Function at 0x4182f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xb4
cmp dword [esp + 0xc8], 0
mov esi, ecx
je 0x418362
cmp byte [esi + 0x185], 0
mov dword [esp + 0x2c], edx
je 0x418779
inc dword [esi + 0x140]
mov dword [esp + 0x14], esi
mov eax, dword [esi + 0x17c]
cmp eax, 3
ja 0x4183e8
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 0x178]
movzx ebx, byte [ecx]
movzx ecx, bl
cmp edx, ecx
jbe 0x418b6d
mov edi, dword [esi + 0x174]
cmp byte [edi + ecx], 0
je 0x41836e
cmp byte [esi + 0x182], 0
jne 0x418398
jmp 0x4183e8
mov byte [esi + 0x185], 0
jmp 0x418779
mov byte [edi + ecx], 1
inc eax
mov ebp, dword [esp + 0x14]
mov dword [esi + 0x17c], eax
movzx esi, byte [ecx + str.743210_._g]
add word [ebp + 0x180], si
mov esi, dword [esp + 0x14]
cmp byte [esi + 0x182], 0
je 0x4183e8
mov bh, bl
add bh, 0xbf
cmp bh, 0x1a
jae 0x4183a9
or bl, 0x20
mov ecx, ebx
jmp 0x4183be
mov bh, bl
xor bl, 0x20
add bh, 0x9f
movzx esi, bl
cmp bh, 0x1a
cmovb ecx, esi
mov esi, dword [esp + 0x14]
movzx ecx, cl
cmp edx, ecx
jbe 0x418b6d
cmp byte [edi + ecx], 0
jne 0x4183e8
mov byte [edi + ecx], 1
inc eax
mov dword [esi + 0x17c], eax
movzx eax, byte [ecx + str.743210_._g]
add word [esi + 0x180], ax
cmp byte [esi + 0x127], 0
mov edi, esi
je 0x41841b
mov ecx, dword [edi + 0x120]
mov esi, edi
cmp ecx, 3
ja 0x418412
mov eax, dword [esp + 0xc8]
cmp eax, 0xff
jbe 0x41854e
mov byte [esi + 0x127], 0
mov edi, esi
mov eax, dword [edi + 0x13c]
mov esi, edi
lea ecx, [eax + 1]
test eax, eax
mov dword [edi + 0x13c], ecx
je 0x418472
test dword [esi + 0x130], 0x7fffffff
je 0x418450
push dword [esi + 0x134]
push 0
push dword [0x94bf18]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0xc8]
mov dword [esi + 0x130], 0x80000000
cmp dword [esi + 0x144], 0x80000000
jne 0x4184e5
jmp 0x418779
mov edi, dword [esp + 0xc8]
movzx eax, byte [0x94bfc5]
xor ecx, ecx
mov edx, edi
call fcn.0071ee80
test eax, eax
je 0x418b81
mov ebp, eax
push edi
push dword [esp + 0x30]
push eax
call fcn.007bd9b0
add esp, 0xc
test dword [esi + 0x130], 0x7fffffff
je 0x4184c1
push dword [esi + 0x134]
push 0
push dword [0x94bf18]
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esi + 0x130], edi
mov dword [esi + 0x134], ebp
mov dword [esi + 0x138], edi
mov eax, edi
cmp dword [esi + 0x144], 0x80000000
je 0x418779
cmp byte [esi + 0x16d], 0
jne 0x418779
mov edi, dword [esi + 0x14c]
cmp edi, 0x80
jb 0x418747
mov byte [esi + 0x16d], 1
mov byte [esi + 0x164], 0
mov eax, esi
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [esi + 0x148]
mov dword [eax + 0x14c], 0
add esi, 4
jmp 0x41853a
add esi, 0xc
dec edi
je 0x418761
cmp dword [esi - 4], 0
je 0x418530
push dword [esi]
push 0
push dword [0x94bf18]
call ebx
jmp 0x418530
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x2c]
xor ebx, ebx
movzx edx, byte [ecx]
add eax, ecx
mov dword [esp + 0xc], eax
mov eax, ecx
mov ebp, eax
movzx ecx, byte [edx + str.743210_._g]
mov dword [esp + 8], edx
movzx edx, byte [esi + 0x126]
mov dword [esp + 0x28], ecx
lea ecx, [esi + 0x100]
mov byte [esp + 0x27], dl
mov dword [esp + 0x18], ecx
xor ecx, ecx
test dl, dl
je 0x418784
cmp ecx, 0x101
mov eax, pe_nt_image_headers32
cmovae eax, ecx
mov dword [esp + 0x20], eax
jmp 0x4185c2
mov eax, ecx
cmp ebp, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov ebx, eax
je 0x4188e7
cmp dword [esp + 0x20], ecx
je 0x418b77
movzx eax, byte [ebp]
mov dword [esp + 0x10], ebx
movzx edi, al
mov ah, al
movzx edx, byte [esi + edi]
mov dword [esp], edi
cmp dl, cl
cmovbe edx, ecx
add ah, 0xbf
cmp ah, 0x1a
mov byte [esi + edi], dl
jae 0x418600
mov edx, eax
or dl, 0x20
jmp 0x418613
mov edx, eax
mov dh, al
add dl, 0x9f
xor dh, 0x20
cmp dl, 0x1a
movzx edx, dh
cmovae edx, edi
lea ebx, [ecx + 1]
movzx edx, dl
inc ebp
mov dword [esp + 4], ebx
movzx ebx, byte [esi + edx]
cmp bl, cl
cmova ecx, ebx
mov byte [esi + edx], cl
mov ecx, dword [esp + 0x10]
test cl, 1
jne 0x4185b0
mov ecx, eax
mov dword [esp + 0xb0], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xa4], 1
mov dword [esp + 0xa0], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x1c], ebp
and al, 7
and cl, 0x78
shr cl, 3
neg cl
movsx edi, cl
mov ecx, eax
mov ebx, dword [esp + edi + 0xa8]
mov ebp, dword [esp + edi + 0xac]
mov esi, dword [esp + edi + 0xb0]
mov edi, dword [esp + edi + 0xa4]
mov edx, ebx
shld esi, ebp, cl
shl ebp, cl
not cl
shr edx, 1
shr edx, cl
mov ecx, eax
mov eax, dword [esp + 0x18]
or edx, ebp
mov ebp, dword [esp]
shld ebx, edi, cl
shl edi, cl
shr ebp, 3
and ebp, 0xfffffff0
and esi, dword [eax + ebp + 0xc]
and ebx, dword [eax + ebp + 4]
and edx, dword [eax + ebp + 8]
and edi, dword [eax + ebp]
mov ebp, dword [esp + 0x1c]
mov al, 1
or ebx, esi
mov esi, dword [esp + 0x14]
or edi, edx
or ebx, edi
jne 0x4185b2
mov edi, dword [esp]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
movzx ecx, byte [edi + str.743210_._g]
movzx eax, al
cmp cl, dl
movzx edx, dl
cmovb edx, ecx
cmovb eax, edi
cmp ebp, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 0x28], edx
jne 0x418593
jmp 0x4188e9
mov edx, dword [esp + 0x2c]
add esi, 0x144
mov ecx, esi
push eax
call fcn.00414b70
add esp, 0xb8
jmp 0x41877f
mov eax, dword [esp + 0x14]
mov dword [eax + 0x158], 0
mov dword [eax + 0x15c], 0xffffffff
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ecx, 0x101
mov eax, pe_nt_image_headers32
cmovae eax, ecx
mov dword [esp + 0x20], eax
jmp 0x4187b2
mov eax, ebx
cmp ebp, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov ebx, eax
je 0x4188e7
cmp dword [esp + 0x20], ecx
je 0x418b77
lea eax, [ecx + 1]
mov dword [esp + 4], eax
movzx eax, byte [ebp]
inc ebp
movzx edi, al
movzx edx, byte [esi + edi]
mov dword [esp], edi
cmp dl, cl
cmova ecx, edx
test bl, 1
mov byte [esi + edi], cl
jne 0x4187a0
mov ecx, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x90], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x84], 1
mov dword [esp + 0x80], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x1c], ebp
and al, 7
and cl, 0x78
shr cl, 3
neg cl
movsx edi, cl
mov ecx, eax
mov edx, dword [esp + edi + 0x88]
mov ebp, dword [esp + edi + 0x8c]
mov esi, dword [esp + edi + 0x90]
mov edi, dword [esp + edi + 0x84]
mov ebx, edx
shld esi, ebp, cl
shl ebp, cl
not cl
shr ebx, 1
shr ebx, cl
mov ecx, eax
mov eax, dword [esp + 0x18]
or ebx, ebp
mov ebp, dword [esp]
shld edx, edi, cl
shl edi, cl
shr ebp, 3
and ebp, 0xfffffff0
and esi, dword [eax + ebp + 0xc]
and edx, dword [eax + ebp + 4]
and ebx, dword [eax + ebp + 8]
and edi, dword [eax + ebp]
mov ebp, dword [esp + 0x1c]
mov al, 1
or edx, esi
mov esi, dword [esp + 0x14]
or edi, ebx
or edx, edi
jne 0x4187a2
mov edi, dword [esp]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
movzx ecx, byte [edi + str.743210_._g]
movzx eax, al
cmp cl, dl
movzx edx, dl
cmovb edx, ecx
cmovb eax, edi
cmp ebp, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 0x28], edx
jne 0x418784
jmp 0x4188e9
mov ebx, eax
test bl, 1
mov edi, esi
jne 0x41841b
mov ebx, dword [esp + 8]
mov eax, ebx
shr al, 7
movzx edx, al
mov eax, dword [esp + 0x18]
shl edx, 4
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + edx + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + edx + 8]
mov dword [esp + 4], ecx
mov ecx, dword [eax + edx]
mov eax, dword [eax + edx + 4]
mov dword [esp], ecx
mov ecx, ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x70], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 1
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 8], ebx
mov eax, ebx
and cl, 0x78
and al, 7
shr cl, 3
neg cl
movsx ebp, cl
mov ecx, eax
mov edx, dword [esp + ebp + 0x68]
mov ebx, dword [esp + ebp + 0x6c]
mov edi, dword [esp + ebp + 0x70]
mov ebp, dword [esp + ebp + 0x64]
mov esi, edx
shld edi, ebx, cl
shl ebx, cl
not cl
shr esi, 1
mov dword [esp + 0x20], edi
shr esi, cl
mov ecx, eax
mov eax, dword [esp + 0xc]
shld edx, ebp, cl
or esi, ebx
mov ebx, dword [esp + 4]
shl ebp, cl
mov ecx, dword [esp]
and eax, edx
and ecx, ebp
and ebx, esi
or ebx, ecx
mov ecx, dword [esp + 0x10]
and ecx, edi
or eax, ecx
or eax, ebx
jne 0x418a1b
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 4]
mov edi, dword [esp]
or eax, dword [esp + 0x20]
add ebx, dword [esp + 0x18]
or ecx, esi
mov esi, dword [esp + 0xc]
or edi, ebp
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [ebx + 8], ecx
mov ecx, dword [esp + 0x14]
or esi, edx
mov dword [ebx], edi
mov dword [ebx + 4], esi
inc eax
mov dword [esp + 0x30], eax
mov dword [ecx + 0x120], eax
movzx eax, byte [esp + 8]
movzx eax, byte [eax + str.743210_._g]
add word [ecx + 0x124], ax
cmp byte [esp + 0x27], 0
mov edi, dword [esp + 0x14]
je 0x41841b
mov edx, dword [esp + 8]
mov eax, edx
add al, 0xbf
cmp al, 0x1a
jae 0x418a3b
or dl, 0x20
jmp 0x418a4d
mov eax, edx
movzx ecx, dl
xor dl, 0x20
add al, 0x9f
movzx edx, dl
cmp al, 0x1a
cmovae edx, ecx
mov eax, edx
mov ecx, dword [esp + 0x18]
shr al, 7
movzx eax, al
shl eax, 4
mov esi, dword [ecx + eax + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp], esi
mov esi, dword [ecx + eax + 8]
mov dword [esp + 0xc], esi
mov esi, dword [ecx + eax]
mov eax, dword [ecx + eax + 4]
mov ecx, edx
and cl, 0x78
shr cl, 3
neg cl
mov dword [esp + 0x10], esi
mov dword [esp + 4], eax
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 8], edx
movsx esi, cl
mov eax, edx
mov edx, dword [esp + esi + 0x48]
mov edi, dword [esp + esi + 0x4c]
mov ebp, dword [esp + esi + 0x50]
and al, 7
mov esi, dword [esp + esi + 0x44]
mov ecx, eax
mov ebx, edx
shld ebp, edi, cl
shl edi, cl
not cl
shr ebx, 1
mov dword [esp + 0x20], ebp
and ebp, dword [esp]
shr ebx, cl
mov ecx, eax
shld edx, esi, cl
or ebx, edi
shl esi, cl
mov eax, esi
mov ecx, ebx
mov edi, edx
and edi, dword [esp + 4]
and eax, dword [esp + 0x10]
and ecx, dword [esp + 0xc]
or ecx, eax
or edi, ebp
or edi, ecx
mov edi, dword [esp + 0x14]
jne 0x41841b
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
or ebx, dword [esp + 0xc]
or edx, dword [esp + 4]
or esi, dword [esp + 0x10]
add eax, dword [esp + 0x1c]
or ecx, dword [esp]
mov dword [eax], esi
mov dword [eax + 4], edx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x30]
inc eax
mov dword [edi + 0x120], eax
movzx eax, byte [esp + 8]
movzx eax, byte [eax + str.743210_._g]
add word [edi + 0x124], ax
jmp 0x41841b
push 0x7d6e90
call fcn.007c1be0
mov ecx, 0x7d6dd4
call fcn.007c1fe0
mov ecx, 1
mov edx, edi
call fcn.007c1490
int3