dword [ecx]
jne 0x491bc0
mov ecx, esi
call fcn.004930eb
jmp 0x491c4e
lea ecx, [esp + 0x7c]
cmp eax, dword [ecx]
jne 0x491bd1
mov ecx, esi
call fcn.00493510
jmp 0x491c4e
lea ecx, [esp + 0x84]
cmp eax, dword [ecx]
jne 0x491be5
mov ecx, esi
call fcn.004936d2
jmp 0x491c4e
lea ecx, [esp + 0x8c]
cmp eax, dword [ecx]
jne 0x491bf9
mov ecx, esi
call fcn.0049387e
jmp 0x491c4e
lea ecx, [esp + 0x94]
cmp eax, dword [ecx]
jne 0x491c0d
mov ecx, esi
call fcn.004944bd
jmp 0x491c4e
lea ecx, [esp + 0x9c]
cmp eax, dword [ecx]
jne 0x491c21
mov ecx, esi
call fcn.004943f4
jmp 0x491c4e
lea ecx, [esp + 0xa4]
cmp eax, dword [ecx]
jne 0x491c35
mov ecx, esi
call fcn.00493aa5
jmp 0x491c4e
lea ecx, [esp + 0xac]
cmp eax, dword [ecx]
mov ecx, esi
jne 0x491c49
call fcn.004945fd
jmp 0x491c4e
call fcn.0049477f
pop ecx
test byte [esi + 0x68], 0x10
je 0x491a41
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret