Function at 0x41e084
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 0x1c], 0
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x20], edx
push edi
test esi, esi
je 0x41e110
cmp esi, dword [0x456c58]
je 0x41e110
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41e110
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
jne 0x41e110
mov eax, dword [ecx + esi + 0x80]
mov ecx, dword [ecx + esi + 0x84]
add eax, esi
add ecx, eax
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x41e110
cmp eax, ecx
je 0x41e28a
lea ecx, [eax + 0xc]
mov dword [ebp - 8], ecx
cmp dword [ecx - 8], 0
jne 0x41e0f2
cmp dword [ecx], 0
je 0x41e28a
mov edx, dword [ecx]
mov edi, dword [ecx - 0xc]
mov ebx, dword [ecx + 4]
lea eax, [esi + edx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0xc], edx
test edi, edi
jne 0x41e117
mov edi, ebx
test ebx, ebx
jne 0x41e11b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp edi, ebx
jne 0x41e122
mov dword [ebp - 0x10], 1
add ebx, esi
add edi, esi
je 0x41e275
cmp dword [edi], 0
je 0x41e272
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 0
je 0x41e266
lea edx, [eax + 4]
mov dword [ebp - 4], edx
mov eax, dword [edx + 4]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx]
mov dword [ebp - 0x24], ecx
test eax, eax
je 0x41e17f
cmp dword [ebp - 0xc], 0
je 0x41e17f
push dword [ebp - 0xc]
push eax
call fcn.00426564
mov edx, dword [ebp - 4]
pop ecx
pop ecx
test eax, eax
jne 0x41e256
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x41e1fc
cmp dword [ebp - 0x10], 0
je 0x41e1bb
cmp dword [edx], 0
je 0x41e256
push dword [edx]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x41e253
mov ecx, dword [ebp - 4]
push dword [ecx - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41e253
cmp dword [ebx], eax
jmp 0x41e1fa
mov eax, dword [edi]
test eax, eax
jns 0x41e1ce
movzx eax, ax
cmp ecx, eax
jne 0x41e256
jmp 0x41e1fc
add eax, 2
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41e1f3
test dl, dl
je 0x41e1ef
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41e1f3
add ecx, 2
add eax, 2
test dl, dl
jne 0x41e1d3
xor eax, eax
jmp 0x41e1f8
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41e253
push 0x456c30
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.0041e045
test eax, eax
jne 0x41e248
push dword [ebp - 0x18]
xor edx, edx
mov ecx, ebx
push dword [ebp - 0x14]
call fcn.0041dfb4
pop ecx
pop ecx
test eax, eax
je 0x41e248
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x64], ecx
inc edx
or dword [eax + 0x68], edx
lea ecx, [ebp - 0x2c]
push ecx
push 0x20
push 0x6c
push eax
mov dword [ebp - 0x1c], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x456c30
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 4]
add edx, 0x10
mov dword [ebp - 4], edx
cmp dword [edx + 4], 0
jne 0x41e148
add ebx, 4
add edi, 4
jne 0x41e12c
mov ecx, dword [ebp - 8]
add ecx, 0x14
mov dword [ebp - 8], ecx
add ecx, 0xfffffff4
cmp ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
jne 0x41e0e3
mov eax, dword [ebp - 0x1c]
jmp 0x41e112