Function at 0x4934d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov rbx, qword [rcx + 0xf0]
mov r8d, dword [rbx + 0x258]
mov r15, rdx
mov r14, rcx
lea rdx, str._nCharacteristics_0x_x_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov eax, dword [rbx + 0x258]
test al, 1
jne 0x4939f2
test al, 2
jne 0x4939d1
test al, 4
jne 0x4939b0
test al, 8
jne 0x493890
test al, 0x20
jne 0x4938b4
test al, 0x80
jne 0x4938d8
test ah, 1
jne 0x4938fd
test ah, 2
jne 0x493922
test ah, 0x10
jne 0x493947
test ah, 0x20
jne 0x49396c
test ah, 0x80
jne 0x493991
movsxd rax, dword [rbx + 0xa8]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0xc0]
mov rcx, rax
mov qword [rsp + 0x90], rax
call qword [sym.imp.msvcrt.dll__ctime64]
lea rdx, str._nTime_Date_t_t_s
mov rcx, r15
mov r8, rax
call sub.msvcrt.dll_fprintf
movsx r8d, word [rbx + 0xb8]
cmp r8w, 0x10b
je 0x4935e0
cmp r8w, 0x20b
je 0x493a13
lea rsi, [0x004fdb76]
cmp r8w, 0x107
je 0x4935e7
lea rdx, str.Magic_t_t_t_04x
mov rcx, r15
call sub.msvcrt.dll_fprintf
jmp 0x493608
lea rsi, str.PE32
lea rdx, str.Magic_t_t_t_04x
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8, rsi
mov rcx, r15
lea rdx, str._t__s_
call sub.msvcrt.dll_fprintf
movsx r8d, byte [rbx + 0xba]
lea rdx, str._nMajorLinkerVersion_t_d_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
movsx r8d, byte [rbx + 0xbb]
lea rdx, str.MinorLinkerVersion_t_d_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8d, dword [rbx + 0xbc]
lea rdx, str.SizeOfCode_t_t_08lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8d, dword [rbx + 0xc0]
lea rdx, str.SizeOfInitializedData_t_08lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8d, dword [rbx + 0xc4]
lea rdx, str.SizeOfUninitializedData_t_08lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r9, r15
mov r8d, 0x14
mov edx, 1
lea rcx, str.AddressOfEntryPoint_t
call sub.msvcrt.dll_fwrite
mov r8, qword [rbx + 0xc8]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov r9, r15
mov r8d, 0xd
mov edx, 1
lea rcx, str._nBaseOfCode_t_t
call sub.msvcrt.dll_fwrite
mov r8, qword [rbx + 0xd0]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov r9, r15
mov r8d, 0xd
mov edx, 1
lea rcx, str._nBaseOfData_t_t
call sub.msvcrt.dll_fwrite
mov r8, qword [rbx + 0xd8]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov r9, r15
mov r8d, 0xc
mov edx, 1
lea rcx, str._nImageBase_t_t
call sub.msvcrt.dll_fwrite
mov r8, qword [rbx + 0xe0]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov r9, r15
mov r8d, 0x12
mov edx, 1
lea rcx, str._nSectionAlignment_t
call sub.msvcrt.dll_fwrite
mov r8, qword [rbx + 0xe8]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov r9, r15
mov r8d, 0x10
mov edx, 1
lea rcx, str._nFileAlignment_t_t
call sub.msvcrt.dll_fwrite
mov r8, qword [rbx + 0xf0]
mov rdx, r15
mov rcx, r14
call fcn.00425150
movsx r8d, word [rbx + 0xf8]
lea rdx, str._nMajorOSystemVersion_t_d_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
movsx r8d, word [rbx + 0xfa]
lea rdx, str.MinorOSystemVersion_t_d_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
movsx r8d, word [rbx + 0xfc]
lea rdx, str.MajorImageVersion_t_d_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
movsx r8d, word [rbx + 0xfe]
lea rdx, str.MinorImageVersion_t_d_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
movsx r8d, word [rbx + 0x100]
lea rdx, str.MajorSubsystemVersion_t_d_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
movsx r8d, word [rbx + 0x102]
lea rdx, str.MinorSubsystemVersion_t_d_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8d, dword [rbx + 0x104]
lea rdx, str.Win32Version_t_t_08lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8d, dword [rbx + 0x108]
lea rdx, str.SizeOfImage_t_t_08lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8d, dword [rbx + 0x10c]
lea rdx, str.SizeOfHeaders_t_t_08lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8d, dword [rbx + 0x110]
lea rdx, str.CheckSum_t_t_08lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
movsx r8d, word [rbx + 0x114]
cmp r8w, 0xe
ja case.0x493887.4
lea rdx, [0x004fe8e8]
movzx eax, r8w
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
lea r8, str.symbols_stripped
mov rcx, r15
lea rdx, str._t_s_n
call sub.msvcrt.dll_fprintf
mov eax, dword [rbx + 0x258]
test al, 0x20
je 0x493534
lea r8, str.large_address_aware
mov rcx, r15
lea rdx, str._t_s_n
call sub.msvcrt.dll_fprintf
mov eax, dword [rbx + 0x258]
test al, 0x80
je 0x49353c
lea r8, str.little_endian
mov rcx, r15
lea rdx, str._t_s_n
call sub.msvcrt.dll_fprintf
mov eax, dword [rbx + 0x258]
test ah, 1
je 0x493545
lea r8, str.32_bit_words
mov rcx, r15
lea rdx, str._t_s_n
call sub.msvcrt.dll_fprintf
mov eax, dword [rbx + 0x258]
test ah, 2
je 0x49354e
lea r8, str.debugging_information_removed
mov rcx, r15
lea rdx, str._t_s_n
call sub.msvcrt.dll_fprintf
mov eax, dword [rbx + 0x258]
test ah, 0x10
je 0x493557
lea r8, str.system_file
mov rcx, r15
lea rdx, str._t_s_n
call sub.msvcrt.dll_fprintf
mov eax, dword [rbx + 0x258]
test ah, 0x20
je 0x493560
lea r8, [0x004fdcd6]
mov rcx, r15
lea rdx, str._t_s_n
call sub.msvcrt.dll_fprintf
mov eax, dword [rbx + 0x258]
test ah, 0x80
je 0x493569
lea r8, str.big_endian
mov rcx, r15
lea rdx, str._t_s_n
call sub.msvcrt.dll_fprintf
jmp 0x493569
lea r8, str.line_numbers_stripped
mov rcx, r15
lea rdx, str._t_s_n
call sub.msvcrt.dll_fprintf
mov eax, dword [rbx + 0x258]
jmp 0x493524
lea r8, str.executable
mov rcx, r15
lea rdx, str._t_s_n
call sub.msvcrt.dll_fprintf
mov eax, dword [rbx + 0x258]
jmp 0x49351c
lea r8, str.relocations_stripped
mov rcx, r15
lea rdx, str._t_s_n
call sub.msvcrt.dll_fprintf
mov eax, dword [rbx + 0x258]
jmp 0x493514
lea rsi, [0x004fdb7a]
jmp 0x4935e7
lea rsi, str.Windows_CUI
nop word cs:[rax + rax]
lea rdx, str.Subsystem_t_t_08x
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8, rsi
mov rcx, r15
lea rdx, str._t__s_
call sub.msvcrt.dll_fprintf
movzx r8d, word [rbx + 0x116]
mov rcx, r15
add rbx, 0x140
xor r13d, r13d
lea rdx, str._nDllCharacteristics_t_08x_n
lea rsi, str.Export_Directory__.edata__or_where_ever_we_found_it__
lea rbp, str.Entry__1x
call sub.msvcrt.dll_fprintf
mov r9, r15
mov r8d, 0x13
mov edx, 1
lea rcx, str.SizeOfStackReserve_t
call sub.msvcrt.dll_fwrite
mov r8, qword [rbx - 0x28]
mov rdx, r15
mov rcx, r14
lea rdi, str.__08lx
lea r12, str.Export_Directory__.edata__or_where_ever_we_found_it__
call fcn.00425150
mov r9, r15
mov r8d, 0x13
mov edx, 1
lea rcx, str._nSizeOfStackCommit_t
call sub.msvcrt.dll_fwrite
mov r8, qword [rbx - 0x20]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov r9, r15
mov r8d, 0x13
mov edx, 1
lea rcx, str._nSizeOfHeapReserve_t
call sub.msvcrt.dll_fwrite
mov r8, qword [rbx - 0x18]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov r9, r15
mov r8d, 0x12
mov edx, 1
lea rcx, str._nSizeOfHeapCommit_t
call sub.msvcrt.dll_fwrite
mov r8, qword [rbx - 0x10]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov r8d, dword [rbx - 8]
lea rdx, str._nLoaderFlags_t_t_08lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8d, dword [rbx - 4]
lea rdx, str.NumberOfRvaAndSizes_t_08lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r9, r15
mov r8d, 0x14
mov edx, 1
lea rcx, str._nThe_Data_Directory_n
call sub.msvcrt.dll_fwrite
jmp 0x493b84
mov rsi, qword [r12 + r13*8]
mov r8d, r13d
mov rdx, rbp
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8, qword [rbx]
mov rdx, r15
mov rcx, r14
add r13, 1
add rbx, 0x10
call fcn.00425150
mov r8d, dword [rbx - 8]
mov rdx, rdi
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8, rsi
mov rcx, r15
lea rdx, [0x004fdf93]
call sub.msvcrt.dll_fprintf
cmp r13, 0x10
jne 0x493b80
mov rax, qword [r14 + 0xf0]
mov rbx, qword [rax + 0x150]
mov qword [rsp + 0x70], rax
test rbx, rbx
jne 0x493bf5
mov ecx, dword [rax + 0x158]
test ecx, ecx
je 0x494890
mov rax, qword [rsp + 0x70]
mov r13, qword [r14 + 0x88]
add rbx, qword [rax + 0xe0]
test r13, r13
je 0x493c32
nop dword [rax]
mov rax, qword [r13 + 0x28]
cmp rbx, rax
jb 0x493c29
mov r12, qword [r13 + 0x38]
add rax, r12
cmp rbx, rax
jb 0x494330
mov r13, qword [r13 + 0x10]
test r13, r13
jne 0x493c10
mov r9, r15
mov r8d, 0x4c
mov edx, 1
lea rcx, str._nThere_is_an_import_table__but_the_section_containing_it_could_not_be_found_n
call sub.msvcrt.dll_fwrite
mov r12, qword [r14 + 0xf0]
mov r9, qword [r12 + 0x140]
test r9, r9
jne 0x493c70
mov eax, dword [r12 + 0x148]
test eax, eax
je 0x494850
mov rbp, qword [r14 + 0x88]
add r9, qword [r12 + 0xe0]
test rbp, rbp
je 0x493ca7
mov rax, qword [rbp + 0x28]
cmp r9, rax
jb 0x493c9e
mov rdx, qword [rbp + 0x38]
lea rcx, [rax + rdx]
cmp r9, rcx
jb 0x493e00
mov rbp, qword [rbp + 0x10]
test rbp, rbp
jne 0x493c84
mov r9, r15
mov r8d, 0x4c
mov edx, 1
lea rcx, str._nThere_is_an_export_table__but_the_section_containing_it_could_not_be_found_n
call sub.msvcrt.dll_fwrite
mov rax, qword [r14 + 8]
mov rax, qword [rax + 0x360]
mov rax, qword [rax + 0x150]
test rax, rax
je 0x494b35
mov rdx, r15
mov rcx, r14
call rax
lea rdx, [0x004fd77e]
mov rcx, r14
mov qword [rsp + 0xc0], 0
call fcn.0042a590
test rax, rax
mov rsi, rax
je 0x493d18
cmp qword [rax + 0x38], 0
je 0x493d18
test byte [rax + 0x21], 1
jne 0x4948fb
mov rdx, r15
mov rcx, r14
call fcn.00492bf0
mov rsi, qword [r14 + 0xf0]
test rsi, rsi
je 0x493d59
lea rdx, str..rsrc
mov rcx, r14
call fcn.0042a590
test rax, rax
mov r12, rax
je 0x493d59
test byte [rax + 0x21], 1
je 0x493d59
mov rdi, qword [rax + 0x38]
test rdi, rdi
jne 0x494947
mov eax, 1
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, str.EFI_boot_service_driver
jmp 0x493a30
lea rsi, str.EFI_runtime_driver
jmp 0x493a30
lea rsi, str.SAL_runtime_driver
jmp 0x493a30
lea rsi, str.XBOX
jmp 0x493a30
lea rsi, str.unspecified
jmp 0x493a30
lea rsi, str.NT_native
jmp 0x493a30
lea rsi, str.Windows_GUI
jmp 0x493a30
lea rsi, str.Wince_CUI
jmp 0x493a30
lea rsi, str.EFI_application
jmp 0x493a30
lea rsi, str.POSIX_CUI
jmp 0x493a30
lea rdx, str.Subsystem_t_t_08x
mov rcx, r15
call sub.msvcrt.dll_fprintf
jmp 0x493a51
test byte [rbp + 0x21], 1
mov r8, qword [rbp]
je 0x494804
movsxd rbx, dword [r12 + 0x148]
mov rdi, r9
sub rdi, rax
sub rdx, rdi
cmp rbx, rdx
ja 0x4948e7
cmp rbx, 0x23
jbe 0x494820
lea rdx, str._nThere_is_an_export_table_in__s_at_0x_lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov rcx, rbx
call fcn.004280a0
test rax, rax
mov r13, rax
je 0x493cc1
mov qword [rsp + 0x20], rbx
mov r9, rdi
mov r8, rax
mov rdx, rbp
mov rcx, r14
call fcn.0042ad30
test eax, eax
je 0x493cc1
mov rax, qword [r14 + 8]
mov rcx, r13
call qword [rax + 0x38]
lea rcx, [r13 + 4]
mov qword [rsp + 0x78], rax
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
lea rcx, [r13 + 8]
mov qword [rsp + 0x80], rax
mov rax, qword [r14 + 8]
call qword [rax + 0x50]
lea rcx, [r13 + 0xa]
mov qword [rsp + 0x88], rax
mov rax, qword [r14 + 8]
call qword [rax + 0x50]
lea rcx, [r13 + 0xc]
mov qword [rsp + 0x98], rax
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
lea rcx, [r13 + 0x10]
mov qword [rsp + 0x70], rax
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
lea rcx, [r13 + 0x14]
mov qword [rsp + 0x58], rax
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
lea rcx, [r13 + 0x18]
mov rsi, rax
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
lea rcx, [r13 + 0x1c]
mov qword [rsp + 0x48], rax
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
lea rcx, [r13 + 0x20]
mov qword [rsp + 0x60], rax
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
lea rcx, [r13 + 0x24]
mov qword [rsp + 0x50], rax
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
mov rdx, rdi
mov r8, qword [rbp]
mov rcx, r15
sub rdx, qword [r12 + 0xe0]
mov qword [rsp + 0x68], rax
mov r12, qword [rbp + 0x28]
add r12, rdx
lea rdx, str._nThe_Export_Tables__interpreted__s_section_contents__n_n
call sub.msvcrt.dll_fprintf
mov r8d, dword [rsp + 0x78]
lea rdx, str.Export_Flags__t_t_t_lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8d, dword [rsp + 0x80]
