Function at 0x50d900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, dword [str.dbgcore.dll]
push edi
push esi
call sym.SystemInformer.exe_PhCountStringZ
add eax, eax
mov dword [esp + 0x24], esi
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
xor ecx, ecx
call fcn.00522860
test eax, eax
je 0x50d988
mov esi, dword [str.dbghelp.dll]
push esi
call sym.SystemInformer.exe_PhCountStringZ
add eax, eax
mov dword [esp + 0x24], esi
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
xor ecx, ecx
call fcn.00522860
test eax, eax
je 0x50d988
mov esi, dword [str.symsrv.dll]
push esi
call sym.SystemInformer.exe_PhCountStringZ
add eax, eax
mov dword [esp + 0x24], esi
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
xor ecx, ecx
call fcn.00522860
lea ebx, [ebx]
test eax, eax
jne 0x50e268
xor ebx, ebx
mov dword [esp + 0x18], 0
push ebx
push 0x62dcf8
push 0xfffffffffffffffd
push 0x20019
lea eax, [esp + 0x1c]
mov dword [esp + 0x2c], ebx
push eax
call sym.SystemInformer.exe_PhOpenKey
test eax, eax
js 0x50dbe6
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x14
push eax
push dword [esp + 0x10]
mov dword [esp + 0x2c], str.KitsRoot10
call sym.SystemInformer.exe_PhQueryRegistryString
mov esi, eax
or edi, 0xffffffff
mov dword [esp + 0x10], esi
test esi, esi
je 0x50d9ec
cmp dword [esi], ebx
jne 0x50da76
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x14
push eax
push dword [esp + 0x10]
mov dword [esp + 0x2c], str.KitsRoot81
call sym.SystemInformer.exe_PhQueryRegistryString
mov ecx, esi
mov esi, eax
mov dword [esp + 0x10], esi
test ecx, ecx
je 0x50da28
add ecx, 0xfffffff8
mov eax, edi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x50da28
call fcn.004f9e40
test esi, esi
je 0x50da30
cmp dword [esi], ebx
jne 0x50da76
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
push dword [esp + 0x10]
mov dword [esp + 0x1c], str.KitsRoot
mov dword [esp + 0x28], esi
call sym.SystemInformer.exe_PhQueryRegistryString
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], esi
test eax, eax
je 0x50da76
lea ecx, [eax - 8]
mov eax, edi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x50da76
call fcn.004f9e40
push dword ds:[esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x50dbe6
mov eax, dword [esi]
add eax, 0x1e
mov dword [esp + 0x24], ebx
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push 0
push eax
call sym.SystemInformer.exe_PhCreateString3
push dword [esi]
mov edi, eax
push dword [esi + 4]
mov dword [esp + 0x28], edi
push dword [edi + 4]
call fcn.0057e5b0
mov edi, dword [edi + 4]
mov ecx, 7
add edi, dword [esi]
add esp, 0xc
mov esi, str.Debuggersx86_
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff8
movsw word es:[edi], word [esi]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x50daeb
call fcn.004f9e40
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x10]
push 0x62dce0
push edi
push eax
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 0x607300
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x20], eax
test eax, eax
je 0x50db39
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x20]
mov edx, esi
mov dword [esp + 0x18], eax
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], edx
dec edx
jne 0x50db39
call fcn.004f9e40
push 0x62dd20
push edi
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 8
push eax
mov dword [esp + 0x30], 0x607300
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword ds:[esp + 0x20], eax
test eax, eax
je 0x50db85
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x20]
mov ebx, eax
add ecx, 0xfffffff8
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x50db85
nop
call fcn.004f9e40
push 0x62dd28
push edi
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 8
push eax
mov dword [esp + 0x30], 0x607300
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x20], eax
test eax, eax
je 0x50dbcf
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x20]
mov edx, esi
mov dword [esp + 0x1c], eax
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], edx
dec edx
jne 0x50dbcf
call fcn.004f9e40
lea ecx, [edi - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x50dbdf
call fcn.004f9e40
cmp dword [esp + 0x18], 0
jne 0x50dc27
push 0x800
push 0
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x50dc27
push 0x200
push eax
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x50dc27
cmp dword [0x62abb0], 0x3e
jae 0x50dc27
push eax
push eax
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test ebx, ebx
jne 0x50dc79
push 0x800
push ebx
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x50dc79
push 0x200
push eax
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x50dc79
cmp dword [0x62abb0], 0x3e
jae 0x50dc77
push eax
push eax
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x50dc79
xor ebx, ebx
cmp dword ds:[esp + 0x1c], 0
jne 0x50dcc6
push 0x800
push 0
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x50dcc6
push 0x200
push eax
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x50dcc6
cmp dword [0x62abb0], 0x3e
jae 0x50dcc6
push eax
push eax
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test ebx, ebx
je 0x50e268
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50dd15
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50dd15
nop
cmp eax, 0x7fffffff
jae 0x50dd15
cmp dword [eax + ebx], 0x4550
jne 0x50dd15
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50dd15
cmp dword [edx + 4], 0
je 0x50dd15
push 0
add eax, ebx
mov ecx, ebx
push str.SymInitializeW
push eax
call fcn.00522ae0
jmp 0x50dd17
xor eax, eax
mov dword [0x631068], eax
mov esi, ebx
mov eax, 0x5a4d
mov edi, 0x3c
cmp word [ebx], ax
jne 0x50dd69
mov eax, dword [edi + esi]
test eax, eax
je 0x50dd69
cmp eax, 0x7fffffff
jae 0x50dd69
cmp dword [eax + ebx], 0x4550
jne 0x50dd69
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50dd69
cmp dword [edx + 4], 0
je 0x50dd69
push 0
add eax, ebx
mov ecx, ebx
push str.SymCleanup
push eax
call fcn.00522ae0
jmp 0x50dd6b
xor eax, eax
mov dword [0x631070], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50ddbd
mov eax, dword ds:[edi + esi]
test eax, eax
je 0x50ddbd
cmp eax, 0x7fffffff
jae 0x50ddbd
cmp dword [eax + ebx], 0x4550
jne 0x50ddbd
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50ddbd
cmp dword [edx + 4], 0
je 0x50ddbd
push 0
add eax, ebx
mov ecx, ebx
push str.SymFromAddrW
push eax
call fcn.00522ae0
jmp 0x50ddbf
xor eax, eax
mov dword [0x631098], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50de0a
mov eax, dword [edi + esi]
test eax, eax
je 0x50de0a
cmp eax, 0x7fffffff
jae 0x50de0a
cmp dword [eax + ebx], 0x4550
jne 0x50de0a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50de0a
cmp dword [edx + 4], 0
je 0x50de0a
push 0
add eax, ebx
mov ecx, ebx
push str.SymFromNameW
push eax
call fcn.00522ae0
jmp 0x50de0c
xor eax, eax
mov dword [0x631078], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50de5d
mov eax, dword ds:[edi + esi]
test eax, eax
je 0x50de5d
cmp eax, 0x7fffffff
jae 0x50de5d
cmp dword [eax + ebx], 0x4550
jne 0x50de5d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50de5d
cmp dword [edx + 4], 0
je 0x50de5d
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetLineFromAddrW64
push eax
call fcn.00522ae0
jmp 0x50de5f
xor eax, eax
mov dword [0x631074], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50deaa
mov eax, dword [edi + esi]
test eax, eax
je 0x50deaa
cmp eax, 0x7fffffff
jae 0x50deaa
cmp dword [eax + ebx], 0x4550
jne 0x50deaa
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50deaa
cmp dword [edx + 4], 0
je 0x50deaa
push 0
add eax, ebx
mov ecx, ebx
push str.SymLoadModuleExW
push eax
call fcn.00522ae0
jmp 0x50deac
xor eax, eax
mov dword [0x63107c], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50defd
mov eax, dword ds:[edi + esi]
test eax, eax
je 0x50defd
cmp eax, 0x7fffffff
jae 0x50defd
cmp dword [eax + ebx], 0x4550
jne 0x50defd
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50defd
cmp dword [edx + 4], 0
je 0x50defd
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetOptions
push eax
call fcn.00522ae0
jmp 0x50deff
xor eax, eax
mov dword [0x6310a4], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50df4a
mov eax, dword [edi + esi]
test eax, eax
je 0x50df4a
cmp eax, 0x7fffffff
jae 0x50df4a
cmp dword [eax + ebx], 0x4550
jne 0x50df4a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50df4a
cmp dword [edx + 4], 0
je 0x50df4a
push 0
add eax, ebx
mov ecx, ebx
push str.SymSetOptions
push eax
call fcn.00522ae0
jmp 0x50df4c
xor eax, eax
mov dword [0x631088], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50df9d
mov eax, dword ds:[edi + esi]
test eax, eax
je 0x50df9d
cmp eax, 0x7fffffff
jae 0x50df9d
cmp dword [eax + ebx], 0x4550
jne 0x50df9d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50df9d
cmp dword [edx + 4], 0
je 0x50df9d
push 0
add eax, ebx
mov ecx, ebx
push str.SymSetSearchPathW
push eax
call fcn.00522ae0
jmp 0x50df9f
xor eax, eax
mov dword [0x6310a8], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50dfea
mov eax, dword [edi + esi]
test eax, eax
je 0x50dfea
cmp eax, 0x7fffffff
jae 0x50dfea
cmp dword [eax + ebx], 0x4550
jne 0x50dfea
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50dfea
cmp dword [edx + 4], 0
je 0x50dfea
push 0
add eax, ebx
mov ecx, ebx
push str.SymFunctionTableAccess64
push eax
call fcn.00522ae0
jmp 0x50dfec
xor eax, eax
mov dword [0x6310a0], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50e03d
mov eax, dword ds:[edi + esi]
test eax, eax
je 0x50e03d
cmp eax, 0x7fffffff
jae 0x50e03d
cmp dword [eax + ebx], 0x4550
jne 0x50e03d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50e03d
cmp dword [edx + 4], 0
je 0x50e03d
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetModuleBase64
push eax
call fcn.00522ae0
jmp 0x50e03f
xor eax, eax
mov dword [0x63106c], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50e08a
mov eax, dword [edi + esi]
test eax, eax
je 0x50e08a
cmp eax, 0x7fffffff
jae 0x50e08a
cmp dword [eax + ebx], 0x4550
jne 0x50e08a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50e08a
cmp dword [edx + 4], 0
je 0x50e08a
push 0
add eax, ebx
mov ecx, ebx
push str.SymRegisterCallbackW64
push eax
call fcn.00522ae0
jmp 0x50e08c
xor eax, eax
mov dword [0x631084], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50e0dd
mov eax, dword ds:[edi + esi]
test eax, eax
je 0x50e0dd
cmp eax, 0x7fffffff
jae 0x50e0dd
cmp dword [eax + ebx], 0x4550
jne 0x50e0dd
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50e0dd
cmp dword [edx + 4], 0
je 0x50e0dd
push 0
add eax, ebx
mov ecx, ebx
push str.StackWalk64
push eax
call fcn.00522ae0
jmp 0x50e0df
xor eax, eax
mov dword [0x63108c], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50e12a
mov eax, dword [edi + esi]
test eax, eax
je 0x50e12a
cmp eax, 0x7fffffff
jae 0x50e12a
cmp dword [eax + ebx], 0x4550
jne 0x50e12a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50e12a
cmp dword [edx + 4], 0
je 0x50e12a
push 0
add eax, ebx
mov ecx, ebx
push str.StackWalkEx
push eax
call fcn.00522ae0
jmp 0x50e12c
xor eax, eax
mov dword [0x631094], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50e17d
mov eax, dword ds:[edi + esi]
test eax, eax
je 0x50e17d
cmp eax, 0x7fffffff
jae 0x50e17d
cmp dword [eax + ebx], 0x4550
jne 0x50e17d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50e17d
cmp dword [edx + 4], 0
je 0x50e17d
push 0
add eax, ebx
mov ecx, ebx
push str.SymFromInlineContextW
push eax
call fcn.00522ae0
jmp 0x50e17f
xor eax, eax
mov dword [0x631080], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50e1ca
mov eax, dword [edi + esi]
test eax, eax
je 0x50e1ca
cmp eax, 0x7fffffff
jae 0x50e1ca
cmp dword [eax + ebx], 0x4550
jne 0x50e1ca
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50e1ca
cmp dword [edx + 4], 0
je 0x50e1ca
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetLineFromInlineContextW
push eax
call fcn.00522ae0
jmp 0x50e1cc
xor eax, eax
mov dword [0x63109c], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50e21d
mov eax, dword ds:[edi + esi]
test eax, eax
je 0x50e21d
cmp eax, 0x7fffffff
jae 0x50e21d
cmp dword [eax + ebx], 0x4550
jne 0x50e21d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50e21d
cmp dword [edx + 4], 0
je 0x50e21d
push 0
add eax, ebx
mov ecx, ebx
push str.MiniDumpWriteDump
push eax
call fcn.00522ae0
jmp 0x50e21f
xor eax, eax
mov dword [0x631090], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x50e268
mov eax, dword [edi + esi]
test eax, eax
je 0x50e268
cmp eax, 0x7fffffff
jae 0x50e268
cmp dword [eax + ebx], 0x4550
jne 0x50e268
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50e268
cmp dword [edx + 4], 0
je 0x50e268
push 0
add eax, ebx
mov ecx, ebx
push str.UnDecorateSymbolNameW
push eax
call fcn.00522ae0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret