Function at 0x403e10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x422004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
mov dword [ebp - 0x810], eax
mov edi, edx
mov eax, dword [ebx + 0x12cb1c18]
push 0xffffffffffffffff
mov dword [ebp - 0x814], edi
mov dword [ebp - 0x818], ebx
push dword [eax]
call esi
mov eax, dword [0x447824]
push 0xffffffffffffffff
push dword [eax]
call esi
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 0x810]
push dword [ebp - 0x81c]
push dword [ebp + 8]
push edi
push 0
push 0x3e8
push dword [ebp - 0x820]
push dword [ebp - 0x824]
call fcn.0041a160
push dword [0x447814]
push dword [0x447810]
push edx
push eax
call fcn.0041a0b0
push eax
push 0x41ba3c
push 0xffffffffffffffff
lea eax, [ebp - 0x80c]
push 0x800
push eax
call fcn.00401570
add esp, 0x24
lea eax, [ebp - 0x80c]
push eax
push 0x41ba0c
push dword [0x447818]
call fcn.00407010
mov eax, dword [0x447824]
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, di
imul eax, eax, 0x41c
add eax, ebx
mov esi, dword [eax + 0xeaf2028]
lea edi, [eax + 0xeaf2028]
mov dword [ebp - 0x820], eax
cmp esi, edi
je 0x403f26
mov eax, dword [ebp - 0x810]
cmp dword [esi + 8], eax
je 0x404047
mov esi, dword [esi]
cmp esi, edi
jne 0x403f17
push 0x224
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x404047
mov eax, dword [ebp - 0x810]
push 0xffffffffffffffff
push dword [ebp - 0x81c]
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
push 0x104
push eax
mov dword [esi + 0x214], 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
lea eax, [esi + 0xc]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
add esp, 0x18
test eax, eax
je 0x403f7e
inc eax
jmp 0x403f81
lea eax, [esi + 0xc]
push 0xffffffffffffffff
push eax
lea eax, [esi + 0x110]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x810]
add esp, 0x10
mov dword [ebp - 0x81c], eax
push ecx
push 0x400
lea ecx, [ebp - 0x40c]
push ecx
push eax
mov eax, dword [ebp - 0x820]
push dword [eax + 0xeaf1c18]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x404006
mov eax, 0x5a4d
cmp ax, word [ebp - 0x40c]
jne 0x404006
cmp word [ebp - 0x3f4], 0x40
jb 0x404006
mov eax, dword [ebp - 0x3d0]
cmp dword [ebp + eax - 0x40c], 0x4550
jne 0x404006
mov ax, word [ebp + eax - 0x408]
mov word [esi + 0x218], ax
test byte [0x44780c], 1
je 0x404030
movzx eax, word [esi + 0x218]
push eax
push dword [ebp - 0x81c]
push dword [ebp - 0x814]
push 0x41b9c0
call fcn.00401530
add esp, 0x10
lea eax, [esi + 0x21c]
mov dword [eax + 4], eax
mov dword [eax], eax
mov eax, dword [edi]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [eax + 4], esi
mov dword [edi], esi
cmp dword [esi + 0x214], 0
jne 0x4041f3
test byte [0x44780c], 1
lea ecx, [esi + 0xc]
mov edi, dword [ebp - 0x814]
je 0x40407f
push dword [esi + 8]
lea eax, [esi + 0x110]
push eax
push ecx
push edi
push 0x41bb88
call fcn.00401530
add esp, 0x14
xor ecx, ecx
mov dword [ebp - 0x810], ecx
cmp dword [ebx + 0xe621c08], ecx
jle 0x4041c4
add ebx, 0x21c08
nop dword [eax]
mov eax, dword [esi + 8]
cdq
cmp dword [ebx + 0x710], eax
jne 0x4040b4
cmp dword [ebx + 0x714], edx
je 0x4040d0
lea eax, [esi + 0xc]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ecx, dword [ebp - 0x810]
add esp, 8
test eax, eax
jne 0x4041a3
mov edx, dword [ebx + 0x708]
mov eax, edx
or eax, dword [ebx + 0x70c]
je 0x4041a3
mov eax, dword [esi + 8]
add eax, edx
push 0x788
mov dword [ebp - 0x820], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x404197
push 0x788
push 0
push edi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x820]
lea ecx, [esi + 0x21c]
mov dword [edi + 0x780], ebx
add esp, 0xc
mov dword [edi + 0x72c], eax
mov dword [edi + 0x784], esi
mov eax, dword [ecx]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [eax + 4], edi
mov dword [ecx], edi
mov ecx, dword [edi + 0x780]
mov eax, dword [ecx + 0x720]
and eax, 1
or eax, 0
je 0x404170
mov edx, dword [ebp - 0x814]
mov ecx, dword [ebp - 0x818]
push edi
call fcn.00403a40
mov ecx, dword [edi + 0x780]
add esp, 4
mov eax, dword [ecx + 0x720]
and eax, 4
or eax, 0
je 0x404197
mov ecx, dword [ebp - 0x818]
push edi
mov edi, dword [ebp - 0x814]
mov edx, edi
call fcn.00403c40
add esp, 4
jmp 0x40419d
mov edi, dword [ebp - 0x814]
mov ecx, dword [ebp - 0x810]
mov eax, dword [ebp - 0x818]
inc ecx
add ebx, 0x730
mov dword [ebp - 0x810], ecx
cmp ecx, dword [eax + 0xe621c08]
jl 0x4040a0
mov ebx, eax
test byte [0x44780c], 1
je 0x4041e9
push dword [esi + 8]
lea eax, [esi + 0x110]
push eax
lea eax, [esi + 0xc]
push eax
push edi
push 0x41bbb4
call fcn.00401530
add esp, 0x14
mov dword [esi + 0x214], 1
mov eax, dword [ebx + 0x12cb1c18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419265
mov esp, ebp
pop ebp
ret