Function at 0x50fca0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, dword [str.dbgcore.dll]
push edi
push esi
call sym.SystemInformer.exe_PhCountStringZ
add eax, eax
mov dword [esp + 0x24], esi
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
xor ecx, ecx
call fcn.005255a0
test eax, eax
je 0x50fd28
mov esi, dword [str.dbghelp.dll]
push esi
call sym.SystemInformer.exe_PhCountStringZ
add eax, eax
mov dword [esp + 0x24], esi
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
xor ecx, ecx
call fcn.005255a0
test eax, eax
je 0x50fd28
mov esi, dword [str.symsrv.dll]
push esi
call sym.SystemInformer.exe_PhCountStringZ
add eax, eax
mov dword [esp + 0x24], esi
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
xor ecx, ecx
call fcn.005255a0
lea ebx, [ebx]
test eax, eax
jne 0x51063b
xor edi, edi
lea eax, [esp + 0x14]
push edi
push 0x630cf8
push 0xfffffffffffffffd
push 0x20019
push eax
mov dword [esp + 0x2c], edi
call sym.SystemInformer.exe_PhOpenKey
test eax, eax
js 0x50ffe3
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x14
push eax
push dword [esp + 0x18]
mov dword [esp + 0x2c], str.KitsRoot10
call sym.SystemInformer.exe_PhQueryRegistryString
or esi, 0xffffffff
mov dword [esp + 0x10], eax
mov ebx, eax
test eax, eax
je 0x50fd7c
cmp dword [eax], edi
jne 0x50fdba
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x14
push eax
push dword [esp + 0x18]
mov dword [esp + 0x2c], str.KitsRoot81
call sym.SystemInformer.exe_PhQueryRegistryString
mov ebx, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x50fdb6
lea ecx, [eax - 8]
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x50fdb6
call fcn.004fbfa0
test ebx, ebx
je 0x50fdbe
cmp dword [ebx], edi
jne 0x50fdf6
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x10
push eax
push dword [esp + 0x18]
mov dword [esp + 0x2c], str.KitsRoot
call sym.SystemInformer.exe_PhQueryRegistryString
mov ecx, ebx
mov ebx, eax
test ecx, ecx
je 0x50fdf6
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x50fdf6
call fcn.004fbfa0
push dword ds:[esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
je 0x50ffe3
mov eax, dword [ebx]
add eax, 0x1e
mov dword [esp + 0x24], edi
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push 0
push eax
call sym.SystemInformer.exe_PhCreateString3
push dword [ebx]
mov esi, eax
push dword [ebx + 4]
mov dword [esp + 0x18], esi
push dword [esi + 4]
call fcn.005831c0
mov edi, dword ds:[esi + 4]
mov ecx, 7
add edi, dword [ebx]
mov esi, str.Debuggersx86_
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx - 8]
add esp, 0xc
or ebx, 0xffffffff
mov eax, ebx
movsw word es:[edi], word [esi]
lock xadd dword [ecx + 4], eax
dec eax
jne 0x50fe68
call fcn.004fbfa0
mov edi, dword [esp + 0x10]
push 0
push 0
mov dword [esp + 0x2c], 0
mov eax, dword [edi]
add eax, dword [0x630ce0]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
call sym.SystemInformer.exe_PhCreateString3
push dword [edi]
mov esi, eax
push dword [edi + 4]
push dword [esi + 4]
call fcn.005831c0
mov eax, dword [edi]
add esp, 0xc
add eax, dword [esi + 4]
push dword [0x630ce0]
push dword [0x630ce4]
push eax
call fcn.005831c0
add esp, 0xc
push dword [esi + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov dword [esp + 0x1c], eax
lea ecx, [esi - 8]
mov edx, ebx
lock xadd dword [ecx + 4], edx
dec edx
jne 0x50fedb
call fcn.004fbfa0
mov eax, dword [edi]
add eax, dword [0x630d20]
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x30], 0
call sym.SystemInformer.exe_PhCreateString3
push dword [edi]
mov esi, eax
push dword [edi + 4]
push dword [esi + 4]
call fcn.005831c0
mov eax, dword [esi + 4]
add esp, 0xc
add eax, dword [edi]
push dword [0x630d20]
push dword [0x630d24]
push eax
call fcn.005831c0
add esp, 0xc
push dword [esi + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov edi, eax
lea ecx, [esi - 8]
mov edx, ebx
lock xadd dword [ecx + 4], edx
dec edx
jne 0x50ff48
call fcn.004fbfa0
mov eax, dword [esp + 0x10]
push 0
push 0
mov dword [esp + 0x2c], 0
mov eax, dword [eax]
add eax, dword [0x630d28]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
call sym.SystemInformer.exe_PhCreateString3
mov esi, eax
mov eax, dword [esp + 0x10]
push dword [eax]
push dword [eax + 4]
push dword [esi + 4]
call fcn.005831c0
mov eax, dword ds:[esp + 0x1c]
add esp, 0xc
push dword [0x630d28]
mov eax, dword [eax]
push dword [0x630d2c]
add eax, dword [esi + 4]
push eax
call fcn.005831c0
add esp, 0xc
push dword [esi + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov dword ds:[esp + 0x18], eax
lea ecx, [esi - 8]
mov edx, ebx
lock xadd dword [ecx + 4], edx
dec edx
jne 0x50ffc8
call fcn.004fbfa0
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], ebx
dec ebx
jne 0x50ffdc
call fcn.004fbfa0
cmp dword [esp + 0x1c], 0
jne 0x510026
push 0x800
push 0
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x510026
push 0x200
push eax
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x510026
cmp dword [0x62dbb0], 0x3e
jae 0x510026
push eax
push eax
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test edi, edi
jne 0x510079
push 0x800
push edi
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x510079
push 0x200
push eax
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x510079
cmp dword [0x62dbb0], 0x3e
jae 0x510077
push eax
push eax
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x510079
xor edi, edi
cmp dword ds:[esp + 0x18], 0
jne 0x5100c6
push 0x800
push 0
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x5100c6
push 0x200
push eax
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x5100c6
cmp dword [0x62dbb0], 0x3e
jae 0x5100c6
push eax
push eax
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test edi, edi
je 0x51063b
mov ebx, 0x5a4d
lea esi, [edi + 0x3c]
cmp word [edi], bx
jne 0x51011d
mov eax, dword ds:[esi]
test eax, eax
je 0x51011d
cmp eax, 0x7fffffff
jae 0x51011d
cmp dword [eax + edi], 0x4550
jne 0x51011d
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x51011d
cmp dword [edx + 4], 0
je 0x51011d
push 0
add eax, edi
mov ecx, edi
push str.SymInitializeW
push eax
call fcn.00525800
jmp 0x51011f
xor eax, eax
mov dword [0x633808], eax
cmp word [edi], bx
jne 0x510167
mov eax, dword [esi]
test eax, eax
je 0x510167
cmp eax, 0x7fffffff
jae 0x510167
cmp dword [eax + edi], 0x4550
jne 0x510167
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x510167
cmp dword [edx + 4], 0
je 0x510167
push 0
add eax, edi
mov ecx, edi
push str.SymCleanup
push eax
call fcn.00525800
jmp 0x510169
xor eax, eax
mov dword [0x633810], eax
cmp word [edi], bx
jne 0x5101b5
mov eax, dword [esi]
test eax, eax
je 0x5101b5
lea esp, [esp]
cmp eax, 0x7fffffff
jae 0x5101b5
cmp dword [eax + edi], 0x4550
jne 0x5101b5
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x5101b5
cmp dword [edx + 4], 0
je 0x5101b5
push 0
add eax, edi
mov ecx, edi
push str.SymFromAddrW
push eax
call fcn.00525800
jmp 0x5101b7
xor eax, eax
mov dword [0x633838], eax
lea esp, [esp]
cmp word [edi], bx
jne 0x510202
mov eax, dword [esi]
test eax, eax
je 0x510202
cmp eax, 0x7fffffff
jae 0x510202
cmp dword [eax + edi], 0x4550
jne 0x510202
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x510202
cmp dword [edx + 4], 0
je 0x510202
push 0
add eax, edi
mov ecx, edi
push str.SymFromNameW
push eax
call fcn.00525800
mov edi, edi
jmp 0x510204
xor eax, eax
mov dword [0x633818], eax
cmp word [edi], bx
jne 0x510249
mov eax, dword [esi]
test eax, eax
je 0x510249
cmp eax, 0x7fffffff
jae 0x510249
cmp dword [eax + edi], 0x4550
jne 0x510249
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x510249
cmp dword [edx + 4], 0
je 0x510249
push 0
add eax, edi
mov ecx, edi
push str.SymGetLineFromAddrW64
push eax
call fcn.00525800
jmp 0x51024b
xor eax, eax
mov dword [0x633814], eax
cmp word [edi], bx
jne 0x510295
mov eax, dword [esi]
test eax, eax
je 0x510295
jmp 0x510260
cmp eax, 0x7fffffff
jae 0x510295
cmp dword [eax + edi], 0x4550
jne 0x510295
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x510295
cmp dword [edx + 4], 0
je 0x510295
push 0
add eax, edi
mov ecx, edi
push str.SymLoadModuleExW
push eax
call fcn.00525800
jmp 0x510297
xor eax, eax
mov dword [0x63381c], eax
lea esp, [esp]
cmp word [edi], bx
jne 0x5102e2
mov eax, dword [esi]
test eax, eax
je 0x5102e2
cmp eax, 0x7fffffff
jae 0x5102e2
cmp dword [eax + edi], 0x4550
jne 0x5102e2
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x5102e2
cmp dword [edx + 4], 0
je 0x5102e2
push 0
add eax, edi
mov ecx, edi
push str.SymGetOptions
push eax
call fcn.00525800
mov edi, edi
jmp 0x5102e4
xor eax, eax
mov dword [0x633844], eax
cmp word [edi], bx
jne 0x510329
mov eax, dword [esi]
test eax, eax
je 0x510329
cmp eax, 0x7fffffff
jae 0x510329
cmp dword [eax + edi], 0x4550
jne 0x510329
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x510329
cmp dword [edx + 4], 0
je 0x510329
push 0
add eax, edi
mov ecx, edi
push str.SymSetOptions
push eax
call fcn.00525800
jmp 0x51032b
xor eax, eax
mov dword [0x633828], eax
cmp word [edi], bx
jne 0x510375
mov eax, dword [esi]
test eax, eax
je 0x510375
jmp 0x510340
cmp eax, 0x7fffffff
jae 0x510375
cmp dword [eax + edi], 0x4550
jne 0x510375
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x510375
cmp dword [edx + 4], 0
je 0x510375
push 0
add eax, edi
mov ecx, edi
push str.SymSetSearchPathW
push eax
call fcn.00525800
jmp 0x510377
xor eax, eax
mov dword [0x633848], eax
lea esp, [esp]
cmp word [edi], bx
jne 0x5103c2
mov eax, dword [esi]
test eax, eax
je 0x5103c2
cmp eax, 0x7fffffff
jae 0x5103c2
cmp dword [eax + edi], 0x4550
jne 0x5103c2
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x5103c2
cmp dword [edx + 4], 0
je 0x5103c2
push 0
add eax, edi
mov ecx, edi
push str.SymFunctionTableAccess64
push eax
call fcn.00525800
mov edi, edi
jmp 0x5103c4
xor eax, eax
mov dword [0x633840], eax
cmp word [edi], bx
jne 0x510409
mov eax, dword [esi]
test eax, eax
je 0x510409
cmp eax, 0x7fffffff
jae 0x510409
cmp dword [eax + edi], 0x4550
jne 0x510409
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x510409
cmp dword [edx + 4], 0
je 0x510409
push 0
add eax, edi
mov ecx, edi
push str.SymGetModuleBase64
push eax
call fcn.00525800
jmp 0x51040b
xor eax, eax
mov dword [0x63380c], eax
cmp word [edi], bx
jne 0x510455
mov eax, dword [esi]
test eax, eax
je 0x510455
jmp 0x510420
cmp eax, 0x7fffffff
jae 0x510455
cmp dword [eax + edi], 0x4550
jne 0x510455
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x510455
cmp dword [edx + 4], 0
je 0x510455
push 0
add eax, edi
mov ecx, edi
push str.SymRegisterCallbackW64
push eax
call fcn.00525800
jmp 0x510457
xor eax, eax
mov dword [0x633824], eax
lea esp, [esp]
cmp word [edi], bx
jne 0x5104a2
mov eax, dword [esi]
test eax, eax
je 0x5104a2
cmp eax, 0x7fffffff
jae 0x5104a2
cmp dword [eax + edi], 0x4550
jne 0x5104a2
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x5104a2
cmp dword [edx + 4], 0
je 0x5104a2
push 0
add eax, edi
mov ecx, edi
push str.StackWalk64
push eax
call fcn.00525800
mov edi, edi
jmp 0x5104a4
xor eax, eax
mov dword [0x63382c], eax
cmp word [edi], bx
jne 0x5104ed
mov eax, dword [esi]
test eax, eax
je 0x5104ed
cmp eax, 0x7fffffff
jae 0x5104ed
cmp dword [eax + edi], 0x4550
jne 0x5104ed
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x5104ed
cmp dword [edx + 4], 0
je 0x5104ed
push 0
add eax, edi
mov ecx, edi
push str.StackWalkEx
push eax
call fcn.00525800
jmp 0x5104ef
xor eax, eax
mov dword [0x633834], eax
cmp word [edi], bx
jne 0x51053d
mov eax, dword ds:[esi]
test eax, eax
je 0x51053d
cmp eax, 0x7fffffff
jae 0x51053d
cmp dword [eax + edi], 0x4550
jne 0x51053d
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x51053d
cmp dword [edx + 4], 0
je 0x51053d
push 0
add eax, edi
mov ecx, edi
push str.SymFromInlineContextW
push eax
call fcn.00525800
jmp 0x51053f
xor eax, eax
mov dword [0x633820], eax
cmp word [edi], bx
jne 0x51058c
mov eax, dword [esi]
test eax, eax
je 0x51058c
cmp eax, 0x7fffffff
jae 0x51058c
cmp dword [eax + edi], 0x4550
jne 0x51058c
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x51058c
cmp dword [edx + 4], 0
je 0x51058c
push 0
add eax, edi
mov ecx, edi
push str.SymGetLineFromInlineContextW
push eax
call fcn.00525800
jmp 0x51058e
xor eax, eax
mov dword [0x63383c], eax
cmp word [edi], bx
jne 0x5105e2
mov eax, dword ds:[esi]
test eax, eax
je 0x5105e2
cmp eax, 0x7fffffff
jae 0x5105e2
cmp dword [eax + edi], 0x4550
jne 0x5105e2
lea edx, [eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x5105e2
cmp dword [edx + 4], 0
je 0x5105e2
push 0
add eax, edi
mov ecx, edi
push str.MiniDumpWriteDump
push eax
call fcn.00525800
nop
jmp 0x5105e4
xor eax, eax
mov dword [0x633830], eax
cmp word [edi], bx
jne 0x51063b
mov eax, dword [esi]
test eax, eax
je 0x51063b
lea esp, [esp]
cmp eax, 0x7fffffff
jae 0x51063b
cmp dword [eax + edi], 0x4550
jne 0x51063b
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x51063b
cmp dword [edx + 4], 0
je 0x51063b
push 0
add eax, edi
mov ecx, edi
push str.UnDecorateSymbolNameW
push eax
call fcn.00525800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret