Function at 0x4328f4
Capabilities:
Parse pe header

Disassembly:
mov edx, edx
mov eax, eax
mov edi, edi
mov ebx, ebx
mov ecx, ecx
mov edx, edx
mov ecx, ecx
mov esi, esi
mov edx, edx
xor eax, eax
pop esi
pop ebp
ret
push 4
mov eax, 0x9d3
call 0x729f28
sub eax, dword [ecx]
mov dword [ebp - 0x10], esi
push 0
call fcn.00432983
and dword [ebp - 4], 0
xor dword [ecx], eax
mov dword [esi], 0x80f908
call fcn.004228df
test eax, eax
jns 0x432900
add eax, ebp
xchg ebx, eax
and eax, dword [eax]
add byte [ebx + 0x760000c6], cl
das
add bl, al
push ebp
aam 1
push esi
mov esi, ecx
call 0x432921
add byte [ebp + 8], al
add dword [eax + ebx - 0x68], esi
je 0x43291a
cwde
add dword [eax], ecx
add al, 0x75
or byte [esi - 0x18], dl
loopne 0x43290c
add byte [eax], al
jmp 0x432919
pop ecx
mov eax, dword [eax]
add byte [ebp - 0x3e], bl
add al, 0
push esi
jae 0x432925
lea eax, [esi + 8]
mov dword [esi], 0xf908
inc esi
or bh, al
push es
or cl, bh
add byte [eax], al
push eax
call dword [0x126968c]
mov ecx, esi
pop esi
jmp 0x54f092
cmp esi, 0x7d000000
jmp 0x4a29ac
jb 0x54efb7
jmp 0x41804f
call fcn.00417c60
jmp 0x4e642a
push eax
push ecx
mov ecx, 0x39535052
mov dword [esp + 4], ecx
mov ecx, dword [esp]
add esp, 4
mov dword [esp], ecx
mov dword [esp], eax
push ebx
mov eax, dword [esp]
sub esp, 4
mov dword [esp], ecx
push esp
pop ecx
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
push dword [esp]
pop eax
push ebp
mov ebp, esp
add ebp, 4
push ecx
mov ecx, 4
add ebp, 0x76dff6fe
add ebp, ecx
sub ebp, 0x76dff6fe
pop ecx
xchg dword [esp], ebp
pop esp
push dword [sym.imp.USER32.dll_OpenClipboard]
push dword [esp]
pop ecx
push ebp
mov ebp, esp
add ebp, 4
push ecx
mov ecx, 0x17fcb81a
add ecx, 0x5ee39e06
shr ecx, 6
sub ecx, 0x1db8154
add ebp, ecx
pop ecx
xchg dword [esp], ebp
pop esp
jmp 0x51e721
push edi
mov edi, esp
push eax
mov eax, 4
add edi, eax
pop eax
sub edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
mov dword [esp], esi
pop dword [0x637980]
push ebx
push edi
push esi
mov dword [esp], 0x3ea214cf
pop edi
mov dword [esp + 4], edi
pop edi
mov dword [esp], ebx
push ebp
mov dword [esp], 0x26468b32
mov dword [esp], ecx
push dword [esp]
pop ebx
add esp, 4
push dword [esp]
pop ebx
push edx
mov edx, esp
add edx, 4
push ebp
mov ebp, 4
add edx, ebp
pop ebp
xor edx, dword [esp]
xor dword [esp], edx
xor edx, dword [esp]
pop esp
jmp 0x4a495a
push edx
sub esp, 4
mov dword [esp], ebx
mov ebx, 0x610110d3
mov dword [esp + 4], ebx
mov ebx, dword [esp]
add esp, 4
mov dword [esp], ebx
push eax
mov dword [esp], edi
mov dword [esp], 0x4a7e09e9
mov dword [esp], ecx
mov ebx, dword [esp]
add esp, 4
push dword [esp]
pop ebx
push edx
mov dword [esp], eax
mov eax, esp
add eax, 4
push edi
mov edi, 4
add eax, edi
pop edi
xchg dword [esp], eax
pop esp
push dword [eax + 0x3c]
mov eax, dword [esp]
push edx
mov edx, esp
push ebp
mov ebp, 0x5fd3f50d
sub ebp, 0x77fbcd84
neg ebp
dec ebp
shr ebp, 6
sub ebp, 0x609f5d
add edx, ebp
pop ebp
add edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
push ecx
mov dword [esp], ebx
push 0x4007e382
mov dword [esp], esi
mov esi, 0x633ada57
mov dword [esp + 4], esi
pop esi
mov dword [esp], eax
push edi
push esp
pop edi
add edi, 4
push eax
mov eax, 4
sub edi, eax
pop eax
xchg dword [esp], edi
pop esp
mov dword [esp], ebx
pop eax
push dword [esp]
pop eax
push ebp
mov ebp, esp
push edx
mov edx, 0x3c692136
not edx
sub edx, 0xc396dec5
add ebp, edx
pop edx
add ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
jmp fcn.005113fb
test eax, eax
jmp 0x5591af
sub esp, 4
mov dword [esp], esi
mov dword [esp], edi
push edx
mov edx, 0x585d6147
mov dword [esp + 4], edx
pop edx
mov dword [esp], ecx
sub ecx, 0x79ff8194
push esi
mov esi, 0x3fb7d140
or esi, 0x7eea6b5b
dec esi
xor esi, 0x3caded5
add ecx, esi
pop esi
add ecx, eax
sub ecx, 0x7c35258f
push esi
mov esi, 0x4ff5f534
xchg esi, ebx
dec ebx
xchg esi, ebx
neg esi
dec esi
sub esi, 0x7f7fb93b
add esi, 0x49753003
add ecx, esi
pop esi
push dword [esp]
mov ecx, dword [esp]
add esp, 4
push esi
mov esi, esp
add esi, 4
add esi, 4
push esi
push dword [esp + 4]
pop esi
pop dword [esp]
pop esp
xor eax, ecx
jmp 0x590572
push dword [0x637980]
push dword [esp]
pop eax
sub esp, 4
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
jmp 0x4b7324
add esp, 4
jmp 0x4c8214
xor eax, ecx
push edi
mov edi, esp
add edi, 4
push esi
mov esi, 4
sub edi, esi
pop esi
xchg dword [esp], edi
pop esp
mov dword [esp], edi
mov dword [esp], edx
mov dword [esp], eax
push eax
mov dword [esp], 0x483d8137
mov dword [esp], edx
mov dword [esp], ebx
mov eax, dword [esp]
add esp, 4
mov eax, dword [esp]
push edi
push esp
pop edi
add edi, 4
push esi
mov esi, 0x5f69fd50
inc esi
add esi, 0x13ee1f89
neg esi
dec esi
not esi
not esi
sub esi, 0x8ca7e321
add edi, esi
pop esi
xchg dword [esp], edi
pop esp
jmp 0x5126c0
cmp word [esi], 0x5a4d
jmp 0x5591ba
xor eax, ecx
sub esp, 4
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
sub ebx, 4
push ebp
mov dword [esp], ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
pop esp
mov dword [esp], ecx
push 0x6df233a8
mov dword [esp], edi
mov edi, 0x7fbf9afd
xor edi, 0x7defecfc
sub edi, 0x827b7536
sub ecx, edi
pop edi
add ecx, eax
push esi
mov esi, 0x7fd500cb
add ecx, esi
mov esi, dword [esp]
add esp, 4
push dword [esp]
pop ecx
push ebx
push esp
pop ebx
add ebx, 4
add ebx, 4
push ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
pop esp
jmp 0x503fd3
push dword [sym.imp.USER32.dll_MoveWindow]
push dword [esp]
mov ecx, dword [esp]
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0x4ce274
push dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
push dword [esp]
pop ecx
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
pop esp
push ebx
mov ebx, esp
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
pop esp
mov dword [esp], edx
mov dword [esp], 0x8efcd85
mov dword [esp], ecx
mov dword [esp], edx
push ebp
mov dword [esp], ecx
push dword [esp]
mov edx, dword [esp]
add esp, 4
add esp, 4
mov edx, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
sub esp, 4
mov dword [esp], edx
mov edx, 4
add ebp, edx
pop edx
xchg dword [esp], ebp
mov esp, dword [esp]
jmp 0x4f98b9
xor eax, ecx
jmp 0x574e2e
xor eax, ecx
jmp 0x55631f
add esi, 0x1000
jmp 0x4a29a1
xor eax, ecx
push edi
mov edi, esp
add edi, 4
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], eax
push ecx
mov ecx, 0x21a91291
mov dword [esp + 4], ecx
pop ecx
mov dword [esp], edx
push edi
mov edi, esp
push ecx
push 4
pop ecx
add edi, ecx
pop ecx
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], ecx
pop edx
push dword [esp]
pop edx
push ebp
mov dword [esp], 0x5eefe415
mov dword [esp], edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
jmp 0x59860a
push 0x5d7a71a9
mov dword [esp], esi
push eax
mov dword [esp], edx
mov edx, 0x2628490e
mov dword [esp + 4], edx
pop edx
mov dword [esp], edx
push esi
mov dword [esp], edx
mov dword [esp], esi
mov dword [esp], ecx
mov edx, dword [esp]
add esp, 4
mov edx, dword [esp]
push ecx
mov ecx, esp
push edx
mov edx, 0x37ef51f5
xor edx, 0x7daa58da
xor edx, 0x5f7f0c21
and edx, 0x74ff4f59
not edx
dec edx
add edx, 0x143a050e
add ecx, edx
pop edx
push ebp
push 4
pop ebp
add ecx, ebp
pop ebp
xchg dword [esp], ecx
pop esp
push dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [esp]
push ecx
mov dword [esp], edi
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
jmp 0x53b0d4
push dword [sym.imp.USER32.dll_MessageBeep]
push dword [esp]
mov ecx, dword [esp]
add esp, 4
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
sub esp, 4
mov dword [esp], edi
push edi
mov edi, 0x2d0cb1bc
mov dword [esp + 4], edi
pop edi
mov dword [esp], edx
push ecx
mov edx, dword [esp]
push ebx
mov ebx, esp
add ebx, 4
push esi
mov esi, 0x2feb72a1
or esi, 0x7ff23ae1
sub esi, 0x7ffb7add
add ebx, esi
pop esi
xchg dword [esp], ebx
mov esp, dword [esp]
mov edx, dword [esp]
push esi
push esp
pop esi
add esi, 4
add esi, 4
push esi
push dword [esp + 4]
pop esi
pop dword [esp]
mov esp, dword [esp]
jmp 0x564b34
sub esp, 4
mov dword [esp], edi
push esi
mov esi, 0x26dc1127
mov dword [esp + 4], esi
pop esi
mov dword [esp], edi
mov dword [esp], ebx
push ebx
mov dword [esp], ecx
mov ebx, dword [esp]
push ecx
mov ecx, esp
push esi
mov esi, 0x6cfd6bc0
add esi, 0x7ff32406
add esi, 0x7cffae62
not esi
and esi, 0x347d8417
add esi, 0xebf27fed
add ecx, esi
pop esi
add ecx, 4
xchg dword [esp], ecx
pop esp
mov ebx, dword [esp]
push 0x5fc7cc3a
mov dword [esp], ebx
push esp
pop ebx
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
mov esp, dword [esp]
xor eax, ecx
jmp 0x4a8c09
push ebx
mov ebx, esp
add ebx, 4
push eax
mov eax, 4
sub ebx, eax
pop eax
xchg dword [esp], ebx
pop esp
mov dword [esp], edi
mov dword [esp], eax
mov dword [esp], ebx
push 0x1f088e6d
mov dword [esp], ecx
mov ebx, dword [esp]
sub esp, 4
mov dword [esp], ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
push dword [esp]
pop ebx
push ebp
mov ebp, esp
add ebp, 4
push eax
mov eax, 4
add ebp, eax
pop eax
xchg dword [esp], ebp
mov esp, dword [esp]
push ecx
mov ecx, esp
sub esp, 4
mov dword [esp], edx
mov edx, 0x7d5cccec
neg edx
sub edx, 0x2dff6bd3
or edx, 0x76f162e9
xor edx, 0x76f3e7ed
add ecx, edx
pop edx
sub ecx, 4
xor ecx, dword [esp]
xor dword [esp], ecx
xor ecx, dword [esp]
pop esp
mov dword [esp], esi
push eax
push esi
push 0x2896db94
pop esi
mov dword [esp + 4], esi
pop esi
mov dword [esp], edi
mov dword [esp], edx
push edi
mov dword [esp], ecx
mov edx, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
push eax
mov eax, 4
add ebp, eax
pop eax
xchg dword [esp], ebp
pop esp
push dword [esp]
pop edx
push ecx
mov ecx, esp
add ecx, 4
push esi
push 0x7abda2d9
pop esi
jp 0x54f0f2
dec esi
neg esi
dec esi
shl esi, 5
not esi
add esi, 0xa84ba4e5
add ecx, esi
pop esi
xchg dword [esp], ecx
pop esp
jmp 0x4adb91
add byte [ebx + 0x1c8704c3], al
and al, 0x8b
and al, 0x24
xor eax, ecx
push ebx
sub esp, 4
mov dword [esp], ebp
mov ebp, 0x478f230d
mov dword [esp + 4], ebp
pop ebp
mov dword [esp], ebx
push edx
mov dword [esp], 0x652851d4
mov dword [esp], ecx
mov ebx, dword [esp]
push edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
push dword [esp]
pop ebx
push esi
mov esi, esp
push ebx
mov dword [esp], ecx
mov ecx, 4
add esi, ecx
pop ecx
add esi, 4
xchg dword [esp], esi
pop esp
jmp 0x556293
push edi
push 0x29847daf
mov dword [esp], ecx
mov ecx, 0x268446b4
mov dword [esp + 4], ecx
pop ecx
mov dword [esp], ecx
mov dword [esp], edx
push 0x64b4b0ac
mov dword [esp], ecx
mov edx, dword [esp]
push 0x68b0a1ea
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
mov edx, dword [esp]
push esi
mov dword [esp], eax
mov eax, esp
add eax, 4
add eax, 4
push 0x51de6fbb
mov dword [esp], eax
push dword [esp + 4]
pop eax
pop dword [esp]
pop esp
push dword [sym.imp.USER32.dll_PeekMessageW]
push dword [esp]
mov ecx, dword [esp]
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0x548a9e
push dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp]
mov ecx, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
add esp, 4
push ecx
mov dword [esp], ebp
push esp
pop ebp
add ebp, 4
sub ebp, 4
push ebp
push dword [esp + 4]
pop ebp
pop dword [esp]
pop esp
mov dword [esp], eax
push edi
mov edi, esp
add edi, 4
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], ebx
mov eax, dword [esp]
push eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
pop esp
push dword [esp]
mov eax, dword [esp]
add esp, 4
push eax
mov eax, esp
add eax, 4
push edx
mov edx, 4
add eax, edx
pop edx
xchg dword [esp], eax
pop esp
jmp 0x5741e2
je 0x520680
jmp 0x4f3ce3
jne 0x520680
jmp 0x4d830c
xor eax, ecx
push ecx
mov dword [esp], ebp
push edx
mov edx, 0x47d783
mov dword [esp + 4], edx
mov edx, dword [esp]
add esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], ecx
mov ebx, dword [esp]
push edx
push esp
pop edx
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
push dword [esp]
pop ebx
push edx
push esp
pop edx
add edx, 4
add edx, 4
xor edx, dword [esp]
xor dword [esp], edx
xor edx, dword [esp]
pop esp
jmp 0x53c509
xor eax, ecx
push edx
mov edx, esp
add edx, 4
sub edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
mov dword [esp], edx
mov dword [esp], ebp
mov dword [esp], ebx
sub esp, 4
mov dword [esp], ecx
mov ebx, dword [esp]
sub esp, 4
mov dword [esp], edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
push dword [esp]
push dword [esp]
pop ebx
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
add esp, 4
jmp 0x53f81e
push dword [sym.imp.USER32.dll_OffsetRect]
push dword [esp]
mov ecx, dword [esp]
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
add esp, 4
push esi
mov esi, esp
push ebx
mov ebx, 0x6deec525
shl ebx, 8
dec ebx
sub ebx, 0xeec524fb
add esi, ebx
pop ebx
push edi
mov edi, 0x7d6fd797
add edi, 0x8290286d
sub esi, edi
mov edi, dword [esp]
add esp, 4
xchg dword [esp], esi
pop esp
mov dword [esp], edx
push ebp
mov dword [esp], ecx
mov edx, dword [esp]
sub esp, 4
mov dword [esp], edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
mov edx, dword [esp]
push edx
push esp
pop edx
push ecx
mov ecx, 0x7efff233
push ebp
mov ebp, 0x67fe487a
shr ebp, 2
xor ebp, 0x6700ccbc
or ecx, ebp
pop ebp
add ecx, 0x7a3fc369
shr ecx, 6
xor ecx, 0x3e4ff0c
add edx, ecx
pop ecx
add edx, 4
xchg dword [esp], edx
pop esp
jmp 0x4f0a2d
push 0x31c08f37
mov dword [esp], edx
mov dword [esp], ecx
mov dword [esp], 0x34465212
mov dword [esp], ebx
mov dword [esp], edx
sub esp, 4
mov dword [esp], edx
mov dword [esp], edi
mov dword [esp], ecx
mov edx, dword [esp]
add esp, 4
push dword [esp]
mov edx, dword [esp]
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
xor eax, ecx
push ebp
mov dword [esp], ebx
push esp
pop ebx
push ecx
mov ecx, 0xded9716
shr ecx, 6
add ecx, 0xffc849a8
add ebx, ecx
pop ecx
sub ebx, 4
xchg dword [esp], ebx
pop esp
mov dword [esp], ecx
push eax
mov eax, 0x6eff93a0
push edi
mov edi, 0x58be0c7b
sub eax, edi
pop edi
sub eax, 0x9652bd71
sub ecx, eax
pop eax
push edi
mov edi, 0x5e7f4328
shl edi, 4
shl edi, 3
neg edi
inc edi
shr edi, 6
add edi, 0x584d5060
add ecx, edi
pop edi
add ecx, eax
sub ecx, 0x5b4eca10
add ecx, 0x7feec9b4
mov ecx, dword [esp]
push eax
mov eax, esp
push 0x3beffd4b
mov dword [esp], esi
mov esi, 4
add eax, esi
pop esi
add eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
jmp fcn.00590ef8
push ecx
mov ecx, esp
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], edx
mov dword [esp], esi
mov dword [esp], eax
push ebx
push dword [esp]
pop eax
push esi
mov esi, esp
add esi, 4
add esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
pop esp
mov eax, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
push edi
mov edi, 4
add ebp, edi
pop edi
push ebp
push dword [esp + 4]
pop ebp
pop dword [esp]
mov esp, dword [esp]
push dword [sym.imp.USER32.dll_ModifyMenuW]
push dword [esp]
pop ecx
push ebp
mov ebp, esp
add ebp, 4
push ebx
mov ebx, 4
add ebp, ebx
pop ebx
xchg dword [esp], ebp
pop esp
push ebx
mov ebx, esp
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
pop esp
mov dword [esp], esi
push edx
mov edx, 0x79d6146e
mov dword [esp + 4], edx
pop edx
mov dword [esp], eax
push ebx
push dword [esp]
mov eax, dword [esp]
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
add esp, 4
mov eax, dword [esp]
push ebp
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
sub esp, 4
mov dword [esp], eax
mov eax, 4
add ebx, eax
pop eax
xchg dword [esp], ebx
pop esp
jmp 0x51e728
push ebx
push esp
pop ebx
add ebx, 4
sub ebx, 4
push ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
mov esp, dword [esp]
mov dword [esp], edx
push ebp
mov dword [esp], ecx
mov edx, dword [esp]
sub esp, 4
mov dword [esp], esi
mov esi, esp
add esi, 4
add esi, 4
xchg dword [esp], esi
pop esp
push dword [esp]
pop edx
push ebp
push esp
pop ebp
push esi
mov esi, 0x47fc8bb1
or esi, 0x37cd7841
or esi, 0x6b6f8b97
sub esi, 0x7ffffbf3
add ebp, esi
pop esi
add ebp, 4
xchg dword [esp], ebp
pop esp
push dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [esp]
push edx
mov edx, esp
push eax
mov eax, 0x71de85d9
or eax, 0x5fcf3f93
xor eax, 0x7cff65b9
and eax, 0x4df73e6d
push edx
mov edx, 0x7f776893
shl edx, 5
and edx, 0x4b7d5b4c
shr edx, 8
add edx, 0xd5ad52
xor eax, edx
pop edx
add edx, eax
pop eax
add edx, 4
xchg dword [esp], edx
pop esp
jmp 0x58b60b