Function at 0x49285b
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [0x4e8008]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
test esi, esi
je 0x492bb6
xor edx, edx
call fcn.0049be8e
xor eax, eax
mov dword [esp + 0x1c], 0x52444849
mov byte [esp + 0x20], al
mov dword [esp + 0xc], 0x54414449
mov byte [esp + 0x10], al
mov dword [esp + 0x24], 0x444e4549
mov byte [esp + 0x28], al
mov dword [esp + 0x14], 0x45544c50
mov byte [esp + 0x18], al
mov dword [esp + 0x2c], 0x44474b62
mov byte [esp + 0x30], al
mov dword [esp + 0x34], 0x4d524863
mov byte [esp + 0x38], al
mov dword [esp + 0x3c], 0x414d4167
mov byte [esp + 0x40], al
mov dword [esp + 0x44], 0x54534968
mov byte [esp + 0x48], al
mov dword [esp + 0x7c], 0x50434369
mov byte [esp + 0x80], al
mov dword [esp + 0x4c], 0x7346466f
mov byte [esp + 0x50], al
mov dword [esp + 0x54], 0x4c414370
mov byte [esp + 0x58], al
mov dword [esp + 0x64], 0x73594870
mov byte [esp + 0x68], al
mov dword [esp + 0x6c], 0x54494273
mov byte [esp + 0x70], al
mov dword [esp + 0x5c], 0x4c414373
mov byte [esp + 0x60], al
mov dword [esp + 0x84], 0x544c5073
mov byte [esp + 0x88], al
mov dword [esp + 0x74], 0x42475273
mov byte [esp + 0x78], al
mov dword [esp + 0x8c], 0x74584574
mov byte [esp + 0x90], al
mov dword [esp + 0x94], 0x454d4974
mov byte [esp + 0x98], al
mov dword [esp + 0x9c], 0x534e5274
mov byte [esp + 0xa0], al
mov dword [esp + 0xa4], 0x7458547a
mov byte [esp + 0xa8], al
mov ecx, esi
call fcn.0049a1f3
mov edi, eax
lea edx, [esi + 0x11c]
mov ecx, dword [edx]
lea eax, [esp + 0x1c]
cmp ecx, dword [eax]
jne 0x4929c6
push edi
mov edx, ebx
mov ecx, esi
call fcn.0049ac85
jmp 0x492bab
mov eax, dword [edx]
lea ecx, [esp + 0x24]
cmp eax, dword [ecx]
mov ecx, esi
jne 0x4929dd
push edi
call fcn.0049afbd
jmp 0x492bab
call fcn.004914e0
test eax, eax
lea ecx, [esp + 0xc]
mov eax, dword [edx]
je 0x492a2b
cmp eax, dword [ecx]
jne 0x492a05
test edi, edi
jne 0x492bcb
test dword [esi + 0x68], 0x2000
jne 0x492bcb
push edi
mov edx, ebx
mov ecx, esi
call fcn.00499cec
mov eax, dword [esi + 0x11c]
pop ecx
lea ecx, [esp + 0x14]
cmp eax, dword [ecx]
jne 0x492bac
or dword [esi + 0x68], 2
jmp 0x492bac
cmp eax, dword [ecx]
jne 0x492a52
test edi, edi
jne 0x492bcb
test dword [esi + 0x68], 0x2000
jne 0x492bcb
mov edx, edi
mov ecx, esi
call fcn.0049be8e
jmp 0x492bac
lea ecx, [esp + 0x14]
mov edx, ebx
push edi
cmp eax, dword [ecx]
jne 0x492a69
mov ecx, esi
call fcn.0049a43b
jmp 0x492bab
lea ecx, [esp + 0x30]
cmp eax, dword [ecx]
jne 0x492a7d
mov ecx, esi
call fcn.00499aa4
jmp 0x492bab
lea ecx, [esp + 0x38]
cmp eax, dword [ecx]
jne 0x492a91
mov ecx, esi
call fcn.0049b8c7
jmp 0x492bab
lea ecx, [esp + 0x40]
cmp eax, dword [ecx]
jne 0x492aa5
mov ecx, esi
call fcn.0049bf11
jmp 0x492bab
lea ecx, [esp + 0x48]
cmp eax, dword [ecx]
jne 0x492ab9
mov ecx, esi
call fcn.0049c037
jmp 0x492bab
lea ecx, [esp + 0x50]
cmp eax, dword [ecx]
jne 0x492acd
mov ecx, esi
call fcn.00499c3e
jmp 0x492bab
lea ecx, [esp + 0x58]
cmp eax, dword [ecx]
jne 0x492ae1
mov ecx, esi
call fcn.0049aa3f
jmp 0x492bab
lea ecx, [esp + 0x60]
cmp eax, dword [ecx]
jne 0x492af5
mov ecx, esi
call fcn.00499930
jmp 0x492bab
lea ecx, [esp + 0x68]
cmp eax, dword [ecx]
jne 0x492b09
mov ecx, esi
call fcn.00499ebc
jmp 0x492bab
lea ecx, [esp + 0x70]
cmp eax, dword [ecx]
jne 0x492b1d
mov ecx, esi
call fcn.0049bd94
jmp 0x492bab
lea ecx, [esp + 0x78]
cmp eax, dword [ecx]
jne 0x492b2e
mov ecx, esi
call fcn.0049a89e
jmp 0x492bab
lea ecx, [esp + 0x80]
cmp eax, dword [ecx]
jne 0x492b42
mov ecx, esi
call fcn.0049c54a
jmp 0x492bab
lea ecx, [esp + 0x88]
cmp eax, dword [ecx]
jne 0x492b56
mov ecx, esi
call fcn.0049c2bc
jmp 0x492bab
lea ecx, [esp + 0x90]
cmp eax, dword [ecx]
jne 0x492b6a
mov ecx, esi
call fcn.0049bc24
jmp 0x492bab
lea ecx, [esp + 0x98]
cmp eax, dword [ecx]
jne 0x492b7e
mov ecx, esi
call fcn.0049b7fc
jmp 0x492bab
lea ecx, [esp + 0xa0]
cmp eax, dword [ecx]
jne 0x492b92
mov ecx, esi
call fcn.0049adf5
jmp 0x492bab
lea ecx, [esp + 0xa8]
cmp eax, dword [ecx]
mov ecx, esi
jne 0x492ba6
call fcn.0049a277
jmp 0x492bab
call fcn.00499cec
pop ecx
test byte [esi + 0x68], 0x10
je 0x49299e
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00413912
mov esp, ebp
pop ebp
ret
mov edx, str.Too_many_IDATs_found
mov ecx, esi
call fcn.00499490
int3