Function at 0x40f63d
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x58]
mov ebp, dword [esp + 0x60]
mov dword [0x48f530], 0
mov dword [0x48f52c], 0
mov dword [0x48f524], 0
cmp dword [0x45f1a4], 0
je 0x40f790
movsx eax, word [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x48f540
call fcn.0041ba3d
mov eax, dword [0x48f530]
add eax, 2
mov dword [0x48f530], eax
movsx edx, word [ebp + 0xa]
mov dword [esp + 4], edx
add eax, 0x48f540
mov dword [esp], eax
call fcn.0041ba3d
mov eax, dword [0x48f530]
lea ecx, [eax + 2]
mov dword [0x48f530], ecx
movzx edx, word [ebp + 6]
movzx eax, dh
and eax, 1
mov edi, edx
and di, 0x40
mov esi, eax
or esi, 4
test di, di
cmovne eax, esi
mov edi, edx
and di, 0x20
mov esi, eax
or esi, 0x10
test di, di
cmovne eax, esi
mov edi, edx
and di, 8
mov esi, eax
or esi, 0x40
test di, di
cmovne eax, esi
mov edi, edx
and di, 4
mov esi, eax
or esi, 0x100
test di, di
cmovne eax, esi
mov edi, edx
and di, 1
mov esi, eax
or esi, 0x400
test di, di
cmovne eax, esi
and dx, 0xf000
mov esi, eax
or esi, 0x800
or ah, 0x88
cmp dx, 0x4000
cmovne eax, esi
mov dword [esp + 4], eax
add ecx, 0x48f540
mov dword [esp], ecx
call fcn.0041ba3d
mov eax, dword [0x48f530]
mov byte [eax + 0x48f542], 0x58
mov byte [eax + 0x48f543], 0x41
mov byte [eax + 0x48f544], 0
mov byte [eax + 0x48f545], 0
mov byte [eax + 0x48f546], 0
mov byte [eax + 0x48f547], 0
mov byte [eax + 0x48f548], 0
lea edx, [eax + 0xa]
mov dword [0x48f530], edx
mov byte [eax + 0x48f549], 0
mov dword [0x48f520], 0xfe
mov eax, 0
test byte [ebx + 0x128], 0x40
jne 0x41035e
mov edi, 0x44f1c4
mov ecx, 2
mov esi, dword [esp + 0x54]
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
cmp dl, al
je 0x40f7e0
mov edi, 0x44f1c6
mov ecx, 3
mov esi, dword [esp + 0x54]
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
cmp dl, al
jne 0x40f7ea
mov byte [ebx + 0x28], 1
mov byte [ebx + 8], 0x22
jmp 0x40f82a
lea edi, [ebx + 0x29]
mov eax, 0
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub ecx, 1
mov byte [ebx + 0x28], cl
add ecx, 0x21
mov byte [ebx + 8], cl
movzx eax, cl
test cl, 1
jne 0x40f816
mov dword [0x48f528], eax
jmp 0x40f821
add eax, 1
mov dword [0x48f528], eax
mov byte [ebx + 8], al
cmp dword [0x48f528], 0x45
jg 0x40f834
mov dword [0x48f528], 0x46
movzx eax, word [ebp + 6]
and ax, 0xf000
cmp ax, 0x8000
jne 0x40f956
cmp dword [0x45f0b4], 0
je 0x40f956
cmp dword [ebx + 0x18c], 0
je 0x40f956
mov eax, dword [0x48f530]
sub eax, dword [0x48f52c]
mov edx, dword [0x48f528]
lea eax, [edx + eax + 0x2a]
cmp eax, 0xfe
jle 0x40f88b
mov edx, 0x12a
mov eax, 0x44f1c9
call fcn.0040f4be
mov eax, dword [0x48f530]
mov byte [eax + 0x48f540], 0x41
mov byte [eax + 0x48f541], 0x41
mov byte [eax + 0x48f542], 0xe
mov byte [eax + 0x48f543], 2
mov edx, dword [ebx + 0x18c]
movzx edx, byte [edx + 0x58]
mov byte [eax + 0x48f544], dl
mov edx, dword [ebx + 0x18c]
movzx edx, byte [edx + 0x59]
mov byte [eax + 0x48f545], dl
mov edx, dword [ebx + 0x18c]
movzx edx, byte [edx + 0x5a]
mov byte [eax + 0x48f546], dl
mov edx, dword [ebx + 0x18c]
movzx edx, byte [edx + 0x5b]
mov byte [eax + 0x48f547], dl
mov edx, dword [ebx + 0x18c]
movzx edx, byte [edx + 0x5d]
mov byte [eax + 0x48f548], dl
mov edx, dword [ebx + 0x18c]
movzx edx, byte [edx + 0x5e]
mov byte [eax + 0x48f549], dl
mov edx, dword [ebx + 0x18c]
movzx edx, byte [edx + 0x5f]
mov byte [eax + 0x48f54a], dl
mov edx, dword [ebx + 0x18c]
movzx edx, byte [edx + 0x60]
mov byte [eax + 0x48f54b], dl
mov edx, dword [ebx + 0x18c]
movsx dx, byte [edx + 0x49]
mov byte [eax + 0x48f54c], dl
lea edx, [eax + 0xe]
mov dword [0x48f530], edx
mov edx, dword [ebx + 0x18c]
movzx edx, word [edx + 0x48]
mov byte [eax + 0x48f54d], dl
cmp dword [0x45f1a8], 0
je 0x410186
test byte [esp + 0x64], 0x10
je 0x40f9c4
mov eax, dword [0x48f530]
mov byte [eax + 0x48f540], 0x53
mov byte [eax + 0x48f541], 0x50
mov byte [eax + 0x48f542], 7
mov byte [eax + 0x48f543], 1
mov byte [eax + 0x48f544], 0xbe
mov byte [eax + 0x48f545], 0xef
cmp dword [0x45f1a4], 0
je 0x40f9b4
lea edx, [eax + 7]
mov dword [0x48f530], edx
mov byte [eax + 0x48f546], 0xe
jmp 0x40f9c4
lea edx, [eax + 7]
mov dword [0x48f530], edx
mov byte [eax + 0x48f546], 0
mov eax, dword [0x48f530]
sub eax, dword [0x48f52c]
mov edx, dword [0x48f528]
lea eax, [edx + eax + 0x21]
cmp eax, dword [0x48f520]
jle 0x40f9f0
mov edx, 0x154
mov eax, 0x44f1cc
call fcn.0040f4be
mov eax, dword [0x48f530]
mov dword [esp + 0x14], eax
mov byte [eax + 0x48f540], 0x52
mov byte [eax + 0x48f541], 0x52
mov byte [eax + 0x48f542], 5
mov byte [eax + 0x48f543], 1
lea edx, [eax + 5]
mov dword [0x48f530], edx
mov byte [eax + 0x48f544], 0
mov edi, 0x44f1c4
mov ecx, 2
mov esi, dword [esp + 0x54]
repe cmpsb byte [esi], byte es:[edi]
seta cl
setb al
mov edi, 0
cmp cl, al
je 0x40fc44
mov edi, 0x44f1c6
mov ecx, 3
mov esi, dword [esp + 0x54]
repe cmpsb byte [esi], byte es:[edi]
seta cl
setb al
mov edi, 0
cmp cl, al
je 0x40fc44
cmp dword [0x45f0a8], 0
je 0x40faa0
mov edi, dword [ebx + 0x18c]
test edi, edi
je 0x40faa0
cmp dword [ebx + 0x198], 0
je 0x40faa0
mov dword [esp + 0x54], edi
mov eax, 0
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov edi, eax
jmp 0x40fab9
mov edi, dword [esp + 0x54]
mov eax, 0
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov esi, ecx
not esi
lea eax, [esi - 1]
mov edi, eax
sub edx, dword [0x48f52c]
mov eax, dword [0x48f528]
lea eax, [eax + edx + 0x22]
cmp eax, dword [0x48f520]
jle 0x40fadf
mov edx, 0x171
mov eax, 0x44f1cf
call fcn.0040f4be
mov esi, edi
test edi, edi
je 0x40fc30
mov dword [esp + 0x58], ebx
mov dword [esp + 0x60], ebp
mov edx, dword [0x48f528]
mov ecx, dword [0x48f530]
mov ebx, dword [0x48f52c]
mov eax, dword [0x48f520]
lea ebp, [edx + esi + 0x21]
mov edi, ecx
sub edi, ebx
add edi, ebp
cmp edi, eax
jle 0x40fb2c
sub ebx, ecx
mov edi, 0xffffffe4
sub edi, edx
add ebx, edi
lea ebx, [eax + ebx - 5]
mov edi, 1
jmp 0x40fb33
mov ebx, esi
mov edi, 0
cmp ebx, 0xf8
jle 0x40fb45
add edi, 1
mov ebx, 0xf8
jmp 0x40fb61
test ebx, ebx
jns 0x40fb61
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Negative_RR_name_length_residual:__d_n
mov dword [esp], 0xffffffff
call fcn.0043acd9
mov edx, dword [0x48f530]
mov byte [edx + 0x48f540], 0x4e
mov byte [edx + 0x48f541], 0x4d
lea eax, [ebx + 5]
mov byte [edx + 0x48f542], al
mov byte [edx + 0x48f543], 1
lea eax, [edx + 5]
mov dword [0x48f530], eax
cmp esi, ebx
setne cl
mov ebp, ecx
mov byte [edx + 0x48f544], cl
cmp dword [0x45f0a8], 0
je 0x40fbde
mov ecx, dword [esp + 0x58]
cmp dword [ecx + 0x18c], 0
je 0x40fbde
cmp dword [ecx + 0x198], 0
je 0x40fbde
add eax, 0x48f540
mov edx, dword [0x45f03c]
mov dword [esp + 4], edx
mov edx, dword [0x45f038]
mov dword [esp], edx
mov ecx, ebx
mov edx, dword [esp + 0x54]
call fcn.0040f430
jmp 0x40fc01
add eax, 0x48f540
mov edx, dword [0x45f03c]
mov dword [esp + 4], edx
mov edx, dword [0x45f040]
mov dword [esp], edx
mov ecx, ebx
mov edx, dword [esp + 0x54]
call fcn.0040f430
add dword [esp + 0x54], ebx
add dword [0x48f530], ebx
sub esi, ebx
test edi, edi
je 0x40fc26
mov eax, ebp
test al, al
je 0x40fc26
mov edx, 0x1a0
mov eax, 0x44f1cf
call fcn.0040f4be
test esi, esi
jne 0x40faf1
jmp 0x40fc37
mov edi, 0
jmp 0x40fc44
mov ebx, dword [esp + 0x58]
mov ebp, dword [esp + 0x60]
mov edi, 8
mov eax, dword [0x48f530]
sub eax, dword [0x48f52c]
mov edx, dword [0x48f528]
lea eax, [edx + eax + 0x48]
cmp eax, dword [0x48f520]
jle 0x40fc70
mov edx, 0x1a6
mov eax, 0x44f1fa
call fcn.0040f4be
mov eax, dword [0x48f530]
mov byte [eax + 0x48f540], 0x50
mov byte [eax + 0x48f541], 0x58
cmp dword [0x4470a0], 0
je 0x40fc9e
lea edx, [eax + 3]
mov dword [0x48f530], edx
mov byte [eax + 0x48f542], 0x2c
jmp 0x40fcae
lea edx, [eax + 3]
mov dword [0x48f530], edx
mov byte [eax + 0x48f542], 0x24
mov edx, dword [0x48f530]
lea eax, [edx + 1]
mov dword [0x48f530], eax
mov byte [edx + 0x48f540], 1
movzx edx, word [ebp + 6]
mov dword [esp + 4], edx
add eax, 0x48f540
mov dword [esp], eax
call fcn.0041baa9
mov eax, dword [0x48f530]
add eax, 8
mov dword [0x48f530], eax
movsx edx, word [ebp + 8]
mov dword [esp + 4], edx
add eax, 0x48f540
mov dword [esp], eax
call fcn.0041baa9
mov eax, dword [0x48f530]
add eax, 8
mov dword [0x48f530], eax
movsx edx, word [ebp + 0xa]
mov dword [esp + 4], edx
add eax, 0x48f540
mov dword [esp], eax
call fcn.0041baa9
mov eax, dword [0x48f530]
add eax, 8
mov dword [0x48f530], eax
movsx edx, word [ebp + 0xc]
mov dword [esp + 4], edx
add eax, 0x48f540
mov dword [esp], eax
call fcn.0041baa9
mov eax, dword [0x48f530]
add eax, 8
mov dword [0x48f530], eax
cmp dword [0x4470a0], 0
je 0x40fd70
mov dword [esp + 4], 0
add eax, 0x48f540
mov dword [esp], eax
call fcn.0041baa9
add dword [0x48f530], 8
movzx eax, word [ebp + 6]
and ax, 0xe000
cmp ax, 0x2000
je 0x40fd86
or edi, 1
jmp 0x40fe1e
mov eax, dword [0x48f530]
sub eax, dword [0x48f52c]
mov edx, dword [0x48f528]
lea eax, [edx + eax + 0x30]
cmp eax, dword [0x48f520]
jle 0x40fdb2
mov edx, 0x1cb
mov eax, 0x44f1fd
call fcn.0040f4be
mov eax, dword [0x48f530]
mov byte [eax + 0x48f540], 0x50
mov byte [eax + 0x48f541], 0x4e
mov byte [eax + 0x48f542], 0x14
lea edx, [eax + 4]
mov dword [0x48f530], edx
mov byte [eax + 0x48f543], 1
or edi, 3
movzx eax, byte [ebp + 0x11]
mov dword [esp + 4], eax
add edx, 0x48f540
mov dword [esp], edx
call fcn.0041baa9
mov eax, dword [0x48f530]
add eax, 8
mov dword [0x48f530], eax