lea rdx, str.Time_Date_stamp__t_t_lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
lea rdx, str.Major_Minor__t_t_t_d__d_n
mov rcx, r15
movsx r9d, word [rsp + 0x98]
movsx r8d, word [rsp + 0x88]
call sub.msvcrt.dll_fprintf
mov r9, r15
mov r8d, 9
mov edx, 1
lea rcx, str.Name__t_t_t_t
call sub.msvcrt.dll_fwrite
mov rdi, qword [rsp + 0x70]
mov rdx, r15
mov rcx, r14
mov r8, rdi
call fcn.00425150
cmp rdi, r12
jb 0x493fd9
lea rax, [rbx + r12]
cmp rdi, rax
jb 0x494e35
mov r9, r15
mov r8d, 0x19
mov edx, 1
lea rcx, str._outside_.edata_section__n
call sub.msvcrt.dll_fwrite
mov rbp, qword [rsp + 0x58]
lea rdx, str.Ordinal_Base__t_t_t_ld_n
mov rcx, r15
mov r8d, ebp
call sub.msvcrt.dll_fprintf
mov r9, r15
mov r8d, 0xb
mov edx, 1
lea rcx, str.Number_in:_n
call sub.msvcrt.dll_fwrite
mov r8d, esi
mov rcx, r15
lea rdx, str._tExport_Address_Table__t_t_08lx_n
call sub.msvcrt.dll_fprintf
mov r8d, dword [rsp + 0x48]
lea rdx, str._t_Name_Pointer_Ordinal__Table_t_08lx_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r9, r15
mov r8d, 0x10
mov edx, 1
lea rcx, str.Table_Addresses_n
call sub.msvcrt.dll_fwrite
mov r9, r15
mov r8d, 0x18
mov edx, 1
lea rcx, str._tExport_Address_Table__t_t
call sub.msvcrt.dll_fwrite
mov rdi, qword [rsp + 0x60]
mov rdx, r15
mov rcx, r14
mov r8, rdi
sub rdi, r12
call fcn.00425150
mov rdx, r15
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov r9, r15
mov r8d, 0x16
mov edx, 1
lea rcx, str._tName_Pointer_Table__t_t
call sub.msvcrt.dll_fwrite
mov r8, qword [rsp + 0x50]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov rdx, r15
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov r9, r15
mov r8d, 0x12
mov edx, 1
lea rcx, str._tOrdinal_Table__t_t_t
call sub.msvcrt.dll_fwrite
mov r8, qword [rsp + 0x68]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov rdx, r15
mov ecx, 0xa
call sub.msvcrt.dll_fputc
lea rdx, str._nExport_Address_Table____Ordinal_Base__ld_n
mov r8d, ebp
mov rcx, r15
call sub.msvcrt.dll_fprintf
lea eax, [rsi*4]
mov rdx, rax
add rax, rdi
cmp rbx, rax
jbe 0x4941e9
cmp edx, esi
jb 0x4941e9
test rdi, rdi
js 0x4941e9
lea eax, [rbx + r12]
xor ebp, ebp
and esi, 0xffffffff
lea rdi, [r13 + rdi]
mov dword [rsp + 0x60], eax
jne 0x4941a2
jmp 0x494200
add rdx, r13
mov dword [rsp + 0x20], eax
mov r8d, ebp
mov rcx, r15
mov qword [rsp + 0x38], rdx
mov edx, dword [rsp + 0x60]
sub edx, eax
mov dword [rsp + 0x30], edx
lea rdx, str.Forwarder_RVA
mov qword [rsp + 0x28], rdx
lea rdx, str._t__4ld__base__4ld___04lx__s_____.s_n
call sub.msvcrt.dll_fprintf
add rbp, 1
add rdi, 4
cmp rbp, rsi
je 0x494200
mov rax, qword [r14 + 8]
mov rcx, rdi
call qword [rax + 0x38]
test rax, rax
je 0x494195
mov ecx, dword [rsp + 0x58]
mov rdx, rax
sub rdx, r12
cmp rbx, rdx
lea r9d, [rbp + rcx]
jae 0x494161
lea rdx, str.Export_RVA
mov dword [rsp + 0x20], eax
mov r8d, ebp
mov rcx, r15
mov qword [rsp + 0x28], rdx
lea rdx, str._t__4ld__base__4ld___04lx__s_n
call sub.msvcrt.dll_fprintf
jmp 0x494195
mov r8d, dword [rsp + 0x60]
lea rdx, str._tInvalid_Export_Address_Table_rva__0x_lx__or_entry_count__0x_lx__n
mov r9d, esi
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov edx, 1
mov r9, r15
mov r8d, 0x1e
lea rcx, str._n_Ordinal_Name_Pointer__Table_n
call sub.msvcrt.dll_fwrite
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
shl eax, 2
sub rsi, r12
mov rdx, rax
add rax, rsi
cmp rbx, rax
jbe 0x494301
cmp edx, edi
jb 0x494301
test rsi, rsi
js 0x494301
mov rdi, qword [rsp + 0x48]
mov r10, qword [rsp + 0x68]
mov eax, edi
sub r10, r12
add eax, eax
add rax, r10
cmp rbx, rax
jbe 0x494e60
test r10, r10
js 0x494e60
mov rax, rdi
and eax, 0xffffffff
je 0x49431a
add r10, r13
add rsi, r13
mov qword [rsp + 0x48], r13
lea rbp, [r10 + rax*2]
mov r13, r10
jmp 0x4942b8
mov r9d, eax
mov r8d, edi
mov rcx, r15
lea rdx, str._t__4ld___corrupt_offset:__lx__n
call sub.msvcrt.dll_fprintf
add r13, 2
add rsi, 4
cmp rbp, r13
je 0x494e7e
mov rax, qword [r14 + 8]
mov rcx, r13
call qword [rax + 0x50]
mov rcx, rsi
mov rdi, rax
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
mov rdx, rax
sub rdx, r12
cmp rbx, rdx
jbe 0x494292
mov rax, qword [rsp + 0x48]
mov r9d, ebx
mov r8d, edi
mov rcx, r15
sub r9d, edx
add rax, rdx
mov qword [rsp + 0x20], rax
lea rdx, str._t__4ld___.s_n
call sub.msvcrt.dll_fprintf
jmp 0x4942a7
mov r9d, dword [rsp + 0x48]
lea rdx, str._tInvalid_Name_Pointer_Table_rva__0x_lx__or_entry_count__0x_lx__n
mov rcx, r15
mov r8d, dword [rsp + 0x50]
call sub.msvcrt.dll_fprintf
mov rcx, r13
call fcn.004d4f88
jmp 0x493cc1
test byte [r13 + 0x21], 1
mov r8, qword [r13]
je 0x4947f0
lea rdx, str._nThere_is_an_import_table_in__s_at_0x_lx_n
mov r9d, ebx
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov r8, qword [r13]
lea rdx, str._nThe_Import_Tables__interpreted__s_section_contents__n
mov rcx, r15
mov rsi, qword [r13 + 0x28]
call sub.msvcrt.dll_fprintf
mov r9, r15
mov r8d, 0x78
mov edx, 1
lea rcx, str._vma:____________Hint____Time______Forward__DLL_______First_n_________________Table___Stamp_____Chain____Name______Thunk_n
call sub.msvcrt.dll_fwrite
mov r8, qword [rsp + 0x90]
mov rdx, r13
mov rcx, r14
call fcn.0042ae20
test eax, eax
jne 0x4943b4
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x493c4c
call fcn.004d4f88
jmp 0x493c4c
sub rbx, rsi
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x78], r13
mov rax, qword [r13 + 0x28]
sub rax, qword [rsi + 0xe0]
mov qword [rsp + 0x48], rax
lea eax, [r12 - 2]
mov dword [rsp + 0x88], eax
jmp 0x4943fb
test rbx, rbx
jne 0x495060
mov rdx, r15
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov rbx, qword [rsp + 0x50]
lea rax, [rbx + 0x14]
cmp rax, r12
mov qword [rsp + 0x50], rax
ja 0x494840
mov eax, dword [rsp + 0x48]
lea rdx, str.__08lx_t
mov rcx, r15
lea r8d, [rax + rbx]
call sub.msvcrt.dll_fprintf
mov rcx, qword [rsp + 0xc0]
mov rax, qword [r14 + 8]
add rcx, rbx
call qword [rax + 0x38]
mov rsi, rax
mov rax, qword [rsp + 0xc0]
lea rcx, [rax + rbx + 4]
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
mov rbp, rax
mov rax, qword [rsp + 0xc0]
lea rcx, [rax + rbx + 8]
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
mov r13, rax
mov rax, qword [rsp + 0xc0]
lea rcx, [rax + rbx + 0xc]
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
mov rdi, rax
mov rax, qword [rsp + 0xc0]
lea rcx, [rax + rbx + 0x10]
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
mov dword [rsp + 0x28], edi
mov r9d, ebp
mov r8d, esi
mov dword [rsp + 0x30], eax
lea rdx, str._08lx__08lx__08lx__08lx__08lx_n
mov rcx, r15
mov rbx, rax
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x58], esi
call sub.msvcrt.dll_fprintf
mov rax, rsi
or rax, rbx
je 0x494840
mov rax, qword [rsp + 0x78]
sub rdi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xc0]
cmp rdi, qword [rax + 0x38]
jae 0x4943aa
lea r9, [rcx + rdi]
mov rax, r12
mov rcx, r15
lea rdx, str._n_tDLL_Name:__.s_n
sub rax, rdi
lea r8d, [rax - 1]
call sub.msvcrt.dll_fprintf
test rsi, rsi
je 0x4943e0
mov edx, 1
mov r9, r15
mov r8d, 0x25
lea rcx, str._tvma:__Hint_Ord_Member_Name_Bound_To_n
call sub.msvcrt.dll_fwrite
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
mov r13d, dword [rsp + 0x58]
sub eax, edi
cdqe
mov rdx, rcx
sub r13d, edi
lea rdi, [rcx + rax]
mov qword [rsp + 0x80], rdi
mov rdi, r12
sub rdi, rax
cmp rsi, rbx
mov qword [rsp + 0x68], rdi
je 0x4947c1
mov rdi, qword [r14 + 0x88]
test rdi, rdi
je 0x49459f
mov rax, qword [rsp + 0x70]
mov r10, qword [rax + 0xe0]
lea rdx, [rbx + r10]
nop dword [rax]
mov r8, qword [rdi + 0x28]
cmp rdx, r8
jb 0x494596
mov rax, qword [rdi + 0x38]
lea r9, [r8 + rax]
cmp rdx, r9
jb 0x4945c0
mov rdi, qword [rdi + 0x10]
test rdi, rdi
jne 0x494580
mov r9, r15
mov r8d, 0x4a
mov edx, 1
lea rcx, str._nThere_is_a_first_thunk__but_the_section_containing_it_could_not_be_found_n
call sub.msvcrt.dll_fwrite
jmp 0x4943f6
cmp rdi, qword [rsp + 0x78]
je 0x4948c4
lea r9d, [rbx + r10]
mov r10d, r9d
sub r10d, r8d
movsxd r9, r10d
sub rax, r9
mov qword [rsp + 0x58], r9
mov rcx, rax
mov qword [rsp + 0x68], rax
call fcn.004280a0
test rax, rax
mov r8, rax
mov qword [rsp + 0x80], rax
je 0x4943f6
mov rax, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, r14
mov r9, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.0042ad30
test eax, eax
je 0x494988
movsxd r13, r13d
lea rdx, [r13 + 4]
mov rax, r13
cmp r12, rdx
jb 0x4947af
mov rcx, qword [rsp + 0xc0]
mov dword [rsp + 0xac], 1
mov rdx, qword [rsp + 0x80]
lea rdi, [r13 + 4]
mov qword [rsp + 0x98], r13
sub rdx, 4
sub rdx, r13
mov qword [rsp + 0xa0], rdx
jmp 0x494743
lea r13, [rdx + 2]
cmp r12, r13
jbe 0x494768
mov qword [rsp + 0x60], rax
mov rax, qword [r14 + 8]
mov rcx, rdx
mov qword [rsp + 0x58], rdx
add rcx, qword [rsp + 0xc0]
call qword [rax + 0x50]
mov rdx, qword [rsp + 0x58]
mov r10, qword [rsp + 0xc0]
mov r9d, eax
mov ecx, dword [rsp + 0x88]
mov r8, qword [rsp + 0x60]
add r10, r13
sub ecx, edx
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], ecx
lea rdx, str._t_04lx_t__4d___.s
mov rcx, r15
call sub.msvcrt.dll_fprintf
test rbp, rbp
setne dl
test rbx, rbx
setne al
test dl, al
je 0x49471f
cmp rbx, rsi
je 0x49471f
mov rax, rdi
sub rax, qword [rsp + 0x98]
cmp rax, qword [rsp + 0x68]
ja 0x49471f
mov rax, qword [rsp + 0xa0]
lea rcx, [rax + rdi]
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
lea rdx, str._t_04lx
mov rcx, r15
mov r8d, eax
call sub.msvcrt.dll_fprintf
mov rdx, r15
mov ecx, 0xa
call sub.msvcrt.dll_fputc
lea rdx, [rdi + 4]
cmp r12, rdx
jb 0x4947a0
mov rcx, qword [rsp + 0xc0]
mov rax, rdi
mov rdi, rdx
add rcx, rax
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
test eax, eax
mov r8, rax
je 0x4947a0
mov edx, eax
sub rdx, qword [rsp + 0x48]
test eax, eax
js 0x494780
cmp r12, rdx
ja 0x494671
lea rdx, str._t_corrupt:_0x_04lx_
mov rcx, r15
call sub.msvcrt.dll_fprintf
jmp 0x4946d3
lea rdx, str._t_04lx_t__4lu___none_
mov r9d, eax
mov rcx, r15
and r9d, 0x7fffffff
call sub.msvcrt.dll_fprintf
jmp 0x4946d3
mov edx, dword [rsp + 0xac]
test edx, edx
je 0x4943e9
mov rcx, qword [rsp + 0x80]
call fcn.004d4f88
jmp 0x4943e9
movsxd r13, r13d
lea rcx, [r13 + 4]
mov rax, r13
cmp r12, rcx
jb 0x4943e9
mov rcx, rdx
mov rsi, rbx
mov dword [rsp + 0xac], 0
jmp 0x494649
lea rdx, str._nThere_is_an_import_table_in__s__but_that_section_has_no_contents_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
jmp 0x493c4c
lea rdx, str._nThere_is_an_export_table_in__s__but_that_section_has_no_contents_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
jmp 0x493cc1
lea rdx, str._nThere_is_an_export_table_in__s__but_it_is_too_small___d__n
mov r9d, ebx
mov rcx, r15
call sub.msvcrt.dll_fprintf
jmp 0x493cc1
mov rcx, qword [rsp + 0xc0]
jmp 0x4943aa
lea rdx, str..edata
mov rcx, r14
call fcn.0042a590
test rax, rax
mov rbp, rax
je 0x493cc1
mov rbx, qword [rax + 0x38]
test rbx, rbx
je 0x493cc1
mov r9, qword [rax + 0x28]
xor edi, edi
mov r8, qword [rax]
jmp 0x493e28
lea rdx, [0x004fd777]
mov rcx, r14
call fcn.0042a590
test rax, rax
mov r13, rax
je 0x493c4c
mov r12, qword [rax + 0x38]
test r12, r12
je 0x493c4c
mov rbx, qword [rax + 0x28]
mov r8, qword [rax]
jmp 0x49433f
movsxd r13, r13d
lea rdx, [r13 + 4]
mov rax, r13
cmp r12, rdx
jb 0x4943e9
mov dword [rsp + 0xac], 0
jmp 0x494649
lea rdx, str._nThere_is_an_export_table_in__s__but_it_does_not_fit_into_that_section_n
mov rcx, r15
call sub.msvcrt.dll_fprintf
jmp 0x493cc1
mov r9, r15
mov r8d, 0x41
mov edx, 1
lea rcx, str._n_nPE_File_Base_Relocations__interpreted_.reloc_section_contents__n
call sub.msvcrt.dll_fwrite
mov r8, qword [rsp + 0x90]
mov rdx, rsi
mov rcx, r14
call fcn.0042ae20
test eax, eax
jne 0x49499a
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x493d18
call fcn.004d4f88
jmp 0x493d18
lea r8, [rsp + 0xb8]
mov rdx, rax
mov rcx, r14
mov rbx, qword [rax + 0x28]
mov rsi, qword [rsi + 0xe0]
call fcn.0042ae20
test eax, eax
jne 0x494c40
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x493d59
call fcn.004d4f88
jmp 0x493d59
mov rcx, qword [rsp + 0x80]
call fcn.004d4f88
jmp 0x4943f6
mov rbx, qword [rsp + 0xc0]
mov rax, qword [rsi + 0x38]
add rax, rbx
mov qword [rsp + 0x50], rax
nop
lea rsi, [rbx + 8]
cmp qword [rsp + 0x50], rsi
jb 0x494b28
mov rax, qword [r14 + 8]
mov rcx, rbx
call qword [rax + 0x38]
lea rcx, [rbx + 4]
mov rbp, rax
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
mov rdi, rax
lea eax, [rax - 8]
shr eax, 1
test edi, edi
je 0x494b28
mov dword [rsp + 0x20], edi
mov r9d, edi
mov r8d, ebp
mov rcx, r15
mov dword [rsp + 0x28], eax
lea rdx, str._nVirtual_Address:__08lx_Chunk_size__ld__0x_lx__Number_of_fixups__ld_n
mov edi, edi
mov r13d, ebp
call sub.msvcrt.dll_fprintf
mov rax, qword [rsp + 0x50]
add rdi, rbx
cmp rax, rdi
cmovbe rdi, rax
add rbx, 0xa
cmp rdi, rbx
jb 0x494b20
xor ebp, ebp
jmp 0x494ab7
mov rax, r10
mov r8d, ebp
mov rcx, r15
mov dword [rsp + 0x48], r10d
lea rdx, str.ABSOLUTE
and eax, 0xf
mov rax, qword [rdx + rax*8]
lea rdx, str._treloc__4d_offset__4x___4lx___s
mov qword [rsp + 0x28], rax
lea eax, [r9 + r13]
mov dword [rsp + 0x20], eax
call sub.msvcrt.dll_fprintf
mov r10d, dword [rsp + 0x48]
cmp r10w, 4
jne 0x494b10
add rsi, 4
cmp rsi, rdi
ja 0x494b10
mov rax, qword [r14 + 8]
mov rcx, rbx
add ebp, 2
call qword [rax + 0x50]
lea rdx, str.___4x_
mov rcx, r15
mov r8d, eax
call sub.msvcrt.dll_fprintf
lea rbx, [rsi + 2]
mov rdx, r15
mov ecx, 0xa
call sub.msvcrt.dll_fputc
cmp rbx, rdi
ja 0x494b20
mov rax, qword [r14 + 8]
lea r12d, [rbp + 1]
mov rcx, rsi
call qword [rax + 0x50]
mov r10d, eax
mov r9d, eax
shr r10w, 0xc
and r9d, 0xfff
cmp r10w, 0xc
jbe 0x494a30
lea rax, [0x004fe8dd]
mov r8d, ebp
mov rcx, r15
mov qword [rsp + 0x28], rax
lea eax, [r9 + r13]
mov ebp, r12d
mov rsi, rbx
mov dword [rsp + 0x20], eax
lea rdx, str._treloc__4d_offset__4x___4lx___s
call sub.msvcrt.dll_fprintf
jmp 0x494aa1
mov ebp, r12d
mov rsi, rbx
jmp 0x494aa1
mov rbx, rsi
jmp 0x4949b0
mov rcx, qword [rsp + 0xc0]
jmp 0x49493d
lea rdx, [0x004fd770]
mov rcx, r14
mov qword [rsp + 0xc0], 0
call fcn.0042a590
test rax, rax
mov rdi, rax
je 0x493ce4
mov rax, qword [rax + 0xe0]
test rax, rax
je 0x493ce4
mov rax, qword [rax + 0x58]
test rax, rax
je 0x493ce4
movabs rdx, 0xcccccccccccccccd
mov rsi, qword [rax]
mov rax, rsi
mul rdx
mov rax, rdx
shr rax, 4
lea rax, [rax + rax*4]
shl rax, 2
cmp rsi, rax
je 0x494bb8
mov r9d, 0x14
mov r8d, esi
mov rcx, r15
lea rdx, str.Warning__.pdata_section_size___ld__is_not_a_multiple_of__d_n
call sub.msvcrt.dll_fprintf
mov r9, r15
mov r8d, 0x3a
mov edx, 1
lea rcx, str._nThe_Function_Table__interpreted_.pdata_section_contents__n
call sub.msvcrt.dll_fwrite
mov r9, r15
mov r8d, 0x7b
mov edx, 1
lea rcx, str._vma:_t_tBegin____End______EH_______EH_______PrologEnd__Exception_n______t_tAddress__Address__Handler__Data_____Address____Mask_n
call sub.msvcrt.dll_fwrite
mov r9, qword [rdi + 0x38]
test r9, r9
je 0x493ce4
cmp rsi, r9
ja 0x495049
mov r8, qword [rsp + 0x90]
mov rdx, rdi
mov rcx, r14
call fcn.0042ae20
test eax, eax
jne 0x494e88
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x493ce4
call fcn.004d4f88
jmp 0x493ce4
mov rax, qword [rsp + 0xb8]
mov rcx, r15
mov qword [rsp + 0xd0], 0
sub rbx, rsi
lea rbp, str._nWARNING:_Extra_data_in_.rsrc_section___it_will_be_ignored_by_Windows:_n
mov esi, 1
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xc0], rax
add rax, rdi
mov qword [rsp + 0xc8], rax
lea rdi, str.Corrupt_.rsrc_section_detected__n
call sub.msvcrt.dll_fflush
mov r8d, 0x27
mov r9, r15
mov edx, 1
lea rcx, str._nThe_.rsrc_Resource_Directory_section:_n
call sub.msvcrt.dll_fwrite
mov r13, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc8]
nop dword [rax + rax]
cmp r8, r13
jbe 0x494dd6
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x28], rbx
mov r9, r13
mov rax, qword [rsp + 0x90]
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.00490a60
mov r8, qword [rsp + 0xc8]
mov qword [rsp + 0xb8], rax
lea rdx, [r8 + 1]
cmp rax, rdx
je 0x494dab
mov ecx, dword [r12 + 0x70]
