Function at 0x405060
Capabilities:
Parse pe header
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x4522d0]
xor eax, esp
mov dword [esp + 8], eax
push edi
mov edi, dword [esp + 0x14]
push 0x460078
call fcn.004036c0
add esp, 4
test eax, eax
je 0x405d9a
push 0x5c
push 0x460078
call fcn.00415170
add esp, 8
test eax, eax
mov dword [0x460074], eax
je 0x4050bc
add eax, 1
mov edx, 0x4612a8
mov dword [0x460074], eax
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4050b0
cmp dword [0x45fba8], 0
jbe 0x4050d6
add dword [0x45fbac], 1
mov dword [0x45fba8], 0
mov eax, dword [0x45fbac]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1013
push eax
mov dword [0x462634], 0x452020
call esi
mov ecx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push ecx
call esi
mov eax, dword [0x45fbac]
mov edx, dword [0x46162c]
push edx
add eax, 1
push 0
mov dword [0x45fbac], eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1014
push eax
mov dword [0x462634], 0x4520b8
call esi
mov ecx, dword [0x462624]
mov edx, dword [0x45fb58]
push 0
push ecx
push 0x1013
push edx
call esi
mov eax, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push eax
call esi
add dword [0x45fbac], 1
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push 0x460078
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x45360c], eax
jne 0x4051c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x460078
push str.Could_not_create_dump_file:__s_nCreateFile_error__d_n
push 0x4610a8
call fcn.00415641
add esp, 0x10
jmp 0x4051f9
mov ecx, dword [0x461098]
push 4
push 0x3000
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x460f84], eax
jne 0x405215
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4494a4
push 0x4610a8
call fcn.00415641
add esp, 0xc
push 0x1010
push 0x448c14
push 0x4610a8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x405d6b
mov edx, dword [0x4520f8]
mov eax, dword [0x461098]
mov ecx, dword [0x46109c]
push 0x460e84
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x405280
mov edx, dword [0x461098]
mov eax, dword [0x460f84]
push edx
push eax
push str.Unable_to_Set_READONLY_protection_non_Process_for_Createdump_nVM_Address:__08X_nSize:__08X
push 0x4610a8
call fcn.00415641
add esp, 0x10
push 0x1010
push 0x448c14
push 0x4610a8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop edi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00415a83
add esp, 0xc
ret
mov ecx, dword [0x461098]
mov edx, dword [0x460f84]
mov eax, dword [0x46109c]
push 0x460f1c
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [0x452114]
mov edx, dword [0x460f88]
mov eax, dword [0x460f84]
push ecx
push edx
push eax
call fcn.00415d10
mov eax, dword [0x460f84]
mov dword [0x462730], eax
mov dword [0x45bb04], eax
mov ecx, dword [eax + 0x3c]
lea edx, [eax + ecx + 4]
mov dword [0x453610], edx
mov ecx, dword [eax + 0x3c]
lea ecx, [eax + ecx + 0x18]
mov dword [0x4535a4], ecx
mov edx, dword [eax + 0x3c]
lea edx, [eax + edx + 0xf8]
add esp, 0xc
mov dword [0x453618], edx
cmp word [eax], 0x5a4d
je 0x40531d
push 0x449528
push 0x4610a8
call fcn.00415641
push 0x4610a8
call fcn.00403960
add esp, 0xc
jmp 0x405d6b
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x40534a
push 0x449558
push 0x4610a8
call fcn.00415641
push 0x4610a8
call fcn.00403960
add esp, 0xc
jmp 0x405d6b
mov eax, dword [ecx + 0x20]
mov dword [ecx + 0x24], eax
mov ecx, dword [0x453610]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
movzx ebp, word [ecx + 2]
mov ecx, dword [0x453618]
test ecx, ecx
je 0x405551
test ebp, ebp
mov dword [0x45362c], 0
jle 0x4054ef
mov edx, dword [ecx]
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 4]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x18], eax
call fcn.00416d80
add esp, 4
test ebx, ebx
mov edi, eax
je 0x4053f3
push 6
push str..PDATA
push edi
call fcn.00415bc4
add esp, 0xc
test eax, eax
je 0x4053c8
push 5
push str.PDATA
push edi
call fcn.00415bc4
add esp, 0xc
test eax, eax
jne 0x4053f3
mov edx, dword [0x453618]
mov eax, dword [edx + 0xc]
mov ecx, dword [0x460f64]
add eax, dword [0x460f84]
mov edx, dword [0x460f4c]
push ecx
push edx
push eax
mov dword [0x4626fc], eax
call fcn.00415d10
add esp, 0xc
push 6
push str..RDATA
push edi
call fcn.00415bc4
add esp, 0xc
test eax, eax
je 0x40541b
push 5
push str.RDATA
push edi
call fcn.00415bc4
add esp, 0xc
test eax, eax
jne 0x405429
mov eax, dword [0x453618]
mov ecx, dword [0x4626cc]
mov dword [eax + 0x24], ecx
mov edi, dword [0x453618]
mov eax, dword [edi + 0xc]
mov edx, dword [0x4535a4]
mov ecx, dword [edx + 0x20]
lea eax, [eax + ecx - 1]
xor edx, edx
div ecx
imul eax, ecx
mov dword [edi + 0xc], eax
mov edi, dword [0x453618]
mov edx, dword [edi + 8]
mov ecx, dword [0x4535a4]
mov ecx, dword [ecx + 0x20]
lea eax, [edx + ecx - 1]
xor edx, edx
div ecx
imul eax, ecx
mov dword [edi + 8], eax
mov edi, dword [0x453618]
mov edx, dword [edi + 0xc]
mov eax, dword [0x4535a4]
mov ecx, dword [eax + 0x20]
lea eax, [edx + ecx - 1]
xor edx, edx
div ecx
imul eax, ecx
mov dword [edi + 0x14], eax
mov edi, dword [0x453618]
mov edx, dword [edi + 8]
mov eax, dword [0x4535a4]
mov ecx, dword [eax + 0x20]
lea eax, [edx + ecx - 1]
xor edx, edx
div ecx
imul eax, ecx
mov dword [edi + 0x10], eax
mov eax, dword [0x453618]
mov ecx, dword [eax + 0xc]
add ecx, dword [eax + 8]
mov edx, dword [0x4535a4]
mov dword [edx + 0x38], ecx
mov edi, dword [0x4535a4]
mov eax, dword [edi + 0x38]
mov ecx, dword [0x453618]
mov dword [0x461098], eax
mov eax, dword [0x45362c]
add eax, 1
add ecx, 0x28
cmp eax, ebp
mov dword [0x453618], ecx
mov dword [0x45362c], eax
jl 0x405380
jmp 0x4054f5
mov edi, dword [0x4535a4]
mov eax, dword [0x4626a0]
test eax, eax
je 0x40550d
sub eax, dword [0x462718]
mov dword [edi + 0x14], eax
mov edi, dword [0x4535a4]
mov eax, dword [0x4626a4]
test eax, eax
je 0x40552d
mov ecx, dword [edi + 0x20]
lea eax, [eax + ecx - 1]
xor edx, edx
div ecx
imul eax, ecx
mov dword [edi + 4], eax
mov edi, dword [0x4535a4]
mov eax, dword [0x462704]
test eax, eax
je 0x405545
sub eax, dword [0x462718]
mov dword [edi + 0x18], eax
mov edi, dword [0x4535a4]
mov eax, dword [0x462720]
test eax, eax
je 0x405551
mov dword [edi + 0x10], eax
mov ecx, dword [0x45360c]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push ecx
call edi
mov edx, dword [0x461098]
mov eax, dword [0x460f84]
mov ecx, dword [0x45360c]
push 0
push 0x460f20
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x461098]
mov eax, dword [0x45360c]
push 0
push 0
push edx
push eax
call edi
mov ecx, dword [0x45360c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [0x45fbac]
mov edx, dword [0x45fb58]
push 0
push eax
push 0x1013
push edx
mov dword [0x462634], 0x4495a0
mov dword [0x462624], eax
call esi
mov eax, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push eax
call esi
push 0x4612a8
push str.Saved_to:__s
mov ebp, 0x45fbb0
mov edi, 1
add dword [0x45fbac], edi
push ebp
call fcn.00415641
mov eax, dword [0x45fbac]
mov ecx, dword [0x45fb58]
add esp, 0xc
push 0
push eax
push 0x1013
push ecx
mov dword [0x462634], ebp
mov dword [0x462624], eax
call esi
mov edx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push edx
call esi
add dword [0x45fbac], edi
test ebx, ebx
jne 0x405d69
mov ecx, dword [0x46162c]
mov edx, dword [0x45fb58]
mov eax, dword [0x45fbac]
push ecx
push ebx
push 0x1014
mov edi, 0x452020
push edx
mov dword [0x462634], edi
mov dword [0x462624], eax
call esi
mov eax, dword [0x462624]
mov ecx, dword [0x45fb58]
push ebx
push eax
push 0x1013
push ecx
call esi
mov edx, dword [0x45fb58]
push 0x462620
push ebx
push 0x1007
push edx
call esi
mov eax, dword [0x45fbac]
push 0
mov ebx, 1
add eax, ebx
push eax
mov dword [0x45fbac], eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1013
push eax
mov dword [0x462634], 0x4495bc
call esi
mov ecx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push ecx
call esi
mov eax, dword [0x45fbac]
add eax, ebx
cmp dword [0x461598], 0
mov dword [0x45fbac], eax
je 0x4057e2
cmp dword [0x461604], 0
mov edx, dword [0x462578]
mov dword [0x462724], edx
je 0x4057d6
push 0
push eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1013
push eax
mov dword [0x462634], 0x4495d4
call esi
mov ecx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push ecx
call esi
add dword [0x45fbac], ebx
call fcn.00404e90
test eax, eax
mov dword [0x4619d4], eax
jne 0x4058cd
push 0x4619e0
push 0x460078
call dword [0x414ffc]
test eax, eax
mov dword [0x4619d4], eax
jbe 0x405788
mov edx, dword [0x46154c]
push edx
call fcn.00404fc0
jmp 0x4058c5
push 0x4495ec
push ebp
call fcn.00415641
mov eax, dword [0x45fbac]
add esp, 8
push 0
push eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1013
push eax
mov dword [0x462634], ebp
call esi
mov ecx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push ecx
call esi
add dword [0x45fbac], ebx
jmp 0x4058cd
mov edx, dword [0x46154c]
push edx
jmp 0x4058c0
cmp dword [0x461604], 0
mov ecx, dword [0x462518]
mov dword [0x462724], ecx
je 0x4058b9
mov edx, dword [0x45fb58]
push 0
push eax
push 0x1013
push edx
mov dword [0x462634], 0x449614
mov dword [0x462624], eax
call esi
mov eax, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push eax
call esi
add dword [0x45fbac], ebx
call fcn.00404e90
test eax, eax
mov dword [0x4619d4], eax
jne 0x4058cd
push 0x4619e0
push 0x460078
call dword [0x414ffc]
test eax, eax
mov dword [0x4619d4], eax
jbe 0x40586e
mov ecx, dword [0x462504]
push ecx
call fcn.00404fc0
jmp 0x4058c5
push str.function:_GetNameFileOptimized_Error_
push ebp
call fcn.00415641
mov eax, dword [0x45fbac]
mov edx, dword [0x45fb58]
add esp, 8
push 0
push eax
push 0x1013
push edx
mov dword [0x462634], ebp
mov dword [0x462624], eax
call esi
mov eax, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push eax
call esi
add dword [0x45fbac], ebx
jmp 0x4058cd
mov ecx, dword [0x462504]
push ecx
call fcn.00405000
mov dword [0x4619c8], eax
add esp, 4
mov eax, dword [0x45fbac]
mov edx, dword [0x45fb58]
push 0
push eax
push 0x1013
push edx
mov dword [0x462634], 0x449654
mov dword [0x462624], eax
call esi
mov eax, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push eax
call esi
mov ecx, dword [0x4619c8]
add dword [0x45fbac], ebx
push ecx
push str.Return_code:__X
push ebp
call fcn.00415641
mov eax, dword [0x45fbac]
mov edx, dword [0x45fb58]
add esp, 0xc
push 0
push eax
push 0x1013
push edx
mov dword [0x462634], ebp
mov dword [0x462624], eax
call esi
mov eax, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push eax
call esi
add dword [0x45fbac], ebx
push 0x461970
push 0x449684
push ebp
call fcn.00415641
mov eax, dword [0x45fbac]
mov ecx, dword [0x45fb58]
add esp, 0xc
push 0
push eax
push 0x1013
push ecx
mov dword [0x462634], ebp
mov dword [0x462624], eax
call esi
mov edx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push edx
call esi
mov eax, dword [0x45fbac]
add eax, ebx
push 0
push eax
mov dword [0x45fbac], eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1013
push eax
mov dword [0x462634], edi
call esi
mov ecx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push ecx
call esi
mov edx, dword [0x4619c0]
add dword [0x45fbac], ebx
push edx
push str.IAT_RVA:__08X
push ebp
call fcn.00415641
mov eax, dword [0x45fbac]
add esp, 0xc
push 0
push eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1013
push eax
mov dword [0x462634], ebp
call esi
mov ecx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push ecx
call esi
mov edx, dword [0x4619c4]
add dword [0x45fbac], ebx
