Function at 0x4a1410
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9240
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4e70ac]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov eax, dword [ebx + 8]
xor edi, edi
lea ecx, [ebx + 0x10]
mov dword [ebx + 0xa0], edi
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 4], edi
call eax
add esp, 8
cmp eax, edi
jne 0x4a147c
push str.GetFileSizeEx__
push edi
push 0x9c
push str..QHPEParser.cpp
call fcn.0049d590
add esp, 0x10
cmp dword [ebp + 8], edi
jne 0x4a1486
mov dword [ebx + 0x20], edi
jmp 0x4a148d
mov dword [ebx + 0x20], 1
lea ecx, [ebx + 0x24]
call fcn.0049dd00
push 0x10000
call fcn.0049dc20
add esp, 4
mov dword [ebx + 0x7c], eax
cmp eax, edi
jne 0x4a14c1
push 0x4cbb04
push edi
push 0xa3
push str..QHPEParser.cpp
call fcn.0049d590
add esp, 0x10
mov eax, dword [ebx + 8]
xor ecx, ecx
lea esi, [ebx + 0xe4]
mov word [esi], cx
lea ecx, [ebp - 0x24]
push ecx
push edi
push edi
push 2
mov dword [ebx + 0x98], edi
mov dword [ebx + 0x9c], edi
mov dword [ebx + 0x90], edi
mov dword [ebx + 0x94], edi
mov dword [ebx + 0x88], edi
mov dword [ebx + 0x8c], edi
mov dword [ebx + 0x80], edi
mov edx, dword [eax]
mov edx, dword [edx + 4]
push esi
push eax
call edx
add esp, 0x18
cmp eax, edi
jne 0x4a1516
call fcn.0049d340
cmp dword [ebp - 0x24], 2
jne 0x4a1526
mov eax, 0x5a4d
cmp word [esi], ax
je 0x4a153f
push 0x4ccdc8
push 1
push 0xb0
push str..QHPEParser.cpp
call fcn.0049d670
add esp, 0x10
mov edx, dword [ebx + 0x20]
push edx
push 0x40
xor ecx, ecx
push ecx
xor eax, eax
push eax
push esi
mov ecx, ebx
call fcn.004a0ff0
cmp eax, edi
jne 0x4a155c
call fcn.0049d340
mov eax, dword [ebx + 0x120]
add eax, 4
cmp edi, dword [ebx + 0x14]
jl 0x4a1594
jg 0x4a1571
cmp eax, dword [ebx + 0x10]
jbe 0x4a1594
push str.DOS
push 1
push 0xba
push str..QHPEParser.cpp
mov dword [ebx + 0xa0], 2
call fcn.0049d670
add esp, 0x10
mov eax, dword [ebx + 0x120]
cdq
mov edi, eax
mov eax, dword [ebx + 0x20]
push eax
push 4
mov esi, edx
push esi
push edi
lea ecx, [ebp - 0x30]
push ecx
mov ecx, ebx
call fcn.004a0ff0
test eax, eax
jne 0x4a15bb
call fcn.0049d340
mov ecx, dword [ebp - 0x30]
movzx eax, cx
sub eax, 0x454c
je 0x4a163d
sub eax, 2
je 0x4a1600
sub eax, 2
je 0x4a15ea
push str.DOS
push 1
mov dword [ebx + 0xa0], 2
push 0xd4
jmp 0x4a1653
cmp ecx, 0x4550
je 0x4a1660
push 0x4ccda0
push 1
push 0xd0
jmp 0x4a1653
mov edx, dword [ebx + 0x20]
push edx
add edi, 2
push 0x40
adc esi, 0
push esi
push edi
lea eax, [ebx + 0xa4]
push eax
mov ecx, ebx
mov dword [ebx + 0xa0], 3
call fcn.004a0ff0
test eax, eax
jne 0x4a162f
call fcn.0049d340
push 0x4ccd88
push 1
push 0xc8
jmp 0x4a1653
push 0x4ccd70
push 1
mov dword [ebx + 0xa0], 4
push 0xcc
push str..QHPEParser.cpp
call fcn.0049d670
add esp, 0x10
mov ecx, dword [ebx + 0x20]
push ecx
add edi, 4
push 0x14
adc esi, 0
push esi
lea eax, [ebx + 0x124]
push edi
push eax
mov ecx, ebx
mov dword [ebx + 0xa0], 6
call fcn.004a0ff0
test eax, eax
jne 0x4a168f
call fcn.0049d340
movzx eax, word [ebx + 0x124]
add edi, 0x14
adc esi, 0
mov edx, 0x14c
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], esi
cmp ax, dx
je 0x4a16e3
mov ecx, 0x200
cmp ax, cx
je 0x4a16e3
mov edx, 0x8664
cmp ax, dx
je 0x4a16e3
push 0x4ccd4c
push 1
push 0xe2
push str..QHPEParser.cpp
mov dword [ebx + 0xa0], 5
call fcn.0049d670
add esp, 0x10
mov ecx, dword [ebx + 0x20]
push ecx
push 2
push esi
lea eax, [ebx + 0x138]
push edi
push eax
mov ecx, ebx
call fcn.004a0ff0
test eax, eax
jne 0x4a1702
call fcn.0049d340
movzx eax, word [ebx + 0x138]
mov edx, 0x10b
cmp ax, dx
jne 0x4a1993
movzx eax, word [ebx + 0x134]
mov dword [ebp - 0x24], eax
cmp eax, 0xe0
jbe 0x4a1730
mov eax, 0xe0
mov dword [ebp - 0x24], eax
mov edx, dword [ebx + 0x20]
push edx
push eax
push esi
lea ecx, [ebx + 0x2e4]
push edi
push ecx
mov ecx, ebx
call fcn.004a0ff0
test eax, eax
jne 0x4a174e
call fcn.0049d340
lea eax, [ebx + 0x2e4]
lea esi, [eax + 0x60]
lea ecx, [edi + 0x40]
mov dword [ebx + 0x250], eax
mov dword [ebx + 0x258], esi
mov dword [ebx + 0x408], ecx
cmp dword [eax + 0x5c], 4
ja 0x4a177e
mov dword [ebx + 0x40c], 0xffffffff
jmp 0x4a1787
sub edi, 0xffffff80
mov dword [ebx + 0x40c], edi
mov edx, dword [ebx + 0x340]
mov dword [ebx + 0x13c], edx
mov eax, dword [ebx + 0x2f4]
mov dword [ebx + 0x140], eax
mov ecx, dword [ebx + 0x304]
mov dword [ebx + 0x144], ecx
mov edx, dword [ebx + 0x31c]
mov dword [ebx + 0x14c], edx
mov eax, dword [ebx + 0x308]
mov dword [ebx + 0x148], eax
mov ecx, dword [ebx + 0x2e8]
mov dword [ebx + 0x150], ecx
mov edx, dword [ebx + 0x300]
mov dword [ebx + 0x158], edx
xor eax, eax
mov dword [ebx + 0x15c], eax
movzx ecx, word [ebx + 0x2e4]
mov word [ebx + 0x160], cx
mov dl, byte [ebx + 0x2e6]
mov byte [ebx + 0x162], dl
mov cl, byte [ebx + 0x2e7]
mov byte [ebx + 0x163], cl
mov edx, dword [ebx + 0x2e8]
mov dword [ebx + 0x164], edx
mov ecx, dword [ebx + 0x2ec]
mov dword [ebx + 0x168], ecx
mov edx, dword [ebx + 0x2f0]
mov dword [ebx + 0x16c], edx
mov ecx, dword [ebx + 0x2f4]
mov dword [ebx + 0x170], ecx
mov edx, dword [ebx + 0x2f8]
mov dword [ebx + 0x174], edx
mov ecx, dword [ebx + 0x300]
mov dword [ebx + 0x178], ecx
mov dword [ebx + 0x17c], eax
mov edx, dword [ebx + 0x304]
mov dword [ebx + 0x180], edx
mov ecx, dword [ebx + 0x308]
mov dword [ebx + 0x184], ecx
movzx edx, word [ebx + 0x30c]
mov word [ebx + 0x188], dx
movzx ecx, word [ebx + 0x30e]
mov word [ebx + 0x18a], cx
movzx edx, word [ebx + 0x310]
mov word [ebx + 0x18c], dx
movzx ecx, word [ebx + 0x312]
mov word [ebx + 0x18e], cx
movzx edx, word [ebx + 0x314]
mov word [ebx + 0x190], dx
movzx ecx, word [ebx + 0x316]
mov word [ebx + 0x192], cx
mov edx, dword [ebx + 0x318]
mov dword [ebx + 0x194], edx
mov ecx, dword [ebx + 0x31c]
mov dword [ebx + 0x198], ecx
mov edx, dword [ebx + 0x320]
mov dword [ebx + 0x19c], edx
mov ecx, dword [ebx + 0x324]
mov dword [ebx + 0x1a0], ecx
movzx edx, word [ebx + 0x328]
mov word [ebx + 0x1a4], dx
movzx ecx, word [ebx + 0x32a]
mov word [ebx + 0x1a6], cx
mov edx, dword [ebx + 0x32c]
mov dword [ebx + 0x1a8], edx
mov dword [ebx + 0x1ac], eax
mov ecx, dword [ebx + 0x330]
mov dword [ebx + 0x1b0], ecx
mov dword [ebx + 0x1b4], eax
mov edx, dword [ebx + 0x334]
mov dword [ebx + 0x1b8], edx
mov dword [ebx + 0x1bc], eax
mov ecx, dword [ebx + 0x338]
mov dword [ebx + 0x1c0], ecx
mov dword [ebx + 0x1c4], eax
mov edx, dword [ebx + 0x33c]
mov dword [ebx + 0x1c8], edx
mov ecx, dword [ebx + 0x340]
mov dword [ebx + 0x1cc], ecx
lea edi, [ebx + 0x1d0]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebx + 0x308]
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
jmp 0x4a1aa2
mov ecx, 0x20b
cmp ax, cx
jne 0x4a1a89
movzx eax, word [ebx + 0x134]
mov dword [ebp - 0x24], eax
cmp eax, 0xf0
jbe 0x4a19ba
mov eax, 0xf0
mov dword [ebp - 0x24], eax
mov edx, dword [ebx + 0x20]
push edx
push eax
push esi
lea ecx, [ebx + 0x2e4]
push edi
push ecx
mov ecx, ebx
call fcn.004a0ff0
test eax, eax
jne 0x4a19d8
call fcn.0049d340
lea eax, [ebx + 0x2e4]
lea ecx, [eax + 0x70]
lea edx, [edi + 0x40]
mov dword [ebx + 0x254], eax
mov dword [ebx + 0x258], ecx
mov dword [ebx + 0x408], edx
cmp dword [eax + 0x6c], 4
ja 0x4a1a08
mov dword [ebx + 0x40c], 0xffffffff
jmp 0x4a1a14
add edi, 0x90
mov dword [ebx + 0x40c], edi
mov ecx, dword [ebx + 0x350]
lea eax, [ebx + 0x2e4]
mov dword [ebx + 0x13c], ecx
mov edx, dword [eax + 0x10]
mov dword [ebx + 0x140], edx
mov ecx, dword [eax + 0x20]
mov dword [ebx + 0x144], ecx
mov edx, dword [eax + 0x38]
mov dword [ebx + 0x14c], edx
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x148], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x150], edx
mov ecx, dword [eax + 0x18]
mov dword [ebx + 0x158], ecx
mov edx, dword [eax + 0x1c]
mov esi, eax
lea edi, [ebx + 0x160]
mov ecx, 0x3c
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x38]
mov dword [ebx + 0x15c], edx
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
jmp 0x4a1aa2
push 0x4ccd30
push 1
push 0x13d
push str..QHPEParser.cpp
call fcn.0049d670
add esp, 0x10
mov eax, 0x10
cmp dword [ebx + 0x13c], eax
jbe 0x4a1ab5
mov dword [ebx + 0x13c], eax
movzx eax, word [ebx + 0x134]
cdq
add edi, eax
mov ecx, ebx
adc esi, edx
call fcn.004a0610
test eax, eax
jne 0x4a1ad1
call fcn.0049d340
movzx eax, word [ebx + 0x126]
lea ecx, [eax + eax*4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
push ecx
mov dword [ebx + 0x3d4], eax
call fcn.0049dc20
add esp, 4
mov dword [ebx + 0x3d8], eax
test eax, eax
jne 0x4a1b12
push 0x4cbb04
push eax
push 0x146
push str..QHPEParser.cpp
call fcn.0049d590
add esp, 0x10
mov eax, dword [ebx + 0x3d4]
mov edx, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x3d8]
lea eax, [eax + eax*4]
add eax, eax
push edx
add eax, eax
add eax, eax
push eax
push esi
push edi
push ecx
mov ecx, ebx
call fcn.004a0ff0
test eax, eax
jne 0x4a1b3f
call fcn.0049d340
mov eax, dword [ebx + 0x3d4]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
add edx, edx
add edi, edx
mov ecx, ebx
adc esi, 0
call fcn.004a03a0
test eax, eax
jne 0x4a1b63
call fcn.0049d340
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov edx, ecx
add edx, edi
mov edi, eax
adc edi, esi
push eax
sub edx, 1
push ecx
sbb edi, 0
push edi
push edx
call fcn.00439b20
mov ecx, dword [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x2c]
push ecx
push edx
push eax
call fcn.00439ae0
mov dword [ebx + 0x1c], edx
mov edx, dword [ebx + 0x3d4]
add edx, edx
add edx, edx
push edx
mov dword [ebx + 0x18], eax
call fcn.0049dc20
add esp, 4
mov dword [ebx + 0x3dc], eax
test eax, eax
jne 0x4a1bca
push 0x4cbb04
push eax
push 0x14e
push str..QHPEParser.cpp
call fcn.0049d590
add esp, 0x10
mov eax, dword [ebx + 0x3d4]
mov ecx, dword [ebx + 0x3dc]
add eax, eax
add eax, eax
push eax
push 0
push ecx
call fcn.00436ad0
add esp, 0xc
xor edi, edi
jmp 0x4a1bf0
cmp edi, dword [ebx + 0x3d4]
jae 0x4a1cb9
mov eax, dword [ebx + 0x3d8]
lea edx, [edi + edi*4]
lea ecx, [eax + edx*8]
push 8
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.004aab30
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
call fcn.00438500
mov eax, esp
mov dword [ebp - 0x10], esp
push esi
push eax
push 0xffffffffffffffff
xor ecx, ecx
lea edx, [ebp - 0x20]
push edx
push ecx
push ecx
mov dword [ebp - 0x28], eax
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a1c53
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
lea eax, [esi + esi]
push eax
call fcn.0049dc20
mov ecx, dword [ebx + 0x3dc]
mov dword [ecx + edi*4], eax
mov edx, dword [ebx + 0x3dc]
add esp, 4
cmp dword [edx + edi*4], 0
jne 0x4a1c9f
push 0x4cbb04
push 0
push 0x159
push str..QHPEParser.cpp
call fcn.0049d590
add esp, 0x10
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebx + 0x3dc]
mov edx, dword [ecx + edi*4]
push eax
push esi
push edx
call fcn.0049aa20
inc edi
jmp 0x4a1bf0
mov eax, dword [ebx + 0x3d4]
add eax, eax
add eax, eax
mov esi, 1
push eax
mov dword [ebx + 0xa0], esi
call fcn.0049dc20
xor edi, edi
add esp, 4
mov dword [ebx + 0x3e0], eax
cmp eax, edi
jne 0x4a1cfb
push 0x4cbb04
push edi
push 0x164
push str..QHPEParser.cpp
call fcn.0049d590
add esp, 0x10
mov ecx, ebx
call fcn.004a02b0
mov ecx, dword [ebx + 0x3d4]
mov edx, dword [ebx + 0x3e0]
mov eax, dword [edx + ecx*4 - 4]
mov ecx, dword [ebx + 0x3d8]
lea eax, [eax + eax*4]
mov edx, dword [ecx + eax*8 + 0x14]
add edx, dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [ebx + 0x10]
xor eax, eax
sub ecx, edx
mov edx, dword [ebx + 0x14]
sbb edx, eax
cmp edx, edi
mov dword [ebx + 0x3e8], ecx
mov dword [ebx + 0x3ec], edx
jg 0x4a1d54
jl 0x4a1d48
cmp ecx, edi
jae 0x4a1d54
mov dword [ebx + 0x3e8], edi
mov dword [ebx + 0x3ec], edi
cmp dword [ebx + 0x1cc], 2
ja 0x4a1d69
mov dword [ebx + 0x410], 0xffffffff
jmp 0x4a1db4
mov edx, dword [ebx + 0x258]
mov edx, dword [edx + 0x10]
mov ecx, dword [ebx + 4]
lea eax, [ebx + 4]
push edx
push eax
mov eax, dword [ecx]
call eax
add esp, 8
mov dword [ebp - 0x34], edx
mov dword [ebx + 0x410], eax
jmp 0x4a1db4
mov eax, esi
lea esp, [ebp - 0x50]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043640c
mov esp, ebp
pop ebp
ret 4