Function at 0x4103f4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 0x1c], 0
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x20], edx
push edi
test esi, esi
je 0x410480
cmp esi, dword [0x45379c]
je 0x410480
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x410480
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
jne 0x410480
mov eax, dword [ecx + esi + 0x80]
mov ecx, dword [ecx + esi + 0x84]
add eax, esi
add ecx, eax
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x410480
cmp eax, ecx
je 0x4105fb
lea ecx, [eax + 0xc]
mov dword [ebp - 8], ecx
cmp dword [ecx - 8], 0
jne 0x410462
cmp dword [ecx], 0
je 0x4105fb
mov edx, dword [ecx]
mov edi, dword [ecx - 0xc]
mov ebx, dword [ecx + 4]
lea eax, [esi + edx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0xc], edx
test edi, edi
jne 0x410487
mov edi, ebx
test ebx, ebx
jne 0x41048b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp edi, ebx
jne 0x410492
mov dword [ebp - 0x10], 1
add ebx, esi
add edi, esi
je 0x4105e6
cmp dword [edi], 0
je 0x4105e3
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 0
je 0x4105d7
lea edx, [eax + 4]
mov dword [ebp - 4], edx
mov eax, dword [edx + 4]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx]
mov dword [ebp - 0x24], ecx
test eax, eax
je 0x4104f0
cmp dword [ebp - 0xc], 0
je 0x4104f0
push dword [ebp - 0xc]
push eax
call dword [0x44bd50]
mov edx, dword [ebp - 4]
pop ecx
pop ecx
test eax, eax
jne 0x4105c7
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x41056d
cmp dword [ebp - 0x10], 0
je 0x41052c
cmp dword [edx], 0
je 0x4105c7
push dword [edx]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x4105c4
mov ecx, dword [ebp - 4]
push dword [ecx - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4105c4
cmp dword [ebx], eax
jmp 0x41056b
mov eax, dword [edi]
test eax, eax
jns 0x41053f
movzx eax, ax
cmp ecx, eax
jne 0x4105c7
jmp 0x41056d
add eax, 2
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x410564
test dl, dl
je 0x410560
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x410564
add ecx, 2
add eax, 2
test dl, dl
jne 0x410544
xor eax, eax
jmp 0x410569
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4105c4
push 0x455c70
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.004103b5
test eax, eax
jne 0x4105b9
push dword [ebp - 0x18]
xor edx, edx
mov ecx, ebx
push dword [ebp - 0x14]
call fcn.00410324
pop ecx
pop ecx
test eax, eax
je 0x4105b9
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x64], ecx
inc edx
or dword [eax + 0x68], edx
lea ecx, [ebp - 0x2c]
push ecx
push 0x20
push 0x6c
push eax
mov dword [ebp - 0x1c], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x455c70
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 4]
add edx, 0x10
mov dword [ebp - 4], edx
cmp dword [edx + 4], 0
jne 0x4104b8
add ebx, 4
add edi, 4
jne 0x41049c
mov ecx, dword [ebp - 8]
add ecx, 0x14
mov dword [ebp - 8], ecx
add ecx, 0xfffffff4
cmp ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
jne 0x410453
mov eax, dword [ebp - 0x1c]
jmp 0x410482