Function at 0x49aec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x5ff004]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 4
xor ebx, ebx
mov dword [esp + 0x58], eax
push ebx
mov dword [esp + 0x60], eax
xor ecx, ecx
mov dword [esp + 0x1c], eax
xor edx, edx
mov dword [esp + 0x28], eax
xor esi, esi
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push ebx
push eax
mov eax, dword [edi]
push edi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x74], ecx
call eax
add esp, 0x14
cmp eax, 4
jne 0x49b67e
mov eax, dword [esp + 0xc]
movzx ecx, al
shl ecx, 8
movzx eax, ah
or ecx, eax
movzx eax, byte [esp + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0xf]
shl ecx, 8
or ecx, eax
cmp ecx, 0x424e5346
jne 0x49b67e
mov edx, str.bnsf
mov ecx, edi
call fcn.0040b140
test eax, eax
je 0x49b67e
push 4
push ebx
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x14
cmp eax, 4
je 0x49af8b
or ebx, 0xffffffff
jmp 0x49afae
mov eax, dword [esp + 0xc]
movzx ebx, al
shl ebx, 8
movzx eax, ah
or ebx, eax
movzx eax, byte [esp + 0xe]
shl ebx, 8
or ebx, eax
movzx eax, byte [esp + 0xf]
shl ebx, 8
or ebx, eax
push 4
push 0
push 8
lea eax, [esp + 0x18]
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x14
cmp eax, 4
je 0x49afcf
or ecx, 0xffffffff
mov dword [esp + 0xc], ecx
jmp 0x49affe
mov eax, dword [esp + 0xc]
movzx ecx, al
shl ecx, 8
movzx eax, ah
or ecx, eax
movzx eax, byte [esp + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0xf]
shl ecx, 8
or ecx, eax
mov dword [esp + 0xc], ecx
cmp ecx, 0x49533232
je 0x49b001
add ebx, 8
mov eax, dword [edi + 4]
push edi
call eax
add esp, 4
cmp ebx, eax
jne 0x49b67e
xor ecx, ecx
mov dword [esp + 0x8c], esi
mov eax, 0xc
mov dword [esp + 0x64], ecx
mov dword [esp + 0x98], ecx
mov dword [esp + 0xa0], ecx
mov dword [esp + 0x10], eax
xor edx, edx
mov ebx, fcn.0041ce90
test edx, edx
je 0x49b046
mov ebx, fcn.0041ce40
test ecx, ecx
jne 0x49b05d
mov eax, dword [edi + 4]
push edi
call eax
mov ecx, eax
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x64], ecx
cmp eax, ecx
jae 0x49b38e
push edi
push eax
call ebx
mov ebx, eax
mov eax, dword [esp + 0x18]
add eax, 4
push edi
push eax
call fcn.0041ce90
mov ecx, eax
add esp, 0x10
mov eax, dword [esp + 0x10]
add eax, 8
mov dword [esp + 0x24], eax
lea edx, [ecx + 8]
add dword [esp + 0x10], edx
cmp ebx, 0xffffffff
je 0x49b38e
cmp ecx, 0xffffffff
je 0x49b38e
test ebx, ebx
je 0x49b38e
cmp ebx, 0x6c6f6f70
je 0x49b2dd
cmp ebx, 0x73646174
je 0x49b2c4
cmp ebx, 0x73666d74
jne 0x49b379
cdq
push 2
push edx
push eax
lea eax, [esp + 0x38]
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x14
cmp eax, 2
je 0x49b0ea
or eax, 0xffffffff
jmp 0x49b0ff
mov ax, word [esp + 0x2c]
movzx ecx, al
movzx eax, ah
shl cx, 8
or cx, ax
movzx eax, cx
mov ebx, dword [esp + 0x24]
movzx eax, ax
mov dword [esp + 0x60], eax
push 2
lea eax, [ebx + 2]
cdq
push edx
push eax
lea eax, [esp + 0x3c]
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x14
cmp eax, 2
je 0x49b129
or eax, 0xffffffff
jmp 0x49b13e
mov ax, word [esp + 0x30]
movzx ecx, al
movzx eax, ah
shl cx, 8
or cx, ax
movzx eax, cx
movzx eax, ax
mov dword [esp + 0x5c], eax
lea eax, [ebx + 4]
cdq
push 4
push edx
push eax
lea eax, [esp + 0x48]
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x14
cmp eax, 4
je 0x49b164
or esi, 0xffffffff
jmp 0x49b187
mov eax, dword [esp + 0x3c]
movzx esi, al
shl esi, 8
movzx eax, ah
or esi, eax
movzx eax, byte [esp + 0x3e]
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x3f]
shl esi, 8
or esi, eax
push 4
lea eax, [ebx + 8]
cdq
push edx
push eax
lea eax, [esp + 0x4c]
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x14
cmp eax, 4
je 0x49b1aa
or eax, 0xffffffff
mov dword [esp + 0x54], eax
jmp 0x49b1d5
mov eax, dword [esp + 0x40]
movzx ebx, al
shl ebx, 8
movzx eax, ah
or ebx, eax
movzx eax, byte [esp + 0x42]
shl ebx, 8
or ebx, eax
movzx eax, byte [esp + 0x43]
shl ebx, 8
or ebx, eax
mov dword [esp + 0x54], ebx
mov ebx, dword [esp + 0x24]
push 4
lea eax, [ebx + 0xc]
cdq
push edx
push eax
lea eax, [esp + 0x50]
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x14
cmp eax, 4
je 0x49b1f4
or ebx, 0xffffffff
jmp 0x49b217
mov eax, dword [esp + 0x44]
movzx ebx, al
shl ebx, 8
movzx eax, ah
or ebx, eax
movzx eax, byte [esp + 0x46]
shl ebx, 8
or ebx, eax
movzx eax, byte [esp + 0x47]
shl ebx, 8
or ebx, eax
mov dword [esp + 0x50], ebx
mov ebx, dword [esp + 0x24]
push 2
lea eax, [ebx + 0x10]
cdq
push edx
push eax
lea eax, [esp + 0x40]
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x14
cmp eax, 2
je 0x49b23e
or eax, 0xffffffff
jmp 0x49b253
mov ax, word [esp + 0x34]
movzx ecx, al
movzx eax, ah
shl cx, 8
or cx, ax
movzx eax, cx
movzx eax, ax
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x12]
cdq
push 2
push edx
push eax
lea eax, [esp + 0x44]
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x14
cmp eax, 2
je 0x49b293
mov ecx, dword [esp + 0x64]
or eax, 0xffffffff
movzx eax, ax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
jmp 0x49b036
mov ax, word [esp + 0x38]
movzx ecx, al
movzx eax, ah
shl cx, 8
or cx, ax
movzx eax, cx
mov ecx, dword [esp + 0x64]
movzx eax, ax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
jmp 0x49b036
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
jmp 0x49b036
cdq
push 4
push edx
push eax
lea eax, [esp + 0x54]
mov dword [esp + 0x28], 1
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x14
cmp eax, 4
je 0x49b305
or eax, 0xffffffff
mov dword [esp + 0x58], eax
jmp 0x49b32c
mov eax, dword [esp + 0x48]
movzx ecx, al
shl ecx, 8
movzx eax, ah
or ecx, eax
movzx eax, byte [esp + 0x4a]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x4b]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x58], ecx
mov eax, dword [esp + 0x24]
push 4
lea eax, [eax + 4]
cdq
push edx
push eax
lea eax, [esp + 0x58]
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x14
cmp eax, 4
je 0x49b34f
or ecx, 0xffffffff
jmp 0x49b372
mov eax, dword [esp + 0x4c]
movzx ecx, al
shl ecx, 8
movzx eax, ah
or ecx, eax
movzx eax, byte [esp + 0x4e]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x4f]
shl ecx, 8
or ecx, eax
lea eax, [ecx + 1]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x64]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
jmp 0x49b036
mov ebx, dword [esp + 0x50]
cmp ebx, dword [esp + 0x20]
jae 0x49b67e
cmp dword [esp + 0x28], 0
je 0x49b67e
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x5c]
call fcn.00405ab0
mov ecx, eax
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x49b678
mov eax, dword [esp + 0x54]
xor edx, edx
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 4], esi
mov ecx, dword [esp + 0x58]
add ecx, ebx
mov ebx, dword [esp + 0x10]
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0x18]
div dword [esp + 0x5c]
mov dword [ebx + 0x1c], ecx
mov ecx, dword [esp + 0xc]
mov dword [ebx + 0x14], 0x2f
mov dword [ebx + 0x10], 1
mov dword [esp + 0x20], eax
mov dword [ebx + 0x24], eax
cmp ecx, 0x49533134
je 0x49b4e9
cmp ecx, 0x49533232
jne 0x49b680
cmp dword [esp + 0x60], 0
jne 0x49b680
mov esi, dword [ebx + 8]
and eax, 0xfffffffe
xor ecx, ecx
mov dword [ebx + 0xc], 0x7f
cmp eax, 0x140
ja 0x49b4d1
push 0x784
push esi
call fcn.0050f2a0
mov ecx, eax
add esp, 8
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x49b4d1
mov dword [esp + 0x18], 0
test esi, esi
jle 0x49b4a6
lea ebx, [ecx + 0x780]
mov dword [esp + 0x14], ebx
lea ecx, [ecx]
push dword [esp + 0x20]
call dword [sym.imp.libg719_decode.dll_Ordinal_3]
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [ecx], eax
test eax, eax
je 0x49b4b1
mov eax, dword [esp + 0x18]
add ecx, 0x784
inc eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp eax, esi
jl 0x49b470
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
mov dword [ebx + 0x1a4], ecx
jmp 0x49b64b
mov edi, dword [sym.imp.libg719_decode.dll_Ordinal_2]
push dword [ebx]
call edi
add esp, 4
lea ebx, [ebx + 0x784]
sub esi, 1
jne 0x49b4b7
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
push ecx
call fcn.005092c3
add esp, 4
mov dword [ebx + 0x1a4], 0
jmp 0x49b680
mov ecx, dword [ebx + 8]
mov edx, eax
mov dword [ebx + 0xc], 0x7e
call fcn.004e9ad0
mov dword [ebx + 0x1a4], eax
test eax, eax
je 0x49b680
cmp dword [esp + 0x60], 0
je 0x49b64b
xor eax, eax
lea ecx, [esp + 0x68]
push edi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
lea edx, [eax + 0x18]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
call fcn.004e4c80
add esp, 4
test eax, eax
je 0x49b54d
cmp eax, 0x18
jbe 0x49b63c
mov eax, dword [ebx + 0x1a4]
or ebx, 0xffffffff
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 0x52c40c]
mov esi, ecx
mov dword [esp + 0x1c], ecx
lea edx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x49b570
sub esi, edx
cmp esi, 0x18
ja 0x49b613
push esi
push ecx
lea eax, [esp + 0x88]
push eax
call fcn.00504df0
add esp, 0xc
mov eax, 0x18
sub eax, esi
mov dword [esp + 0x20], eax
push eax
lea eax, [esp + 0x84]
add eax, esi
push 0
push eax
call fcn.00504370
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x8c]
add esp, 0xc
call fcn.004e9c60
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
push edi
call fcn.004e9e10
add esp, 4
test eax, eax
js 0x49b60e
test ebx, ebx
jle 0x49b5e5
cmp eax, ebx
jge 0x49b60e
test eax, eax
jle 0x49b60e
push esi
push dword [esp + 0x20]
mov ebx, eax
lea eax, [esp + 0x70]
push eax
call fcn.00504df0
add esp, 0xc
lea eax, [esp + 0x68]
add eax, esi
push dword [esp + 0x20]
push 0
push eax
call fcn.00504370
add esp, 0xc
cmp ebx, 1
je 0x49b627
mov eax, dword [esp + 0x14]
add eax, 4
mov dword [esp + 0x14], eax
cmp eax, 0x10
jb 0x49b560
push str.BNSF:_decryption_key_not_found_n
shr ebx, 0x1f
push ebx
call fcn.0040ba00
mov ebx, dword [esp + 0x18]
add esp, 8
mov ecx, dword [ebx + 0x1a4]
lea edx, [esp + 0x68]
call fcn.004e9c60
push 0
push dword [esp + 0x2c]
mov edx, edi
mov ecx, ebx
call fcn.004064d0
add esp, 8
test eax, eax
je 0x49b680
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00502eb4
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x10]
jmp 0x49b680
xor ebx, ebx
mov ecx, ebx
call fcn.00405c10
mov ecx, dword [esp + 0xa4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00502eb4
mov esp, ebp
pop ebp
ret