Function at 0x40d525
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
mov edi, 0x44ffa8
push edi
mov dword [0x4515cc], esi
mov dword [0x4515c4], esi
call fcn.0040c16b
pop ecx
test eax, eax
je 0x40d77b
push 0x5c
push edi
call fcn.00414dac
mov dword [0x44f84c], eax
pop ecx
pop ecx
test eax, eax
je 0x40d566
inc eax
mov dword [0x44f84c], eax
mov eax, dword [0x44f468]
xor ecx, ecx
test eax, eax
push 0x44f020
cmovne eax, ecx
push 0x445dac
mov dword [0x44f468], eax
call fcn.0040d967
push dword [0x44f84c]
push str.Loading:__s
call fcn.0040d967
add esp, 0x10
push esi
push 0x80
push 3
push esi
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40d5d5
push dword [0x44f84c]
push str.CreateFile_Error:__s
call fcn.0040d967
push esi
call fcn.0040d967
add esp, 0xc
jmp 0x40d781
mov eax, dword [0x45ef74]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add eax, 8
push 0x451570
push 4
push 0x451554
push eax
push dword [ebp + 8]
mov dword [0x45155c], eax
call ebx
test eax, eax
jne 0x40d60b
push dword [0x45155c]
push str.ReadProcessMemory_Error_DetermineSecurityARMVM_address:__p
jmp 0x40d5c2
mov eax, dword [0x451554]
test eax, eax
je 0x40d781
push 0x451570
mov dword [0x4515c4], eax
mov eax, dword [0x45ef64]
push 4
add eax, 0xffffffd0
push 0x451554
push eax
push dword [ebp + 8]
mov dword [0x45155c], eax
call ebx
test eax, eax
je 0x40d5fe
mov eax, dword [0x451554]
test eax, eax
je 0x40d781
push 4
push 0x3000
push dword [0x4515c4]
mov dword [0x4515cc], eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x4515d4], eax
test eax, eax
jne 0x40d67f
push str.VirtualAlloc_Error_load_security_dll
call fcn.0040d967
pop ecx
jmp 0x40d760
push dword [0x4515c4]
push esi
push eax
call sub.VCRUNTIME140D.dll_memset
mov eax, dword [0x4515c4]
add esp, 0xc
mov dword [0x45d560], eax
push esi
push 0x451570
push eax
push dword [0x4515d4]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40d6c4
push dword [0x44f84c]
push str.ReadFile_Error:__s
call fcn.0040d967
pop ecx
jmp 0x40d679
mov edx, dword [0x4515d4]
mov dword [0x45f430], edx
mov dword [0x45f434], edx
mov eax, dword [edx + 0x3c]
lea ebx, [edx + 0x18]
add eax, 4
add eax, edx
mov dword [0x45f438], eax
add ebx, dword [edx + 0x3c]
mov dword [0x45f43c], ebx
mov eax, dword [edx + 0x3c]
add eax, 0xf8
add eax, edx
mov dword [0x45f440], eax
mov eax, 0x5a4d
cmp word [edx], ax
je 0x40d70f
mov esi, str.IMAGE_DOS_SIGNATURE_not_found
jmp 0x40d760
mov eax, dword [edx + 0x3c]
cmp dword [edx + eax], 0x4550
je 0x40d722
mov esi, str.IMAGE_NT_SIGNATURE_not_found
jmp 0x40d760
mov ecx, dword [0x4515cc]
push 0x451574
mov dword [0x45155c], ecx
mov eax, dword [ebx + 0x38]
push eax
push edx
push ecx
push dword [ebp + 8]
mov dword [0x45d560], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40d75b
push dword [0x45155c]
push str.WriteProcessMemory_Error_LoadSecurityDll_address:__p
jmp 0x40d6bc
mov esi, str.Load_Done.
push esi
call fcn.0040d967
pop ecx
test edi, edi
je 0x40d772
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.0040b686
mov dword [0x44ffa8], esi
pop edi
pop esi
pop ebx
pop ebp
ret