Function at 0x421870
Capabilities:
Parse pe header

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x421889
xor eax, eax
pop ebx
add esp, 0xc
ret
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
cmp dword [esi], 0x4550
je 0x42189f
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ecx, dword [esi + 0x50]
push edi
push 4
push 0x1000
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [esp + 0xc], edi
test edi, edi
jne 0x4218c4
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esi + 0x54]
add edx, dword [ebx + 0x3c]
push ebp
push edx
push ebx
push edi
call fcn.004a7010
mov ebp, dword [ebx + 0x3c]
add ebp, edi
mov eax, 0x2000
add esp, 0xc
mov dword [esp + 0x14], ebp
test word [ebp + 0x16], ax
je 0x4219b0
mov ecx, 0x10b
xor eax, eax
cmp word [ebp + 0x18], cx
jne 0x421b54
movzx edx, word [ebp + 0x14]
lea esi, [edx + ebp + 0x18]
xor ebx, ebx
mov dword [esp + 0x18], esi
cmp ax, word [ebp + 6]
jae 0x421955
add esi, 0x10
mov ecx, dword [esi - 8]
mov edx, dword [esi - 4]
push 4
push 0x1000
push ecx
add edx, edi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x4219b0
mov ecx, dword [esi]
test ecx, ecx
jbe 0x421949
push ecx
mov ecx, dword [esi + 4]
add ecx, dword [esp + 0x24]
push ecx
push eax
call fcn.004a7010
add esp, 0xc
movzx edx, word [ebp + 6]
inc ebx
add esi, 0x28
cmp ebx, edx
jl 0x421916
mov edx, edi
sub edx, dword [ebp + 0x34]
cmp dword [ebp + 0xa4], 0
jbe 0x421a01
mov esi, dword [ebp + 0xa0]
mov eax, dword [esi + edi]
add esi, edi
test eax, eax
je 0x421a01
lea ebx, [ebx]
lea ecx, [eax + edi]
mov eax, dword [esi + 4]
sub eax, 8
shr eax, 1
xor ebp, ebp
lea ebx, [esi + 8]
test eax, eax
jle 0x4219f4
movzx eax, word [ebx]
mov edi, eax
shr edi, 0xc
dec edi
cmp edi, 9
ja case.0x4219a9.4
movzx edi, byte [edi + 0x421b6c]
jmp dword [edi*4 + 0x421b5c]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
and eax, 0xfff
add eax, ecx
add dword [eax], edx
jmp case.0x4219a9.4
and eax, 0xfff
mov edi, edx
add eax, ecx
shr edi, 0x10
add word [eax], di
jmp case.0x4219a9.4
and eax, 0xfff
add eax, ecx
add word [eax], dx
mov eax, dword [esi + 4]
sub eax, 8
inc ebp
shr eax, 1
add ebx, 2
cmp ebp, eax
jl 0x421994
mov edi, dword [esp + 0x10]
add esi, dword [esi + 4]
mov eax, dword [esi]
test eax, eax
jne 0x421980
mov ebp, dword [esp + 0x14]
cmp dword [ebp + 0x84], 0
jbe 0x421a9e
mov esi, dword [ebp + 0x80]
mov eax, dword [esi + edi + 0xc]
add esi, edi
mov dword [esp + 0x20], esi
test eax, eax
je 0x421a9e
jmp 0x421a30
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x421a9e
mov eax, dword [esi]
test eax, eax
jne 0x421a48
mov eax, dword [esi + 0x10]
mov esi, dword [esi + 0x10]
add esi, dword [esp + 0x10]
add edi, eax
mov eax, dword [edi]
test eax, eax
je 0x421a84
jns 0x421a61
and eax, 0xffff
push eax
jmp 0x421a6a
mov ecx, dword [esp + 0x10]
lea edx, [eax + ecx + 2]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
test eax, eax
je 0x421a96
mov eax, dword [edi + 4]
add edi, 4
add esi, 4
test eax, eax
jne 0x421a57
mov eax, dword [esp + 0x20]
add eax, 0x14
mov dword [esp + 0x20], eax
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x421a24
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
xor eax, eax
xor ebx, ebx
cmp ax, word [ebp + 6]
jae 0x421b1f
mov esi, dword [esp + 0x18]
add esi, 0x24
nop
cmp dword [esi - 0x14], 0
jne 0x421acc
mov eax, dword [esi]
test al, 0x40
je 0x421ac1
mov eax, dword [ebp + 0x20]
jmp 0x421ac8
test al, al
jns 0x421b13
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x421b13
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0x1d
mov edx, eax
shr edx, 0x1e
and ecx, 1
and edx, 1
lea ecx, [edx + ecx*2]
mov edx, eax
shr edx, 0x1f
lea ecx, [edx + ecx*2]
mov ecx, dword [ecx*4 + 0x50e430]
test eax, 0x4000000
je 0x421afd
or ecx, 0x200
mov eax, dword [esi - 0x1c]
lea edx, [esp + 0x20]
push edx
push ecx
mov ecx, dword [esi - 0x18]
push eax
add ecx, edi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx edx, word [ebp + 6]
inc ebx
add esi, 0x28
cmp ebx, edx
jl 0x421ab0
mov ebp, dword [ebp + 0x28]
test ebp, ebp
je 0x421b38
lea eax, [edi + ebp]
test eax, eax
je 0x421b38
push 0
push 1
push edi
call eax
test eax, eax
jne 0x421b52
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esp + 0x10], 0
mov edi, dword [esp + 0x10]
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret