Function at 0x401117
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
call fcn.004017d6
test eax, eax
jne 0x401130
xor eax, eax
jmp 0x401404
push 0
push 2
call dword [0x40b06c]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xffffffff
jne 0x401150
xor eax, eax
jmp 0x401404
push 0x128
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.00402030
add esp, 0xc
mov dword [ebp - 0x228], 0x128
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x22c]
call dword [0x40b05c]
and byte [ebp - 0x100], 0
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x22c]
call dword [0x40b064]
test eax, eax
je 0x4011c3
mov eax, dword [ebp - 0x220]
cmp eax, dword [ebp + 8]
jne 0x4011c1
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401f30
pop ecx
pop ecx
jmp 0x40118a
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movsx eax, byte [ebp - 0x100]
test eax, eax
jne 0x4011e1
xor eax, eax
jmp 0x401404
push dword [ebp + 8]
push 8
call dword [0x40b06c]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xffffffff
jne 0x401202
xor eax, eax
jmp 0x401404
push 0x224
push 0
lea eax, [ebp - 0x468]
push eax
call fcn.00402030
add esp, 0xc
mov dword [ebp - 0x468], 0x224
push 0xc
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.00402030
add esp, 0xc
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x22c]
call dword [0x40b068]
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x348]
push eax
call fcn.00407936
pop ecx
pop ecx
test eax, eax
jne 0x401279
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x22c]
call dword [0x40b060]
test eax, eax
je 0x4012c3
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x348]
push eax
call fcn.00407936
pop ecx
pop ecx
test eax, eax
jne 0x4012c1
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x23c], eax
jmp 0x401279
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x240], 0
jne 0x4012df
xor eax, eax
jmp 0x401404
cmp dword [ebp - 0x23c], 0x2000
jae 0x4012f9
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x470], eax
jmp 0x401303
mov dword [ebp - 0x470], 0x2000
push dword [ebp + 8]
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
jne 0x401326
xor eax, eax
jmp 0x401404
push dword [ebp - 0x470]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x40134a
xor eax, eax
jmp 0x401404
push 0x40a6c0
push dword [ebp - 0x470]
push dword [ebp - 0x230]
push dword [ebp - 0x240]
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x401384
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x401404
mov eax, dword [ebp - 0x230]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x4013a4
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x401404
mov eax, dword [ebp - 0x230]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
add eax, dword [ebp - 0x230]
cmp dword [eax], 0x4550
je 0x4013d7
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x401404
mov eax, dword [ebp - 0x234]
add eax, dword [ebp - 0x230]
mov eax, dword [eax + 0x28]
add eax, dword [ebp - 0x240]
mov dword [ebp - 0x238], eax
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x238]
leave
ret