Function at 0x41c8c0
Capabilities:
Allocate or change rwx memory
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0x14
xor ecx, ecx
mov dword [esp + 0x1c], 0x5f67c4
call fcn.005255a0
mov edi, eax
mov ebx, 0x5a4d
test edi, edi
je 0x41c98e
cmp word [edi], bx
jne 0x41c93d
mov eax, dword ds:[edi + 0x3c]
test eax, eax
je 0x41c93d
cmp eax, 0x7fffffff
jae 0x41c93d
cmp dword [eax + edi], 0x4550
jne 0x41c93d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x41c93d
cmp dword [edx + 4], 0
je 0x41c93d
push 0
add eax, edi
mov ecx, edi
push 0x5f67dc
push eax
call fcn.00525800
jmp 0x41c93f
xor eax, eax
mov dword [0x6338f4], eax
cmp word [edi], bx
jne 0x41c987
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x41c987
cmp eax, 0x7fffffff
jae 0x41c987
cmp dword ds:[eax + edi], 0x4550
jne 0x41c987
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x41c987
cmp dword [edx + 4], 0
je 0x41c987
push 0
add eax, edi
mov ecx, edi
push 0x5f67ec
push eax
call fcn.00525800
jmp 0x41c989
xor eax, eax
mov dword [0x6338e8], eax
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0x16
xor ecx, ecx
mov dword [esp + 0x1c], str.uxtheme.dll
call fcn.005255a0
mov ecx, eax
test ecx, ecx
je 0x41c9fa
cmp word [ecx], bx
jne 0x41c9f3
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x41c9f3
jmp 0x41c9c0
cmp eax, 0x7fffffff
jae 0x41c9f3
cmp dword [eax + ecx], 0x4550
jne 0x41c9f3
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x41c9f3
cmp dword [edx + 4], 0
je 0x41c9f3
push 0
add eax, ecx
push str.DrawThemeBackground
push eax
call fcn.00525800
jmp 0x41c9f5
xor eax, eax
mov dword [0x6338e0], eax
cmp dword [0x635aac], 0
je 0x41ca16
mov esi, 0xc0000476
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x41cb7f
mov eax, dword fs:[0x18]
mov edx, 0x635aac
mov ecx, dword [eax + 0x24]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x41ca45
mov esi, 0xc0000476
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
lea esp, [esp]
jmp 0x41cb7f
mov edi, dword [0x635ab8]
mov dword [0x635ac0], 0
mov dword [0x635abc], 0
mov dword [0x635ab4], 0
test edi, edi
je 0x41caaf
lea ecx, [ecx]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0x40
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edi
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x10000
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov esi, eax
test esi, esi
js 0x41cb4c
mov edi, dword [edi + 4]
test edi, edi
jne 0x41ca70
cmp byte [0x633156], 0
mov dword [0x635aa8], 0
jne 0x41cacb
cmp byte [0x633157], 0
je 0x41cafc
sub esp, 0xc
mov edx, 0x41c660
mov ecx, 0x6338e0
call fcn.00533840
mov esi, eax
test esi, esi
js 0x41cb28
sub esp, 0xc
mov edx, 0x41c820
mov ecx, 0x6338e8
call fcn.00533840
mov esi, eax
test esi, esi
js 0x41cb28
sub esp, 0xc
mov edx, 0x41c780
mov ecx, 0x6338f4
call fcn.00533840
mov esi, eax
test esi, esi
js 0x41cb28
call fcn.00533580
mov esi, eax
jmp 0x41cb20
test esi, esi
jns 0x41cbdc
cmp esi, 0xc0000022
je 0x41cb5d
cmp esi, 0xc0000005
je 0x41cb5d
mov eax, esi
shr eax, 0x10
and eax, 0xfff
cmp eax, 7
jne 0x41cb54
movzx eax, si
jmp 0x41cb67
mov dword [0x635aa8], esi
jmp 0x41cb28
cmp eax, 0xb
jne 0x41cb6b
mov eax, esi
jmp 0x41cb67
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x41cb76
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x41cb7f
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x41cbc6
lfence
lfence
push dword [esi + 4]
push 0x5cd020
push str.Unable_to_commit_detours_transaction.
push 0xfffe
push 0x20
push 0
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x41cbdc
lfence
call fcn.004fbfa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Unable_to_commit_detours_transaction.
push 0x5cd020
push 0x10
push 0
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret