Function at 0x49378f
Capabilities:
Contain obfuscated stackstrings
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5007f4
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x5466b0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
inc ebx
mov dword [esp + 0x3c], ebx
cmp eax, ebx
jne 0x4938a6
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x49409e
cmp dword [ebp + 0xc], edi
je 0x49409e
push dword [ebp + 0xc]
lea eax, [esp + 0x3c]
push eax
call fcn.0046405d
pop ecx
pop ecx
mov dword [esp + 0x78], edi
mov edx, dword [eax]
lea ecx, [esp + 0x28]
call fcn.0046719d
lea ecx, [esp + 0x38]
mov byte [esp + 0x78], 2
call fcn.004087f0
push dword [esp + 0x28]
call fcn.004673c1
push 0x54cfe0
push 0x10
mov esi, eax
call fcn.004cba2a
pop ecx
pop ecx
cmp esi, edi
je 0x493874
mov dword [esp + 0x34], eax
mov byte [esp + 0x78], 3
cmp eax, edi
je 0x49385a
call fcn.00430ac0
movzx edi, ax
shl edi, 0x10
call fcn.00430af0
movzx eax, ax
or eax, edi
cdq
push edx
push eax
mov eax, dword [esp + 0x3c]
call fcn.00431050
jmp 0x49385c
xor eax, eax
mov ecx, dword [ebp + 0x14]
push eax
mov byte [esp + 0x7c], 2
call fcn.0040ed50
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x493898
mov ecx, eax
mov dword [esp + 0x40], ecx
xor eax, eax
mov byte [esp + 0x78], 4
cmp ecx, edi
je 0x49388a
call fcn.0040c000
mov ecx, dword [ebp + 0x14]
push eax
mov byte [esp + 0x7c], 2
call fcn.0040ed50
lea ecx, [esp + 0x28]
call fcn.004087f0
jmp 0x49409e
cmp eax, 2
jne 0x493ad9
lea esi, [esp + 0x18]
call fcn.00404790
xor ebx, ebx
mov dword [esp + 0x78], 5
cmp dword [ebp + 0x10], ebx
jbe 0x493acb
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x493acb
mov eax, dword [ecx + 4]
cmp dword [eax], 6
mov byte [esp + 0x1c], 0x89
mov byte [esp + 0x1d], 0x50
mov byte [esp + 0x1e], 0x4e
mov byte [esp + 0x1f], 0x47
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], 0xd8
mov byte [esp + 0x16], 0xff
mov byte [esp + 0x10], 0x42
mov byte [esp + 0x11], 0x4d
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 1
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0x47
mov byte [esp + 0x25], 0x49
mov byte [esp + 0x26], 0x46
mov byte [esp + 0x27], 0x38
jne 0x4939ac
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x493a90
cmp dword [eax + 0xc], 4
jbe 0x493a90
mov eax, dword [eax + 4]
mov ecx, dword [eax]
cmp ecx, dword [esp + 0x1c]
jne 0x493957
mov edx, 0x51e944
jmp 0x49399e
push 3
pop ecx
lea edi, [esp + 0x14]
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x49396d
mov edx, 0x51e948
jmp 0x49399e
mov cx, word [eax]
cmp cx, word [esp + 0x10]
jne 0x49397e
mov edx, 0x51e94c
jmp 0x49399e
mov ecx, dword [eax]
cmp ecx, dword [esp + 0x20]
jne 0x49398d
mov edx, str.icon
jmp 0x49399e
mov eax, ecx
cmp eax, dword [esp + 0x24]
jne 0x493a90
mov edx, 0x51e950
lea ebx, [esp + 0x18]
call fcn.00417210
jmp 0x493a90
push ecx
lea eax, [esp + 0x3c]
push eax
call fcn.0046405d
pop ecx
pop ecx
mov byte [esp + 0x78], 6
mov edx, dword [eax]
lea ecx, [esp + 0x30]
call fcn.0046719d
lea ecx, [esp + 0x38]
mov byte [esp + 0x78], 8
call fcn.004087f0
push ebx
push 0x80
push 3
push ebx
push 7
push SysReAllocString
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x2c], eax
cmp eax, 0xffffffff
je 0x493a87
xor eax, eax
push ebx
lea edi, [esp + 0x2c]
stosd dword es:[edi], eax
lea eax, [esp + 0x38]
push eax
push 4
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x3c]
mov dword [esp + 0x48], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x1c]
jne 0x493a31
mov edx, 0x51e944
jmp 0x493a74
push 3
pop ecx
lea edi, [esp + 0x14]
lea esi, [esp + 0x28]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x493a49
mov edx, 0x51e948
jmp 0x493a74
mov cx, word [esp + 0x28]
cmp cx, word [esp + 0x10]
jne 0x493a5c
mov edx, 0x51e94c
jmp 0x493a74
cmp eax, dword [esp + 0x20]
jne 0x493a69
mov edx, str.icon
jmp 0x493a74
cmp eax, dword [esp + 0x24]
jne 0x493a7d
mov edx, 0x51e950
lea ebx, [esp + 0x18]
call fcn.00417210
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x30]
call fcn.004087f0
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
mov esi, eax
pop ecx
mov dword [esp + 0x40], esi
mov byte [esp + 0x78], 9
test esi, esi
je 0x493abb
mov ebx, dword [esp + 0x18]
and dword [esi], 0
call fcn.0040c040
jmp 0x493abd
xor esi, esi
mov ecx, dword [ebp + 0x14]
push esi
mov byte [esp + 0x7c], 5
call fcn.0040ed50
lea eax, [esp + 0x18]
call fcn.0042afc0
jmp 0x49409e
cmp eax, 3
jne 0x493b5a
mov eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, edi
je 0x493b2a
cmp dword [ebp + 0x10], edi
je 0x493b2a
mov eax, dword [eax + 4]
cmp dword [eax], 6
jne 0x493b2a
mov eax, dword [eax + 8]
cmp eax, edi
je 0x493b2a
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 4]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
cmp eax, edi
je 0x493b2a
push eax
call fcn.00493453
mov esi, eax
pop ecx
test esi, esi
je 0x493b2a
mov ecx, esi
call fcn.00493509
mov edi, eax
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax]
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x78], 0xa
test ecx, ecx
je 0x493c78
mov eax, edi
call fcn.0041a750
jmp 0x493c7a
cmp eax, 4
jne 0x493c84
xor ebx, ebx
cmp dword [ebp + 0x10], 3
jb 0x493c4a
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x493c4a
mov eax, dword [esi + 4]
cmp dword [eax], 6
jne 0x493bdd
mov eax, dword [eax + 8]
test eax, eax
je 0x493c4a
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 4]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
test eax, eax
je 0x493c4a
push eax
call fcn.00493453
mov edi, eax
pop ecx
test edi, edi
je 0x493c4a
mov ecx, dword [esi + 0x1c]
mov esi, dword [esi + 0x10]
call fcn.0040c5b0
push eax
mov ecx, esi
call fcn.0040c5b0
push eax
mov eax, edi
call fcn.00493643
pop ecx
pop ecx
mov ebx, eax
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
jmp 0x493c4a
lea eax, [esp + 0x38]
push esi
push eax
call fcn.0046405d
pop ecx
pop ecx
mov dword [esp + 0x78], 0xb
mov edx, dword [eax]
lea ecx, [esp + 0x30]
call fcn.0046719d
lea ecx, [esp + 0x38]
mov byte [esp + 0x78], 0xd
call fcn.004087f0
push dword [esp + 0x30]
call fcn.004673c1
mov edi, eax
test edi, edi
je 0x493c41
mov ecx, dword [esi + 0x1c]
mov esi, dword [esi + 0x10]
call fcn.0040c5b0
push eax
mov ecx, esi
call fcn.0040c5b0
push eax
mov eax, edi
call fcn.00493643
pop ecx
pop ecx
mov ebx, eax
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
lea ecx, [esp + 0x30]
call fcn.004087f0
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x78], 0xe
test eax, eax
je 0x493c78
mov eax, ebx
cdq
push edx
push eax
mov eax, dword [esp + 0x40]
call fcn.00431080
jmp 0x493c7a
xor eax, eax
or dword [esp + 0x78], 0xffffffff
jmp 0x494080
cmp eax, 5
jne 0x49408b
push 0x54cfe0
push 0x20
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x40], eax
xor edi, edi
mov dword [esp + 0x78], 0xf
cmp eax, edi
je 0x493cba
mov esi, eax
call fcn.00460b7c
mov dword [esp + 0x20], eax
jmp 0x493cbe
mov dword [esp + 0x20], edi
or dword [esp + 0x78], 0xffffffff
cmp dword [esp + 0x20], edi
je 0x49405d
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x49405d
cmp dword [ebp + 0x10], edi
jbe 0x49405d
mov eax, dword [esi + 4]
cmp dword [eax], 6
jne 0x493d15
mov eax, dword [eax + 8]
cmp eax, edi
je 0x49405d
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 4]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
cmp eax, edi
je 0x49405d
push eax
call fcn.00493453
pop ecx
mov ebx, eax
jmp 0x493d5c
lea eax, [esp + 0x38]
push esi
push eax
call fcn.0046405d
pop ecx
pop ecx
mov dword [esp + 0x78], 0x10
mov edx, dword [eax]
lea ecx, [esp + 0x30]
call fcn.0046719d
lea ecx, [esp + 0x38]
mov byte [esp + 0x78], 0x12
call fcn.004087f0
push dword [esp + 0x30]
call fcn.004673c1
or dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0x30]
mov ebx, eax
call fcn.004087f0
cmp ebx, edi
je 0x49405d
cmp dword [ebp + 0x10], 3
jb 0x493d80
mov ecx, dword [esi + 0x10]
call fcn.0040c5b0
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x10], eax
call fcn.0040c5b0
jmp 0x493d90
mov esi, ebx
call fcn.00430af0
mov dword [esp + 0x10], eax
call fcn.00430ac0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x2c]
push eax
push dword [ebx + 4]
mov dword [esp + 0x34], edi
call sub.gdiplus.dll_GdipImageGetFrameDimensionsCount
cmp eax, edi
je 0x493dac
mov dword [ebx + 8], eax
mov edi, dword [esp + 0x2c]
test edi, edi
jbe 0x494055
push 0x54cfe0
xor ecx, ecx
push 0x10
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004cc21d
pop ecx
pop ecx
mov dword [esp + 0x38], eax
test eax, eax
je 0x494055
push edi
push eax
push dword [ebx + 4]
call sub.gdiplus.dll_GdipImageGetFrameDimensionsList
test eax, eax
je 0x493df2
mov dword [ebx + 8], eax
and dword [esp + 0x28], 0
lea eax, [esp + 0x28]
push eax
mov esi, 0x5100
push esi
push dword [ebx + 4]
call sub.gdiplus.dll_GdipGetPropertyItemSize
test eax, eax
je 0x493e11
mov dword [ebx + 8], eax
push dword [esp + 0x28]
call fcn.004cca0d
pop ecx
mov dword [esp + 0x34], eax
test eax, eax
je 0x49404b
push eax
push dword [esp + 0x2c]
push esi
push dword [ebx + 4]
call sub.gdiplus.dll_GdipGetPropertyItem
test eax, eax
je 0x493e3c
mov dword [ebx + 8], eax
and dword [esp + 0x1c], 0
test edi, edi
jbe 0x494041
mov eax, dword [esp + 0x38]
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], edi
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x28]
xor esi, esi
push dword [ebx + 4]
mov dword [esp + 0x24], esi
call sub.gdiplus.dll_GdipImageGetFrameCount
cmp eax, esi
je 0x493e73
mov dword [ebx + 8], eax
mov dword [esp + 0x28], esi
cmp dword [esp + 0x18], esi
jbe 0x494032
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [ebx + 4]
call sub.gdiplus.dll_GdipImageSelectActiveFrame
test eax, eax
je 0x493e98
mov dword [ebx + 8], eax
push dword [esp + 0x14]
mov eax, ebx
push dword [esp + 0x14]
call fcn.00493643
pop ecx
pop ecx
mov dword [esp + 0x40], eax
test eax, eax
je 0x49401c
push 0x54cfe0
push 0x20
call fcn.004cba2a
pop ecx
pop ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x78], 0x13
test eax, eax
je 0x493ede
mov esi, eax
call fcn.00460b7c
mov edi, eax
jmp 0x493ee0
xor edi, edi
or dword [esp + 0x78], 0xffffffff
test edi, edi
je 0x49401c
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x78], 0x14
test ecx, ecx
je 0x493f18
mov eax, dword [esp + 0x40]
call fcn.0041a750
jmp 0x493f1a
xor eax, eax
or dword [esp + 0x78], 0xffffffff
push eax
lea esi, [esp + 0x4c]
call fcn.0040ec70
push eax
mov dword [esp + 0x7c], 0x15
mov edx, dword [edi]
push str.hbmp
mov ecx, edi
call dword [edx + 0xc]
or dword [esp + 0x78], 0xffffffff
mov ecx, esi
mov dword [esp + 0x48], vtable.os::script_shared_ptr_class__variant__.0
call fcn.0040ea60
mov eax, dword [esp + 0x34]
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x1c]
mov esi, dword [eax + ecx*4]
imul esi, esi, 0xa
test esi, esi
jne 0x493f6a
push 0x64
pop esi
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x78], 0x16
test ecx, ecx
je 0x493f93
mov eax, esi
call fcn.0040c000
jmp 0x493f95
xor eax, eax
or dword [esp + 0x78], 0xffffffff
push eax
lea esi, [esp + 0x58]
call fcn.0040ec70
push eax
mov dword [esp + 0x7c], 0x17
mov edx, dword [edi]
push str.delay
mov ecx, edi
call dword [edx + 0xc]
or dword [esp + 0x78], 0xffffffff
mov ecx, esi
mov dword [esp + 0x54], vtable.os::script_shared_ptr_class__variant__.0
call fcn.0040ea60
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
test eax, eax
je 0x493fea
mov dword [eax + 8], edi
mov dword [eax], 5
jmp 0x493fec
xor eax, eax
push eax
lea esi, [esp + 0x64]
call fcn.0040ec70
mov dword [esp + 0x78], 0x18
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
or dword [esp + 0x78], 0xffffffff
mov ecx, esi
mov dword [esp + 0x60], vtable.os::script_shared_ptr_class__variant__.0
call fcn.0040ea60
inc dword [esp + 0x1c]
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x18]
jb 0x493e81
add dword [esp + 0x24], 0x10
dec dword [esp + 0x2c]
jne 0x493e55
push dword [esp + 0x34]
call fcn.004cc15e
pop ecx
push dword [esp + 0x38]
call fcn.004cc1ec
pop ecx
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
test eax, eax
je 0x49407e
mov ecx, dword [esp + 0x20]
mov dword [eax + 8], ecx
mov dword [eax], 5
jmp 0x494080
xor eax, eax
mov ecx, dword [ebp + 0x14]
push eax
call fcn.0040ed50
jmp 0x49409e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.0046626b
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10