Function at 0x66424490
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov dword [ebp - 0x134], eax
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
sub esp, 4
test eax, eax
je 0x66424730
mov edi, eax
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x11c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x134]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
sub eax, 1
sub esp, 0xc
cmp eax, 0x102
ja 0x66424730
lea ecx, [ebp - 0x11c]
mov dword [esp + 4], 0x5c
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_strrchr]
lea ecx, [ebp - 0x11c]
mov esi, dword [sym.imp.ucrtbase.dll_strlen]
lea ebx, [eax + 1]
test eax, eax
cmove ebx, ecx
mov dword [esp], ebx
call esi
mov dword [esp + 4], 0x2e
mov dword [esp], ebx
mov dword [ebp - 0x12c], eax
call dword [sym.imp.ucrtbase.dll_strchr]
lea ecx, [ebp - 0x11c]
mov edx, eax
mov dword [esp], ecx
sub edx, ebx
test eax, eax
cmove edx, dword [ebp - 0x12c]
mov dword [ebp - 0x12c], edx
call esi
mov ecx, dword [ebp - 0x12c]
mov dword [esp], 0x42
mov dword [ebp - 0x13c], eax
add eax, 0xc
and eax, 0xfffffffc
mov dword [ebp - 0x138], eax
lea eax, [eax + ecx + 0x76]
mov dword [esp + 4], eax
call sym.krnl386.exe16_GlobalAlloc16
movzx esi, ax
sub esp, 8
test si, si
je 0x66424730
mov dword [esp + 4], esi
mov dword [esp], esi
mov word [ebp - 0x12e], si
call sym.krnl386.exe16_FarSetOwner16
sub esp, 8
mov dword [esp], esi
call sym.krnl386.exe16_GlobalLock16
movzx edx, word [ebp - 0x12e]
mov esi, eax
mov dword [eax], 0x1454e
xor eax, eax
mov ecx, dword [ebp - 0x13c]
mov dword [esi + 0xa], 0x100058
sub esp, 4
mov word [esi + 6], ax
mov word [esi + 0x48], dx
mov edx, dword [ebp - 0x134]
mov dword [esi + 0xe], 0
mov dword [esi + 0x12], 0x20000
mov dword [esi + 0x16], 0x10000
mov dword [esi + 0x1a], 0x20000
mov dword [esi + 0x1e], 0
mov byte [esi + 0x36], 2
mov dword [esi + 0x40], edx
movzx edx, word [edi + 0x48]
movzx eax, byte [edi + 0x4a]
shl edx, 8
or eax, edx
mov word [esi + 0x3e], ax
movzx eax, word [edi + 0x16]
lea edx, [ecx + 9]
lea edi, [esi + 0x58]
mov dword [ebp - 0x134], edi
lea ecx, [ecx + 8]
and ax, 0x2000
cmp ax, 1
sbb eax, eax
shr ecx, 2
and ax, 0x7fff
sub ax, 0x7fef
mov word [esi + 0xc], ax
xor eax, eax
mov dword [esi + edx + 0x54], 0
mov edi, dword [ebp - 0x134]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x11c]
mov eax, 0xff
cmp edx, eax
cmovle eax, edx
mov byte [esi + 0x58], al
lea eax, [esi + 0x60]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strcpy]
mov eax, dword [ebp - 0x138]
xor ecx, ecx
add eax, 0x58
mov edx, eax
lea eax, [esi + eax]
mov word [esi + 0x22], dx
mov edx, 0x1000
lea edi, [eax + 0x14]
mov word [eax + 6], dx
add eax, 0x15
mov edx, edi
mov word [eax - 7], cx
sub edx, esi
mov dword [eax - 0x13], 0x10000
mov word [esi + 0x26], dx
mov edx, dword [ebp - 0x12c]
mov byte [eax - 1], dl
mov ecx, edx
lea edx, [edx + 1]
cmp edx, 1
jbe 0x6642474b
add ecx, ebx
jmp 0x664246d5
add ebx, 1
add eax, 1
mov byte [eax - 1], dl
cmp ebx, ecx
je 0x664246dc
movzx edx, byte [ebx]
test dl, dl
jne 0x664246c8
mov byte [eax], 0
mov eax, dword [ebp - 0x12c]
lea eax, [edi + eax + 2]
sub eax, esi
mov word [esi + 4], ax
mov word [esi + 0x2a], ax
mov word [esi + 0x24], ax
mov eax, dword [0x66444a20]
movzx edx, word [eax + 4]
mov word [esi + 6], dx
movzx edx, word [esi + 0x48]
mov word [eax + 4], dx
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [esi + 0x44], eax
sub esp, 4
movzx eax, word [ebp - 0x12e]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 0xb
mov word [ebp - 0x12e], bx
movzx eax, word [ebp - 0x12e]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test edx, edx
je 0x664246df
jmp 0x664246dc