Function at 0x436800
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], 0
mov edi, dword [ebx + 0x24]
mov eax, dword [edi + 0x10]
or esi, 0xffffffff
cmp byte [eax], 0x3c
jne 0x436b2c
cmp byte [eax + 1], 0x21
jne 0x436b2c
cmp byte [eax + 2], 0x45
jne 0x436b2c
cmp byte [eax + 3], 0x4c
jne 0x436b2c
cmp byte [eax + 4], 0x45
jne 0x436b2c
cmp byte [eax + 5], 0x4d
jne 0x436b2c
cmp byte [eax + 6], 0x45
jne 0x436b2c
cmp byte [eax + 7], 0x4e
jne 0x436b2c
cmp byte [eax + 8], 0x54
jne 0x436b2c
add dword [ebx + 0xc8], 9
lea edx, [eax + 9]
mov dword [edi + 0x10], edx
add dword [edi + 0x20], 9
cmp byte [eax + 9], 0x25
jne 0x436894
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParserHandlePEReference
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x10]
cmp byte [edx], 0
jne 0x4368bb
mov dword [esp + 4], 0xfa
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlParserInputGrow
test eax, eax
jg 0x4368bb
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlPopInput
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
mov al, byte [eax]
lea edx, [eax - 9]
cmp dl, 1
jbe 0x4368e4
cmp al, 0x20
je 0x4368e4
cmp al, 0xd
je 0x4368e4
mov ecx, str.Space_required_after_ELEMENT_n
mov edx, 0x41
mov eax, ebx
call fcn.0042d18c
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlSkipBlankChars
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParseName
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x436912
mov ecx, str.xmlParseElementDecl:_no_name_for_Element_n
mov edx, 0x44
jmp 0x436a5a
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlPopInput
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
mov al, byte [eax]
test al, al
jne 0x436924
cmp dword [ebx + 0x28], 1
jg 0x43690a
lea edx, [eax - 9]
cmp dl, 1
jbe 0x436945
cmp al, 0x20
je 0x436945
cmp al, 0xd
je 0x436945
mov ecx, str.Space_required_after_the_element_name_n
mov edx, 0x41
mov eax, ebx
call fcn.0042d18c
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlSkipBlankChars
mov edx, dword [ebx + 0x24]
mov eax, dword [edx + 0x10]
mov cl, byte [eax]
cmp cl, 0x45
jne 0x4369ae
cmp byte [eax + 1], 0x4d
jne 0x436a50
cmp byte [eax + 2], 0x50
jne 0x436a50
cmp byte [eax + 3], 0x54
jne 0x436a50
cmp byte [eax + 4], 0x59
jne 0x436a50
add dword [ebx + 0xc8], 5
lea ecx, [eax + 5]
mov dword [edx + 0x10], ecx
add dword [edx + 0x20], 5
cmp byte [eax + 5], 0x25
jne 0x4369a1
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParserHandlePEReference
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x10]
mov esi, 1
jmp 0x4369f1
cmp cl, 0x41
jne 0x436a14
cmp byte [eax + 1], 0x4e
jne 0x436a50
cmp byte [eax + 2], 0x59
jne 0x436a50
add dword [ebx + 0xc8], 3
lea ecx, [eax + 3]
mov dword [edx + 0x10], ecx
add dword [edx + 0x20], 3
cmp byte [eax + 3], 0x25
jne 0x4369e6
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParserHandlePEReference
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x10]
mov esi, 2
cmp byte [edx], 0
jne 0x436a69
mov dword [esp + 4], 0xfa
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlParserInputGrow
test eax, eax
jg 0x436a69
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlPopInput
jmp 0x436a69
cmp cl, 0x28
jne 0x436a33
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParseElementContentDecl
mov esi, eax
jmp 0x436a69
cmp cl, 0x25
jne 0x436a50
cmp dword [ebx + 0x60], 0
jne 0x436a50
cmp dword [ebx + 0x28], 1
jne 0x436a50
mov ecx, str.PEReference:_forbidden_within_markup_decl_in_internal_subset_n
mov edx, 0x15
jmp 0x436a5a
mov ecx, str.xmlParseElementDecl:_EMPTY__ANY_or___expected_n
mov edx, 0x36
mov eax, ebx
call fcn.0042d18c
or esi, 0xffffffff
jmp 0x436b2c
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlSkipBlankChars
jmp 0x436a7b
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlPopInput
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0
jne 0x436a8c
cmp dword [ebx + 0x28], 1
jg 0x436a73
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlSkipBlankChars
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x10]
cmp byte [edx], 0x3e
je 0x436aaf
xor ecx, ecx
mov edx, 0x49
mov eax, ebx
call fcn.0042d009
jmp 0x436b16
cmp edi, eax
je 0x436ac4
mov ecx, str.Element_declaration_doesnt_start_and_stop_in_the_same_entity_n
mov edx, 0x5a
mov eax, ebx
call fcn.0042d18c
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNextChar
mov eax, dword [ebx]
test eax, eax
je 0x436b16
cmp dword [ebx + 0xd4], 0
jne 0x436b16
mov edx, dword [eax + 0x24]
test edx, edx
je 0x436b16
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x436af0
mov dword [eax + 0x14], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call edx
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x436b2c
cmp dword [eax + 0x14], 0
jne 0x436b2c
jmp 0x436b1d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x436b2c
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlFreeDocElementContent
mov eax, esi
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret