Function at 0x40c100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x148
mov esi, esp
mov dword [esi + 0x130], ebp
mov dword [esi + 0x134], esp
mov dword [esi + 0x140], 0xffffffff
mov dword [esi + 0x13c], 0x4363c0
mov dword [esi + 0x64], ecx
lea eax, [esi + 0x138]
mov ecx, dword fs:[0]
mov dword [esi + 0x138], ecx
mov dword fs:[0], eax
lea ecx, [esi + 0x20]
mov dword [esi + 0x140], 0
call fcn.00427f90
jmp 0x40c1a1
lea ecx, [esi + 0xe8]
mov dword [esi + 0x140], 0
call fcn.0040cd30
mov dword [esi + 0x140], 0
lea ecx, [esi + 0x20]
mov dword [esi + 0x140], 0
call fcn.00427f90
cmp dword [esi + 0x20], 1
je 0x40ca1f
lea eax, [esi + 0x24]
mov dword [esi + 0x140], 9
mov ecx, eax
mov eax, dword [eax + 8]
movsd xmm0, qword [ecx]
lea ecx, [esi + 0x88]
mov dword [esi + 0xf0], eax
movsd qword [esi + 0xe8], xmm0
mov edx, dword [esi + 0xe8]
mov dword [esi + 0x10], edx
push eax
call fcn.00423d10
add esp, 4
lea ecx, [esi + 0x20]
lea edx, [esi + 0x88]
call fcn.00429b20
mov eax, dword [esi + 0x20]
cmp eax, 5
je 0x40c99d
add eax, 0xfffffffe
cmp eax, 3
jae 0x40c99d
lea ecx, [esi + 0x88]
call fcn.004243b0
test eax, eax
mov dword [esi + 0xc], edx
mov dword [esi + 8], eax
je 0x40c99d
push dword [esi + 0x64]
call fcn.00420d10
add esp, 4
mov edi, edx
mov ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
lea ecx, [esi + 0x20]
push edi
push eax
push ebx
call fcn.00428e90
add esp, 0xc
lea eax, [esi + 0x20]
mov dword [esi + 0x140], 0xa
push eax
call fcn.00420d10
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
push 0xb
push str.svchost.exeupgrader.exe_magic0617
call fcn.00428220
add esp, 8
mov edi, edx
mov edx, dword [esi + 8]
lea ecx, [esi + 0x6c]
push edi
push eax
push dword [esi + 0xc]
call fcn.00428e90
add esp, 0xc
cmp dword [esi + 0x24], 0
je 0x40c29e
mov edi, dword [esi + 0x20]
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp dword [esi + 0xec], 0
je 0x40c2b7
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi + 0x10]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov ecx, dword [esi + 0x6c]
mov edx, dword [esi + 0x74]
mov dword [esi + 0x140], 4
mov dword [esi + 0x68], ecx
call fcn.0042d150
test al, al
je 0x40c2f0
push 0x3a98
call sub.KERNEL32.dll_Sleep
lea ecx, [esi + 0x20]
call fcn.00427f90
jmp 0x40c302
push 0x3e8
call sub.KERNEL32.dll_Sleep
lea ecx, [esi + 0x20]
call fcn.00427f90
cmp dword [esi + 0x20], 1
je 0x40ca59
lea eax, [esi + 0x24]
mov dword [esi + 0x140], 7
mov ecx, eax
mov eax, dword [eax + 8]
movsd xmm0, qword [ecx]
lea ecx, [esi + 0x88]
mov dword [esi + 0xf0], eax
movsd qword [esi + 0xe8], xmm0
mov edx, dword [esi + 0xe8]
mov dword [esi + 0x10], edx
push eax
call fcn.00423d10
add esp, 4
lea ecx, [esi + 0x20]
lea edx, [esi + 0x88]
call fcn.00429b20
mov eax, dword [esi + 0x20]
cmp eax, 5
je 0x40c9b9
add eax, 0xfffffffe
cmp eax, 3
jae 0x40c9b9
lea ecx, [esi + 0x88]
call fcn.004243b0
test eax, eax
mov dword [esi + 0xc], edx
mov dword [esi + 8], eax
je 0x40c9b9
push 0xc
push 0x4456a7
call fcn.00428220
add esp, 8
mov edi, edx
mov ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
lea ecx, [esi + 0x14]
push edi
push eax
push ebx
call fcn.00428e90
add esp, 0xc
cmp dword [esi + 0xec], 0
je 0x40c3c5
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi + 0x10]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
lea eax, [esi + 0x14]
mov dword [esi + 0x88], 0
mov byte [esi + 0xc4], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb8], 0
mov dword [esi + 0x98], 2
mov dword [esi + 0x90], 2
mov byte [esi + 7], 1
mov dword [esi + 0x140], 5
push eax
call fcn.00420d10
add esp, 4
mov edi, edx
mov byte [esi + 7], 1
lea ecx, [esi + 0xe8]
mov edx, eax
push edi
call fcn.00423d10
add esp, 4
lea ecx, [esi + 0x20]
lea edx, [esi + 0xe8]
mov byte [esi + 7], 1
call fcn.00429b20
mov eax, dword [esi + 0x20]
cmp eax, 5
je 0x40c9d5
add eax, 0xfffffffe
cmp eax, 3
jae 0x40c9d5
lea ecx, [esi + 0xe8]
mov byte [esi + 7], 1
call fcn.004243b0
mov ebx, eax
test eax, eax
je 0x40c9d5
mov edi, edx
test edx, edx
js 0x40ca90
je 0x40c4a0
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x40c4a5
jmp 0x40ca9b
mov eax, 1
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], 0
mov dword [esi + 0x140], 6
lea ecx, [esi + 0x20]
mov edx, ebx
push edi
call fcn.00428230
add esp, 4
mov eax, dword [esi + 0x28]
movsd xmm0, qword [esi + 0x20]
lea ecx, [esi + 0xb8]
mov byte [esi + 7], 1
mov dword [esi + 0x140], 5
mov dword [esi + 0xf0], eax
mov dword [ecx + 8], eax
lea eax, [esi + 0x14]
movsd qword [esi + 0xe8], xmm0
movsd qword [ecx], xmm0
push eax
call fcn.00420d10
add esp, 4
test edx, edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
je 0x40c590
add eax, dword [esi + 0xc]
mov edi, dword [esi + 8]
movzx ecx, byte [edi]
lea ebx, [edi + 1]
test cl, cl
js 0x40c540
nop word cs:[eax + eax]
nop dword [eax + eax]
mov edi, ebx
cmp edi, eax
je 0x40c590
movzx ecx, byte [edi]
lea ebx, [edi + 1]
test cl, cl
jns 0x40c530
add edi, 2
cmp cl, 0xe0
jae 0x40c553
cmp ebx, eax
cmove edi, ebx
cmp edi, eax
jne 0x40c536
jmp 0x40c590
cmp cl, 0xed
jne 0x40c570
cmp ebx, eax
cmove edi, ebx
cmp edi, eax
je 0x40c590
inc edi
cmp ebx, eax
je 0x40c532
cmp byte [ebx], 0x9f
jbe 0x40c532
jmp 0x40c9f5
cmp ebx, eax
mov edx, edi
cmove edx, ebx
lea edi, [edx + 1]
cmp edx, eax
cmove edi, edx
cmp cl, 0xf0
jb 0x40c532
lea ecx, [edi + 1]
cmp edi, eax
cmovne edi, ecx
cmp edi, eax
jne 0x40c536
movsd xmm1, qword [esi + 0xb8]
movsd xmm2, qword [esi + 0xb0]
mov eax, dword [esi + 8]
movsd xmm0, qword [esi + 0xc0]
mov byte [esi + 7], 0
mov dword [esi + 0x140], 5
lea ecx, [esi + 0xe8]
lea edx, [esi + 0x120]
movsd qword [esi + 0x50], xmm1
movsd xmm1, qword [esi + 0xa8]
movsd qword [esi + 0x48], xmm2
movsd xmm2, qword [esi + 0xa0]
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0xc]
movsd qword [esi + 0x58], xmm0
movsd qword [esi + 0x40], xmm1
movsd xmm1, qword [esi + 0x98]
movsd qword [esi + 0x38], xmm2
movsd xmm2, qword [esi + 0x88]
mov dword [esi + 0x124], eax
lea eax, [esi + 0x20]
mov dword [esi + 0x128], 0x4456b3
mov dword [esi + 0x12c], 0xa
movsd qword [esi + 0x30], xmm1
movsd xmm1, qword [esi + 0x90]
movsd qword [esi + 0x20], xmm2
movsd qword [esi + 0x28], xmm1
push eax
push 2
call fcn.0040b7b0
add esp, 8
mov edi, dword [esi + 0xe8]
mov bl, 1
test edi, edi
je 0x40c6c0
cmp dword [esi + 0x18], 0
je 0x40c673
mov dword [esi + 0xc], ebx
mov ebx, edi
mov edi, dword [esi + 0x14]
call sub.KERNEL32.dll_GetProcessHeap
push edi
mov edi, ebx
mov ebx, dword [esi + 0xc]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp dword [esi + 0x70], 0
je 0x40c689
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi + 0x68]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
test edi, edi
jne 0x40c170
test bl, bl
je 0x40c185
lea ecx, [esi + 0xec]
mov dword [esi + 0x140], 0
call fcn.00401220
jmp 0x40c185
lea eax, [esi + 0xec]
lea ecx, [esi + 0xd0]
lea edx, [esi + 0x20]
mov dword [esi + 0xc], edi
mov dword [esi + 0x140], 2
movsd xmm2, qword [eax + 0x18]
movsd xmm1, qword [eax + 0x10]
movsd xmm0, qword [eax + 0x20]
movsd qword [esi + 0x38], xmm2
movsd qword [esi + 0x30], xmm1
movsd xmm2, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [esi + 0x40], xmm0
movsd qword [esi + 0x28], xmm1
movsd qword [esi + 0x20], xmm2
mov byte [esi + 0x44], 1
call fcn.00435690
cmp byte [esi + 0xd0], 4
jne 0x40c8d7
lea eax, [esi + 0x14]
push eax
call fcn.00420d10
add esp, 4
test edx, edx
mov dword [esi + 8], edx
je 0x40c7b3
mov edx, eax
mov edi, eax
mov dword [esi + 0x10], eax
add edx, dword [esi + 8]
movzx ecx, byte [edi]
lea ebx, [edi + 1]
test cl, cl
js 0x40c760
nop word [eax + eax]
mov edi, ebx
cmp edi, edx
je 0x40c7b3
movzx ecx, byte [edi]
lea ebx, [edi + 1]
test cl, cl
jns 0x40c750
add edi, 2
cmp cl, 0xe0
jae 0x40c773
cmp ebx, edx
cmove edi, ebx
cmp edi, edx
jne 0x40c756
jmp 0x40c7b3
cmp cl, 0xed
jne 0x40c790
cmp ebx, edx
cmove edi, ebx
cmp edi, edx
je 0x40c7b3
inc edi
cmp ebx, edx
je 0x40c752
cmp byte [ebx], 0x9f
jbe 0x40c752
jmp 0x40caa9
cmp ebx, edx
mov eax, edi
cmove eax, ebx
lea edi, [eax + 1]
cmp eax, edx
cmove edi, eax
cmp cl, 0xf0
jb 0x40c7ac
lea eax, [edi + 1]
cmp edi, edx
cmovne edi, eax
mov eax, dword [esi + 0x10]
cmp edi, edx
jne 0x40c756
test eax, eax
je 0x40caa9
cmp dword [esi + 0x38], 1
mov edx, dword [esi + 8]
lea ecx, [esi + 0x118]
mov dword [esi + 0x118], eax
mov dword [esi + 0x140], 2
mov dword [esi + 0xc8], ecx
mov dword [esi + 0x11c], edx
jne 0x40cacc
mov eax, dword [esi + 0x3c]
lea ecx, [esi + 0xc8]
mov dword [esi + 0xd0], 0x4456c0
mov dword [esi + 0xd4], 3
lea edx, [esi + 0xcc]
mov dword [esi + 0xd8], 0
mov dword [esi + 0x78], ecx
lea ecx, [esi + 0x78]
mov dword [esi + 0x7c], 0x40cd10
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], 0x40ffc0
mov dword [esi + 0xe0], ecx
lea ecx, [esi + 0xd0]
mov dword [esi + 0xe4], 2
mov dword [esi + 0xcc], eax
call fcn.0042bfe0
lea eax, [esi + 0xd0]
mov dword [esi + 0xd4], 0
mov dword [esi + 0xd0], 0
lea ecx, [esi + 0x78]
lea edx, [esi + 0x20]
push eax
call fcn.00430d50
add esp, 4
cmp dword [esi + 0x78], 1
jne 0x40c93b
cmp byte [esi + 0x7c], 2
jb 0x40c945
mov ecx, dword [esi + 0x80]
mov eax, dword [ecx]
mov dword [esi + 8], ecx
mov ecx, dword [ecx + 4]
mov dword [esi + 0x140], 3
push eax
call dword [ecx]
add esp, 4
mov ebx, dword [esi + 8]
mov eax, dword [ebx + 4]
cmp dword [eax + 4], 0
je 0x40c97b
mov edi, dword [ebx]
cmp dword [eax + 8], 9
jae 0x40c96b
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x40c973
lea ecx, [esi + 0x20]
mov dword [esi + 0x140], 1
call fcn.00401220
cmp dword [esi + 0x18], 0
je 0x40c900
mov edi, dword [esi + 0x14]
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp dword [esi + 0x70], 0
je 0x40c185
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi + 0x68]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov dword [esi + 0x140], 0
lea ecx, [esi + 0x20]
mov dword [esi + 0x140], 0
call fcn.00427f90
jmp 0x40c1a1
cmp dword [esi + 0x38], 0
je 0x40cae5
lea ecx, [esi + 0x20]
mov dword [esi + 0x140], 1
call fcn.00401220
mov edi, dword [esi + 0xc]
xor ebx, ebx
cmp dword [esi + 0x18], 0
jne 0x40c658
jmp 0x40c673
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
lea ecx, [esi + 0x20]
mov dword [esi + 0x140], 1
call fcn.00401220
jmp 0x40c957
mov ecx, 0x4494d9
mov edx, 0x2b
push 0x449484
call fcn.004104b0
add esp, 4
jmp 0x40caea
mov ecx, 0x4494d9
mov edx, 0x2b
push 0x449484
call fcn.004104b0
add esp, 4
jmp 0x40caea
mov byte [esi + 7], 1
mov ecx, 0x4494d9
mov edx, 0x2b
push 0x449484
call fcn.004104b0
add esp, 4
jmp 0x40caea
mov byte [esi + 7], 1
mov dword [esi + 0x140], 5
mov ecx, 0x4494d9
mov edx, 0x2b
push 0x449484
call fcn.004104b0
add esp, 4
jmp 0x40caea
movsd xmm0, qword [esi + 0x24]
mov dword [esi + 0x140], 0xb
mov ecx, 0x447fab
mov edx, 0x2b
movsd qword [esi + 0x88], xmm0
push 0x44568c
lea eax, [esi + 0x88]
push eax
call fcn.00411a20
add esp, 8
jmp 0x40caea
movsd xmm0, qword [esi + 0x24]
mov dword [esi + 0x140], 8
mov ecx, 0x447fab
mov edx, 0x2b
movsd qword [esi + 0x88], xmm0
push 0x44568c
lea eax, [esi + 0x88]
push eax
call fcn.00411a20
add esp, 8
jmp 0x40caea
mov byte [esi + 7], 1
call fcn.0041e940
jmp 0x40caea
mov ecx, edi
mov edx, 1
call fcn.0040dcf0
ud2
mov dword [esi + 0x140], 2
mov ecx, 0x4494d9
mov edx, 0x2b
push 0x449484
call fcn.004104b0
add esp, 4
jmp 0x40caea
mov ecx, 0x4494d9
mov edx, 0x2b
push 0x449484
call fcn.004104b0
add esp, 4
jmp 0x40caea
call fcn.00435e20
ud2