Function at 0x404d30
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428ee5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
push str..936
push 0
mov dword [ebp - 0x20], ebx
call fcn.00416e5d
xor esi, esi
add esp, 8
mov dword [ebp - 0x18], esi
cmp dword [ebp + 8], esi
je 0x404eaf
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov eax, dword [ebp + 8]
test esi, esi
je 0x404ea3
push str.renamelib
push dword [ebx + esi*4]
lea ebx, [ebx + esi*4]
call edi
test eax, eax
je 0x405456
push str.CreateWeak
push dword [ebx]
call edi
test eax, eax
je 0x405440
push str.AppendWeak
push dword [ebx]
call edi
test eax, eax
je 0x40542a
push str.CreateWeaks
push dword [ebx]
call edi
test eax, eax
je 0x405414
push str.RemoveAllObj
push dword [ebx]
call edi
test eax, eax
je 0x405407
push str.FixObj
push dword [ebx]
call edi
test eax, eax
je 0x4052ea
push str.ExportDef
push dword [ebx]
call edi
test eax, eax
je 0x4051e8
push str.CopyLibType
push dword [ebx]
call edi
test eax, eax
je 0x4051d4
push str.RemoveAPISET
push dword [ebx]
call edi
test eax, eax
je 0x4051c0
push str.RemoveMSSign
push dword [ebx]
call edi
test eax, eax
je 0x40507f
push str.ExportObj
push dword [ebx]
call edi
test eax, eax
je 0x405064
push str.BuildYY_ThunksLibraries
push dword [ebx]
call edi
test eax, eax
je 0x404ed0
push 8
push str._PREFIX:
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
mov ecx, dword [ebx]
test eax, eax
jne 0x404e8a
lea esi, [ecx + 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push esi
mov ecx, 0x439a0c
call fcn.0040a5b0
mov esi, dword [ebp - 0x18]
jmp 0x404e9d
push str._SupportApiSet
push ecx
call edi
test eax, eax
jne 0x404eaf
mov byte [0x439a08], 1
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, eax
jne 0x404d87
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e950
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x20]
push ecx
mov dword [ebp - 0x24], esp
mov eax, dword [edi + esi*4 + 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], esp
call fcn.0040db30
mov ecx, eax
test ecx, ecx
je 0x40555f
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x14]
add eax, 0x10
mov dword [ecx], eax
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x404f52
test edx, 0xffff0000
jne 0x404f32
movzx eax, dx
mov ecx, eax
mov dword [ebp - 0x1c], eax
call fcn.0040d010
test eax, eax
je 0x404f5e
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
push eax
call fcn.0040d1a0
jmp 0x404f5e
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x1c], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404f40
sub ecx, dword [ebp - 0x1c]
sar ecx, 1
jmp 0x404f54
xor ecx, ecx
push ecx
mov ecx, dword [ebp - 0x14]
push edx
call fcn.0040d240
mov dword [ebp - 4], 6
mov esi, dword [edi + esi*4 + 8]
push ecx
mov edi, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x14], edi
call fcn.0040db30
mov ecx, eax
test ecx, ecx
je 0x405569
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 7
test esi, esi
je 0x404fd1
test esi, 0xffff0000
jne 0x404fb4
movzx esi, si
mov ecx, esi
call fcn.0040d010
test eax, eax
je 0x404fdc
push esi
push eax
mov ecx, edi
call fcn.0040d1a0
jmp 0x404fdc
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404fc0
sub ecx, edx
sar ecx, 1
jmp 0x404fd3
xor ecx, ecx
push ecx
push esi
mov ecx, edi
call fcn.0040d240
push ecx
mov byte [ebp - 4], 8
mov edi, esp
mov esi, dword [ebx + 4]
mov dword [ebp - 0x14], edi
call fcn.0040db30
mov ecx, eax
test ecx, ecx
je 0x405573
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 9
test esi, esi
je 0x405041
test esi, 0xffff0000
jne 0x40502b
movzx esi, si
mov ecx, esi
call fcn.0040d010
test eax, eax
je 0x40504c
push esi
push eax
mov ecx, edi
call fcn.0040d1a0
jmp 0x40504c
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405030
sub ecx, edx
sar ecx, 1
jmp 0x405043
xor ecx, ecx
push ecx
push esi
mov ecx, edi
call fcn.0040d240
mov byte [ebp - 4], 8
mov dword [ebp - 4], 0xffffffff
call fcn.00407a90
add esp, 0xc
jmp 0x404eb4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebx + 4]
push dword [eax + esi*4 + 0xc]
mov edx, dword [eax + esi*4 + 8]
call fcn.004061d0
add esp, 4
jmp 0x404eb4
mov ebx, dword [ebx + 4]
lea ecx, [ebp - 0x14]
mov edx, ebx
call fcn.00403680
mov dword [ebp - 4], 4
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], 0
je 0x4050cb
cmp dword [esi - 4], 1
jle 0x4050b0
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.0040d5f0
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, eax
test ecx, ecx
jne 0x4050f6
push ebx
push 0x431468
call fcn.0040cf10
add esp, 8
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4050ea
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, 0xd
mov eax, edi
jmp 0x404eb4
movzx eax, word [ecx + 0x14]
mov edi, dword [eax + ecx - 0x48]
test edi, edi
jne 0x405138
push ebx
push 0x431978
call fcn.0040cf10
add esp, 8
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40512f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor edi, edi
mov eax, edi
jmp 0x404eb4
cmp dword [esi - 0xc], edi
jae 0x40514f
push 0x4318bc
call fcn.0040cf10
add esp, 4
jmp 0x4050cb
mov dword [eax + ecx - 0x44], 0
mov edx, edi
mov dword [eax + ecx - 0x48], 0
mov ecx, esi
call fcn.00406120
push edi
mov edx, esi
mov ecx, ebx
call fcn.0040de20
mov edi, eax
add esp, 4
test edi, edi
je 0x40518c
push edi
push ebx
push str.Error
call fcn.0040cf10
add esp, 0xc
jmp 0x40519a
push ebx
push 0x431958
call fcn.0040cf10
add esp, 8
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4051b9
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
jmp 0x404eb4
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebx + 4]
mov edx, dword [edx + esi*4 + 8]
call fcn.00405a80
jmp 0x404eb4
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebx + 4]
mov edx, dword [edx + esi*4 + 8]
call fcn.00404910
jmp 0x404eb4
mov ecx, dword [ebx + 4]
xor eax, eax
mov ebx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x24], ecx
lea ecx, [esi + 2]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], ecx
cmp ecx, ebx
jge 0x4052d7
nop dword [eax]
mov eax, dword [ebp - 0x20]
push 9
lea esi, [eax + ecx*4]
push str._MACHINE:
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
mov ecx, dword [esi]
test eax, eax
jne 0x40529d
lea esi, [ecx + 0x12]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push 0x4313f4
push esi
call edi
test eax, eax
je 0x405293
push str.Win32
push esi
call edi
test eax, eax
je 0x405293
push 0x4313fc
push esi
call edi
test eax, eax
jne 0x405263
mov eax, 0x8664
mov dword [ebp - 0x18], eax
jmp 0x4052c5
push str.arm64
push esi
call edi
test eax, eax
jne 0x405279
mov eax, 0xaa64
mov dword [ebp - 0x18], eax
jmp 0x4052c5
push 0x431410
push esi
call edi
test eax, eax
jne 0x404eaf
mov eax, 0x1c0
mov dword [ebp - 0x18], eax
jmp 0x4052c5
mov eax, 0x14c
mov dword [ebp - 0x18], eax
jmp 0x4052c5
push 5
push str._OUT:
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x404eaf
mov eax, dword [esi]
add eax, 0xa
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, ebx
jl 0x405210
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
push edx
mov edx, eax
call fcn.00404430
add esp, 4
jmp 0x404eb4
push 0x18
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.0040ee95
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp + 8]
inc esi
xor eax, eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
cmp esi, ebx
je 0x4053cf
nop
mov eax, dword [ebp - 0x20]
push 0xf
push str._WeakExternFix:
mov edi, dword [eax + esi*4]
push edi
call fcn.00419acc
add esp, 0xc
test eax, eax
jne 0x405400
add edi, 0x1e
push edi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push 0x3d
push edi
call fcn.0040ffc0
add esp, 8
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4053c0
mov ecx, eax
sub ecx, edi
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040a690
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00409b30
mov ecx, dword [ebp - 0x24]
mov esi, eax
push 0xa
add ecx, 2
push 0
push ecx
call fcn.00412cd1
mov dword [esi], eax
add esp, 0xc
mov byte [ebp - 4], 2
or eax, 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4053bd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, ebx
jne 0x405330
lea edx, [ebp - 0x2c]
mov ecx, eax
call fcn.00405580
mov ecx, dword [ebp - 0x2c]
mov esi, eax
lea eax, [ebp - 0x2c]
push dword [ecx + 4]
mov ecx, eax
push eax
call fcn.0040b9e0
push 0x18
push dword [ebp - 0x2c]
call fcn.0040e95e
add esp, 8
mov eax, esi
jmp 0x404eb4
mov eax, edi
mov dword [ebp - 0x14], eax
jmp 0x4053c3
mov ecx, dword [ebx + 4]
call fcn.00404210
jmp 0x404eb4
mov ecx, dword [ebp + 8]
mov edx, ebx
push 1
sub ecx, esi
call fcn.00403400
add esp, 4
jmp 0x404eb4
mov ecx, dword [ebp + 8]
mov edx, ebx
push 2
sub ecx, esi
call fcn.00403400
add esp, 4
jmp 0x404eb4
mov ecx, dword [ebp + 8]
mov edx, ebx
push 0
sub ecx, esi
call fcn.00403400
add esp, 4
jmp 0x404eb4
cmp dword [ebp + 8], 7
jne 0x404eaf
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + esi*4 + 8]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push 0x4313f4
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x405488
mov dword [ebp - 0x14], 0x14c
jmp 0x4054cf
push 0x4313fc
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x40549f
mov dword [ebp - 0x14], 0x8664
jmp 0x4054cf
push str.arm64
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x4054b6
mov dword [ebp - 0x14], 0xaa64
jmp 0x4054cf
push 0x431410
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x404eaf
mov dword [ebp - 0x14], 0x1c0
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push dword [eax + esi*4 + 0x14]
call fcn.0040a770
mov esi, eax
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], 0
push dword [eax + edi*4 + 0x10]
call fcn.0040a770
mov byte [ebp - 4], 1
push dword [esi]
mov edx, dword [ebp - 0x14]
push dword [eax]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebx + 4]
push dword [eax + edi*4 + 0xc]
call fcn.004037d0
mov byte [ebp - 4], 0
or ebx, 0xffffffff
mov edx, dword [ebp - 0x24]
add esp, 0xc
mov esi, eax
add edx, 0xfffffff0
mov ecx, ebx
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x405539
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x405558
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
jmp 0x404eb4
push 0x80004005
call fcn.0040d910
push 0x80004005
call fcn.0040d910
push 0x80004005
call fcn.0040d910
int3