Function at 0x402261
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x2000
mov dword [esp + 4], eax
jmp 0x401774
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4022fa
mov eax, 0
jmp 0x4022f5
je 0x4020a6
mov edx, dword [ebp - 0x1c]
jmp 0x402432
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x28]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 0x28]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 0x20]
jmp 0x4021cc
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call fcn.00401a27
mov eax, 0
leave
jmp 0x401e63
je 0x401f60
jmp 0x40209c
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x401dca
mov eax, 0
jmp 0x401dc5
mov eax, dword [ebp - 0x10]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jmp 0x40187c
mov eax, dword [eax + 0x34]
neg eax
add eax, dword [ebp - 0x1c]
jmp 0x401de4
cmp dword [ebp - 0x1c], 0
jne 0x4022fa
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x50]
jmp 0x40174d
add edx, eax
mov eax, dword [ebp - 0x28]
mov dword [eax], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x34], edx
mov eax, dword [ebp + 8]
jmp 0x4024e0
mov dword [esp + 8], 0
jmp 0x402320
sub esp, 0x10
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x54]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
jmp 0x401d90
mov eax, dword [eax + 0x3c]
lea eax, [edx + eax]
mov dword [ebp - 0x20], eax
jmp 0x4025b4
call fcn.004022dc
test eax, eax
sete al
test al, al
jne 0x4020ae
mov eax, dword [ebp - 0x28]
jmp 0x401fff
jmp 0x401f61
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x3c]
jmp 0x4020cd
jmp 0x401876
jmp 0x4023d8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402042
jmp 0x4020b4
ret
nop
jmp 0x401f61
nop
jmp 0x401866
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
jmp 0x4018bc
mov dword [esp], eax
call fcn.00401b74
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
test eax, eax
jmp 0x40179a
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov dword [ebp - 0x1c], eax
jmp 0x401a62
mov dword [esp], eax
call fcn.004017bf
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
jmp 0x401c87
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 0x28]
jmp 0x401876
nop
jmp 0x401d86
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
jmp 0x40203a
mov edx, eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x54]
lea eax, [edx + eax]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
jmp 0x402115
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x3c]
jmp 0x401a77
mov eax, dword [eax + 0x50]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
jmp 0x4024d0
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
jmp 0x401ff4
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x50]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x2000
mov dword [esp + 4], edx
jmp 0x402027
jmp 0x401876
call sub.KERNEL32.dll_GetProcessHeap
mov dword [esp + 8], 0x14
jmp 0x402599
mov dword [esp + 4], 1
mov dword [esp], eax
jmp 0x401938
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
jmp 0x401c59
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
lea eax, [edx + eax]
mov dword [ebp - 0x10], eax
jmp 0x4025f3
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
jmp 0x401807
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualAlloc
jmp 0x401bf7
mov edx, dword [ebp - 0x28]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004015e8
mov eax, dword [ebp - 0x20]
jmp 0x401a2d
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_HeapAlloc
sub esp, 0xc
mov dword [ebp - 0x28], eax
jmp 0x40245c
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40227e
mov eax, 0
jmp 0x401876
cmp dword [ebp - 0x10], 0
je 0x401f5d
mov eax, dword [ebp - 0x1c]
jmp 0x401ba9