Function at 0x510180
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov edx, 0x631d28
xor ecx, ecx
push ebx
push esi
push edi
call fcn.00528ba0
test eax, eax
je 0x5101c8
mov edx, 0x631d68
xor ecx, ecx
call fcn.00528ba0
test eax, eax
je 0x5101c8
mov edx, 0x631d70
xor ecx, ecx
call fcn.00528ba0
jmp 0x5101c0
test eax, eax
jne 0x510ba5
xor ebx, ebx
mov dword [esp + 0x18], 0
push ebx
push 0x631d40
push 0xfffffffffffffffd
push 0x20019
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], ebx
push eax
call sym.SystemInformer.exe_PhOpenKey
or esi, 0xffffffff
test eax, eax
js 0x510453
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x14
push eax
push dword [esp + 0x10]
mov dword [esp + 0x28], str.KitsRoot10
call sym.SystemInformer.exe_PhQueryRegistryString
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x51022c
cmp dword [edi], ebx
jne 0x5102b6
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x14
push eax
push dword [esp + 0x10]
mov dword [esp + 0x28], str.KitsRoot81
call sym.SystemInformer.exe_PhQueryRegistryString
mov ecx, edi
mov dword [esp + 0x1c], eax
mov edi, eax
test ecx, ecx
je 0x510268
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x510268
call fcn.004fc020
test edi, edi
je 0x510270
cmp dword [edi], ebx
jne 0x5102b6
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x10
push eax
push dword [esp + 0x10]
mov dword [esp + 0x28], str.KitsRoot
mov dword [esp + 0x18], edi
call sym.SystemInformer.exe_PhQueryRegistryString
mov edi, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], edi
test eax, eax
je 0x5102b6
lea ecx, [eax - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x5102b6
call fcn.004fc020
push dword ds:[esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
je 0x510453
mov eax, dword [edi]
add eax, 0x1e
mov dword [esp + 0x14], ebx
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 0
push eax
call sym.SystemInformer.exe_PhCreateString3
push dword [edi]
mov esi, eax
push dword [edi + 4]
mov dword [esp + 0x18], esi
push dword [esi + 4]
call fcn.005823b0
mov eax, dword [esp + 0x28]
mov ecx, 7
mov edi, dword [esi + 4]
add esp, 0xc
mov esi, str.Debuggersx86_
add edi, dword [eax]
rep movsd dword es:[edi], dword [esi]
lea ecx, [eax - 8]
movsw word es:[edi], word [esi]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x51032b
call fcn.004fc020
push 0x631d28
push dword [esp + 0x14]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x60a7d8
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x510433
push dword ds:[eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov dword [esp + 0x18], edi
add ecx, 0xfffffff8
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x510385
lea esp, [esp]
call fcn.004fc020
test edi, edi
je 0x510435
push 0x631d68
push dword [esp + 0x14]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x60a7d8
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x510435
push dword ds:[eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov ebx, eax
add ecx, 0xfffffff8
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x5103dd
call fcn.004fc020
lea ecx, [ecx]
test ebx, ebx
je 0x510435
push 0x631d70
push dword [esp + 0x14]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x60a7d8
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x510435
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov edx, esi
mov dword [esp + 0x24], eax
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], edx
dec edx
jne 0x510435
call fcn.004fc020
jmp 0x510435
xor edi, edi
mov ecx, dword [esp + 0x10]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x51044b
call fcn.004fc020
test edi, edi
jne 0x5105af
call sym.SystemInformer.exe_PhGetApplicationDirectoryWin32
mov edi, eax
test edi, edi
je 0x51056c
push 0x631d28
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x60a7d8
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x510505
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x5104b2
call fcn.004fc020
cmp dword [esp + 0x18], 0
je 0x510505
push 0x631d68
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x60a7d8
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword ds:[esp + 0x1c], eax
test eax, eax
je 0x510505
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov ebx, eax
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x510505
nop
call fcn.004fc020
test ebx, ebx
je 0x510553
push 0x631d70
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x60a7d8
