Function at 0x41b5b0
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xa8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, DllRegisterServer
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x41b5f6
mov eax, 0xff
jmp 0x41b858
mov dword [rax], DllRegisterServer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x41b627
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x41b858
mov eax, dword [rbx + 0x10]
mov dword [0x00458934], eax
mov eax, dword [rbx + 4]
mov dword [0x00458940], eax
mov eax, dword [rbx + 8]
mov dword [0x00458944], eax
mov eax, dword [rbx + 0xc]
and eax, 0x7fff
mov dword [0x00458938], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x00458934], 2
je 0x41b675
bts dword [0x00458938], 0xf
mov eax, dword [0x00458940]
shl eax, 8
add eax, dword [0x00458944]
mov dword [0x0045893c], eax
cmp word [0x00400000], 0x5a4d
je 0x41b6aa
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x00400000]
jmp 0x41b738
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x41b6ce
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x41b738
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x41b715
cmp ecx, 0x20b
je 0x41b6ed
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x41b738
cmp dword [rax + 0x84], 0xe
ja 0x41b701
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x41b738
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x41b738
cmp dword [rax + 0x74], 0xe
ja 0x41b726
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x41b738
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
mov ecx, 1
call fcn.00421fb0
test eax, eax
jne 0x41b768
cmp dword [0x00458920], 1
jne 0x41b754
call fcn.00422270
mov ecx, 0x1c
call fcn.00422040
mov ecx, 0xff
call fcn.0041d2d0
call fcn.0041e4a0
test eax, eax
jne 0x41b794
cmp dword [0x00458920], 1
jne 0x41b77f
call fcn.00422270
mov ecx, InitCommonControls
call fcn.00422040
mov ecx, 0xff
call fcn.0041d2d0
nop
call fcn.00422bc0
test eax, eax
jns 0x41b7a7
mov ecx, 0x1b
call int.0041b580
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x0045a6e0], rax
call fcn.004229d0
mov qword [0x00458910], rax
call fcn.004228d0
test eax, eax
jns 0x41b7d3
mov ecx, 8
call int.0041b580
call fcn.00422570
test eax, eax
jns 0x41b7e6
mov ecx, 9
call int.0041b580
call fcn.0041d380
test eax, eax
je 0x41b7f6
mov ecx, eax
call int.0041b580
call fcn.004224e0
test byte [rsp + 0x6c], 1
je 0x41b80a
movzx r9d, word [rsp + 0x70]
jmp 0x41b810
mov r9d, 0xa
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.004299ac
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x41b82e
mov ecx, eax
call fcn.0041d520
call fcn.0041d540
jmp 0x41b84f
mov eax, edi
jmp 0x41b858
mov rbx, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xc8]
add rsp, 0xa8
ret