Function at 0x510580
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov edx, 0x632d28
xor ecx, ecx
push ebx
push esi
push edi
call fcn.00529000
test eax, eax
je 0x5105c8
mov edx, 0x632d68
xor ecx, ecx
call fcn.00529000
test eax, eax
je 0x5105c8
mov edx, 0x632d70
xor ecx, ecx
call fcn.00529000
jmp 0x5105c0
test eax, eax
jne 0x510fa5
xor ebx, ebx
mov dword [esp + 0x18], 0
push ebx
push 0x632d40
push 0xfffffffffffffffd
push 0x20019
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], ebx
push eax
call sym.SystemInformer.exe_PhOpenKey
or esi, 0xffffffff
test eax, eax
js 0x510853
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x14
push eax
push dword [esp + 0x10]
mov dword [esp + 0x28], str.KitsRoot10
call sym.SystemInformer.exe_PhQueryRegistryString
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x51062c
cmp dword [edi], ebx
jne 0x5106b6
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x14
push eax
push dword [esp + 0x10]
mov dword [esp + 0x28], str.KitsRoot81
call sym.SystemInformer.exe_PhQueryRegistryString
mov ecx, edi
mov dword [esp + 0x1c], eax
mov edi, eax
test ecx, ecx
je 0x510668
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x510668
call fcn.004fc420
test edi, edi
je 0x510670
cmp dword [edi], ebx
jne 0x5106b6
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x10
push eax
push dword [esp + 0x10]
mov dword [esp + 0x28], str.KitsRoot
mov dword [esp + 0x18], edi
call sym.SystemInformer.exe_PhQueryRegistryString
mov edi, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], edi
test eax, eax
je 0x5106b6
lea ecx, [eax - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x5106b6
call fcn.004fc420
push dword ds:[esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
je 0x510853
mov eax, dword [edi]
add eax, 0x1e
mov dword [esp + 0x14], ebx
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 0
push eax
call sym.SystemInformer.exe_PhCreateString3
push dword [edi]
mov esi, eax
push dword [edi + 4]
mov dword [esp + 0x18], esi
push dword [esi + 4]
call fcn.00582850
mov eax, dword [esp + 0x28]
mov ecx, 7
mov edi, dword [esi + 4]
add esp, 0xc
mov esi, str.Debuggersx86_
add edi, dword [eax]
rep movsd dword es:[edi], dword [esi]
lea ecx, [eax - 8]
movsw word es:[edi], word [esi]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x51072b
call fcn.004fc420
push 0x632d28
push dword [esp + 0x14]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x60b800
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x510833
push dword ds:[eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov dword [esp + 0x18], edi
add ecx, 0xfffffff8
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x510785
lea esp, [esp]
call fcn.004fc420
test edi, edi
je 0x510835
push 0x632d68
push dword [esp + 0x14]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x60b800
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x510835
push dword ds:[eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov ebx, eax
add ecx, 0xfffffff8
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x5107dd
call fcn.004fc420
lea ecx, [ecx]
test ebx, ebx
je 0x510835
push 0x632d70
push dword [esp + 0x14]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x60b800
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x510835
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov edx, esi
mov dword [esp + 0x24], eax
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], edx
dec edx
jne 0x510835
call fcn.004fc420
jmp 0x510835
xor edi, edi
mov ecx, dword [esp + 0x10]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x51084b
call fcn.004fc420
test edi, edi
jne 0x5109af
call sym.SystemInformer.exe_PhGetApplicationDirectoryWin32
mov edi, eax
test edi, edi
je 0x51096c
push 0x632d28
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x60b800
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x510905
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x5108b2
call fcn.004fc420
cmp dword [esp + 0x18], 0
je 0x510905
push 0x632d68
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x60b800
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword ds:[esp + 0x1c], eax
test eax, eax
je 0x510905
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov ebx, eax
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x510905
nop
call fcn.004fc420
test ebx, ebx
je 0x510953
push 0x632d70
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x60b800
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x510953
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x510953
call fcn.004fc420
lea ecx, [edi - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x510965
mov edi, edi
call fcn.004fc420
cmp dword [esp + 0x18], 0
jne 0x5109af
push 0x800
push 0
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, edi
test eax, eax
jne 0x5109af
push 0x200
push eax
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x5109af
cmp dword [0x62fbb0], 0x3e
jae 0x5109af
push eax
push eax
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test ebx, ebx
jne 0x510a06
push 0x800
push ebx
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x510a06
push 0x200
push eax
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x510a06
cmp dword [0x62fbb0], 0x3e
jae 0x510a04
push eax
push eax
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x510a06
xor ebx, ebx
cmp dword [esp + 0x24], 0
jne 0x510a4f
push 0x800
push 0
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop
test eax, eax
jne 0x510a4f
push 0x200
push eax
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x510a4f
cmp dword [0x62fbb0], 0x3e
jae 0x510a4f
push eax
push eax
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test ebx, ebx
je 0x510fa5
mov esi, 0x5a4d
cmp word [ebx], si
jne 0x510aa2
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510aa2
cmp eax, 0x7fffffff
jae 0x510aa2
cmp dword [eax + ebx], 0x4550
jne 0x510aa2
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510aa2
cmp dword [edx + 4], 0
je 0x510aa2
push 0
add eax, ebx
mov ecx, ebx
push str.SymInitializeW
push eax
call fcn.00529280
nop
jmp 0x510aa4
xor eax, eax
mov ecx, ebx
mov edx, 0x3c
mov dword [0x636074], eax
cmp word [ebx], si
jne 0x510af3
mov eax, dword [ecx + edx]
test eax, eax
je 0x510af3
lea esp, [esp]
cmp eax, 0x7fffffff
jae 0x510af3
cmp dword [eax + ebx], 0x4550
jne 0x510af3
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510af3
cmp dword [edx + 4], 0
je 0x510af3
push 0
add eax, ebx
push str.SymCleanup
push eax
call fcn.00529280
jmp 0x510af5
xor eax, eax
mov dword [0x63607c], eax
cmp word [ebx], si
jne 0x510b3d
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510b3d
cmp eax, 0x7fffffff
jae 0x510b3d
cmp dword [eax + ebx], 0x4550
jne 0x510b3d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510b3d
cmp dword [edx + 4], 0
je 0x510b3d
push 0
add eax, ebx
mov ecx, ebx
push str.SymFromAddrW
push eax
call fcn.00529280
jmp 0x510b3f
xor eax, eax
mov dword [0x6360a4], eax
cmp word [ebx], si
jne 0x510b87
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510b87
cmp eax, 0x7fffffff
jae 0x510b87
cmp dword ds:[eax + ebx], 0x4550
jne 0x510b87
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510b87
cmp dword [edx + 4], 0
je 0x510b87
push 0
add eax, ebx
mov ecx, ebx
push str.SymFromNameW
push eax
call fcn.00529280
jmp 0x510b89
xor eax, eax
mov dword [0x636084], eax
cmp word [ebx], si
jne 0x510bd5
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510bd5
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x510bd5
cmp dword [eax + ebx], 0x4550
jne 0x510bd5
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510bd5
cmp dword [edx + 4], 0
je 0x510bd5
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetLineFromAddrW64
push eax
call fcn.00529280
jmp 0x510bd7
xor eax, eax
mov dword [0x636080], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x510c22
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510c22
cmp eax, 0x7fffffff
jae 0x510c22
cmp dword [eax + ebx], 0x4550
jne 0x510c22
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510c22
cmp dword [edx + 4], 0
je 0x510c22
push 0
add eax, ebx
mov ecx, ebx
push str.SymLoadModuleExW
push eax
call fcn.00529280
nop
jmp 0x510c24
xor eax, eax
mov dword [0x636088], eax
cmp word [ebx], si
jne 0x510c6a
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510c6a
cmp eax, 0x7fffffff
jae 0x510c6a
cmp dword [eax + ebx], 0x4550
jne 0x510c6a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510c6a
cmp dword [edx + 4], 0
je 0x510c6a
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetOptions
push eax
call fcn.00529280
jmp 0x510c6c
xor eax, eax
mov dword [0x6360b0], eax
cmp word [ebx], si
jne 0x510cb5
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510cb5
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x510cb5
cmp dword [eax + ebx], 0x4550
jne 0x510cb5
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510cb5
cmp dword [edx + 4], 0
je 0x510cb5
push 0
add eax, ebx
mov ecx, ebx
push str.SymSetOptions
push eax
call fcn.00529280
jmp 0x510cb7
xor eax, eax
mov dword [0x636094], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x510d02
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510d02
cmp eax, 0x7fffffff
jae 0x510d02
cmp dword [eax + ebx], 0x4550
jne 0x510d02
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510d02
cmp dword [edx + 4], 0
je 0x510d02
push 0
add eax, ebx
mov ecx, ebx
push str.SymSetSearchPathW
push eax
call fcn.00529280
nop
jmp 0x510d04
xor eax, eax
mov dword [0x6360b4], eax
cmp word [ebx], si
jne 0x510d4a
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510d4a
cmp eax, 0x7fffffff
jae 0x510d4a
cmp dword [eax + ebx], 0x4550
jne 0x510d4a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510d4a
cmp dword [edx + 4], 0
je 0x510d4a
push 0
add eax, ebx
mov ecx, ebx
push str.SymFunctionTableAccess64
push eax
call fcn.00529280
jmp 0x510d4c
xor eax, eax
mov dword [0x6360ac], eax
cmp word [ebx], si
jne 0x510d95
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510d95
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x510d95
cmp dword [eax + ebx], 0x4550
jne 0x510d95
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510d95
cmp dword [edx + 4], 0
je 0x510d95
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetModuleBase64
push eax
call fcn.00529280
jmp 0x510d97
xor eax, eax
mov dword [0x636078], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x510de2
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510de2
cmp eax, 0x7fffffff
jae 0x510de2
cmp dword [eax + ebx], 0x4550
jne 0x510de2
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510de2
cmp dword [edx + 4], 0
je 0x510de2
push 0
add eax, ebx
mov ecx, ebx
push str.SymRegisterCallbackW64
push eax
call fcn.00529280
nop
jmp 0x510de4
xor eax, eax
mov dword [0x636090], eax
cmp word [ebx], si
jne 0x510e2a
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510e2a
cmp eax, 0x7fffffff
jae 0x510e2a
cmp dword [eax + ebx], 0x4550
jne 0x510e2a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510e2a
cmp dword [edx + 4], 0
je 0x510e2a
push 0
add eax, ebx
mov ecx, ebx
push str.StackWalk64
push eax
call fcn.00529280
jmp 0x510e2c
xor eax, eax
mov dword [0x636098], eax
cmp word [ebx], si
jne 0x510e75
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510e75
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x510e75
cmp dword [eax + ebx], 0x4550
jne 0x510e75
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510e75
cmp dword [edx + 4], 0
je 0x510e75
push 0
add eax, ebx
mov ecx, ebx
push str.StackWalkEx
push eax
call fcn.00529280
jmp 0x510e77
xor eax, eax
mov dword [0x6360a0], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x510ec2
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510ec2
cmp eax, 0x7fffffff
jae 0x510ec2
cmp dword [eax + ebx], 0x4550
jne 0x510ec2
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510ec2
cmp dword [edx + 4], 0
je 0x510ec2
push 0
add eax, ebx
mov ecx, ebx
push str.SymFromInlineContextW
push eax
call fcn.00529280
nop
jmp 0x510ec4
xor eax, eax
mov dword [0x63608c], eax
cmp word [ebx], si
jne 0x510f0a
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510f0a
cmp eax, 0x7fffffff
jae 0x510f0a
cmp dword [eax + ebx], 0x4550
jne 0x510f0a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510f0a
cmp dword [edx + 4], 0
je 0x510f0a
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetLineFromInlineContextW
push eax
call fcn.00529280
jmp 0x510f0c
xor eax, eax
mov dword [0x6360a8], eax
cmp word [ebx], si
jne 0x510f55
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510f55
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x510f55
cmp dword [eax + ebx], 0x4550
jne 0x510f55
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510f55
cmp dword [edx + 4], 0
je 0x510f55
push 0
add eax, ebx
mov ecx, ebx
push str.MiniDumpWriteDump
push eax
call fcn.00529280
jmp 0x510f57
xor eax, eax
mov dword [0x63609c], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x510fa5
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510fa5
cmp eax, 0x7fffffff
jae 0x510fa5
cmp dword ds:[eax + ebx], 0x4550
jne 0x510fa5
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510fa5
cmp dword [edx + 4], 0
je 0x510fa5
push 0
add eax, ebx
mov ecx, ebx
push str.UnDecorateSymbolNameW
push eax
call fcn.00529280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret