Function at 0x49fb71
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx + 8], 0x40
push ebx
push esi
push edi
jae 0x49fb86
mov dword [ecx + 4], str.Too_small
jmp 0x49fdec
mov eax, dword [ecx + 0xc]
cmp byte [eax], 0x4d
jne 0x49fde5
cmp byte [eax + 1], 0x5a
jne 0x49fde5
mov edx, dword [eax + 0x3c]
cmp edx, dword [ecx + 8]
jb 0x49fbb0
mov dword [ecx + 4], str.Bad_offset_to_PE_header
jmp 0x49fdec
lea esi, [eax + edx]
cmp esi, eax
jbe 0x49fba4
mov edi, dword [ecx + 0x10]
lea eax, [edi - 0x18]
cmp esi, eax
jae 0x49fba4
test dl, 7
je 0x49fbd2
mov dword [ecx + 4], str.Misaligned_PE_header
jmp 0x49fdec
cmp byte [esi], 0x50
jne 0x49fddc
cmp byte [esi + 1], 0x45
jne 0x49fddc
cmp byte [esi + 2], 0
jne 0x49fddc
cmp byte [esi + 3], 0
jne 0x49fddc
mov ax, word [esi + 4]
mov word [ecx + 0x3c], ax
mov ax, word [esi + 6]
mov word [ecx + 0x3e], ax
mov ax, word [esi + 0x14]
add esi, 0x18
movzx edx, ax
mov word [ecx + 0x38], ax
lea eax, [esi + edx]
mov dword [ecx + 0x34], esi
cmp eax, edi
jb 0x49fc2d
mov dword [ecx + 4], str.optional_header_past_end_of_file
jmp 0x49fdec
push 2
pop eax
cmp dx, ax
jae 0x49fc41
mov dword [ecx + 4], str.optional_header_no_magic
jmp 0x49fdec
movzx eax, word [esi]
mov edi, 0x10b
xor ebx, ebx
cmp ax, di
jne 0x49fc57
mov byte [ecx + 0x30], bl
push 0x60
jmp 0x49fc6b
mov edi, 0x20b
cmp ax, di
jne 0x49fdd3
mov byte [ecx + 0x30], 1
push 0x70
pop eax
mov word [ecx + 0x3a], ax
cmp dx, ax
jae 0x49fc81
mov dword [ecx + 4], str.optional_header_too_short
jmp 0x49fdec
mov eax, dword [esi + 4]
mov dl, byte [ecx + 0x30]
mov dword [ecx + 0x48], eax
mov eax, dword [esi + 8]
mov dword [ecx + 0x4c], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0x50], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x54], eax
test dl, dl
je 0x49fcb1
mov dword [ecx + 0x58], ebx
mov eax, dword [esi + 0x18]
mov dword [ecx + 0x60], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x64], eax
jmp 0x49fcc0
mov eax, dword [esi + 0x18]
mov dword [ecx + 0x58], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x60], eax
mov dword [ecx + 0x64], ebx
mov eax, dword [esi + 0x38]
push 0x5c
mov dword [ecx + 0x68], eax
pop eax
push 0x6c
pop edi
test dl, dl
cmovne eax, edi
mov eax, dword [eax + esi]
mov dword [ecx + 0x6c], eax
lea eax, [ecx + 0x70]
push eax
push ebx
call fcn.0049fa31
mov bl, al
lea eax, [ecx + 0x78]
push eax
push 1
and bl, 1
call fcn.0049fa31
and bl, al
lea eax, [ecx + 0x80]
push eax
push 2
call fcn.0049fa31
and bl, al
lea eax, [ecx + 0x88]
push eax
push 3
call fcn.0049fa31
and bl, al
lea eax, [ecx + 0x90]
push eax
push 5
call fcn.0049fa31
and bl, al
lea eax, [ecx + 0x98]
push eax
push 0xb
call fcn.0049fa31
and bl, al
lea eax, [ecx + 0xa0]
push eax
push 0xc
call fcn.0049fa31
and bl, al
lea eax, [ecx + 0xa8]
push eax
push 0xd
call fcn.0049fa31
and bl, al
lea eax, [ecx + 0xb0]
push eax
push 0xe
call fcn.0049fa31
test bl, al
jne 0x49fd6e
mov dword [ecx + 4], str.malformed_data_directory
jmp 0x49fdec
movzx eax, word [ecx + 0x38]
movzx edi, word [ecx + 0x3e]
add esi, eax
xor edx, edx
mov dword [ecx + 0x40], esi
test edi, edi
jle 0x49fda5
cmp dword [esi], 0x7865742e
jne 0x49fd94
cmp word [esi + 4], 0x74
jne 0x49fd94
mov byte [ecx + 0x44], 1
mov eax, dword [esi + 0x14]
add eax, dword [esi + 0x10]
cmp eax, edx
cmova edx, eax
add esi, 0x28
dec edi
jne 0x49fd81
cmp edx, dword [ecx + 8]
jae 0x49fdad
mov dword [ecx + 8], edx
cmp byte [ecx + 0x30], 0
jne 0x49fdbc
mov dword [ecx + 4], str.32_bit_executables_are_not_supported_by_this_disassembler
jmp 0x49fdec
cmp byte [ecx + 0x44], 0
jne 0x49fdcb
mov dword [ecx + 4], str.Resource_only_executables_are_not_yet_supported
jmp 0x49fdec
and dword [ecx + 4], 0
mov al, 1
jmp 0x49fdee
mov dword [ecx + 4], str.unrecognized_magic
jmp 0x49fdec
mov dword [ecx + 4], str.no_PE_signature
jmp 0x49fdec
mov dword [ecx + 4], str.Not_MZ
xor al, al
pop edi
pop esi
pop ebx
ret