movzx edx, byte [ebp + 0x10]
mov dword [esp + 4], edx
add eax, 0x48f540
mov dword [esp], eax
call fcn.0041baa9
add dword [0x48f530], 8
cmp dword [0x45f048], 1
sbb eax, eax
and eax, 0xffffffe2
add eax, dword [0x48f528]
mov edx, dword [0x48f530]
sub edx, dword [0x48f52c]
lea eax, [eax + edx + 0x54]
cmp eax, dword [0x48f520]
jle 0x40fe57
mov edx, 0x2d3
mov eax, 0x44f200
call fcn.0040f4be
mov eax, dword [0x48f530]
mov byte [eax + 0x48f540], 0x54
mov byte [eax + 0x48f541], 0x46
cmp dword [0x45f048], 0
jne 0x410273
jmp 0x4101d1
test byte [esp + 0x64], 1
je 0x40fee1
mov eax, dword [0x48f530]
sub eax, dword [0x48f52c]
mov edx, dword [0x48f528]
lea eax, [edx + eax + 0x20]
cmp eax, dword [0x48f520]
jle 0x40feaf
mov edx, 0x301
mov eax, 0x44f203
call fcn.0040f4be
mov eax, dword [0x48f530]
mov byte [eax + 0x48f540], 0x52
mov byte [eax + 0x48f541], 0x45
mov byte [eax + 0x48f542], 4
lea edx, [eax + 4]
mov dword [0x48f530], edx
mov byte [eax + 0x48f543], 1
mov esi, edi
or esi, 0xc0
test byte [esp + 0x64], 2
je 0x40ff5e
mov eax, dword [0x48f530]
sub eax, dword [0x48f52c]
mov edx, dword [0x48f528]
lea eax, [edx + eax + 0x28]
cmp eax, dword [0x48f520]
jle 0x40ff14
mov edx, 0x30b
mov eax, 0x44f206
call fcn.0040f4be
mov eax, dword [0x48f530]
mov byte [eax + 0x48f540], 0x50
mov byte [eax + 0x48f541], 0x4c
mov byte [eax + 0x48f542], 0xc
lea edx, [eax + 4]
mov dword [0x48f530], edx
mov byte [eax + 0x48f543], 1
mov dword [esp + 4], 0
lea edx, [eax + 0x48f544]
mov dword [esp], edx
call fcn.0041baa9
add dword [0x48f530], 8
or esi, 0x20
test byte [esp + 0x64], 4
je 0x40ffdb
mov eax, dword [0x48f530]
sub eax, dword [0x48f52c]
mov edx, dword [0x48f528]
lea eax, [edx + eax + 0x28]
cmp eax, dword [0x48f520]
jle 0x40ff91
mov edx, 0x318
mov eax, 0x44f209
call fcn.0040f4be
mov eax, dword [0x48f530]
mov byte [eax + 0x48f540], 0x43
mov byte [eax + 0x48f541], 0x4c
mov byte [eax + 0x48f542], 0xc
lea edx, [eax + 4]
mov dword [0x48f530], edx
mov byte [eax + 0x48f543], 1
mov dword [esp + 4], 0
lea edx, [eax + 0x48f544]
mov dword [esp], edx
call fcn.0041baa9
add dword [0x48f530], 8
or esi, 0x10
cmp dword [0x45f0f8], 0
je 0x410142
movzx eax, word [ebp + 6]
and ax, 0xf000
cmp ax, 0x8000
jne 0x410142
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x44f20c
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
test eax, eax
je 0x410142
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 1
lea ebp, [esp + 0x20]
mov dword [esp], ebp
call sub.msvcrt.dll_fread
mov dword [esp + 0x18], eax
mov dword [esp + 8], 8
mov dword [esp + 4], 0x44f230
mov dword [esp], ebp
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x410345
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.0041bb00
mov ebp, eax
movzx eax, byte [esp + 0x2c]
mov byte [esp + 0x1e], al
movzx eax, byte [esp + 0x2d]
mov byte [esp + 0x1f], al
mov dword [esp], edi
call sub.msvcrt.dll_fclose
cmp dword [esp + 0x18], 0x10
jne 0x410142
mov eax, dword [0x48f530]
sub eax, dword [0x48f52c]
mov edx, dword [0x48f528]
lea eax, [edx + eax + 0x2c]
cmp eax, dword [0x48f520]
jle 0x4100db
mov edx, 0x35a
mov eax, 0x44f20f
call fcn.0040f4be
mov eax, dword [0x48f530]
mov byte [eax + 0x48f540], 0x5a
mov byte [eax + 0x48f541], 0x46
mov byte [eax + 0x48f542], 0x10
mov byte [eax + 0x48f543], 1
mov byte [eax + 0x48f544], 0x70
mov byte [eax + 0x48f545], 0x7a
movzx ecx, byte [esp + 0x1e]
mov byte [eax + 0x48f546], cl
lea edx, [eax + 8]
mov dword [0x48f530], edx
movzx ecx, byte [esp + 0x1f]
mov byte [eax + 0x48f547], cl
mov dword [esp + 4], ebp
lea edx, [eax + 0x48f548]
mov dword [esp], edx
call fcn.0041baa9
add dword [0x48f530], 8
test byte [esp + 0x64], 8
je 0x410158
mov edx, 0x36e
mov eax, 0x44f212
call fcn.0040f4be
mov ecx, dword [esp + 0x14]
mov eax, esi
mov byte [ecx + 0x48f544], al
mov eax, dword [0x48f52c]
test eax, eax
je 0x410186
mov edx, dword [0x48f530]
sub edx, eax
mov dword [esp + 4], edx
add eax, 0x48f538
mov dword [esp], eax
call fcn.0041baa9
mov eax, dword [0x48f530]
mov dword [esp], eax
call fcn.00402e15
mov dword [ebx + 0x178], eax
mov esi, dword [0x48f530]
mov dword [ebx + 0x180], esi
mov edx, dword [0x48f524]
test edx, edx
cmove edx, esi
mov dword [ebx + 0x17c], edx
mov dword [esp + 8], esi
mov dword [esp + 4], 0x48f540
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, esi
jmp 0x41035e
mov byte [eax + 0x48f542], 0x1a
mov byte [eax + 0x48f543], 1
lea ecx, [eax + 5]
mov dword [0x48f530], ecx
mov byte [eax + 0x48f544], 0xe
mov esi, edi
or esi, 0x80
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp + 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
add ecx, 0x48f540
mov dword [esp], ecx
call fcn.004026bc
mov eax, dword [0x48f530]
lea ecx, [eax + 7]
mov dword [0x48f530], ecx
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
add ecx, 0x48f540
mov dword [esp], ecx
call fcn.004026bc
mov eax, dword [0x48f530]
lea ecx, [eax + 7]
mov dword [0x48f530], ecx
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp + 0x34]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
add ecx, 0x48f540
mov dword [esp], ecx
call fcn.004026bc
add dword [0x48f530], 7
jmp 0x40fe7c
mov byte [eax + 0x48f542], 0x38
mov byte [eax + 0x48f543], 1
lea ecx, [eax + 5]
mov dword [0x48f530], ecx
mov byte [eax + 0x48f544], 0x8e
mov esi, edi
or esi, 0x80
mov dword [esp + 0x10], 0xffffff9c
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp + 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
add ecx, 0x48f540
mov dword [esp], ecx
call fcn.00402796
mov eax, dword [0x48f530]
lea ecx, [eax + 0x11]
mov dword [0x48f530], ecx
mov dword [esp + 0x10], 0xffffff9c
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
add ecx, 0x48f540
mov dword [esp], ecx
call fcn.00402796
mov eax, dword [0x48f530]
lea ecx, [eax + 0x11]
mov dword [0x48f530], ecx
mov dword [esp + 0x10], 0xffffff9c
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp + 0x34]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
add ecx, 0x48f540
mov dword [esp], ecx
call fcn.00402796
add dword [0x48f530], 0x11
jmp 0x40fe7c
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.0041bb00
mov dword [esp], edi
call sub.msvcrt.dll_fclose
jmp 0x410142
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret