Function at 0x40470b
Capabilities:
Parse pe header
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x44f124]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x44f478], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x44f850
push edi
je 0x404755
push 0x5c
push ebx
call fcn.00414dac
push ebx
sub eax, ebx
mov edi, 0x44f958
push eax
push str._.sdump.exe
push 0x104
push edi
call fcn.00413a0a
add esp, 0x1c
jmp 0x404769
mov edi, 0x44f958
push edi
call fcn.0040e36e
pop ecx
test eax, eax
je 0x404e38
push 0x5c
push edi
call fcn.00414dac
pop ecx
pop ecx
mov ecx, eax
mov dword [0x44f84c], ecx
test ecx, ecx
je 0x404795
inc ecx
mov edx, 0x45d778
mov dword [0x44f84c], ecx
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x40478b
push 0x44f020
mov ebx, 0x445dac
push ebx
call fcn.0040d967
push dword [0x44f074]
push ebx
call fcn.0040d967
add esp, 0x10
push 0
push 0x80
push 2
pop eax
push eax
push 0
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x44f45c], eax
cmp eax, 0xffffffff
jne 0x4047f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x45d778
push str.CreateFile_error__s__d
call fcn.0040d967
add esp, 0xc
jmp 0x404e1f
mov eax, dword [0x45d560]
xor ebx, ebx
inc ebx
cmp dword [ebp + 0xc], ebx
jne 0x40480a
add eax, dword [0x4515c4]
push 4
push 0x3000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x4515d4], eax
test eax, eax
jne 0x404834
push str.VirtualAlloc_Error_CreateDump
call fcn.0040d967
push 0
jmp 0x404e18
push 0x451498
push dword [0x44f0a0]
push dword [0x45d560]
push dword [0x45d564]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x40486a
push dword [0x45d564]
push str.VirtualProtectEx_Error_CreateDump_address:__p
call fcn.0040d967
push 0
jmp 0x4047ea
push 0x451570
push dword [0x45d560]
push dword [0x4515d4]
push dword [0x45d564]
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x404899
push dword [0x45d564]
push str.ReadProcessMemory_Error_CreateDump_address:__p
jmp 0x404861
push dword [0x44f0c4]
push dword [0x4515d8]
push dword [0x4515d4]
call sub.VCRUNTIME140D.dll_memcpy
mov ecx, dword [0x4515d4]
add esp, 0xc
mov dword [0x45f430], ecx
mov dword [0x45f434], ecx
mov eax, dword [ecx + 0x3c]
add eax, 4
add eax, ecx
mov dword [0x45f438], eax
lea eax, [ecx + 0x18]
mov edx, dword [ecx + 0x3c]
add eax, edx
mov dword [0x45f43c], eax
mov eax, dword [ecx + 0x3c]
add eax, 0xf8
add eax, ecx
mov dword [0x45f440], eax
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x40490e
push str.IMAGE_DOS_SIGNATURE_not_found
call fcn.0040d967
mov dword [esp], 0x45d778
jmp 0x404e13
mov eax, dword [ecx + 0x3c]
cmp dword [ecx + eax], 0x4550
je 0x404921
push str.IMAGE_NT_SIGNATURE_not_found
jmp 0x4048fd
mov eax, dword [ecx + edx + 0x38]
mov dword [ecx + edx + 0x3c], eax
mov eax, dword [0x45f438]
mov ecx, dword [0x45f440]
movzx eax, word [eax + 2]
test ecx, ecx
je 0x404b41
and dword [0x45db90], 0
test eax, eax
je 0x404a4f
mov ebx, eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.ucrtbased.dll__strupr]
push 6
mov esi, eax
push str..RDATA
push esi
call dword [sym.imp.ucrtbased.dll_strncmp]
add esp, 0x10
test eax, eax
je 0x404992
push 5
push str.RDATA
push esi
call dword [sym.imp.ucrtbased.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x4049a0
mov ecx, dword [0x45f440]
mov eax, dword [0x45f3cc]
mov dword [ecx + 0x24], eax
mov eax, dword [0x45f43c]
mov esi, dword [0x45f440]
push dword [eax + 0x20]
push dword [esi + 0xc]
call fcn.0040e0ff
mov dword [esi + 0xc], eax
mov eax, dword [0x45f43c]
mov esi, dword [0x45f440]
push dword [eax + 0x20]
push dword [esi + 8]
call fcn.0040e0ff
mov dword [esi + 8], eax
mov eax, dword [0x45f43c]
mov esi, dword [0x45f440]
push dword [eax + 0x20]
push dword [esi + 0xc]
call fcn.0040e0ff
mov dword [esi + 0x14], eax
mov eax, dword [0x45f43c]
mov esi, dword [0x45f440]
push dword [eax + 0x20]
push dword [esi + 8]
call fcn.0040e0ff
mov dword [esi + 0x10], eax
add esp, 0x20
mov eax, dword [0x45f440]
mov ecx, dword [eax + 0xc]
add ecx, dword [eax + 8]
mov eax, dword [0x45f43c]
mov dword [eax + 0x38], ecx
mov esi, dword [0x45f43c]
mov ecx, dword [0x45f440]
add ecx, 0x28
mov eax, dword [esi + 0x38]
mov dword [0x45d560], eax
mov eax, dword [0x45db90]
inc eax
mov dword [0x45f440], ecx
mov dword [0x45db90], eax
cmp eax, ebx
jl 0x404951
xor ebx, ebx
inc ebx
jmp 0x404a55
mov esi, dword [0x45f43c]
cmp dword [ebp + 0xc], ebx
jne 0x404ae8
push str.Dump_error_option_selected.
call fcn.0040d967
mov dword [esp], str.Adding_new_.error_section_header...
call fcn.0040d967
mov ecx, dword [0x45f430]
push dword [0x4515c4]
push str..error
mov eax, dword [ecx + 0x3c]
add ecx, 0xf8
add eax, ecx
mov dword [0x45f440], eax
call fcn.00402fb7
push str.Appending_new_data...
call fcn.0040d967
mov eax, dword [0x45f440]
push dword [0x45d574]
push dword [0x4515a4]
mov eax, dword [eax + 0xc]
add eax, dword [0x4515d4]
mov dword [0x45f408], eax
mov eax, dword [0x45d560]
add eax, dword [0x4515d4]
push eax
call sub.VCRUNTIME140D.dll_memcpy
mov eax, dword [0x45d574]
add esp, 0x1c
add dword [0x45d560], eax
mov esi, dword [0x45f43c]
mov eax, dword [0x45f3a0]
test eax, eax
je 0x404b00
sub eax, dword [0x45f418]
mov dword [esi + 0x14], eax
mov esi, dword [0x45f43c]
mov eax, dword [0x45f3a4]
test eax, eax
je 0x404b1d
push dword [esi + 0x20]
push eax
call fcn.0040e0ff
pop ecx
mov dword [esi + 4], eax
mov esi, dword [0x45f43c]
pop ecx
mov eax, dword [0x45f410]
test eax, eax
je 0x404b35
sub eax, dword [0x45f418]
mov dword [esi + 0x18], eax
mov esi, dword [0x45f43c]
mov eax, dword [0x45f420]
test eax, eax
je 0x404b41
mov dword [esi + 0x10], eax
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
push eax
push eax
push eax
push dword [0x44f45c]
call esi
push 0
push 0x451574
push dword [0x45d560]
push dword [0x4515d4]
push dword [0x44f45c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
push dword [0x45d560]
push dword [0x44f45c]
call esi
push dword [0x44f45c]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push str.Dump_done_
call fcn.0040d967
mov dword [esp], 0x45d778
push str.Saved_to:__s
call fcn.0040d967
pop ecx
pop ecx
cmp dword [ebp + 0xc], ebx
je 0x404e1f
mov eax, dword [0x44f45c]
test eax, eax
je 0x404bce
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x44f45c], 0
push 0x44f020
mov esi, 0x445dac
push esi
call fcn.0040d967
push str.Rebuilding_Imports...
call fcn.0040d967
add esp, 0xc
cmp dword [0x45dac0], 0
je 0x404c50
cmp dword [0x45db30], 0
je 0x404c48
push str.Rebuilding_Sections...
call fcn.0040d967
pop ecx
call fcn.0040a432
mov dword [0x45df1c], eax
test eax, eax
jne 0x404ca0
push 0x45df28
push edi
call dword [0x401004]
mov dword [0x45df1c], eax
test eax, eax
je 0x404c3c
push dword [0x45da70]
call fcn.0040a8dd
jmp 0x404c9a
push str.function:_GetNameFileOptimized_Error_
call fcn.0040d967
jmp 0x404c9f
push dword [0x45da70]
jmp 0x404c95
cmp dword [0x45db30], 0
je 0x404c8f
push str.Rebuilding_Sections...
call fcn.0040d967
pop ecx
call fcn.0040a432
mov dword [0x45df1c], eax
test eax, eax
jne 0x404ca0
push 0x45df28
push edi
call dword [0x401004]
mov dword [0x45df1c], eax
test eax, eax
je 0x404c3c
push dword [0x45f1d4]
jmp 0x404c35
push dword [0x45f1d4]
call fcn.0040a8a7
mov dword [0x45df10], eax
pop ecx
mov eax, dword [0x44f478]
test eax, eax
je 0x404cbb
cmp dword [0x45df10], 0
push 2
pop ecx
cmove eax, ecx
mov dword [0x44f478], eax
push str.Rebuilding_Imports_completed
call fcn.0040d967
push dword [0x45df10]
push str.Return_code:__X
call fcn.0040d967
push 0x45dec0
push esi
call fcn.0040d967
push 0x44f020
push esi
call fcn.0040d967
push dword [0x45ddb4]
push str.IAT_RVA:__08X
call fcn.0040d967
push dword [0x45debc]
push str.IAT_Size:__08X
call fcn.0040d967
push dword [0x45f424]
push str.OEP_VA:__p
call fcn.0040d967
push dword [0x45f420]
push str.OEP_RVA:__p
call fcn.0040d967
mov eax, dword [0x4515c8]
add esp, 0x3c
test eax, eax
je 0x404d78
push eax
push str.OEP_call_return_VA:__p
call fcn.0040d967
mov eax, dword [0x45f428]
pop ecx
pop ecx
test eax, eax
je 0x404d78
cmp eax, dword [0x45f420]
je 0x404d78
push dword [0x45f42c]
push str.2nd_TEXT_OEP_VA:__p
call fcn.0040d967
push dword [0x45f428]
push str.2nd_TEXT_OEP_RVA:__p
call fcn.0040d967
add esp, 0x10
cmp dword [0x45db0c], 0
je 0x404e1f
push 0x44f020
push esi
call fcn.0040d967
push str.Unpacking_Pdata_Section...
call fcn.0040d967
add esp, 0xc
push 0x44f488
push edi
push 0x44f850
call dword [0x401028]
push str.Unpacking_Pdata_completed
mov dword [0x45df1c], eax
call fcn.0040d967
push dword [0x45df1c]
push str.Return_code:__X
call fcn.0040d967
push 0x448108
push 0x44f4ab
call dword [sym.imp.ucrtbased.dll_strcspn]
mov edi, 0x44f488
push edi
lea esi, [eax + 0x23]
push esi
push str._.s
call fcn.0040d967
add esp, 0x20
cmp dword [0x45df1c], 0
jne 0x404e0c
push 0x5c
push edi
call fcn.00414dac
sub ebx, edi
pop ecx
pop ecx
lea esi, [ebx + eax]
lea eax, [esi + 0x44f488]
push eax
push 0x445dac
call fcn.0040d967
pop ecx
pop ecx
mov eax, dword [0x44f45c]
test eax, eax
je 0x404e3f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x44f45c], 0
jmp 0x404e3f
and dword [0x44f958], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416750
leave
ret