Function at 0x491091
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4913e5
xor edx, edx
call fcn.00492071
xor eax, eax
mov dword [esp + 0x20], 0x52444849
mov byte [esp + 0x24], al
lea ebx, [esi + 0x11c]
mov dword [esp + 0x10], 0x54414449
mov byte [esp + 0x14], al
mov dword [esp + 0x28], 0x444e4549
mov byte [esp + 0x2c], al
mov dword [esp + 0x18], 0x45544c50
mov byte [esp + 0x1c], al
mov dword [esp + 0x30], 0x44474b62
mov byte [esp + 0x34], al
mov dword [esp + 0x38], 0x4d524863
mov byte [esp + 0x3c], al
mov dword [esp + 0x40], 0x414d4167
mov byte [esp + 0x44], al
mov dword [esp + 0x48], 0x54534968
mov byte [esp + 0x4c], al
mov dword [esp + 0x80], 0x50434369
mov byte [esp + 0x84], al
mov dword [esp + 0x50], 0x7346466f
mov byte [esp + 0x54], al
mov dword [esp + 0x58], 0x4c414370
mov byte [esp + 0x5c], al
mov dword [esp + 0x68], 0x73594870
mov byte [esp + 0x6c], al
mov dword [esp + 0x70], 0x54494273
mov byte [esp + 0x74], al
mov dword [esp + 0x60], 0x4c414373
mov byte [esp + 0x64], al
mov dword [esp + 0x88], 0x544c5073
mov byte [esp + 0x8c], al
mov dword [esp + 0x78], 0x42475273
mov byte [esp + 0x7c], al
mov dword [esp + 0x90], 0x74584574
mov byte [esp + 0x94], al
mov dword [esp + 0x98], 0x454d4974
mov byte [esp + 0x9c], al
mov dword [esp + 0xa0], 0x534e5274
mov byte [esp + 0xa4], al
mov dword [esp + 0xa8], 0x7458547a
mov byte [esp + 0xac], al
mov ecx, esi
call fcn.00491f83
mov ecx, dword [ebx]
mov edi, eax
lea eax, [esp + 0x20]
cmp ecx, dword [eax]
jne 0x4911ef
push edi
xor edx, edx
mov ecx, esi
call fcn.004924b4
jmp 0x4913da
mov eax, dword [ebx]
lea ecx, [esp + 0x28]
cmp eax, dword [ecx]
mov ecx, esi
jne 0x491206
push edi
call fcn.00492753
jmp 0x4913da
mov edx, ebx
call fcn.0049043b
test eax, eax
lea ecx, [esp + 0x10]
mov eax, dword [ebx]
je 0x491256
cmp eax, dword [ecx]
jne 0x491234
test edi, edi
jne 0x491228
test dword [esi + 0x68], 0x2000
je 0x491234
mov edx, str.Too_many_IDATs_found
mov ecx, esi
call fcn.00491ba1
push edi
xor edx, edx
mov ecx, esi
call fcn.00493f0c
mov eax, dword [ebx]
pop ecx
lea ecx, [esp + 0x18]
cmp eax, dword [ecx]
jne 0x4913db
or dword [esi + 0x68], 2
jmp 0x4913db
cmp eax, dword [ecx]
jne 0x491281
test edi, edi
jne 0x491267
test dword [esi + 0x68], 0x2000
je 0x491273
mov edx, str.Too_many_IDATs_found
mov ecx, esi
call fcn.00491ba1
mov edx, edi
mov ecx, esi
call fcn.00492071
jmp 0x4913db
lea ecx, [esp + 0x18]
xor edx, edx
push edi
cmp eax, dword [ecx]
jne 0x491298
mov ecx, esi
call fcn.004925fe
jmp 0x4913da
lea ecx, [esp + 0x34]
cmp eax, dword [ecx]
jne 0x4912ac
mov ecx, esi
call fcn.00493425
jmp 0x4913da
lea ecx, [esp + 0x3c]
cmp eax, dword [ecx]
jne 0x4912c0
mov ecx, esi
call fcn.004929c3
jmp 0x4913da
lea ecx, [esp + 0x44]
cmp eax, dword [ecx]
jne 0x4912d4
mov ecx, esi
call fcn.00492798
jmp 0x4913da
lea ecx, [esp + 0x4c]
cmp eax, dword [ecx]
jne 0x4912e8
mov ecx, esi
call fcn.004935c5
jmp 0x4913da
lea ecx, [esp + 0x54]
cmp eax, dword [ecx]
jne 0x4912fc
mov ecx, esi
call fcn.0049375d
jmp 0x4913da
lea ecx, [esp + 0x5c]
cmp eax, dword [ecx]
jne 0x491310
mov ecx, esi
call fcn.004937fa
jmp 0x4913da
lea ecx, [esp + 0x64]
cmp eax, dword [ecx]
jne 0x491324
mov ecx, esi
call fcn.00493a21
jmp 0x4913da
lea ecx, [esp + 0x6c]
cmp eax, dword [ecx]
jne 0x491338
mov ecx, esi
call fcn.004936c2
jmp 0x4913da
lea ecx, [esp + 0x74]
cmp eax, dword [ecx]
jne 0x49134c
mov ecx, esi
call fcn.004928bb
jmp 0x4913da
lea ecx, [esp + 0x7c]
cmp eax, dword [ecx]
jne 0x49135d
mov ecx, esi
call fcn.00492cdc
jmp 0x4913da
lea ecx, [esp + 0x84]
cmp eax, dword [ecx]
jne 0x491371
mov ecx, esi
call fcn.00492e7a
jmp 0x4913da
lea ecx, [esp + 0x8c]
cmp eax, dword [ecx]
jne 0x491385
mov ecx, esi
call fcn.0049302d
jmp 0x4913da
lea ecx, [esp + 0x94]
cmp eax, dword [ecx]
jne 0x491399
mov ecx, esi
call fcn.00493c63
jmp 0x4913da
lea ecx, [esp + 0x9c]
cmp eax, dword [ecx]
jne 0x4913ad
mov ecx, esi
call fcn.00493b9b
jmp 0x4913da
lea ecx, [esp + 0xa4]
cmp eax, dword [ecx]
jne 0x4913c1
mov ecx, esi
call fcn.0049326e
jmp 0x4913da
lea ecx, [esp + 0xac]
cmp eax, dword [ecx]
mov ecx, esi
jne 0x4913d5
call fcn.00493d8d
jmp 0x4913da
call fcn.00493f0c
pop ecx
test byte [esi + 0x68], 0x10
je 0x4911cd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret