Function at 0x475000
Capabilities:
Parse pe header

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
movzx eax, word [ebx]
xor ebp, ebp
cmp eax, 0x5a4d
jne 0x475446
mov esi, dword [ebx + 0x3c]
xor ebp, ebp
cmp dword [ebx + esi], 0x4550
jne 0x475446
push 4
push 0x2000
push dword [ebx + esi + 0x50]
push dword [ebx + esi + 0x34]
call sub.KERNEL32.DLL_VirtualAlloc
mov edi, eax
test edi, edi
jne 0x475063
push 4
push 0x2000
push dword [ebx + esi + 0x50]
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov edi, eax
test edi, edi
je 0x475444
call sub.KERNEL32.DLL_GetProcessHeap
sub esp, 4
push 0x14
push 0
push eax
call sub.KERNEL32.DLL_HeapAlloc
add esp, 4
mov ebp, esi
mov esi, eax
mov dword [esi + 4], edi
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
push 4
push 0x1000
push dword [ebx + ebp + 0x50]
push edi
call sub.KERNEL32.DLL_VirtualAlloc
push 4
push 0x1000
push dword [ebx + ebp + 0x54]
push edi
call sub.KERNEL32.DLL_VirtualAlloc
mov ecx, ebx
mov ebx, eax
mov dword [esp + 8], ebp
mov eax, dword [ecx + ebp + 0x54]
add eax, dword [ecx + 0x3c]
sub esp, 4
push eax
push ecx
mov ebp, ecx
push ebx
call fcn.008075c0
add esp, 0x10
mov ecx, dword [ebp + 0x3c]
lea eax, [ebx + ecx]
mov dword [esi], eax
mov dword [esp + 0x14], edi
mov dword [ebx + ecx + 0x34], edi
cmp word [ebx + ecx + 6], 0
mov dword [esp + 0x10], esi
je 0x47519b
mov edi, dword [esi + 4]
movzx ecx, word [eax + 0x14]
lea ebp, [eax + ecx + 0x20]
xor esi, esi
nop word cs:[eax + eax]
mov eax, dword [ebp + 8]
test eax, eax
je 0x475150
mov ecx, dword [ebp + 4]
add ecx, edi
push 4
push 0x1000
push eax
push ecx
call sub.KERNEL32.DLL_VirtualAlloc
mov ebx, eax
mov eax, dword [ebp + 0xc]
add eax, dword [esp + 0x30]
sub esp, 4
push dword [ebp + 8]
push eax
push ebx
call fcn.008075c0
add esp, 0x10
mov dword [ebp], ebx
jmp 0x475185
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 8]
mov ebx, dword [eax + ecx + 0x38]
test ebx, ebx
jle 0x475185
mov eax, dword [ebp + 4]
add eax, edi
push 4
push 0x1000
push ebx
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp], eax
sub esp, 4
push ebx
push 0
push eax
call fcn.0080778b
add esp, 0x10
inc esi
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
movzx ecx, word [eax + 6]
add ebp, 0x28
cmp esi, ecx
jl 0x475110
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 8]
sub ecx, dword [eax + edx + 0x34]
je 0x47523e
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 4]
mov eax, dword [esp + 0xc]
cmp dword [eax + 0xa4], 0
je 0x475249
mov edx, dword [eax + 0xa0]
mov esi, dword [edi + edx]
test esi, esi
je 0x475249
mov dword [esp + 8], edi
add edx, edi
mov edi, dword [edx + 4]
mov ebx, edi
and ebx, 0xfffffffe
cmp ebx, 8
je 0x47522a
add esi, dword [esp + 8]
xor ebx, ebx
nop word cs:[eax + eax]
movzx eax, word [edx + ebx*2 + 8]
mov ebp, eax
and ebp, 0xf000
cmp ebp, 0x3000
jne 0x475220
and eax, 0xfff
add dword [esi + eax], ecx
mov edi, dword [edx + 4]
inc ebx
lea eax, [edi - 8]
shr eax, 1
cmp ebx, eax
jb 0x475200
mov esi, dword [edx + edi]
lea edx, [edx + edi]
test esi, esi
jne 0x4751e0
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 8]
jmp 0x475245
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 4]
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x84], 0
je 0x475270
mov esi, dword [eax + 0x80]
add esi, edi
sub esp, 8
push 0x14
push esi
call sub.KERNEL32.DLL_IsBadReadPtr
add esp, 8
test eax, eax
je 0x475354
mov esi, dword [ebp]
cmp word [esi + 6], 0
je 0x47531b
movzx ecx, word [esi + 0x14]
lea edi, [esi + ecx + 0x20]
xor ebx, ebx
nop dword [eax + eax]
mov eax, dword [edi + 0x1c]
test eax, 0x2000000
jne 0x4752b0
mov edx, dword [edi + 8]
test edx, edx
jne 0x4752d0
test al, 0x40
jne 0x4752c7
test al, al
jns 0x475308
add esi, 0x24
jmp 0x4752ca
sub esp, 4
push 0x4000
push dword [edi + 8]
push dword [edi]
call sub.KERNEL32.DLL_VirtualFree
add esp, 4
jmp 0x475308
add esi, 0x20
mov edx, dword [esi]
test edx, edx
je 0x475308
mov ebp, eax
shr ebp, 0x1f
mov esi, eax
shr esi, 0x1b
mov ecx, eax
shr ecx, 0x19
and esi, 8
and ecx, 0x10
or ecx, esi
shr eax, 0x11
and eax, 0x200
or eax, dword [ecx + ebp*4 + 0xac4794]
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push eax
push edx
push dword [edi]
call sub.KERNEL32.DLL_VirtualProtect
inc ebx
mov esi, dword [ebp]
movzx eax, word [esi + 6]
add edi, 0x28
cmp ebx, eax
jl 0x475290
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x475446
add ecx, dword [esp + 0x14]
je 0x475438
sub esp, 4
push 0
push 1
push dword [esp + 0x20]
call ecx
add esp, 4
test eax, eax
je 0x475438
mov dword [ebp + 0x10], 1
jmp 0x475446
mov dword [esp + 8], edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x475270
mov dword [esp + 0xc], esi
add eax, edi
sub esp, 0xc
push eax
call sub.KERNEL32.DLL_LoadLibraryA
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x475438
mov eax, dword [ebp + 0xc]
lea eax, [eax*4 + 4]
sub esp, 8
push eax
push dword [ebp + 8]
call fcn.00806b38
add esp, 0x10
mov dword [ebp + 8], eax
test eax, eax
je 0x475438
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + 1]
mov dword [ebp + 0xc], edx
mov dword [eax + ecx*4], ebx
mov ecx, dword [esp + 0xc]
mov edi, dword [ecx]
test edi, edi
je 0x4753c6
mov eax, dword [esp + 8]
add edi, eax
mov esi, dword [ecx + 0x10]
add esi, eax
jmp 0x4753cf
mov edi, dword [ecx + 0x10]
add edi, dword [esp + 8]
mov esi, edi
mov eax, dword [edi]
test eax, eax
je 0x475412
add edi, 4
nop dword [eax + eax]
test eax, eax
js 0x4753f0
mov ecx, dword [esp + 8]
lea eax, [ecx + eax + 2]
jmp 0x4753f3
movzx eax, ax
sub esp, 8
push eax
push ebx
call sub.KERNEL32.DLL_GetProcAddress
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x475438
add esi, 4
mov eax, dword [edi]
add edi, 4
test eax, eax
jne 0x4753e0
mov esi, dword [esp + 0xc]
add esi, 0x14
sub esp, 8
push 0x14
push esi
call sub.KERNEL32.DLL_IsBadReadPtr
add esp, 8
test eax, eax
mov edi, dword [esp + 8]
je 0x475358
jmp 0x475270
sub esp, 0xc
push ebp
call fcn.00475450
add esp, 0x10
xor ebp, ebp
mov eax, ebp
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret