Function at 0x419eaa
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432660
push 0x42c980
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
movsx eax, byte [0x438bed]
push eax
push 0x4dc7ffff
call fcn.00410092
pop ecx
pop ecx
mov word [0x438bfa], ax
movsx eax, byte [0x438bef]
or eax, dword [0x438c18]
mov dword [0x438c14], eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x41a0d1
or al, 0xff
sub al, byte [0x438bf0]
add byte [0x438be8], al
mov word [0x438c04], 0xfffe
and dword [ebp - 0x20], 0
push 0xa361ffff
movsx eax, word [0x438c02]
push eax
call fcn.0041003a
pop ecx
pop ecx
add dword [0x438c10], eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
jne 0x41a0d1
call dword [sym.imp.USER32.dll_GetCursor]
add word [0x438bfe], ax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x41a0d1
mov byte [0x438bee], 1
mov ax, word [0x438c2c]
sub ax, word [0x438bf6]
mov word [0x438c00], ax
movsx eax, byte [0x438bef]
push eax
push 0x2bc9ffff
call fcn.004100c8
mov word [0x438bfe], ax
push 0x4d
call fcn.004146c6
add esp, 0xc
call eax
and eax, 0xc0000000
cmp eax, 0x80000000
jne 0x419fcb
push edi
call fcn.0041b2b6
pop ecx
mov edi, eax
mov dword [ebp - 0x1c], edi
movsx eax, word [0x438bfe]
push eax
movsx eax, word [0x438bf4]
push eax
call fcn.00410130
mov byte [0x438be8], al
push 0xc8e5ffff
movsx eax, word [0x438bfc]
push eax
call fcn.00410246
add esp, 0x10
add word [0x438bf6], ax
push 0x40
push edi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
call esi
test eax, eax
jne 0x41a0d1
push 0xf943ffff
movsx eax, byte [0x438be9]
push eax
call fcn.00410092
pop ecx
pop ecx
mov dword [0x438c28], eax
cmp word [edi], 0x5a4d
jne 0x41a0d1
inc byte [0x438bf1]
push 0x3e5ffff
push dword [0x438c0c]
call fcn.00410285
add byte [0x438be8], al
push dword [edi + 0x3c]
push edi
call fcn.00419e5e
mov ebx, eax
mov dword [ebp - 0x24], ebx
push 0xbbffff
movsx eax, byte [0x438bed]
push eax
call fcn.00410246
add esp, 0x18
mov word [0x438c02], ax
inc dword [0x438c0c]
push 0xf8
push ebx
call esi
test eax, eax
jne 0x41a0d1
push dword [0x438c20]
push 0xe007ffff
call fcn.00410285
add byte [0x438bea], al
dec byte [0x438bee]
movsx eax, byte [0x438bec]
push eax
push 0xe283ffff
call fcn.00410285
add esp, 0x10
add byte [0x438bf1], al
cmp dword [ebx], 0x4550
je 0x41a0d8
xor eax, eax
jmp 0x41abd5
movsx eax, byte [0x438be9]
and eax, 0xf81fffff
mov dword [0x438c08], eax
mov eax, dword [0x438c18]
imul eax, eax, 0x99d3ffff
add dword [0x438c2c], eax
push dword [ebx + 0x80]
push edi
call fcn.00419e5e
mov esi, eax
mov dword [ebp - 0x2c], esi
push 0xff6fffff
push dword [0x438c14]
call fcn.00410130
mov byte [0x438bf0], al
push 0x7191ffff
push 0x4a07ffff
call fcn.00410167
add word [0x438c00], ax
movsx eax, byte [0x438be9]
push eax
push 0x3d59ffff
call fcn.004100c8
add esp, 0x20
mov byte [0x438bee], al
cmp esi, edi
je 0x41a61f
movsx eax, word [0x438bf8]
mov ecx, dword [0x438c20]
add eax, ecx
mov dword [0x438c10], eax
cmp esi, ebx
je 0x41a61f
movsx eax, word [0x438c04]
and eax, dword [0x438c28]
mov dword [0x438c08], eax
xor eax, eax
cmp ecx, eax
jne 0x41a194
cmp dword [0x438c18], eax
je 0x41a197
push 1
pop eax
add dword [0x438c2c], eax
movsx eax, byte [0x438be8]
push eax
push 0x6a57ffff
call fcn.004100f9
pop ecx
pop ecx
add byte [0x438bea], al
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [0x438c28], 1
push 0x793fffff
push dword [0x438c24]
call fcn.00410092
pop ecx
pop ecx
add word [0x438c02], ax
push 0xb909ffff
call dword [sym.imp.USER32.dll_IsWindow]
mov byte [0x438bed], al
cmp dword [esi + 0xc], ebx
je 0x41a33d
push 1
pop eax
mov dword [ebp - 4], eax
inc dword [0x438c10]
cmp byte [0x438beb], 0
jne 0x41a218
cmp byte [0x438bf0], 0
jne 0x41a218
xor eax, eax
mov word [0x438bf8], ax
movsx eax, word [0x438c02]
push eax
push 0xd359ffff
call fcn.00410092
add dword [0x438c2c], eax
push dword [esi + 0xc]
push edi
call fcn.00419e5e
mov dword [ebp - 0x38], eax
movsx eax, byte [0x438bf0]
push eax
push 0x6409ffff
call fcn.00410092
add esp, 0x18
add dword [0x438c20], eax
movsx ax, byte [0x438be8]
or ecx, 0xffffffff
sub ecx, eax
add word [0x438bf8], cx
call dword [sym.imp.USER32.dll_GetInputState]
add word [0x438bf8], ax
lea eax, [ebp - 0x34]
push eax
push 4
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5e
call fcn.004146c6
pop ecx
call eax
mov dword [ebp - 0x3c], eax
push dword [0x438c0c]
push 0x8dfdffff
call fcn.00410130
add dword [0x438c24], eax
push dword [ebp + 0xc]
push dword [ebp - 0x38]
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x10
test eax, eax
jne 0x41a3d9
cmp byte [0x438bec], al
je 0x41a2da
cmp word [0x438bf2], bx
je 0x41a2da
push 1
pop eax
jmp 0x41a2dc
xor eax, eax
mov word [0x438c04], ax
push 0x7a33ffff
push dword [0x438c14]
call fcn.00410246
pop ecx
pop ecx
mov byte [0x438bef], al
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5e
call fcn.004146c6
pop ecx
call eax
movsx eax, byte [0x438bef]
mov ecx, dword [0x438c28]
lea eax, [ecx + eax - 0x216fffff]
mov dword [0x438c28], eax
xor eax, eax
cmp byte [0x438bea], al
setne al
add dword [0x438c18], eax
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 0xc], ebx
je 0x41a61f
push dword [esi + 0x10]
push edi
call fcn.00419e5e
pop ecx
pop ecx
mov esi, eax
movsx eax, word [0x438c04]
imul eax, eax, 0x133dffff
add dword [0x438c14], eax
cmp dword [esi], ebx
je 0x41a61f
movsx eax, byte [0x438beb]
mov ecx, dword [0x438c10]
lea eax, [ecx + eax - 0x70580001]
mov dword [0x438c10], eax
movsx eax, byte [0x438bf0]
push eax
push dword [0x438c24]
call fcn.004101be
pop ecx
pop ecx
add dword [0x438c2c], eax
mov eax, dword [esi]
cmp eax, dword [ebp - 0x28]
je 0x41a492
add esi, 4
mov dword [0x438c20], 0xd8aa0000
movsx eax, word [0x438bf4]
push eax
push 0x1da9ffff
call fcn.00410285
pop ecx
pop ecx
mov byte [0x438bf0], al
jmp 0x41a36a
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5e
call fcn.004146c6
pop ecx
call eax
mov dword [ebp - 4], ebx
jmp 0x41a44f
mov ax, word [0x438c2c]
imul ax, word [0x438c04]
add word [0x438bf2], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add byte [0x438bf1], al
push 0x4b67ffff
push 0x89b5ffff
call fcn.00410246
pop ecx
pop ecx
add byte [0x438bed], al
add esi, 0x14
mov dword [ebp - 0x2c], esi
jmp 0x41a1ef
push 0xbe23ffff
movsx eax, byte [0x438bf0]
push eax
call fcn.004100f9
pop ecx
pop ecx
add byte [0x438bf1], al
xor eax, eax
cmp word [0x438bfc], ax
setne al
mov dword [0x438c28], eax
mov al, byte [0x438c18]
and al, byte [0x438be8]
mov byte [0x438beb], al
lea eax, [ebp - 0x40]
push eax
push 4
push 4
push esi
push 0x5e
call fcn.004146c6
pop ecx
call eax
mov ebx, eax
push dword [0x438c0c]
movsx eax, byte [0x438bed]
push eax
call fcn.00410130
mov word [0x438bfa], ax
movsx eax, word [0x438bf2]
push eax
push 0x2e2dffff
call fcn.0041003a
mov byte [0x438beb], al
push dword [0x438c08]
push 0x1e87ffff
call fcn.004101be
add esp, 0x18
add byte [0x438bf0], al
test ebx, ebx
je 0x41a5b6
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
push 0xb88dffff
movsx eax, word [0x438c00]
push eax
call fcn.0041020b
mov dword [0x438c28], eax
movsx eax, byte [0x438bed]
push eax
push dword [0x438c24]
call fcn.00410092
add esp, 0x10
add byte [0x438be8], al
mov al, byte [0x438bee]
and al, byte [0x438bf0]
add byte [0x438be8], al
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
push 4
push esi
push 0x5e
call fcn.004146c6
pop ecx
call eax
dec word [0x438bf8]
push 0x2419ffff
push dword [0x438c10]
call fcn.004100c8
pop ecx
pop ecx
add word [0x438bf6], ax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
movsx eax, word [0x438bfc]
add eax, dword [0x438c28]
mov dword [0x438c10], eax
jmp 0x41a61f
cmp dword [0x438c20], 0
setne al
mov byte [0x438bed], al
mov ax, word [0x438bfe]
neg ax
mov word [0x438bfe], ax
movsx eax, word [0x438c00]
push eax
push 0x7d41ffff
call fcn.004101be
add dword [0x438c18], eax
mov eax, dword [ebp - 0x24]
push dword [eax + 0xe0]
push edi
call fcn.00419e5e
mov ebx, eax
mov dword [ebp - 0x48], ebx
push dword [0x438c18]
push 0xde65ffff
call fcn.0041020b
add esp, 0x18
mov dword [0x438c20], eax
cmp ebx, edi
je 0x41abb9
mov al, byte [0x438bf6]
add al, byte [0x438bec]
mov byte [0x438be9], al
cmp ebx, dword [ebp - 0x24]
je 0x41abb9
movsx eax, word [0x438bf2]
push eax
push dword [0x438c28]
call fcn.004101be
pop ecx
pop ecx
add dword [0x438c14], eax
push 2
pop esi
mov dword [ebp - 4], esi
cmp dword [ebx + 4], 0
je 0x41a7a5
movsx eax, word [0x438c04]
push eax
push 0xfe37ffff
call fcn.0041003a
pop ecx
pop ecx
add byte [0x438bf0], al
mov dword [ebp - 4], 3
push dword [ebx + 4]
push edi
call fcn.00419e5e
pop ecx
pop ecx
mov dword [ebp - 0x58], eax
mov byte [0x438bef], 1
lea eax, [ebp - 0x54]
push eax
push 4
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5e
call fcn.004146c6
pop ecx
call eax
mov dword [ebp - 0x5c], eax
push dword [ebp + 0xc]
push dword [ebp - 0x58]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x41a88a
movsx eax, word [0x438bf4]
push eax
push dword [0x438c24]
call fcn.00410167
add byte [0x438bf0], al
movsx eax, byte [0x438bf0]
push eax
push dword [0x438c18]
call fcn.00410092
add esp, 0x10
mov byte [0x438bf1], al
movsx eax, byte [0x438be9]
and eax, dword [0x438c18]
add dword [0x438c28], eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5e
call fcn.004146c6
pop ecx
call eax
mov eax, dword [0x438c1c]
sub eax, dword [0x438c28]
add word [0x438bfc], ax
mov dword [ebp - 4], esi
or dword [ebp - 4], 0xffffffff
mov al, byte [0x438be9]
movsx ecx, al
add ecx, 0x459e0001
mov dword [0x438c10], ecx
movsx ecx, word [0x438bf2]
movsx edx, word [0x438bf8]
sub ecx, edx
mov dword [0x438c0c], ecx
test al, al
setne al
mov byte [0x438bed], al
cmp dword [ebx + 4], 0
je 0x41abb9
mov byte [0x438be8], 1
push dword [ebx + 0x10]
push edi
call fcn.00419e5e
pop ecx
pop ecx
mov esi, eax
and dword [ebp - 0x4c], 0
cmp dword [esi], 0
je 0x41ab77
push 0x62a9ffff
movsx eax, byte [0x438bec]
push eax
call fcn.0041020b
add dword [0x438c10], eax
push 0x51a3ffff
push 0xeea3ffff
call fcn.00410092
add esp, 0x10
add word [0x438bfa], ax
mov eax, dword [0x438c0c]
mov ecx, eax
neg ecx
mov word [0x438bf6], cx
test byte [esi + 3], 0x80
je 0x41a950
movsx ecx, byte [0x438beb]
push ecx
push eax
call fcn.00410167
mov dword [0x438c28], eax
movsx eax, byte [0x438be9]
push eax
movsx eax, word [0x438bfc]
push eax
call fcn.00410092
add esp, 0x10
add word [0x438bfc], ax
jmp 0x41a9ed
movsx ax, byte [0x438bea]
and ax, word [0x438bf2]
add word [0x438c02], ax
mov eax, dword [0x438c20]
mov ecx, dword [0x438c1c]
add ecx, eax
mov dword [0x438c24], ecx
push 0x7651ffff
push 0xad5dffff
call fcn.004100c8
pop ecx
pop ecx
add word [0x438c02], ax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5e
call fcn.004146c6
pop ecx
call eax
mov dword [ebp - 4], esi
jmp 0x41a945
add ebx, 0x20
mov dword [ebp - 0x48], ebx
jmp 0x41a6c3
mov byte [0x438bec], 1
mov edi, dword [esi]
push 0xe297ffff
movsx eax, word [0x438bfa]
push eax
call fcn.004101be
pop ecx
pop ecx
add dword [0x438c20], eax
mov al, byte [0x438beb]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerA]
add dword [0x438c1c], eax
mov eax, dword [0x438c24]
or eax, 0x4335ffff
mov dword [0x438c08], eax
add edi, 2
push edi
push dword [ebp - 0x1c]
call fcn.00419e5e
mov edi, eax
push dword [0x438c10]
movsx eax, word [0x438bfc]
push eax
call fcn.0041003a
add byte [0x438bee], al
mov ax, word [0x438bf2]
neg ax
mov word [0x438bf6], ax
mov eax, dword [0x438c20]
add eax, eax
sub eax, dword [0x438c2c]
mov dword [0x438c20], eax
push dword [ebp + 0x10]
push edi
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x18
test eax, eax
je 0x41aa2a
movsx eax, word [0x438bfe]
push eax
push 0x7155ffff
call fcn.00410130
add dword [0x438c0c], eax
movsx eax, byte [0x438beb]
push eax
push 0xdb99ffff
call fcn.0041003a
add esp, 0x10
mov dword [0x438c1c], eax
add esi, 4
inc dword [ebp - 0x4c]
jmp 0x41a7ff
movsx eax, word [0x438bf8]
mov ecx, 0xe0dfffff
sub ecx, eax
add dword [0x438c14], ecx
movsx eax, byte [0x438beb]
and eax, 0x4b9ffff
mov dword [0x438c0c], eax
push dword [0x438c2c]
push dword [0x438c24]
call fcn.00410285
add word [0x438bf6], ax
push dword [ebx + 0xc]
push dword [ebp - 0x1c]
call fcn.00419e5e
add esp, 0x10
mov esi, eax
mov al, byte [0x438bf2]
imul byte [0x438c28]
add byte [0x438bea], al
mov al, byte [0x438beb]
and al, byte [0x438bef]
movsx ax, al
mov word [0x438bfe], ax
mov eax, dword [ebp - 0x4c]
lea esi, [esi + eax*4]
lea eax, [ebp - 0x68]
push eax
push 4
push 4
push esi
push 0x5e
call fcn.004146c6
pop ecx
call eax
mov edi, eax
movsx eax, byte [0x438bf0]
push eax
push 0x211dffff
call fcn.00410285
pop ecx
pop ecx
add dword [0x438c24], eax
test edi, edi
je 0x41ab77
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
push 0xf919ffff
movsx eax, byte [0x438bf0]
push eax
call fcn.004101be
pop ecx
pop ecx
add dword [0x438c08], eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x68]
push 4
push esi
push 0x5e
call fcn.004146c6
pop ecx
call eax
push dword [0x438c2c]
movsx eax, byte [0x438be8]
push eax
call fcn.004101be
pop ecx
pop ecx
mov word [0x438bf2], ax
mov al, byte [0x438c28]
push eax
call dword [sym.imp.USER32.dll_IsCharLowerA]
add dword [0x438c08], eax
cmp dword [ebp - 0x20], 0
jne 0x41ab46
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
push dword [0x438c0c]
push 0x40bfffff
call fcn.00410092
mov dword [0x438c18], eax
push dword [0x438c10]
movsx eax, word [0x438bf4]
push eax
call fcn.00410167
add esp, 0x10
mov word [0x438bf2], ax
mov ax, word [0x438c2c]
mov word [0x438bf4], ax
jmp 0x41abb9
push 0x912dffff
movsx eax, byte [0x438bec]
push eax
call fcn.004100c8
pop ecx
pop ecx
mov byte [0x438be8], al
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10