Function at 0x43e610
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1f8
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
push ebx
mov ebx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
push esi
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov eax, dword [eax + 8]
push edi
lea esi, [esp + 0xaf]
lea edi, reloc.KERNEL32.dll_GetProcessHeap
mov dword [esp + 0x50], edx
and esi, 0xffffffc0
and edi, 0xffffffc0
xor edx, edx
and ebx, reloc.uxtheme.dll_HitTestThemeBackground
mov dword [esp + 0x58], ecx
mov dword [esp + 0x60], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x54], ebx
jle 0x43e9eb
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
push ebp
and eax, reloc.uxtheme.dll_HitTestThemeBackground
mov dword [esp + 0x70], eax
lea ecx, [eax + eax*2]
lea ecx, [ecx + ecx*4]
lea ebp, [eax + ecx*4]
mov ecx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
shl ebp, 3
mov dword [esp + 0x60], ebp
mov dword [esp + 0x2c], ecx
xor ecx, ecx
cmp eax, edx
mov dword [esp + 0x18], ecx
jle 0x43e9cb
mov ebx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov ebp, dword [esp + 0x2c]
and ebx, reloc.uxtheme.dll_HitTestThemeBackground
mov dword [esp + 0x10], ebp
mov dword [esp + 0x50], ebx
jmp 0x43e6bc
xor edx, edx
mov eax, ebx
add ebp, 0x15c
imul eax, dword [esp + 0x14]
add eax, ecx
mov ecx, dword [esp + 0x5c]
shl eax, 4
add eax, ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x34], 2
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 2
push edi
push esi
push ebx
push eax
call dword [0x50bc5c]
mov ecx, dword [edi]
mov ebp, dword [edi + 4]
mov ebx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x78], ebp
add ecx, ebp
mov ebp, dword [esp + 0x50]
add ecx, ebx
add ebp, eax
add ecx, edx
mov dword [esp + 0x50], ebp
mov ebp, dword [esp + 0x48]
mov dword [esp + 0x40], eax
shl ecx, 6
xor eax, eax
add ebp, ecx
mov ax, word [esi]
mov dword [esp + 0x48], ebp
mov ebp, eax
add esp, 0x10
imul ebp, eax
mov eax, dword [esp + 0x6c]
shl eax, 4
sub eax, ebp
mov dword [esp + 0x1c], eax
xor eax, eax
mov ax, word [esi + 2]
mov ebp, eax
imul ebp, eax
mov eax, dword [esp + 0x68]
shl eax, 4
sub eax, ebp
mov dword [esp + 0x20], eax
xor eax, eax
mov ax, word [esi + 4]
mov ebp, eax
imul ebp, eax
xor eax, eax
mov ax, word [esi + 6]
shl ebx, 4
sub ebx, ebp
mov ebp, eax
imul ebp, eax
mov eax, dword [esp + 0x30]
shl edx, 4
sub edx, ebp
mov ebp, eax
imul ebp, eax
sub ecx, ebp
mov ebp, dword [esp + 0x3c]
mov dword [ebp], ecx
je 0x43e7b7
lea eax, [edx + ebx]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
add eax, edx
add eax, ebx
xor edx, edx
shl eax, 8
div ecx
mov dword [ebp], eax
jmp 0x43e7be
mov dword [ebp], reloc.wtsapi32.dll_WTSVirtualChannelOpen
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov ebx, dword [esp + 0x50]
add eax, 8
add ebp, 4
dec ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x48], ecx
jne 0x43e6f8
mov eax, dword [esp + 0x4c]
lea ecx, [ebx*8]
add eax, ecx
mov ecx, dword [esp + 0x34]
dec ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x34], ecx
jne 0x43e6e8
mov eax, dword [esp + 0x14]
mov edx, ebx
shr edx, 1
lea ecx, [eax*8]
mov eax, dword [esp + 0x18]
imul edx, ecx
mov ecx, dword [esp + 0x54]
push edi
lea eax, [edx + eax*8]
push esi
mov dword [esp + 0x38], eax
add eax, ecx
push ebx
push eax
call dword [0x50bc5c]
xor ecx, ecx
mov edx, dword [edi]
mov cx, word [esi]
add esp, 0x10
mov ebp, ecx
imul ebp, ecx
xor ecx, ecx
mov cx, word [esi + 2]
shl edx, 4
sub edx, ebp
mov ebp, ecx
imul ebp, ecx
mov ecx, dword [edi + 4]
shl ecx, 4
sub ecx, ebp
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov cx, word [esi + 4]
mov ebp, ecx
imul ebp, ecx
mov ecx, dword [edi + 8]
shl ecx, 4
sub ecx, ebp
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov cx, word [esi + 6]
mov ebp, ecx
imul ebp, ecx
mov ecx, dword [edi + 0xc]
shl ecx, 4
sub ecx, ebp
mov ebp, dword [edi + 4]
mov dword [esp + 0x28], ecx
mov ecx, dword [edi]
add ecx, ebp
mov ebp, dword [edi + 8]
add ecx, ebp
mov ebp, dword [edi + 0xc]
add ecx, ebp
mov ebp, eax
imul ebp, eax
mov eax, dword [esp + 0x10]
shl ecx, 6
sub ecx, ebp
mov dword [eax + reloc.KERNEL32.dll_GetProcessHeap], ecx
je 0x43e8d5
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
add eax, ebp
mov ebp, dword [esp + 0x20]
add eax, ebp
add eax, edx
xor edx, edx
shl eax, 8
div ecx
mov ecx, dword [esp + 0x10]
mov dword [ecx + reloc.KERNEL32.dll_GetProcessHeap], eax
jmp 0x43e8df
mov dword [eax + reloc.KERNEL32.dll_GetProcessHeap], reloc.wtsapi32.dll_WTSVirtualChannelOpen
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x30]
push edi
push esi
add eax, edx
push ebx
push eax
call dword [0x50bc5c]
xor ecx, ecx
mov edx, dword [edi]
mov cx, word [esi]
add esp, 0x10
mov ebp, ecx
imul ebp, ecx
xor ecx, ecx
mov cx, word [esi + 2]
shl edx, 4
sub edx, ebp
mov ebp, ecx
imul ebp, ecx
mov ecx, dword [edi + 4]
shl ecx, 4
sub ecx, ebp
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov cx, word [esi + 4]
mov ebp, ecx
imul ebp, ecx
mov ecx, dword [edi + 8]
shl ecx, 4
sub ecx, ebp
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov cx, word [esi + 6]
mov ebp, ecx
imul ebp, ecx
mov ecx, dword [edi + 0xc]
shl ecx, 4
sub ecx, ebp
mov ebp, dword [edi + 4]
mov dword [esp + 0x28], ecx
mov ecx, dword [edi]
add ecx, ebp
mov ebp, dword [edi + 8]
add ecx, ebp
mov ebp, dword [edi + 0xc]
add ecx, ebp
mov ebp, eax
imul ebp, eax
shl ecx, 6
sub ecx, ebp
mov ebp, dword [esp + 0x10]
mov dword [ebp + reloc.KERNEL32.dll_GetProcessHeap], ecx
je 0x43e998
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
add eax, ebp
mov ebp, dword [esp + 0x20]
add eax, ebp
mov ebp, dword [esp + 0x10]
add eax, edx
xor edx, edx
shl eax, 8
div ecx
mov dword [ebp + reloc.KERNEL32.dll_GetProcessHeap], eax
jmp 0x43e9a2
mov dword [ebp + reloc.KERNEL32.dll_GetProcessHeap], reloc.wtsapi32.dll_WTSVirtualChannelOpen
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x70]
inc ecx
add ebp, 0x1e8
cmp ecx, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ebp
jl 0x43e6ba
mov ebx, dword [esp + 0x58]
mov ebp, dword [esp + 0x60]
xor edx, edx
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x2c]
add ecx, ebp
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
jl 0x43e691
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1f8
ret