Function at 0x4a0be4
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4b9026
mov eax, dword fs:[0]
push eax
mov eax, 0x2db8
call fcn.004a53e0
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x2db4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0x2dcc]
mov dword fs:[0], eax
call fcn.00435dc0
mov eax, dword [0x4f65f8]
movsx eax, byte [eax + 0x4cc34c]
mov cl, byte [0x4f804c]
xor ebp, ebp
mov dword [0x4caddc], eax
neg eax
sbb eax, eax
mov dword [0x4cadd8], eax
mov al, byte [0x4f804b]
mov dword [0x51e170], ebp
mov dword [0x51e174], ebp
mov dword [0x51e15c], ebp
mov dword [0x51e158], ebp
mov dword [0x4d76e8], ebp
mov dword [0x4d7b78], ebp
mov dword [0x4cade0], 0x4d7b78
mov dword [0x4d7708], ebp
mov dword [0x4d7704], ebp
mov dword [0x51e154], ebp
mov dword [0x51e150], ebp
cmp al, 0x52
jne 0x4a07e3
mov dword [0x4d7b64], 3
test cl, cl
je 0x4a07e9
mov dword [0x4d7b64], ebp
xor edx, edx
cmp al, 0x53
sete dl
mov dword [0x4d7b6c], edx
cmp al, 0x52
jne 0x4a0809
mov dword [0x4d7b68], 1
cmp cl, 0x4e
je 0x4a080f
mov dword [0x4d7b68], ebp
cmp byte [0x4f8c7c], 0
je 0x4a09bd
push 0x4f8c7c
call fcn.004a1ef0
mov dword [0x4d7708], eax
cmp eax, ebp
jne 0x4a0845
mov ecx, 0x4d76b4
call fcn.00428df0
push 0x4baa2e
push 4
call fcn.004a01b0
cmp word [0x4f907c], bp
je 0x4a0866
push 0x4f907c
call fcn.004a1f70
mov dword [0x4d7704], eax
cmp eax, ebp
je 0x4a082f
mov eax, dword [0x4d7708]
cmp byte [0x4f6653], 0
je 0x4a089e
push eax
call fcn.00451980
test al, al
je 0x4a089e
movsx eax, byte [0x4f804b]
push eax
push 0x4bb070
call fcn.004a4980
add esp, 8
test eax, eax
je 0x4a089e
mov ecx, dword [0x4d7708]
push ecx
call fcn.00432c80
cmp dword [0x4d7b64], ebp
je 0x4a093b
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x4bde64]
mov word [esp + eax + 0x25c8], cx
add eax, 2
cmp cx, bp
jne 0x4a08b0
mov edx, dword [0x4d7704]
push edx
call fcn.00451bd0
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4a08d5
lea edi, [esp + 0x25c8]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bp
jne 0x4a08f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x25c8]
push eax
and ecx, 3
push 0x267
rep movsb byte es:[edi], byte [esi]
call fcn.004612e0
push eax
lea ecx, [esp + 0x48]
push ecx
mov edx, 0x4c8
call fcn.0049c880
add esp, 0xc
lea edx, [esp + 0x40]
push edx
call fcn.004861b0
call fcn.004a34b0
mov esi, eax
cmp esi, ebp
je 0x4a09b8
lea eax, [esi - 2]
cmp eax, 9
ja case.0x4a0955.5
movzx eax, byte [eax + 0x4a1b98]
jmp dword [eax*4 + 0x4a1b88]
push 0x2ad
call fcn.004612e0
mov ecx, dword [0x4d7704]
push eax
push ecx
call fcn.00493af0
mov eax, dword [0x4d7708]
add esp, 8
push eax
push esi
jmp 0x4a0840
mov ecx, 0x4d76b4
call fcn.00428df0
mov eax, dword [0x4d7708]
push eax
push esi
jmp 0x4a0840
mov edx, dword [0x4d7708]
push ebp
push edx
push ebp
push ebp
mov ecx, 0x4d76b4
call fcn.004295b0
mov eax, dword [0x4d7708]
push eax
push esi
jmp 0x4a0840
mov al, byte [0x4f804b]
cmp al, 0x44
jne 0x4a09df
call fcn.0047ca30
cmp eax, ebp
je 0x4a09da
cmp eax, 0xffffffff
je 0x4a09da
push 0x4baa2e
push eax
jmp 0x4a0840
mov al, byte [0x4f804b]
cmp al, 0x41
jne 0x4a09e8
call fcn.0047c790
call fcn.004331e0
cmp dword [0x4d76f8], ebp
je 0x4a0a04
mov ecx, dword [0x4d76f0]
push ecx
call fcn.004a4d4f
add esp, 4
mov esi, dword [0x4d7b70]
mov dword [0x51e160], ebp
mov dword [0x51e164], ebp
mov dword [0x51e168], ebp
mov dword [0x51e16c], ebp
mov dword [esp + 0x1c], ebp
cmp esi, ebp
je 0x4a0bf8
cmp dword [esi + 0x50], ebp
je 0x4a0bed
mov eax, dword [esi + 0x38]
push 0x400
lea edx, [esp + 0x25cc]
push edx
push eax
call fcn.00452c80
cmp byte [0x4f6611], 0
je 0x4a0a72
mov ecx, dword [esi + 0x38]
push ecx
call fcn.004a0380
test al, 0x20
jne 0x4a0a72
mov dword [esi + 0x50], ebp
mov dword [esi + 0x54], 1
jmp 0x4a0bed
mov edx, dword [esi + 0x14]
add dword [0x51e168], edx
adc dword [0x51e16c], ebp
cmp byte [0x4f804b], 0x44
je 0x4a0be9
mov eax, dword [esi + 0x38]
push ebp
push ebp
push eax
call fcn.0047c560
mov edx, dword [0x51e170]
mov ecx, dword [0x51e174]
cmp eax, ebp
je 0x4a0acc
cmp eax, edx
jb 0x4a0acc
cmp ecx, ebp
je 0x4a0ab5
cmp eax, ecx
jae 0x4a0acc
cmp byte [0x4f6615], 0
jne 0x4a0ac7
cmp byte [0x4f6614], 0
je 0x4a0b07
cmp eax, dword [esi + 8]
ja 0x4a0b07
mov dword [esi + 0x50], ebp
cmp eax, ebp
je 0x4a0ae6
cmp eax, edx
jb 0x4a0ae6
cmp ecx, ebp
je 0x4a0adf
cmp eax, ecx
jae 0x4a0ae6
mov eax, 1
jmp 0x4a0ae8
xor eax, eax
mov dword [esi + 0x54], eax
cmp eax, ebp
je 0x4a0bed
mov ecx, dword [esi + 0x14]
sub dword [0x51e168], ecx
sbb dword [0x51e16c], ebp
jmp 0x4a0bed
cmp byte [0x4f804b], 0x44
je 0x4a0be9
mov eax, dword [0x4f65f4]
cmp eax, ebp
je 0x4a0be9
cmp eax, 2
sete bl
cmp eax, 4
jne case.default.0x4a0baf
xor eax, eax
jmp 0x4a0b40
mov cl, byte [esp + eax + 0x25c8]
mov byte [esp + eax + 0x21c8], cl
inc eax
test cl, cl
jne 0x4a0b40
lea edx, [esp + 0x21c8]
push edx
mov edi, 2
call fcn.00451c30
movsx eax, byte [eax]
push eax
call fcn.00451640
test al, al
jne 0x4a0ba7
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x14]
push 7
push ecx
push ebp
push edx
push ebp
lea eax, [esp + 0x21dc]
push eax
call fcn.0040af50
mov edx, dword [str.YNANC]
movsx ecx, al
push ecx
push edx
call fcn.004a4980
sub eax, dword [str.YNANC]
add esp, 8
inc eax
mov edi, eax
lea eax, [edi - 2]
cmp eax, 3
ja case.default.0x4a0baf
jmp dword [eax*4 + 0x4a1ba4]
mov dword [0x4f65f4], 1
jmp case.default.0x4a0baf
mov dword [0x4f65f4], 2
mov dword [esi + 0x50], ebp
jmp 0x4a0bed
push 0xff
mov ecx, 0x4d76b4
call fcn.004296f0
test bl, bl
je 0x4a0be9
mov dword [esi + 0x50], ebp
jmp 0x4a0bed
inc dword [esp + 0x1c]
mov esi, dword [esi + 0x58]
cmp esi, ebp
jne 0x4a0a2e
lea ecx, [esp + 0x193c]
call fcn.0046dbe0
lea ecx, [esp + 0x1960]
call fcn.0046dbe0
lea ecx, [esp + 0x1984]
call fcn.0046dbe0
mov eax, dword [0x4d7704]
mov ecx, dword [0x4d7708]
push eax
mov dword [esp + 0x30], ebp
push ecx
xor ebp, ebp
call fcn.00431720
test al, al
je 0x4a0c69
mov eax, dword [0x4d7704]
mov ecx, dword [0x4d7708]
push ebp
lea edx, [esp + 0xd2c]
push edx
push eax
push ecx
call fcn.00435440
test al, al
je 0x4a0c69
mov edx, dword [esp + 0x1928]
mov ebp, dword [esp + 0x192c]
mov dword [esp + 0x2c], edx
mov esi, dword [0x4d7b78]
test esi, esi
je 0x4a0d9c
jmp 0x4a0c80
mov eax, dword [esi + 0xc]
add dword [0x51e168], eax
adc dword [0x51e16c], 0
mov ecx, dword [esi]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4a0c97
mov edx, dword [esi + 0xc]
sub eax, edi
lea eax, [edx + eax*2 + 0x100]
add dword [esp + 0x2c], eax
adc ebp, 0
test ebp, ebp
jg 0x4a0e39
jl 0x4a0cc9
cmp dword [esp + 0x2c], 0x80000000
jae 0x4a0e39
push 0
push 0
push ecx
call fcn.0047c560
mov ecx, dword [esi]
mov edi, eax
test edi, edi
push ecx
sete bl
call fcn.00451c30
movsx edx, byte [eax]
push edx
call fcn.00451640
cmp byte [0x4f6611], 0
mov byte [esp + 0x24], al
je 0x4a0d04
mov eax, dword [esi]
push eax
call fcn.004a0380
test al, 0x20
je 0x4a0d65
mov al, byte [0x4f804b]
cmp al, 0x44
je 0x4a0d65
cmp al, 0x41
jne 0x4a0d1a
cmp byte [0x4f6614], 0
jne 0x4a0d65
mov ecx, dword [esp + 0x24]
mov edx, dword [esi]
push 1
push 1
push ecx
push edx
mov ecx, 0x4f2cd0
call fcn.0041c7c0
test al, al
jne 0x4a0d65
test bl, bl
jne 0x4a0d69
cmp edi, dword [0x51e170]
jb 0x4a0d8c
mov eax, dword [0x51e174]
test eax, eax
je 0x4a0d4d
cmp edi, eax
jae 0x4a0d8c
mov eax, dword [0x4d7708]
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.0046a910
test eax, eax
je 0x4a0d8c
mov esi, dword [esi + 0x14]
jmp 0x4a0d94
test bl, bl
je 0x4a0d8c
mov edx, dword [esi + 8]
push edx
call fcn.0046ad80
push eax
push 0x206
call fcn.004612e0
push eax
mov eax, dword [0x4d7704]
push eax
call fcn.00493af0
add esp, 0xc
push esi
call fcn.00433100
mov esi, eax
test esi, esi
jne 0x4a0c80
cmp dword [esp + 0x1c], 0
mov eax, dword [0x4d7b70]
jne 0x4a0eae
cmp dword [0x4d7b78], 0
jne 0x4a0eae
cmp dword [0x4d7b68], 0
jne 0x4a0eae
mov ecx, dword [0x4f663c]
mov edx, dword [0x4d7b64]
mov esi, dword [0x4d7b6c]
test eax, eax
je 0x4a0e01
test ecx, ecx
jne 0x4a0eae
test edx, edx
jne 0x4a0f08
test esi, esi
jne 0x4a0eb7
cmp word [0x4f4ce0], si
jne 0x4a0eb7
cmp byte [0x4f6615], 0
jne 0x4a0ea7
cmp byte [0x4f6614], 0
jne 0x4a0ea7
test eax, eax
jne 0x4a0e5f
test ecx, ecx
jne 0x4a0e2b
test edx, edx
jne 0x4a0e2b
test esi, esi
je 0x4a0e5f
mov edx, dword [0x4d7708]
push edx
push 0xd
jmp 0x4a0840
push 0x3b7
call fcn.004612e0
mov ecx, dword [0x4d7704]
push eax
push ecx
call fcn.00493af0
add esp, 8
push 0x4baa2e
push 5
jmp 0x4a0840
mov al, byte [0x4f804b]
cmp al, 0x41
jne 0x4a0e7b
push 0x340
call fcn.004612e0
push eax
mov eax, dword [0x4d7704]
push eax
jmp 0x4a0e91
cmp al, 0x44
jne 0x4a0e99
push 0x345
call fcn.004612e0
mov ecx, dword [0x4d7704]
push eax
push ecx
call fcn.00493af0
add esp, 8
mov edx, dword [0x4d7708]
push edx
push 0xc
jmp 0x4a0840
push 0
jmp 0x4a194c
cmp dword [0x4d7b64], 0
jne 0x4a0f08
cmp byte [0x4f2ce0], 0
je 0x4a0ecc
test eax, eax
jne 0x4a0ecc
cmp dword [0x4d7700], eax
je 0x4a0f08
mov eax, dword [0x4d7704]
mov ecx, dword [0x4d7708]
push eax
push ecx
call fcn.00431800
cmp dword [0x4d7b70], 0
mov dword [esp + 0x24], eax
jne 0x4a0f10
cmp dword [0x4d7700], 0
jne 0x4a0f10
mov edx, dword [0x4d7704]
mov eax, dword [0x4d7708]
push edx
push eax
call fcn.00431a10
jmp 0x4a0f10
mov dword [esp + 0x24], 0
mov ecx, dword [0x4d7704]
mov edx, dword [0x4d7708]
push ecx
xor edi, edi
xor esi, esi
push edx
mov dword [esp + 0x24], esi
mov dword [0x4d76ec], edi
call fcn.00431720
mov bl, al
cmp dword [0x4d7b70], edi
jne 0x4a0f43
cmp dword [0x4d7700], edi
je 0x4a0f90
mov eax, dword [0x4d7704]
mov ecx, dword [0x4d7708]
push edi
push 0x4baa34
push eax
push ecx
call fcn.00431f10
mov esi, eax
mov dword [0x51e150], eax
mov dword [esp + 0x1c], esi
cmp eax, edi
jne 0x4a0f90
mov edx, dword [0x4d7704]
push edx
push 0x1f5
call fcn.004612e0
push eax
call fcn.00493500
add esp, 8
push 0x4baa2e
push 0xd
jmp 0x4a0840
test bl, bl
je 0x4a0fa1
mov eax, dword [0x4d7708]
push eax
call fcn.00433670
jmp 0x4a0fb0
mov ecx, dword [0x4d7708]
push ecx
call fcn.004b5140
add esp, 4
mov dword [0x51e15c], eax
cmp eax, edi
je 0x4a082f
test bl, bl
jne 0x4a102f
mov ecx, dword [0x4d7704]
cmp ecx, edi
je 0x4a102f
push ecx
call fcn.004a6cf1
mov ecx, eax
add esp, 4
mov dword [0x51e158], ecx
cmp ecx, edi
je 0x4a082f
mov eax, dword [0x51e15c]
push edi
push 0x4bae08
push ecx
push eax
call fcn.00431f10
mov dword [esp + 0x28], eax
mov dword [0x51e154], eax
cmp eax, edi
jne 0x4a1037
mov edx, dword [0x51e15c]
push edx
call fcn.0046ad80
push eax
push 0x1f6
call fcn.004612e0
push eax
call fcn.00493500
add esp, 8
push 0x4baa2e
push 0xa
jmp 0x4a0840
mov ecx, dword [0x51e158]
jmp 0x4a0fe9
mov ecx, dword [0x4d7700]
cmp ecx, edi
je 0x4a106b
push ecx
push eax
push esi
call fcn.00433750
cmp eax, edi
je 0x4a1065
mov ecx, dword [0x51e15c]
cmp eax, 0xa
je 0x4a105e
mov ecx, dword [0x4d7708]
push ecx
push eax
jmp 0x4a0840
mov ecx, dword [0x4d7700]
mov al, byte [0x4f804b]
mov dword [0x4d76ec], ecx
mov dword [esp + 0x2c], edi
cmp al, 0x41
jne 0x4a10a2
cmp dword [0x4d7b70], edi
mov edx, dword [0x4d7704]
setne al
movzx ecx, al
mov eax, dword [0x4d7708]
push ecx
push edx
push eax
call fcn.00409cf0
mov al, byte [0x4f804b]
mov esi, dword [0x4d7b70]
mov dword [esp + 0x14], 0x4d7b70
cmp esi, edi
je 0x4a1421
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x28]
jmp 0x4a10c7
mov al, byte [0x4f804b]
mov ebx, 1
cmp dword [esi + 0x50], ebx
jne 0x4a11d0
cmp al, 0x41
jne 0x4a114d
mov ecx, dword [esi + 0x4c]
push 0
push 0
push ebx
push 0
push ecx
call fcn.00409d20
push ebp
push esi
call fcn.004a4270
test eax, eax
je 0x4a1102
cmp eax, 0x12
je 0x4a1110
cmp eax, 0xffffffff
jne 0x4a14cd
cmp eax, 0x12
je 0x4a1110
cmp eax, 0xffffffff
jne 0x4a1410
mov edx, dword [esi + 0x4c]
mov eax, dword [0x4d7704]
mov ecx, dword [0x4d7708]
push 0
push edx
push eax
push ecx
mov ecx, 0x4d76b4
mov dword [esp + 0x3c], ebx
call fcn.00429460
mov edx, dword [esp + 0x1c]
push ebp
push edx
push esi
call fcn.004a26c0
test eax, eax
jne 0x4a09cf
mov dword [esi + 0x50], eax
jmp 0x4a1410
cmp byte [0x4eac4c], 0
jne 0x4a1421
mov eax, dword [esi + 0x4c]
push 0
push 0
push eax
call fcn.0040ab00
mov ecx, dword [esi + 0x48]
mov ebx, dword [esi + 0x58]
push ecx
call fcn.004a4d4f
mov edx, dword [esi + 0x4c]
push edx
call fcn.004a4d4f
add esp, 8
cmp dword [esi + 0x1c], 0
je 0x4a1191
mov eax, dword [esi + 0x3c]
push eax
call fcn.004a4d4f
add esp, 4
cmp dword [esi + 0x20], 0
je 0x4a11a8
mov eax, dword [esi + 0x40]
cmp eax, dword [esi + 0x3c]
je 0x4a11a8
push eax
call fcn.004a4d4f
add esp, 4
cmp dword [esi + 0x24], 0
je 0x4a11ba
mov ecx, dword [esi + 0x44]
push ecx
call fcn.004a4d4f
add esp, 4
push esi
call fcn.004a4d4f
add esp, 4
mov dword [edi], ebx
dec dword [0x4d76f8]
jmp 0x4a1417
cmp byte [0x4eac4c], 0
jne 0x4a1421
cmp al, 0x44
jne 0x4a11ed
mov edx, dword [esi + 0x4c]
push ebx
push 0
push edx
call fcn.0040ab00
cmp dword [0x4d7b68], 0
mov edi, dword [0x4d7b64]
je 0x4a13f6
lea ecx, [esp + 0x40]
call fcn.004021e0
mov dword [esp + 0x2dd4], 0
push 0xce8
lea eax, [esp + 0x44]
push 0
push eax
call fcn.004a5410
mov ecx, dword [esi + 0x48]
add esp, 0xc
push ecx
call fcn.00451c30
movsx edx, byte [eax]
push edx
call fcn.00451640
mov ecx, dword [esi + 0x48]
mov byte [esp + 0x22], al
push 0x3ff
lea eax, [esp + 0x74]
push eax
push ecx
call fcn.00452c80
lea edx, [esp + 0x25c8]
push edx
lea eax, [esp + 0x74]
push eax
call sub.USER32.dll_CharToOemA
lea ecx, [esp + 0x21c8]
push ecx
lea edx, [esp + 0x25cc]
push edx
call sub.USER32.dll_OemToCharA
lea ecx, [esp + 0x21c8]
lea eax, [esp + 0x70]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4a12a3
test dl, dl
je 0x4a129f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4a12a3
add eax, 2
add ecx, 2
test dl, dl
jne 0x4a1283
xor eax, eax
jmp 0x4a12a8
sbb eax, eax
sbb eax, 0xffffffff
mov bx, word [esi + 4]
test eax, eax
sete byte [esp + 0x23]
shr bx, 0xb
and bl, 1
jne 0x4a12d4
movzx eax, word [esi]
push eax
shr eax, 8
push eax
call fcn.004a1d00
test al, al
je 0x4a12d4
mov byte [esp + 0x1b], 1
jmp 0x4a132b
mov byte [esp + 0x1b], 0
test bl, bl
je 0x4a132b
mov eax, dword [esp + 0x48]
push 0x400
lea ecx, [esp + 0x474]
push ecx
lea edx, [esp + 0x78]
or eax, 0x200
push edx
mov word [esp + 0x54], ax
call fcn.00473420
push 0x3ff
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x478]
xor eax, eax
push edx
mov word [esp + 0xc7a], ax
call fcn.00473250
mov byte [esp + 0x46f], 0
lea eax, [esp + 0x70]
push eax
mov ecx, eax
push ecx
call sub.USER32.dll_CharToOemA
cmp byte [esp + 0x23], 0
jne 0x4a1347
test bl, bl
je 0x4a13e2
lea edx, [esp + 0x40]
push edx
push 0x4f2cd0
call fcn.00454560
test al, al
je 0x4a13e2
cmp byte [esp + 0x22], 0
je 0x4a136f
lea eax, [esp + 0x70]
push eax
call fcn.00452090
push 0x400
push 0
lea ecx, [esp + 0x78]
push ecx
call fcn.00452d10
lea edx, [esp + 0x70]
test bl, bl
je 0x4a13a5
push 0x400
push edx
lea eax, [esp + 0x478]
push eax
call fcn.00473360
mov byte [esp + 0x46f], 0
jmp 0x4a13b0
lea ecx, [esp + 0x70]
push ecx
push edx
call sub.USER32.dll_OemToCharA
cmp byte [esp + 0x1b], 0
je 0x4a13bf
mov eax, 0xb17
mov word [esi], ax
mov ecx, dword [esi + 0x48]
push ecx
call fcn.004a4d4f
lea edx, [esp + 0x74]
push edx
call fcn.004b5140
mov dword [esi + 0x48], eax
add esp, 8
mov dword [0x4d7b64], 3
mov dword [esp + 0x2dd4], 0xffffffff
lea ecx, [esp + 0x40]
call fcn.004017e0
mov eax, dword [esp + 0x1c]
push ebp
push eax
push esi
call fcn.004a26c0
mov dword [0x4d7b64], edi
test eax, eax
jne 0x4a09cf
lea edi, [esi + 0x58]
mov dword [esp + 0x14], edi
mov esi, dword [edi]
test esi, esi
jne 0x4a10c2
mov edi, dword [0x4d7b78]
test edi, edi
je 0x4a153d
xor ebx, ebx
cmp byte [0x4eac4c], 0
jne 0x4a153d
push 0x5c
call fcn.004a4c8c
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4a082f
mov dword [esi + 0x58], ebx
mov ecx, dword [edi]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 4]
mov dword [edi], ebx
lea ebp, [esi + 0x58]
push ebx
mov dword [esi + 0x48], edx
mov eax, dword [edi + 8]
mov dword [edi + 4], ebx
push ebx
mov dword [esi + 0x4c], eax
mov dword [edi + 8], ebx
mov ecx, dword [esi + 0x4c]
push ebx
push ebx
push ecx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x50], 1
call fcn.00409d20
mov edx, dword [esp + 0x28]
push edx
push esi
call fcn.004a4270
cmp eax, ebx
je 0x4a14b1
cmp eax, 0x12
je 0x4a14e5
cmp eax, 0xffffffff
jne 0x4a15a1
cmp eax, 0x12
je 0x4a14e5
cmp eax, 0xffffffff
je 0x4a14e5
mov eax, dword [esp + 0x14]
mov dword [eax], esi
inc dword [0x4d76f8]
mov dword [esp + 0x14], ebp
jmp 0x4a152d
cmp byte [0x4eac4c], 0
jne 0x4a1421
push 0x4baa2e
push eax
jmp 0x4a0840
mov ecx, dword [esi + 0x4c]
mov edx, dword [0x4d7704]
mov eax, dword [0x4d7708]
push ebx
push ecx
push edx
push eax
mov ecx, 0x4d76b4
mov dword [esp + 0x3c], 1
call fcn.00429460
mov ecx, dword [esi + 0x38]
push ecx
call fcn.004a4d4f
mov edx, dword [esi + 0x48]
push edx
call fcn.004a4d4f
mov eax, dword [esi + 0x4c]
push eax
call fcn.004a4d4f
push esi
call fcn.004a4d4f
add esp, 0x10
push edi
call fcn.00433100
mov edi, eax
cmp edi, ebx
jne 0x4a1431
cmp word [0x4f4ce0], 0
je 0x4a1718
cmp dword [0x4d7b64], 0
jne 0x4a1718
push 0
push 0x4baa34
push 0x4f4ce0
call fcn.00432010
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
jne 0x4a15b5
mov ecx, dword [0x4d7704]
mov edx, dword [0x4d7708]
push 0x4f4ce0
push 0x4f48e0
push ecx
push edx
mov ecx, 0x4d76b4
call fcn.00429460
push 0x4baa2e
push 0x12
jmp 0x4a0840
cmp byte [0x4eac4c], 0
jne 0x4a153d
push 0x4d7710
push eax
jmp 0x4a0840
cmp dword [0x4d76f4], 0
je 0x4a15cc
mov eax, dword [0x4d7b74]
push eax
call fcn.004a4d4f
add esp, 4
push 0x8000
call fcn.004a4c8c
add esp, 4
mov dword [0x4d7b74], eax
test eax, eax
je 0x4a082f
push esi
push 0x7fff
push 1
push eax
call fcn.004a68d2
mov ecx, dword [0x4d7b74]
mov dword [0x4d76f4], eax
add esp, 0x10
mov byte [ecx + eax], 0
cmp dword [0x4f54e0], 2
jne 0x4a161c
mov eax, dword [0x4d7b74]
push eax
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [0x4f54e0], 3
jne 0x4a170b
mov ebp, dword [0x4d7b74]
mov al, byte [ebp]
cmp al, 0xff
jne 0x4a1643
cmp byte [ebp + 1], 0xfe
jne 0x4a1643
mov edi, 1
jmp 0x4a1645
xor edi, edi
cmp al, 0xfe
jne 0x4a1656
cmp byte [ebp + 1], 0xff
jne 0x4a1656
mov ebx, 1
jmp 0x4a1658
xor ebx, ebx
mov edx, dword [0x4d76f4]
inc edx
push edx
lea ecx, [esp + 0x38]
call fcn.0040b630
mov dword [esp + 0x2dd4], 1
xor edx, edx
lea ecx, [edx + 2]
test edi, edi
jne 0x4a1686
test ebx, ebx
jne 0x4a1686
lea edi, [edx + 1]
xor ecx, ecx
mov esi, dword [esp + 0x34]
cmp ecx, dword [0x4d76f4]
jae 0x4a16c8
lea eax, [ecx + ebx]
add eax, ebp
sub edi, ebx
lea esp, [esp]
movzx bx, byte [edi + eax]
mov ebp, pe_nt_image_headers32
imul bx, bp
movzx bp, byte [eax]
add bx, bp
mov word [esi + edx*2], bx
add ecx, 2
inc edx
add eax, 2
cmp ecx, dword [0x4d76f4]
jb 0x4a16a0
xor eax, eax
mov word [esi + edx*2], ax
mov ecx, dword [0x4d76f4]
mov edx, dword [0x4d7b74]
dec ecx
push ecx
push edx
push esi
call fcn.00473250
mov eax, dword [0x4d76f4]
mov ecx, dword [0x4d7b74]
mov byte [ecx + eax - 1], 0
mov dword [esp + 0x2dd4], 0xffffffff
test esi, esi
je 0x4a170b
push esi
call fcn.004a4d4f
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call fcn.004a6c75
add esp, 4
mov esi, dword [0x4d7b70]
mov eax, dword [0x4d76ec]
xor ebp, ebp
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov edi, eax
cmp esi, ebp
je 0x4a17f9
mov ebp, dword [esp + 0x28]
cmp dword [0x4d7b64], 0
jne 0x4a1827
mov eax, 0x800
test word [esi + 4], ax
jne 0x4a1827
movzx eax, word [esi]
push eax
shr eax, 8
push eax
call fcn.004a1d00
test al, al
je 0x4a1827
mov ecx, dword [esi + 0x48]
push 0x400
push ecx
lea edx, [esp + 0x25d0]
push edx
mov bl, 1
call fcn.0046abc0
mov eax, dword [esi + 0x48]
push eax
push eax
call sub.USER32.dll_CharToOemA
push ebp
push esi
call fcn.004a22c0
test eax, eax
jne 0x4a182e
test bl, bl
je 0x4a17ba
mov edx, dword [esi + 0x48]
lea ecx, [esp + 0x25c8]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4a17b0
mov eax, dword [esi + 0x24]
add eax, dword [esi + 0x20]
mov ecx, dword [0x4d76ec]
add eax, dword [esi + 0x18]
cmp byte [esp + 0x14], 0
lea edx, [ecx + eax + 0x2e]
mov dword [0x4d76ec], edx
jne 0x4a17df
call fcn.00447090
mov esi, dword [esi + 0x58]
inc dword [esp + 0x14]
test esi, esi
jne 0x4a1739
mov ebx, dword [esp + 0x14]
mov eax, dword [0x4d76ec]
xor ebp, ebp
mov esi, dword [esp + 0x28]
mov edx, dword [0x4d7b74]
mov ecx, dword [0x4d76f4]
push esi
push edx
push ecx
push edi
sub eax, edi
push eax
push ebx
call fcn.004a2580
cmp eax, ebp
je 0x4a183b
mov edx, dword [0x51e15c]
push edx
push eax
jmp 0x4a0840
xor bl, bl
jmp 0x4a178c
mov ecx, dword [0x51e15c]
push ecx
push eax
jmp 0x4a0840
push esi
mov dword [0x51e154], ebp
call fcn.004a6c75
add esp, 4
test eax, eax
je 0x4a185b
mov eax, dword [0x51e15c]
push eax
push 0xa
jmp 0x4a0840
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x4a186c
push eax
call fcn.004a6c75
add esp, 4
call fcn.00421d70
cmp byte [0x4eac4c], 0
je 0x4a1980
mov ecx, dword [0x51e158]
mov edx, dword [0x51e15c]
push ecx
push edx
call fcn.00431a10
mov edx, dword [0x51e15c]
push edx
call fcn.004a4d4f
mov eax, dword [0x51e158]
add esp, 4
mov dword [0x51e15c], ebp
cmp eax, ebp
je 0x4a18b8
push eax
call fcn.004a4d4f
add esp, 4
mov dword [0x51e158], ebp
cmp ebx, ebp
jne 0x4a18d4
mov eax, dword [0x4d7704]
mov ecx, dword [0x4d7708]
push eax
push ecx
call fcn.00431a10
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x4a18f4
cmp eax, 0xffffffff
je 0x4a18f4
mov edx, dword [0x4d7704]
push eax
mov eax, dword [0x4d7708]
push edx
push eax
call fcn.00431830
cmp byte [0x4f6610], 0
je 0x4a1940
mov esi, dword [0x4d7b70]
cmp esi, ebp
je 0x4a1940
mov edi, 1
lea esp, [esp]
cmp dword [esi + 0x50], edi
je 0x4a191a
cmp dword [esi + 0x54], ebp
je 0x4a1939
mov ecx, dword [esi + 0x38]
push ecx
call fcn.004a0380
cmp eax, 0xffffffff
je 0x4a1939
test al, 0x20
je 0x4a1939
mov edx, dword [esi + 0x38]
and eax, 0xffffffdf
push eax
push edx
call fcn.004a0410
mov esi, dword [esi + 0x58]
cmp esi, ebp
jne 0x4a1910
mov eax, dword [esp + 0x2c]
neg eax
sbb eax, eax
and eax, 0x12
push eax
lea ecx, [esp + 0xd2c]
call fcn.004a04b0
mov ecx, dword [esp + 0x2dcc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2db4]
xor ecx, esp
call fcn.004a4bb3
add esp, 0x2dc4
ret
cmp dword [0x4d7b64], ebp
je 0x4a1ac6
mov eax, dword [str.rebuilt.]
mov ecx, dword [0x4bde8c]
mov dl, byte [0x4bde90]
mov dword [esp + 0x21c8], eax
mov eax, dword [0x4d7708]
push eax
mov dword [esp + 0x21d0], ecx
mov byte [esp + 0x21d4], dl
call fcn.00451b50
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a19c0
lea edi, [esp + 0x21c8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4a19d1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
lea ecx, [esp + 0x21cc]
push ecx
call fcn.00452bf0
push ebp
lea edx, [esp + 0x21cc]
push edx
call fcn.00431720
test al, al
je 0x4a1a48
push ebp
push ebp
push 0x7fffffff
push 0x7fffffff
push ebp
lea eax, [esp + 0x21dc]
push eax
call fcn.0040af50
cmp al, 0x4e
je 0x4a1aa7
cmp al, 0x43
je 0x4a1aa7
push ebp
push ebp
lea ecx, [esp + 0x21d0]
push ecx
call fcn.00431830
lea edx, [esp + 0x21c8]
push edx
call fcn.004329f0
cmp byte [esp + 0x21c8], 0
je 0x4a1891
mov eax, dword [0x51e15c]
push ebp
lea edx, [esp + 0x21cc]
push edx
push ebp
push eax
call fcn.00431930
test al, al
jne 0x4a1891
lea ecx, [esp + 0x21c8]
push ecx
call fcn.0046ad80
mov edx, dword [0x51e15c]
push eax
push edx
call fcn.0046ad80
push eax
push 0x207
call fcn.004612e0
push eax
push ebp
call fcn.00493af0
add esp, 0x10
jmp 0x4a1891
mov eax, dword [0x51e158]
mov ecx, dword [0x51e15c]
push eax
push ecx
call fcn.00431a10
mov byte [esp + 0x21c8], 0
jmp 0x4a1891
mov eax, dword [0x51e15c]
mov ecx, dword [0x4d7704]
mov edx, dword [0x4d7708]
push eax
push ecx
push edx
call fcn.00433850
mov esi, eax
cmp esi, ebp
je 0x4a1891
mov eax, dword [0x4d7704]
mov ecx, dword [0x51e15c]
push eax
push ecx
call fcn.0046ad80
push eax
push 0x207
call fcn.004612e0
push eax
push ebp
call fcn.00493af0
mov edx, dword [0x4d7708]
add esp, 0x10
push ebp
push edx
mov ecx, 0x4d76b4
call fcn.004297c0
cmp esi, 0xf
jne 0x4a1b4f
mov eax, dword [0x4d7704]
mov ecx, dword [0x4d7708]
push eax
push ecx
call fcn.00431720
test al, al
je 0x4a1b4f
mov edx, dword [0x51e158]
mov eax, dword [0x51e15c]
push edx
push eax
call fcn.00431a10
mov ecx, dword [0x51e15c]
push ecx
call fcn.004a4d4f
mov eax, dword [0x51e158]
add esp, 4
mov dword [0x51e15c], ebp
cmp eax, ebp
je 0x4a1b76
push eax
call fcn.004a4d4f
add esp, 4
push 0x4baa2e
mov dword [0x51e158], ebp
push esi
jmp 0x4a0840