Function at 0x449da4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x94c
mov dword [ebp - 0x920], eax
mov ebx, edx
mov dword [ebp - 0x928], ecx
mov eax, dword [ebp + 0x10]
mov edx, eax
and edx, 3
mov dword [ebp - 0x91c], edx
cmp edx, 1
ja 0x4496a8
and eax, 0x1c
shr eax, 2
mov dword [ebp - 0x924], eax
cmp eax, 3
jbe 0x4496e0
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x920]
mov dword [esp + 4], ecx
mov dword [esp], str._B:_Unrecognised_import_name_type___x
call dword [0x49e8c0]
xor eax, eax
add esp, 0x94c
pop ebx
pop esi
pop edi
leave
ret
cmp edx, 2
je 0x449b24
mov edi, dword [ebp - 0x91c]
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x920]
mov dword [esp + 4], eax
mov dword [esp], str._B:_Unrecognised_import_type___x
call dword [0x49e8c0]
xor eax, eax
add esp, 0x94c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], 8
call fcn.00437dcc
mov dword [ebp - 0x68], eax
test eax, eax
je 0x449b7c
mov ecx, 0xffffffff
mov edi, dword [ebp - 0x928]
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
mov ecx, 0xffffffff
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
lea eax, [edx + ecx*2 + 0x586]
lea eax, [eax + edx*2 + 6]
mov dword [esp], eax
call fcn.00437fa8
mov edx, eax
mov esi, dword [ebp - 0x68]
mov dword [esi + 4], eax
mov ecx, 0xffffffff
mov edi, dword [ebp - 0x928]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0x92c], ecx
mov ecx, 0xffffffff
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
mov edi, dword [ebp - 0x92c]
lea eax, [edi + ecx*2 + 0x586]
lea eax, [eax + edi*2 + 6]
mov dword [esi], eax
test edx, edx
je 0x449b65
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], 0
lea eax, [edx + 0x120]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
lea eax, [edx + 0x140]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
lea eax, [edx + 0x240]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
lea eax, [edx + 0x260]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [edx + 0x2f0]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], 0
lea eax, [edx + 0x370]
mov dword [ebp - 0x1c], eax
lea esi, [edx + 0x3f0]
mov dword [ebp - 0x30], esi
add edx, 0x3f4
mov dword [ebp - 0x2c], edx
mov ecx, 0xffffffff
mov edi, dword [ebp - 0x928]
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
mov ecx, 0xffffffff
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx + edx*2 + 0x54]
lea eax, [esi + eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x6c], eax
mov edi, dword [ebp - 0x920]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x34], 0
mov word [ebp - 0x936], bx
mov word [ebp - 0x64], bx
mov dword [esp], 0
mov ecx, 4
mov edx, 0x4ea16e
lea eax, [ebp - 0x70]
call fcn.0044952c
mov dword [ebp - 0x92c], eax
mov dword [esp], 0
mov ecx, 4
mov edx, 0x4ea177
lea eax, [ebp - 0x70]
call fcn.0044952c
mov dword [ebp - 0x930], eax
mov eax, dword [ebp - 0x92c]
test eax, eax
je 0x449b50
mov edi, dword [ebp - 0x930]
test edi, edi
je 0x449b50
mov esi, dword [ebp - 0x924]
test esi, esi
jne 0x449bc8
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x449d88
mov eax, dword [ebp + 0xc]
or eax, 0x80000000
mov ecx, dword [ebp - 0x92c]
mov edx, dword [ecx + 0x6c]
mov dword [edx], eax
mov edi, dword [ebp - 0x930]
mov edx, dword [edi + 0x6c]
mov dword [edx], eax
cmp dword [ebp - 0x91c], 1
je 0x449bb8
mov edx, dword [0x49f090]
test edx, edx
je 0x449b84
movzx eax, word [0x49f06c]
cmp eax, ebx
jne 0x449b84
mov esi, 1
imul esi, esi, 0x2c
lea ebx, [esi + 0x49f060]
mov ecx, dword [ebx + 4]
mov dword [esp], 0x10
mov edx, 0x4ea0b9
lea eax, [ebp - 0x70]
call fcn.0044952c
mov dword [ebp - 0x924], eax
test eax, eax
je 0x449b50
mov edx, dword [ebp - 0x924]
mov eax, dword [edx + 0x6c]
add esi, 0x49f042
mov ecx, dword [ebx + 4]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], 0
mov ecx, dword [ebp - 0x930]
mov dword [esp], ecx
mov ecx, dword [ebp - 0x928]
mov edx, 0x4ea189
lea eax, [ebp - 0x70]
call fcn.004493a0
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x50]
dec eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
sub eax, 4
mov dword [esp], eax
mov ecx, 2
lea eax, [ebp - 0x70]
call fcn.004492f0
mov edx, dword [ebp - 0x924]
lea eax, [ebp - 0x70]
call fcn.00446048
lea ebx, [ebp - 0x90c]
mov ecx, 0x89c
xor eax, eax
mov edi, ebx
rep stosb byte es:[edi], al
mov di, word [ebp - 0x936]
mov word [ebp - 0x88], di
mov word [ebp - 0x76], 0x104
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x920]
mov dword [esp], eax
call fcn.00432ad0
test eax, eax
je 0x449b50
mov edx, dword [ebp - 0x920]
mov eax, dword [edx + 8]
mov eax, dword [eax + 0x1a8]
mov dword [esp + 4], ebx
mov dword [esp], edx
call dword [eax + 0x74]
test eax, eax
je 0x449b50
mov ecx, dword [ebp - 0x920]
mov eax, dword [ecx + 8]
mov eax, dword [eax + 0x1a8]
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], ecx
call dword [eax + 0x78]
test eax, eax
je 0x449b50
mov edi, dword [ebp - 0x920]
mov eax, dword [edi + 0xa8]
mov dword [eax + 0x54], 1
mov dword [esp], edi
call fcn.0043c23c
mov eax, dword [ebp - 0x68]
mov dword [edi + 0xc], eax
or dword [edi + 0x38], 0x800
mov dword [edi + 0x10], 0x4e74e0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov eax, dword [edi + 0xa8]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
cmp dword [ebp - 0x91c], 1
je 0x449ad6
mov dword [esp + 4], 0x408
mov eax, dword [ebp - 0x924]
mov dword [esp], eax
mov ecx, dword [ebp - 0x928]
mov edx, 0x4ea104
lea eax, [ebp - 0x70]
call fcn.004493a0
mov dword [esp + 4], 0x2e
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sub.msvcrt.dll_strrchr
mov esi, eax
test eax, eax
je 0x449d58
mov byte [eax], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, dword [ebp + 8]
mov edx, str.__IMPORT_DESCRIPTOR_
lea eax, [ebp - 0x70]
call fcn.004493a0
mov byte [esi], 0x2e
mov eax, dword [edi + 0xa8]
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
mov edx, dword [ebp - 0x50]
mov edi, dword [ebp - 0x920]
mov dword [edi + 0x7c], edx
mov ecx, dword [ebp - 0x44]
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], edx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], 1
mov ecx, dword [ebp - 0x4c]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], 1
or dword [edi + 0x38], 0x10
mov eax, 1
jmp 0x4496d4
mov dword [esp + 8], 2
mov ecx, dword [ebp - 0x920]
mov dword [esp + 4], ecx
mov dword [esp], str._B:_Unhandled_import_type___x
call dword [0x49e8c0]
xor eax, eax
add esp, 0x94c
pop ebx
pop esi
pop edi
leave
ret
mov esi, dword [ebp - 0x68]
mov eax, dword [esi + 4]
test eax, eax
je 0x449b65
mov dword [esp], eax
call sub.msvcrt.dll_free
mov esi, dword [ebp - 0x68]
mov dword [esp], esi
call sub.msvcrt.dll_free
xor eax, eax
add esp, 0x94c
pop ebx
pop esi
pop edi
leave
ret
xor eax, eax
jmp 0x4496d4
mov eax, dword [0x49f064]
test eax, eax
je 0x449b9c
movzx eax, word [0x49f040]
cmp eax, ebx
je 0x449d51
mov dword [esp + 8], str.pe_ILF_build_a_bfd
mov dword [esp + 4], 0x3a6
mov dword [esp], str..._.._bfd_peicode.h
call fcn.00432418
mov dword [ebp - 0x924], 0
jmp 0x449975
mov ecx, 0xffffffff
mov edi, dword [ebp - 0x928]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 3
mov dword [esp], 0
mov edx, 0x4ea180
lea eax, [ebp - 0x70]
call fcn.0044952c
mov dword [ebp - 0x934], eax
test eax, eax
je 0x449b50
cmp dword [ebp - 0x924], 1
je 0x449d05
mov edx, dword [ebp - 0x928]
mov al, byte [edx]
cmp al, 0x5f
je 0x449cf9
cmp al, 0x40
je 0x449cf9
cmp al, 0x3f
je 0x449cf9
mov esi, dword [ebp - 0x928]
xor eax, eax
mov ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
lea edx, [ecx - 1]
cmp dword [ebp - 0x924], 3
je 0x449d24
mov ecx, dword [ebp - 0x934]
mov eax, dword [ecx + 0x6c]
mov cl, byte [ebp + 0xc]
mov byte [eax], cl
mov edi, dword [ebp - 0x934]
mov ecx, dword [edi + 0x6c]
mov eax, dword [ebp + 0xc]
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [edi + 0x6c]
add eax, 2
mov edi, eax
mov ecx, edx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x934]
mov eax, dword [ecx + 0x6c]
mov byte [eax + edx + 2], 0
mov eax, dword [ecx + 0x8c]
mov eax, dword [eax + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x9c]
mov dword [esp], eax
mov ecx, 0x3c
xor edx, edx
lea eax, [ebp - 0x70]
call fcn.004492f0
mov edx, dword [ebp - 0x92c]
lea eax, [ebp - 0x70]
call fcn.00446048
mov edi, dword [ebp - 0x934]
mov eax, dword [edi + 0x8c]
mov eax, dword [eax + 0x14]
mov dword [esp + 4], eax
mov eax, dword [edi + 0x9c]
mov dword [esp], eax
mov ecx, 0x3c
xor edx, edx
lea eax, [ebp - 0x70]
call fcn.004492f0
mov edx, dword [ebp - 0x930]
lea eax, [ebp - 0x70]
call fcn.00446048
jmp 0x4498af
mov esi, dword [ebp - 0x928]
inc esi
jmp 0x449c31
mov ecx, 0xffffffff
mov edi, dword [ebp - 0x928]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea edx, [ecx - 1]
mov esi, dword [ebp - 0x928]
jmp 0x449c4e
mov dword [esp + 4], 0x40
mov dword [esp], esi
mov dword [ebp - 0x93c], edx
call sub.msvcrt.dll_strchr
test eax, eax
mov edx, dword [ebp - 0x93c]
je 0x449c4e
mov edx, eax
sub edx, esi
jmp 0x449c4e
xor esi, esi
jmp 0x4498de
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, dword [ebp + 8]
mov edx, str.__IMPORT_DESCRIPTOR_
lea eax, [ebp - 0x70]
call fcn.004493a0
mov ecx, dword [ebp - 0x920]
mov eax, dword [ecx + 0xa8]
jmp 0x449ad6
mov dword [esp + 8], str.pe_ILF_build_a_bfd
mov dword [esp + 4], 0x354
mov dword [esp], str..._.._bfd_peicode.h
call fcn.00432418
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xdc
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
call fcn.0043be6c
test eax, eax
jne 0x449f08
mov dword [esp + 8], ebx
mov dword [esp + 4], 4
lea esi, [ebp - 0x1c]
mov dword [esp], esi
call fcn.0043bcbc
cmp eax, 4
jne 0x449f08
mov eax, dword [ebx + 8]
mov dword [esp], esi
call dword [eax + 0x4c]
cmp eax, 0xffff0000
je 0x449f20
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
call fcn.0043be6c
test eax, eax
jne 0x449f08
mov dword [esp + 8], ebx
mov dword [esp + 4], pe_nt_image_headers32
lea esi, [ebp - 0xc4]
mov dword [esp], esi
call fcn.0043bcbc
add eax, 0xffffff80
jne 0x449f08
mov eax, dword [ebx + 8]
mov dword [esp], esi
call dword [eax + 0x58]
cmp eax, 0x5a4d
jne 0x449f8c
mov eax, dword [ebx + 8]
lea edx, [ebp - 0x88]
mov dword [esp], edx
call dword [eax + 0x4c]
mov esi, eax
xor edi, edi
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.0043be6c
test eax, eax
jne 0x449f08
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x18
lea edx, [ebp - 0x44]
mov dword [esp], edx
mov dword [ebp - 0xd8], edx
call fcn.0043bcbc
cmp eax, 0x18
mov edx, dword [ebp - 0xd8]
jne 0x449f08
mov eax, dword [ebx + 8]
mov dword [esp], edx
call dword [eax + 0x4c]
cmp eax, 0x4550
jne 0x449f8c
mov dword [esp + 0xc], 0
add esi, 0xffffff80
adc edi, 0xffffffff
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.0043be6c
test eax, eax
jne 0x449f08
mov dword [esp], ebx
call fcn.0043a1bc
jmp 0x449f12
call fcn.004322a4
dec eax
jne 0x449f8c
xor eax, eax
add esp, 0xdc
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x10
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.0043bcbc
cmp eax, 0x10
jne 0x449f10
mov eax, dword [ebx + 8]
lea edx, [ebp - 0x2a]
mov dword [esp], edx
call dword [eax + 0x58]
cmp eax, 0x1c0
je 0x449f74
ja 0x449fa5
cmp eax, 0x166
je 0x449f74
ja 0x44a0d5
cmp eax, 0x14c
je 0x449fef
cmp eax, 0x162
je 0x449f74
test eax, eax
jne 0x449fc7
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], str._B:_Recognised_but_unhandled_machine_type__0x_x__in_Import_Library_Format_archive
call dword [0x49e8c0]
lea esi, [esi]
mov dword [esp], 3
call fcn.004328a0
xor eax, eax
add esp, 0xdc
pop ebx
pop esi
pop edi
leave
ret
cmp eax, 0x268
je 0x449f74
ja 0x44a0f2
cmp eax, 0x200
je 0x449f74
cmp eax, 0x266
je 0x449f74
cmp eax, 0x1c2
je 0x449f74
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], str._B:_Unrecognised_machine_type__0x_x__in_Import_Library_Format_archive
call dword [0x49e8c0]
mov dword [esp], 0xa
call fcn.004328a0
xor eax, eax
jmp 0x449f12
mov eax, dword [ebx + 8]
lea edx, [ebp - 0x24]
mov dword [esp], edx
call dword [eax + 0x4c]
mov esi, eax
test eax, eax
jne 0x44a025
mov dword [esp + 4], ebx
mov dword [esp], str._B:_size_field_is_zero_in_Import_Library_Format_header
call dword [0x49e8c0]
mov dword [esp], 0xa
call fcn.004328a0
xor eax, eax
jmp 0x449f12
mov eax, dword [ebx + 8]
lea edx, [ebp - 0x20]
mov dword [esp], edx
call dword [eax + 0x58]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebx + 8]
lea edx, [ebp - 0x1e]
mov dword [esp], edx
call dword [eax + 0x58]
mov dword [ebp - 0xd4], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00434224
mov dword [ebp - 0xcc], eax
test eax, eax
je 0x449f10
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0043bcbc
cmp esi, eax
jne 0x44a12c
xor eax, eax
mov ecx, 0xffffffff
mov edi, dword [ebp - 0xcc]
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [ebp - 0xcc]
cmp byte [edx + esi - 1], 0
jne 0x44a10f
lea eax, [edx + ecx]
cmp ecx, esi
jae 0x44a10f
mov edx, dword [ebp - 0xd4]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xd0]
mov dword [esp + 4], edx
mov dword [esp], eax
mov ecx, dword [ebp - 0xcc]
mov edx, 0x14c
mov eax, ebx
call fcn.00449640
test eax, eax
je 0x44a12c
mov eax, dword [ebx + 8]
jmp 0x449f12
cmp eax, 0x184
je 0x449f74
ja 0x44a145
cmp eax, 0x168
jne 0x449fc7
jmp 0x449f74
cmp eax, 0x366
je 0x449f74
ja 0x44a160
cmp eax, 0x284
jne 0x449fc7
jmp 0x449f74
mov dword [esp + 4], ebx
mov dword [esp], str._B:_string_not_null_terminated_in_ILF_object_file.
call dword [0x49e8c0]
mov dword [esp], 0xa
call fcn.004328a0
mov eax, dword [ebp - 0xcc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00434470
xor eax, eax
jmp 0x449f12
cmp eax, 0x1a2
je 0x449f74
cmp eax, 0x1a6
jne 0x449fc7
jmp 0x449f74
cmp eax, 0x466
je 0x449f74
cmp eax, 0x8664
jne 0x449fc7
jmp 0x449f74