push edx
push str.IAT_Size:__08X
push ebp
call fcn.00415641
mov eax, dword [0x45fbac]
add esp, 0xc
push 0
push eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1013
push eax
mov dword [0x462634], ebp
call esi
mov ecx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push ecx
call esi
mov edx, dword [0x462724]
add dword [0x45fbac], ebx
push edx
push str.OEP_VA:__08X
push ebp
call fcn.00415641
mov eax, dword [0x45fbac]
add esp, 0xc
push 0
push eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1013
push eax
mov dword [0x462634], ebp
call esi
mov ecx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push ecx
call esi
mov edx, dword [0x462720]
add dword [0x45fbac], ebx
push edx
push str.OEP_RVA:__08X
push ebp
call fcn.00415641
mov eax, dword [0x45fbac]
add esp, 0xc
push 0
push eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1013
push eax
mov dword [0x462634], ebp
call esi
mov ecx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push ecx
call esi
mov eax, dword [0x460f68]
add dword [0x45fbac], ebx
test eax, eax
jbe 0x405c49
push eax
push str.OEP_call_return_VA:__08X
push ebp
call fcn.00415641
mov eax, dword [0x46162c]
mov ecx, dword [0x45fb58]
mov edx, dword [0x45fbac]
add esp, 0xc
push eax
push 0
push 0x1014
push ecx
mov dword [0x462634], ebp
mov dword [0x462624], edx
call esi
mov edx, dword [0x462624]
mov eax, dword [0x45fb58]
push 0
push edx
push 0x1013
push eax
call esi
mov ecx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push ecx
call esi
add dword [0x45fbac], ebx
cmp dword [0x462728], 0
jbe 0x405c49
mov edx, dword [0x46272c]
push edx
push str.DELPHI_OEP_VA:__08X
push ebp
call fcn.00415641
mov eax, dword [0x45fbac]
add esp, 0xc
push 0
push eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1013
push eax
mov dword [0x462634], ebp
call esi
mov ecx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push ecx
call esi
mov edx, dword [0x462728]
add dword [0x45fbac], ebx
push edx
push str.DELPHI_OEP_RVA:__08X
push ebp
call fcn.00415641
mov eax, dword [0x45fbac]
add esp, 0xc
push 0
push eax
mov dword [0x462624], eax
mov eax, dword [0x45fb58]
push 0x1013
push eax
mov dword [0x462634], ebp
call esi
mov ecx, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push ecx
call esi
add dword [0x45fbac], ebx
cmp dword [0x4615e8], 0
je 0x405d69
push ebp
push 0x460078
call dword [0x415018]
push 0x20
push 0x45fbd3
mov dword [0x4619d4], eax
sub ebx, ebp
call fcn.004150b0
push 0x50
mov edi, eax
push 0
push 0x4612a8
add edi, ebx
call fcn.00415c90
push edi
push ebp
push 0x4612a8
call fcn.00415aa0
mov eax, dword [0x45fbac]
mov edx, dword [0x45fb58]
add esp, 0x20
push 0
push eax
push 0x1013
push edx
mov dword [0x462634], 0x4612a8
mov dword [0x462624], eax
call esi
mov eax, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push eax
call esi
add dword [0x45fbac], 1
push 0x50
push 0
push 0x4612a8
call fcn.00415c90
add esp, 0xc
cmp dword [0x4619d4], 0
jne 0x405d03
push 0x5c
push 0x45fbd3
call fcn.00415170
mov edi, eax
add esp, 8
add edi, ebx
lea eax, [ebp + 1]
mov cl, byte [ebp]
add ebp, 1
test cl, cl
jne 0x405d06
sub ebp, eax
sub ebp, edi
push ebp
lea ecx, [edi + 0x45fbb0]
push ecx
push 0x4612a8
call fcn.00415aa0
mov eax, dword [0x45fbac]
mov edx, dword [0x45fb58]
add esp, 0xc
push 0
push eax
push 0x1013
push edx
mov dword [0x462634], 0x4612a8
mov dword [0x462624], eax
call esi
mov eax, dword [0x45fb58]
push 0x462620
push 0
push 0x1007
push eax
call esi
add dword [0x45fbac], 1
pop ebp
pop ebx
mov eax, dword [0x45360c]
test eax, eax
je 0x40526f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov dword [0x45360c], 0
pop edi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00415a83
add esp, 0xc
ret
mov ecx, dword [esp + 0xc]
pop edi
xor ecx, esp
mov dword [0x460078], 0
call fcn.00415a83
add esp, 0xc
ret