mov edx, esi
shl edx, cl
lea ecx, [rdx - 1]
neg edx
movsxd rcx, ecx
movsxd rdx, edx
add rax, rcx
and rax, rdx
mov rcx, rax
mov rdx, rax
mov qword [rsp + 0xb8], rax
sub rcx, r13
add rbx, rcx
lea rcx, [r8 - 4]
cmp rax, rcx
je 0x494d9b
cmp r8, rax
mov r13, rax
jbe 0x494cc0
nop dword [rax]
lea r13, [rdx + 1]
cmp r8, r13
mov qword [rsp + 0xb8], r13
jbe 0x494cc0
movzx eax, byte [rdx + 1]
mov rdx, r13
test al, al
je 0x494d50
mov r8d, 0x47
mov r9, r15
mov edx, 1
mov rcx, rbp
call sub.msvcrt.dll_fwrite
mov r13, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc8]
jmp 0x494cc0
mov qword [rsp + 0xb8], r8
mov r13, r8
jmp 0x494cc0
mov r8d, 0x20
mov r9, r15
mov edx, 1
mov rcx, rdi
call sub.msvcrt.dll_fwrite
mov r13, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc8]
jmp 0x494cc0
mov r8, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc0]
test r8, r8
je 0x494e05
lea rdx, str._String_table_starts_at_offset:__03x_n
sub r8d, ecx
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov rcx, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xd8]
test r8, r8
je 0x49497e
lea rdx, str._Resources_start_at_offset:__03x_n
sub r8d, ecx
mov rcx, r15
call sub.msvcrt.dll_fprintf
mov rcx, qword [rsp + 0xc0]
jmp 0x49497e
mov rdi, qword [rsp + 0x70]
lea r8d, [rbx + r12]
mov rcx, r15
lea rdx, str.__.s_n
mov rax, rdi
sub r8d, edi
sub rax, r12
lea r9, [r13 + rax]
call sub.msvcrt.dll_fprintf
jmp 0x493ff3
mov r9d, dword [rsp + 0x48]
lea rdx, str._tInvalid_Ordinal_Table_rva__0x_lx__or_entry_count__0x_lx__n
mov rcx, r15
mov r8d, dword [rsp + 0x68]
call sub.msvcrt.dll_fprintf
jmp 0x49431a
mov r13, qword [rsp + 0x48]
jmp 0x49431a
cmp rsi, 0x13
mov ebx, 0x14
ja 0x494f9e
jmp 0x495037
mov rdx, r15
mov ecx, 0x20
call sub.msvcrt.dll_fputc
add r13, qword [rdi + 0x28]
mov rdx, r15
mov rcx, r14
mov r8, r13
call fcn.00425150
mov rdx, r15
mov ecx, 9
call sub.msvcrt.dll_fputc
mov r8, qword [rsp + 0x48]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov rdx, r15
mov ecx, 0x20
call sub.msvcrt.dll_fputc
mov r8, qword [rsp + 0x50]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov rdx, r15
mov ecx, 0x20
call sub.msvcrt.dll_fputc
mov rax, r12
mov rdx, r15
mov rcx, r14
and rax, 0xfffffffffffffffc
mov r8, rax
call fcn.00425150
mov rdx, r15
mov ecx, 0x20
call sub.msvcrt.dll_fputc
mov r8, qword [rsp + 0x58]
mov rdx, r15
mov rcx, r14
call fcn.00425150
mov rdx, r15
mov ecx, 0x20
call sub.msvcrt.dll_fputc
mov r8, rbp
mov rdx, r15
mov rcx, r14
and r8, 0xfffffffffffffffc
call fcn.00425150
lea eax, [r12*4]
mov r8d, ebp
mov rcx, r15
lea rdx, str.____x
and eax, 4
and r8d, 3
or r8d, eax
call sub.msvcrt.dll_fprintf
mov rdx, r15
mov ecx, 0xa
call sub.msvcrt.dll_fputc
cmp rsi, rbx
jbe 0x495037
add rbx, 0x14
cmp rsi, rbx
jb 0x495037
mov rcx, qword [rsp + 0xc0]
lea r13, [rbx - 0x14]
mov rax, qword [r14 + 8]
add rcx, r13
call qword [rax + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
lea rcx, [rax + rbx - 0x10]
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
lea rcx, [rax + rbx - 0xc]
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
mov r12, rax
mov rax, qword [rsp + 0xc0]
lea rcx, [rax + rbx - 8]
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc0]
lea rcx, [rax + rbx - 4]
mov rax, qword [r14 + 8]
call qword [rax + 0x38]
mov rdx, qword [rsp + 0x48]
or rdx, qword [rsp + 0x50]
mov rbp, rax
mov rax, rdx
or rax, r12
or rax, qword [rsp + 0x58]
or rax, rbp
jne 0x494ea0
mov rcx, qword [rsp + 0xc0]
call fcn.004d4f88
jmp 0x493ce4
lea rdx, str.Virtual_size_of_.pdata_section___ld__larger_than_real_size___ld__n
mov r8d, esi
mov rcx, r15
call sub.msvcrt.dll_fprintf
jmp 0x493ce4
mov edx, 1
mov r9, r15
mov r8d, 0x25
lea rcx, str._tvma:__Hint_Ord_Member_Name_Bound_To_n
mov r13d, ebx
call sub.msvcrt.dll_fwrite
sub r13d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0xc0]
movsxd r13, r13d
lea rax, [rdx + r13]
mov qword [rsp + 0x80], rax
mov rax, r12
sub rax, r13
mov qword [rsp + 0x68], rax
jmp 0x4947c4