Function at 0x49bcb0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
sub esp, 0x3c
test eax, eax
push ebx
push esi
push edi
jne 0x49bcd1
mov eax, 0x80004003
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov edi, dword [ebp + 8]
lea esi, [edi - 0x24]
mov dword [eax], 0
mov ebx, 1
mov byte [esp + 0x13], 0
mov dword [esp + 0x24], esi
call fcn.0049a1d0
lea eax, [edi - 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [eax]
test eax, eax
je 0x49bd17
cmp eax, dword [ebp + 0x10]
je 0x49bd17
push 0x507
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
call fcn.0049bb40
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49c073
mov ebx, dword [ebp + 0x10]
mov ecx, dword [esp + 0x14]
cmp dword [ecx], ebx
je 0x49bd3e
call fcn.0049b550
mov byte [esp + 0x13], 1
cmp dword [edi + 0xa8], 0
jne 0x49bd67
mov edx, dword [esp + 0x14]
push edx
call fcn.0049c080
test eax, eax
je 0x49bd59
push 0xf
jmp 0x49bd5b
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [edi + 0xa8], eax
mov eax, dword [ebp + 0x24]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x18]
push eax
lea edx, [esp + 0x16]
mov ecx, esi
mov byte [esp + 0x16], 0
call fcn.0049c0f0
mov ebx, eax
add esp, 4
test ebx, ebx
jl 0x49bda3
mov ecx, dword [ebp + 0x14]
mov esi, dword [esp + 0x24]
push ecx
mov edx, edi
mov eax, dword [edx]
push 0
push eax
call fcn.0049b5b0
mov esi, dword [ebp + 0xc]
mov ebx, eax
test ebx, ebx
mov eax, dword [ebp + 0x1c]
mov edx, dword [eax]
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x5c]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
jl 0x49c040
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
test eax, eax
je 0x49bde5
mov edx, dword [ebp + 0x20]
test edx, edx
je 0x49bde5
add edi, 0x70
push edi
push ecx
push edx
call fcn.0049c340
cmp byte [esp + 0x12], 0
je 0x49c033
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
je 0x49c033
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push edx
call edi
test eax, 0x300000
jne 0x49be20
mov eax, dword [ebp + 8]
or dword [eax + 0xbc], 8
jmp 0x49be55
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push 0xfffffffffffffff0
push ecx
call edi
mov edi, dword [esp + 0x14]
mov edx, dword [edi]
and eax, 0xffcfffff
push eax
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [edi]
push 0x37
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp + 0x18]
mov edi, dword [ecx]
test edi, edi
mov dword [esp + 0x1c], edi
je 0x49be6a
mov edx, dword [edi]
mov eax, dword [edx + 4]
push edi
call eax
movzx eax, word [esi]
cmp ax, 0x4d
je 0x49be7d
cmp ax, 0x6d
jne 0x49bfa0
movzx eax, word [esi + 2]
cmp ax, 0x53
je 0x49be91
cmp ax, 0x73
jne 0x49bfa0
movzx eax, word [esi + 4]
cmp ax, 0x48
je 0x49bea5
cmp ax, 0x68
jne 0x49bfa0
movzx eax, word [esi + 6]
cmp ax, 0x54
je 0x49beb9
cmp ax, 0x74
jne 0x49bfa0
movzx eax, word [esi + 8]
cmp ax, 0x4d
je 0x49becd
cmp ax, 0x6d
jne 0x49bfa0
movzx eax, word [esi + 0xa]
cmp ax, 0x4c
je 0x49bee1
cmp ax, 0x6c
jne 0x49bfa0
cmp word [esi + 0xc], 0x3a
jne 0x49bfa0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax - 0xe]
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x49bf96
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp + 0xc]
push eax
add ecx, 0xe
mov eax, edi
mov edx, edi
call fcn.0040fdb0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [esp + 0x20]
push ecx
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ebx, eax
test ebx, ebx
jl 0x49bf8d
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x18]
push ecx
push 0x59d95c
push eax
mov dword [esp + 0x24], 0
call edx
mov ebx, eax
test ebx, ebx
jl 0x49bf7d
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov ebx, eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x49bf8d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x20]
jmp 0x49c017
mov ebx, 0x8007000e
jmp 0x49c023
mov eax, dword [edi]
mov edx, dword [eax]
lea ecx, [esp + 0x18]
push ecx
push 0x59d9bc
push edi
mov dword [esp + 0x24], 0
call edx
cmp dword [esp + 0x18], 0
je 0x49c027
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, esi
lea esi, [esp + 0x38]
call fcn.0049c3e0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa4]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push edx
push edx
push edx
mov edx, esi
push edx
push eax
mov eax, dword [ecx + 0xd0]
call eax
mov ecx, esi
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push ecx
call esi
lea edx, [esp + 0x28]
push edx
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x49c023
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x49c033
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push edi
call ecx
test ebx, ebx
jl 0x49c040
mov edx, dword [ebp + 8]
cmp dword [edx + 0x3c], 0
jne 0x49c073
mov esi, dword [esp + 0x24]
call fcn.0049a1d0
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
test eax, eax
je 0x49c073
push 0x507
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
test ebx, ebx
jge 0x49c073
cmp byte [esp + 0x13], 0
je 0x49c073
call fcn.0049bb40
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x20