Function at 0x40df4c
Capabilities:
Parse pe header

Disassembly:
push ebp
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40df53
call fcn.0041abc0
push edx
call fcn.0041ab10
pop edx
push eax
mov eax, 0x41f3d4
push eax
call fcn.0040d925
lea eax, [0x4208dc]
push eax
call fcn.0041ac80
push edx
call fcn.0041ab10
pop edx
push eax
mov eax, str.VmlydHVhbFByb3RlY3Q
push eax
call fcn.0040d925
lea eax, [0x4208d4]
push eax
call fcn.0041ac80
push edx
call fcn.0041ab10
pop edx
push eax
mov eax, str.VmlydHVhbEZyZWU
push eax
call fcn.0040d925
lea eax, [0x4208e0]
push eax
call fcn.0041ac80
mov eax, str.kernel32.dll
push eax
push 0x41
call fcn.00412c56
mov ebx, dword [esp + 0x38]
and ebx, ebx
jne 0x40dfdf
jmp 0x40e22f
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov ebp, dword [esp]
movsx ebx, word [ebp]
cmp ebx, 0x5a4d
je 0x40dffa
jmp 0x40e22f
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp]
add ebx, dword [ebp + 0x3c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 4]
mov ebx, dword [ebp]
cmp ebx, 0x4550
je 0x40e01c
jmp 0x40e22f
mov ebp, dword [esp + 4]
movsx ebx, word [ebp + 0x16]
and ebx, 0x2000
and ebx, ebx
jne 0x40e033
jmp 0x40e22f
mov ebp, dword [esp + 4]
movsx ebx, word [ebp + 0x18]
cmp ebx, 0x10b
je 0x40e048
jmp 0x40e22f
mov ebp, dword [esp + 4]
mov eax, dword [ebp + 0x34]
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 4]
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 4]
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x1c], eax
push 4
push 0x2000
push dword [esp + 0x20]
push dword [esp + 0x18]
push dword [0x4208dc]
push 0x41
call fcn.00412d71
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x40e0d0
mov dword [esp + 0x24], 1
mov ebp, dword [esp + 4]
mov ebx, dword [ebp + 0xa4]
and ebx, ebx
je 0x40e0be
mov ebp, dword [esp + 4]
movsx ebx, word [ebp + 0x16]
and ebx, 1
and ebx, ebx
jne 0x40e0be
jmp 0x40e0c5
mov eax, 1
jmp 0x40e0c7
xor eax, eax
and eax, eax
je 0x40e0d0
jmp 0x40e22f
cmp dword [esp + 0x24], 0
je 0x40e10b
push 4
push 0x2000
push dword [esp + 0x20]
push 0
push dword [0x4208dc]
push 0x41
call fcn.00412d71
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x40e10b
jmp 0x40e22f
push 4
push 0x1000
push dword [esp + 0x20]
push dword [esp + 0x1c]
push dword [0x4208dc]
push 0x41
call fcn.00412d71
mov dword [esp + 0x10], eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
push dword [esp + 0x40]
call fcn.0041a5f0
push dword [esp + 0x38]
push dword [esp + 0x14]
call fcn.0040d9c9
push dword [esp + 0x10]
call fcn.0040e7a4
mov ebx, eax
and ebx, ebx
jne 0x40e163
jmp 0x40e22f
cmp dword [esp + 0x24], 0
je 0x40e194
push dword [esp + 0x10]
call fcn.0040e33b
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x38]
add ebx, dword [esp + 0x20]
mov dword [esp + 8], ebx
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x18]
call fcn.0040db69
push dword [esp + 0x10]
call fcn.0040e60e
mov ebx, eax
and ebx, ebx
jne 0x40e1a8
jmp 0x40e22f
mov ebp, dword [esp + 4]
cmp dword [ebp + 0x28], 0
je 0x40e229
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 4]
add ebx, dword [ebp + 0x28]
mov dword [esp + 0x28], ebx
push dword [esp + 0x28]
lea ebp, [0x4208d8]
push ebp
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
mov eax, dword [esp + 0x20]
cdq
push edx
push eax
call fcn.004104b0
pop eax
pop ebp
push eax
push dword [esp]
call fcn.0040f1b0
call fcn.0040f192
add dword [esp], edx
push dword [ebp]
call fcn.004122fe
mov ebp, eax
pop eax
mov dword [ebp], eax
push 0
push 1
push dword [esp + 0x18]
call dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x40e229
jmp 0x40e22f
mov eax, dword [esp + 0x10]
jmp 0x40e263
cmp dword [esp + 0x10], 0
je 0x40e25d
push 0x8000
push 0
push dword [esp + 0x18]
push dword [0x4208e0]
push 0x41
call fcn.00412d4c
push dword [esp + 0x10]
call fcn.0040e26b
xor eax, eax
jmp 0x40e263
add esp, 0x2c
pop ebx
pop ebp
ret 4