Function at 0x4016a6
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x433e80]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp + 0x14]
push 0x4295bc
push eax
mov dword [ebp - 0x54], ecx
call fcn.004179b8
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x4016ec
push 0x64
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004151e0
leave
ret
and dword [ebp - 0x4c], 0
and dword [ebp - 0x60], 0
push esi
mov esi, dword [ebp + 0x10]
lea eax, [esi + 7]
and eax, reloc.OLEAUT32.dll_VariantInit
push edi
jns 0x401708
dec eax
or eax, 0xfffffff8
inc eax
push ebx
xor edi, edi
inc edi
sub esi, eax
push edi
lea eax, [ebp - 0x44]
push 0x40
push eax
add esi, 7
call fcn.004178d9
add esp, 0x10
cmp eax, edi
je 0x401734
push 0x65
pop esi
push ebx
call fcn.00417600
pop ecx
pop edi
mov eax, esi
pop esi
jmp 0x4016df
cmp word [ebp - 0x44], 0x5a4d
je 0x401740
push 0x67
jmp 0x401726
mov eax, dword [ebp - 8]
mov dword [ebp - 0x64], eax
add eax, 0xffffffc0
push edi
push eax
push ebx
mov dword [ebp - 0x48], eax
call fcn.00417508
push ebx
push edi
lea eax, [ebp - 0x58]
push 4
push eax
call fcn.004178d9
add esp, 0x1c
cmp eax, edi
jne 0x401724
cmp dword [ebp - 0x58], 0x4550
jne 0x40173c
push ebx
push edi
lea eax, [ebp - 0x78]
push 0x14
push eax
call fcn.004178d9
add esp, 0x10
cmp eax, edi
je 0x40178a
or esi, 0xffffffff
jmp 0x401727
push ebx
call fcn.00417413
push ebx
push edi
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x158]
push 0xe0
push eax
call fcn.004178d9
add esp, 0x14
cmp eax, edi
jne 0x401785
cmp dword [ebp - 0xd8], 0
je 0x401898
cmp dword [ebp - 0xd4], 0
je 0x401898
mov eax, dword [ebp + 0x10]
neg eax
push 2
push eax
push ebx
mov dword [ebp - 0x48], eax
call fcn.00417508
push dword [ebp + 0x10]
call fcn.00417211
push ebx
push edi
push dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
push eax
call fcn.004178d9
push 0x10
push dword [ebp - 0x50]
push dword [ebp - 0x4c]
call fcn.00415b78
add esp, 0x2c
test eax, eax
je 0x401868
push str.ACTIVEMARK_MAGIC_TO_CHECK_INSTALLER
push dword [ebp - 0x4c]
call fcn.00415af0
test eax, eax
pop ecx
pop ecx
je 0x401868
add dword [ebp - 0xd4], esi
push 0
push dword [ebp - 0x5c]
push ebx
call fcn.00417508
push ebx
push edi
lea eax, [ebp - 0x158]
push 0xe0
push eax
call fcn.00415a55
add esp, 0x1c
cmp eax, edi
je 0x401847
push 0x66
jmp 0x401726
push 2
push 0
push ebx
call fcn.00417508
add esp, 0xc
sub esi, dword [ebp + 0x10]
je 0x401876
push ebx
push 0
call fcn.004157fc
dec esi
pop ecx
pop ecx
jne 0x401859
jmp 0x401876
push 2
push dword [ebp - 0x48]
push ebx
call fcn.00417508
add esp, 0xc
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp - 0x50]
call fcn.00415a55
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jne 0x401840
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
jmp 0x4019e1
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x48], eax
jae 0x4018f6
movzx eax, word [ebp - 0x76]
xor ecx, ecx
push 0x28
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00417211
movzx ecx, word [ebp - 0x76]
imul ecx, ecx, 0x28
push ebx
push edi
push ecx
push eax
mov dword [ebp - 0x4c], eax
call fcn.004178d9
add esp, 0x14
cmp eax, edi
jne 0x401724
movzx eax, word [ebp - 0x68]
mov esi, dword [ebp + 0x10]
sub esi, dword [ebp - 0x48]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x4c]
lea eax, [eax + esi + 0x18]
cmp eax, dword [ecx + 0x14]
jbe 0x4018f9
push 0x68
jmp 0x401726
mov esi, dword [ebp - 0x60]
push 0x40
lea eax, [ebp - 0x44]
push 0x433030
push eax
call fcn.004152c0
mov eax, dword [ebp - 0x64]
push 0
add eax, esi
push 0
push ebx
mov dword [ebp - 8], eax
call fcn.00417508
push ebx
push edi
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00415a55
add esp, 0x28
cmp eax, edi
jne 0x401840
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp - 0x50]
call fcn.00415a55
add esp, 0x10
test eax, eax
jl 0x401840
mov ecx, dword [ebp - 0x48]
sub ecx, eax
lea eax, [ecx + esi]
test eax, eax
jbe 0x401969
mov dword [ebp - 0x48], eax
push ebx
push 0
call fcn.004157fc
dec dword [ebp - 0x48]
pop ecx
pop ecx
jne 0x40195a
test esi, esi
jbe 0x4019d8
push ebx
push edi
lea eax, [ebp - 0x58]
push 4
push eax
call fcn.00415a55
add esp, 0x10
cmp eax, edi
jne 0x401840
push ebx
push edi
lea eax, [ebp - 0x78]
push 0x14
push eax
call fcn.00415a55
add esp, 0x10
cmp eax, edi
jne 0x401840
push ebx
push edi
lea eax, [ebp - 0x158]
push 0xe0
push eax
call fcn.00415a55
add esp, 0x10
cmp eax, edi
jne 0x401840
movzx eax, word [ebp - 0x76]
imul eax, eax, 0x28
push ebx
push edi
push eax
push dword [ebp - 0x4c]
call fcn.00415a55
add esp, 0x10
cmp eax, edi
jne 0x401840
mov eax, dword [ebp - 0x54]
mov dword [eax], 0x40
xor esi, esi
jmp 0x401727