Function at 0x402b53
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x374
mov eax, dword [0x43e0a4]
xor eax, esp
mov dword [esp + 0x36c], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x28]
shr eax, 1
and eax, 0xffffff01
cmp dword [edi + 0x20148], 0xffffffff
mov dword [esp + 0x28], eax
je 0x402ede
test al, al
je 0x402b99
cmp dword [edi + 0x2014c], 0xffffffff
je 0x402ede
call fcn.0040313b
mov dword [esp + 0x24], eax
test eax, eax
je 0x402ede
mov edx, dword [edi + 0x20]
mov cl, byte [edi + 0x2012c]
test edx, edx
je 0x402bd2
test cl, cl
je 0x402bc0
mov eax, dword [edi + 0x1c]
jmp 0x402bc3
mov eax, dword [edi + 0x18]
mov dword [esp + 0x2c], eax
movzx eax, cl
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
xor ebx, ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
push 3
pop edx
test cl, cl
jne 0x402bf0
mov eax, dword [edi + 0x18]
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], eax
jmp 0x402bf8
mov dword [esp + 0x64], 2
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x6c], eax
mov eax, dword [edi + 0x20154]
test eax, eax
je 0x402c0d
mov ecx, dword [eax]
jmp 0x402c0f
mov ecx, ebx
xor eax, eax
cmp byte [edi + 0x2c], al
push 0xc
setne al
add eax, edx
add eax, ecx
xor ecx, ecx
pop ebp
mul ebp
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00406a20
mov esi, eax
mov dword [esp], 0x308
lea eax, [esp + 0x68]
push ebx
mov dword [esi + 4], ebp
xor ebp, ebp
mov dword [esi + 8], eax
inc ebp
mov dword [esi], 0x47670001
mov eax, dword [edi + 0x24]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x78]
push eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], esi
call fcn.0040b260
mov eax, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
je 0x402cf7
mov ebp, 0x308
cmp byte [edi + 0x2012c], bl
je 0x402ce1
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
push ecx
push ebp
lea ecx, [esp + 0x78]
push ecx
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x402ca4
cmp dword [esp + 0x20], ebp
je 0x402cdd
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [edi + 0x20150], bl
je 0x402cba
push dword [edi + 0x20148]
call ebp
cmp byte [edi + 0x20151], bl
je 0x402ed3
mov eax, dword [edi + 0x2014c]
cmp eax, 0xffffffff
je 0x402ed3
push eax
call ebp
jmp 0x402ed3
lea eax, [esp + 0x70]
mov dword [esi + 0x10], ebp
mov dword [esi + 0xc], 0x47670002
mov dword [esi + 0x14], eax
mov ebp, dword [esp + 0x18]
inc ebp
mov dword [esp + 0x18], ebp
mov eax, dword [edi + 0x20154]
test eax, eax
je 0x402d5e
cmp dword [eax], ebx
jbe 0x402d5e
mov edx, ebx
mov eax, dword [edi + 0x20154]
imul ecx, ebp, 0xc
mov eax, dword [eax + 4]
mov eax, dword [edx + eax]
lea edx, [edx + 0xc]
mov dword [ecx + esi], eax
imul ecx, dword [esp + 0x18], 0xc
mov eax, dword [edi + 0x20154]
mov eax, dword [eax + 4]
mov eax, dword [eax + edx - 8]
mov dword [ecx + esi + 4], eax
imul ecx, dword [esp + 0x18], 0xc
inc ebx
mov eax, dword [edi + 0x20154]
mov eax, dword [eax + 4]
mov eax, dword [eax + edx - 4]
mov dword [ecx + esi + 8], eax
mov ebp, dword [esp + 0x18]
mov eax, dword [edi + 0x20154]
inc ebp
mov dword [esp + 0x18], ebp
cmp ebx, dword [eax]
jb 0x402d07
xor ebx, ebx
lea edx, [edi + 0x2c]
cmp byte [edx], 0
je 0x402d9f
imul eax, ebp, 0xc
mov ecx, edx
lea ebp, [ecx + 1]
mov dword [eax + esi], 0xa
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402d75
sub ecx, ebp
mov eax, 0x20000
cmp ecx, eax
cmova ecx, eax
imul eax, dword [esp + 0x18], 0xc
inc ecx
mov dword [eax + esi + 4], ecx
imul eax, dword [esp + 0x18], 0xc
mov dword [eax + esi + 8], edx
inc dword [esp + 0x18]
push ebx
push ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x54], ebx
call fcn.00403669
cmp dword [edi + 0x20], 0
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
je 0x402e23
test byte [edi + 0x28], 4
jne 0x402e23
push dword [edi + 0x20]
lea ecx, [esp + 0x3c]
push dword [edi + 0x10]
call fcn.00402865
test al, al
jne 0x402e23
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [edi + 0x20150], al
je 0x402dff
push dword [edi + 0x20148]
call ebp
cmp byte [edi + 0x20151], 0
je 0x402eca
mov eax, dword [edi + 0x2014c]
cmp eax, 0xffffffff
je 0x402eca
push eax
call ebp
jmp 0x402eca
cmp byte [esp + 0x28], 0
mov ebp, dword [esp + 0x24]
mov byte [esp + 0x17], 1
je 0x402e62
push ebx
lea eax, [esp + 0x1c]
xor ecx, ecx
cmp dword [edi + 0x20], ebx
push eax
lea eax, [esp + 0x34]
cmove eax, ecx
push eax
mov eax, dword [edi + 0x28]
or eax, 4
push eax
push dword [edi + 0x2014c]
push dword [edi + 0x14]
push dword [edi + 0x10]
call ebp
test eax, eax
setne byte [esp + 0x17]
imul ecx, dword [esp + 0x18], 0xc
mov eax, dword [esp + 0x50]
cmp eax, dword [esp + 0x54]
je 0x402e90
mov dword [ecx + esi], 0x12
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x50]
mov dword [ecx + esi + 4], eax
mov eax, dword [esp + 0x50]
mov dword [ecx + esi + 8], eax
inc dword [esp + 0x18]
push dword [edi + 0x20158]
lea eax, [esp + 0x1c]
xor ecx, ecx
cmp dword [edi + 0x20], ebx
push eax
lea eax, [esp + 0x34]
cmove eax, ecx
push eax
mov eax, dword [edi + 0x28]
and eax, 0xfffffffd
push eax
push dword [edi + 0x20148]
push dword [edi + 0x14]
push dword [edi + 0x10]
call ebp
test eax, eax
je 0x402eca
cmp byte [esp + 0x17], 0
je 0x402eca
mov bl, 1
lea ecx, [esp + 0x38]
call fcn.00402844
push esi
call fcn.00406a50
pop ecx
mov al, bl
jmp 0x402ee0
xor al, al
mov ecx, dword [esp + 0x37c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00409ca0
add esp, 0x374
ret