Function at 0x64404924
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push ebx
sub esp, 0x10
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp], 2
call ebx
mov edx, str.could_not_import:
call sym._rawWrite
mov dword [esp], 2
call ebx
mov edx, esi
call sym._rawWrite
mov dword [esp], 2
call ebx
mov edx, 0x6441c326
call sym._rawWrite
mov dword [esp], 1
call sym._exit

Function at 0x64404d4d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], 0
lea esi, [eax + 4]
jne 0x64404d66
mov esi, 0x6441c2e3
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [esp], 2
call ebx
mov edx, esi
call sym._rawWrite
mov dword [esp], 2
call ebx
mov edx, 0x6441c326
call sym._rawWrite
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._exit

Function at 0x64407308
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ebx
xor ebx, ebx
test ecx, ecx
je 0x6440733e
cmp word [ecx], 0x5a4d
jne 0x6440733e
xor ebx, ebx
add ecx, dword [ecx + 0x3c]
seto bl
jno 0x6440732b
call sym._raiseOverflow
jmp 0x6440733e
cmp dword [ecx], 0x4550
jne 0x6440733e
mov bx, word [ecx + 0x16]
shr bx, 0xd
and ebx, 1
mov eax, ebx
pop edx
pop ebx
pop ebp
ret

Function at 0x644073b6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0xbc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xa8], eax
call sym._is_dll__6873nvoke_u138_4
mov dword [esp], 0x6441b124
mov esi, eax
call sym.___emutls_get_address
cmp byte [eax], 0
mov dword [ebp - 0xa0], eax
jne 0x644074ea
test esi, esi
je 0x6440741e
mov esi, ebx
add esi, dword [ebx + 0x3c]
jo 0x64407440
lea eax, [ebp - 0x98]
add esi, 0x78
mov ecx, 0x20
mov edi, eax
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x94], 0
jne 0x6440742b
xor eax, eax
mov dword [ebp - 0x9c], eax
jmp 0x644074ea
mov edi, dword [ebp - 0x98]
test edi, edi
je 0x6440741e
xor eax, eax
add edi, ebx
seto al
mov esi, eax
jno 0x6440744a
call sym._raiseOverflow
jmp 0x644074ea
mov eax, dword [edi + 0x18]
cmp dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], eax
jne 0x64407465
cmp dword [ebp - 0xa4], 0
je 0x6440741e
mov eax, dword [ebp - 0xac]
cmp esi, eax
jg 0x6440741e
imul eax, esi, 4
jo 0x64407440
add eax, dword [edi + 0x20]
jo 0x64407440
add eax, ebx
jo 0x64407440
mov ecx, ebx
add ecx, dword [eax]
jo 0x64407440
call sym._getHash__6873nvoke_u95_4
mov ecx, dword [ebp - 0xa0]
cmp byte [ecx], 0
jne 0x644074ea
cmp dword [ebp - 0xa8], edx
jne 0x644074a3
cmp dword [ebp - 0xa4], eax
je 0x644074aa
add esi, 1
jno 0x64407465
jmp 0x64407440
imul esi, esi, 2
jo 0x64407440
add esi, dword [edi + 0x24]
jo 0x64407440
add esi, ebx
jo 0x64407440
mov ax, word [esi]
mov edx, dword [edi + 0x1c]
shl eax, 2
movzx eax, ax
add eax, edx
jo 0x64407440
add eax, ebx
jo 0x64407440
add ebx, dword [eax]
jo 0x64407440
mov dword [ebp - 0x9c], ebx
test ebx, ebx
je 0x6440741e
mov eax, dword [ebp - 0x9c]
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret 0xc