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x510553
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x510553
call fcn.004fc020
lea ecx, [edi - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x510565
mov edi, edi
call fcn.004fc020
cmp dword [esp + 0x18], 0
jne 0x5105af
push 0x800
push 0
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, edi
test eax, eax
jne 0x5105af
push 0x200
push eax
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x5105af
cmp dword [0x62ebb0], 0x3e
jae 0x5105af
push eax
push eax
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test ebx, ebx
jne 0x510606
push 0x800
push ebx
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x510606
push 0x200
push eax
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x510606
cmp dword [0x62ebb0], 0x3e
jae 0x510604
push eax
push eax
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x510606
xor ebx, ebx
cmp dword [esp + 0x24], 0
jne 0x51064f
push 0x800
push 0
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop
test eax, eax
jne 0x51064f
push 0x200
push eax
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x51064f
cmp dword [0x62ebb0], 0x3e
jae 0x51064f
push eax
push eax
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test ebx, ebx
je 0x510ba5
mov esi, 0x5a4d
cmp word [ebx], si
jne 0x5106a2
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x5106a2
cmp eax, 0x7fffffff
jae 0x5106a2
cmp dword [eax + ebx], 0x4550
jne 0x5106a2
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x5106a2
cmp dword [edx + 4], 0
je 0x5106a2
push 0
add eax, ebx
mov ecx, ebx
push str.SymInitializeW
push eax
call fcn.00528e20
nop
jmp 0x5106a4
xor eax, eax
mov ecx, ebx
mov edx, 0x3c
mov dword [0x635074], eax
cmp word [ebx], si
jne 0x5106f3
mov eax, dword [ecx + edx]
test eax, eax
je 0x5106f3
lea esp, [esp]
cmp eax, 0x7fffffff
jae 0x5106f3
cmp dword [eax + ebx], 0x4550
jne 0x5106f3
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x5106f3
cmp dword [edx + 4], 0
je 0x5106f3
push 0
add eax, ebx
push str.SymCleanup
push eax
call fcn.00528e20
jmp 0x5106f5
xor eax, eax
mov dword [0x63507c], eax
cmp word [ebx], si
jne 0x51073d
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x51073d
cmp eax, 0x7fffffff
jae 0x51073d
cmp dword [eax + ebx], 0x4550
jne 0x51073d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x51073d
cmp dword [edx + 4], 0
je 0x51073d
push 0
add eax, ebx
mov ecx, ebx
push str.SymFromAddrW
push eax
call fcn.00528e20
jmp 0x51073f
xor eax, eax
mov dword [0x6350a4], eax
cmp word [ebx], si
jne 0x510787
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510787
cmp eax, 0x7fffffff
jae 0x510787
cmp dword ds:[eax + ebx], 0x4550
jne 0x510787
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510787
cmp dword [edx + 4], 0
je 0x510787
push 0
add eax, ebx
mov ecx, ebx
push str.SymFromNameW
push eax
call fcn.00528e20
jmp 0x510789
xor eax, eax
mov dword [0x635084], eax
cmp word [ebx], si
jne 0x5107d5
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x5107d5
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x5107d5
cmp dword [eax + ebx], 0x4550
jne 0x5107d5
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x5107d5
cmp dword [edx + 4], 0
je 0x5107d5
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetLineFromAddrW64
push eax
call fcn.00528e20
jmp 0x5107d7
xor eax, eax
mov dword [0x635080], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x510822
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510822
cmp eax, 0x7fffffff
jae 0x510822
cmp dword [eax + ebx], 0x4550
jne 0x510822
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510822
cmp dword [edx + 4], 0
je 0x510822
push 0
add eax, ebx
mov ecx, ebx
push str.SymLoadModuleExW
push eax
call fcn.00528e20
nop
jmp 0x510824
xor eax, eax
mov dword [0x635088], eax
cmp word [ebx], si
jne 0x51086a
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x51086a
cmp eax, 0x7fffffff
jae 0x51086a
cmp dword [eax + ebx], 0x4550
jne 0x51086a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x51086a
cmp dword [edx + 4], 0
je 0x51086a
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetOptions
push eax
call fcn.00528e20
jmp 0x51086c
xor eax, eax
mov dword [0x6350b0], eax
cmp word [ebx], si
jne 0x5108b5
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x5108b5
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x5108b5
cmp dword [eax + ebx], 0x4550
jne 0x5108b5
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x5108b5
cmp dword [edx + 4], 0
je 0x5108b5
push 0
add eax, ebx
mov ecx, ebx
push str.SymSetOptions
push eax
call fcn.00528e20
jmp 0x5108b7
xor eax, eax
mov dword [0x635094], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x510902
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510902
cmp eax, 0x7fffffff
jae 0x510902
cmp dword [eax + ebx], 0x4550
jne 0x510902
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510902
cmp dword [edx + 4], 0
je 0x510902
push 0
add eax, ebx
mov ecx, ebx
push str.SymSetSearchPathW
push eax
call fcn.00528e20
nop
jmp 0x510904
xor eax, eax
mov dword [0x6350b4], eax
cmp word [ebx], si
jne 0x51094a
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x51094a
cmp eax, 0x7fffffff
jae 0x51094a
cmp dword [eax + ebx], 0x4550
jne 0x51094a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x51094a
cmp dword [edx + 4], 0
je 0x51094a
push 0
add eax, ebx
mov ecx, ebx
push str.SymFunctionTableAccess64
push eax
call fcn.00528e20
jmp 0x51094c
xor eax, eax
mov dword [0x6350ac], eax
cmp word [ebx], si
jne 0x510995
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510995
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x510995
cmp dword [eax + ebx], 0x4550
jne 0x510995
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510995
cmp dword [edx + 4], 0
je 0x510995
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetModuleBase64
push eax
call fcn.00528e20
jmp 0x510997
xor eax, eax
mov dword [0x635078], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x5109e2
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x5109e2
cmp eax, 0x7fffffff
jae 0x5109e2
cmp dword [eax + ebx], 0x4550
jne 0x5109e2
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x5109e2
cmp dword [edx + 4], 0
je 0x5109e2
push 0
add eax, ebx
mov ecx, ebx
push str.SymRegisterCallbackW64
push eax
call fcn.00528e20
nop
jmp 0x5109e4
xor eax, eax
mov dword [0x635090], eax
cmp word [ebx], si
jne 0x510a2a
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510a2a
cmp eax, 0x7fffffff
jae 0x510a2a
cmp dword [eax + ebx], 0x4550
jne 0x510a2a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510a2a
cmp dword [edx + 4], 0
je 0x510a2a
push 0
add eax, ebx
mov ecx, ebx
push str.StackWalk64
push eax
call fcn.00528e20
jmp 0x510a2c
xor eax, eax
mov dword [0x635098], eax
cmp word [ebx], si
jne 0x510a75
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510a75
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x510a75
cmp dword [eax + ebx], 0x4550
jne 0x510a75
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510a75
cmp dword [edx + 4], 0
je 0x510a75
push 0
add eax, ebx
mov ecx, ebx
push str.StackWalkEx
push eax
call fcn.00528e20
jmp 0x510a77
xor eax, eax
mov dword [0x6350a0], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x510ac2
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510ac2
cmp eax, 0x7fffffff
jae 0x510ac2
cmp dword [eax + ebx], 0x4550
jne 0x510ac2
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510ac2
cmp dword [edx + 4], 0
je 0x510ac2
push 0
add eax, ebx
mov ecx, ebx
push str.SymFromInlineContextW
push eax
call fcn.00528e20
nop
jmp 0x510ac4
xor eax, eax
mov dword [0x63508c], eax
cmp word [ebx], si
jne 0x510b0a
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510b0a
cmp eax, 0x7fffffff
jae 0x510b0a
cmp dword [eax + ebx], 0x4550
jne 0x510b0a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510b0a
cmp dword [edx + 4], 0
je 0x510b0a
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetLineFromInlineContextW
push eax
call fcn.00528e20
jmp 0x510b0c
xor eax, eax
mov dword [0x6350a8], eax
cmp word [ebx], si
jne 0x510b55
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510b55
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x510b55
cmp dword [eax + ebx], 0x4550
jne 0x510b55
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510b55
cmp dword [edx + 4], 0
je 0x510b55
push 0
add eax, ebx
mov ecx, ebx
push str.MiniDumpWriteDump
push eax
call fcn.00528e20
jmp 0x510b57
xor eax, eax
mov dword [0x63509c], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x510ba5
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510ba5
cmp eax, 0x7fffffff
jae 0x510ba5
cmp dword ds:[eax + ebx], 0x4550
jne 0x510ba5
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510ba5
cmp dword [edx + 4], 0
je 0x510ba5
push 0
add eax, ebx
mov ecx, ebx
push str.UnDecorateSymbolNameW
push eax
call fcn.00528e20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret