Function at 0x535eb6
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
or eax, 0xffffffff
xor esi, esi
mov dword [0x610120], ebx
mov dword [0x61011c], ebx
mov dword [0x610114], 0x60fd20
mov dword [0x610110], 0x60f550
mov word [0x60fd20], bx
inc edi
mov dword [0x610118], eax
movsx ecx, word [esi*2 + 0x603c58]
cmp ecx, ebx
jne 0x535e7c
cmp eax, ebx
jge 0x535dc7
mov ecx, dword [0x610128]
call fcn.0047d6bd
cmp eax, ebx
mov dword [0x610118], eax
jge 0x535dc7
xor eax, eax
mov dword [0x610118], eax
movsx ecx, word [esi*2 + 0x604108]
cmp ecx, ebx
je 0x535e40
add ecx, eax
js 0x535e40
cmp ecx, 0xd88
jg 0x535e40
add ecx, ecx
movsx edx, word [ecx + 0x606498]
cmp edx, eax
jne 0x535e40
mov eax, dword [0x610114]
cmp eax, 0x610106
jae 0x536baa
movsx esi, word [ecx + 0x604980]
inc eax
inc eax
mov dword [0x610114], eax
mov word [eax], si
add dword [0x610110], 4
mov eax, dword [0x610108]
mov ecx, dword [0x610110]
mov dword [ecx], eax
or eax, 0xffffffff
cmp dword [0x61011c], ebx
mov dword [0x610118], eax
jle 0x535d98
dec dword [0x61011c]
jmp 0x535d98
movsx ecx, word [esi*2 + 0x6044d0]
cmp ecx, ebx
je 0x536ae3
add ecx, eax
js 0x536ae3
cmp ecx, 0xd88
jg 0x536ae3
add ecx, ecx
movsx edx, word [ecx + 0x606498]
cmp edx, eax
jne 0x536ae3
movsx ecx, word [ecx + 0x604980]
mov edx, dword [0x610110]
lea eax, [ecx + ecx]
movsx esi, word [eax + 0x603a08]
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 2
sub edx, eax
mov dword [ebp - 4], eax
mov eax, dword [edx + 4]
mov dword [0x61010c], eax
lea eax, [ecx - 1]
cmp eax, 0x124
ja case.default.0x535eaf
jmp dword [eax*4 + 0x536bc3]
push ebx
push ebx
jmp 0x5369fd
push edi
push edi
jmp 0x5369fd
push edi
push 2
jmp 0x5369fd
push 2
push 3
jmp 0x5369fd
push ebx
push 4
jmp 0x5369fd
push edi
push 5
jmp 0x5369fd
push edi
push 6
jmp 0x5369fd
push edi
push 7
jmp 0x5369fd
push edi
push 8
jmp 0x5369fd
push edi
push 9
jmp 0x5369fd
push edi
push 0xa
jmp 0x5369fd
push 2
push 0xb
jmp 0x5369fd
push ebx
push 0xc
jmp 0x5369fd
push ebx
push 0xd
jmp 0x5369fd
push ebx
push 0xe
jmp 0x5369fd
push ebx
push 0xf
jmp 0x5369fd
push ebx
push 0x10
jmp 0x5369fd
push ebx
push 0x11
jmp 0x5369fd
push edi
push 0x12
jmp 0x5369fd
push edi
push 0x13
jmp 0x5369fd
push edi
push 0x14
jmp 0x5369fd
push 2
push 0x15
jmp 0x5369fd
push ebx
push 0x16
jmp 0x5369fd
push ebx
push 0x17
jmp 0x5369fd
push ebx
push 0x18
jmp 0x5369fd
push edi
push 0x19
jmp 0x5369fd
push 2
push 0x1a
jmp 0x5369fd
push edi
push 0x1d
jmp 0x5369fd
push 2
push 0x1e
jmp 0x5369fd
push 2
push 0x1f
jmp 0x5369fd
push 2
push 0x20
jmp 0x5369fd
push edi
push 0x21
jmp 0x5369fd
push edi
push 0x22
jmp 0x5369fd
push 2
push 0x23
jmp 0x5369fd
push edi
push 0x24
jmp 0x5369fd
push edi
push 0x25
jmp 0x5369fd
push edi
push 0x26
jmp 0x5369fd
push edi
push 0x27
jmp 0x5369fd
push edi
push 0x28
jmp 0x5369fd
push 2
push 0x29
jmp 0x5369fd
push edi
push 0x2a
jmp 0x5369fd
push 2
push 0x2b
jmp 0x5369fd
push ebx
push 0x2c
jmp 0x5369fd
push edi
push 0x2d
jmp 0x5369fd
push edi
push 0x2e
jmp 0x5369fd
push edi
push 0x2f
jmp 0x5369fd
push edi
push 0x30
jmp 0x5369fd
push ebx
push 0x31
jmp 0x5369fd
push ebx
push 0x32
jmp 0x5369fd
push ebx
push 0x33
jmp 0x5369fd
push ebx
push 0x34
jmp 0x5369fd
push ebx
push 0x35
jmp 0x5369fd
push ebx
push 0x36
jmp 0x5369fd
push 2
push 0x37
jmp 0x5369fd
push ebx
push 0x38
jmp 0x5369fd
push 3
push 0x39
jmp 0x5369fd
push ebx
push 0x3a
jmp 0x5369fd
push ebx
push 0x3b
jmp 0x5369fd
push ebx
push 0x3c
jmp 0x5369fd
push ebx
push 0x3d
jmp 0x5369fd
push ebx
push 0x3e
jmp 0x5369fd
push ebx
push 0x3f
jmp 0x5369fd
push ebx
push 0x40
jmp 0x5369fd
push ebx
push 0x41
jmp 0x5369fd
push ebx
push 0x42
jmp 0x5369fd
push ebx
push 0x43
jmp 0x5369fd
push ebx
push 0x44
jmp 0x5369fd
push ebx
push 0x45
jmp 0x5369fd
push ebx
push 0x46
jmp 0x5369fd
push ebx
push 0x47
jmp 0x5369fd
push ebx
push 0x48
jmp 0x5369fd
push ebx
push 0x49
jmp 0x5369fd
push 2
push 0x4a
jmp 0x5369fd
push 3
push 0x4b
jmp 0x5369fd
push 3
push 0x4c
jmp 0x5369fd
push 4
push 0x4d
jmp 0x5369fd
push edi
push 0x4e
jmp 0x5369fd
push 2
push 0x4f
jmp 0x5369fd
push ebx
push 0x50
jmp 0x5369fd
push edi
push 0x51
jmp 0x5369fd
push 2
push 0x52
jmp 0x5369fd
push ebx
push 0x53
jmp 0x5369fd
push edi
push 0x54
jmp 0x5369fd
push edi
push 0x55
jmp 0x5369fd
push edi
push 0x56
jmp 0x5369fd
push 2
push 0x57
jmp 0x5369fd
push ebx
push 0x58
jmp 0x5369fd
push edi
push 0x59
jmp 0x5369fd
push edi
push 0x5a
jmp 0x5369fd
push 2
push 0x5b
jmp 0x5369fd
push 2
push 0x5c
jmp 0x5369fd
push 3
push 0x5d
jmp 0x5369fd
push ebx
push 0x5e
jmp 0x5369fd
push edi
push 0x5f
jmp 0x5369fd
push ebx
push 0x60
jmp 0x5369fd
push edi
push 0x61
jmp 0x5369fd
push 2
push 0x62
jmp 0x5369fd
push ebx
push 0x63
jmp 0x5369fd
push edi
push 0x64
jmp 0x5369fd
push edi
push 0x65
jmp 0x5369fd
push edi
push 0x66
jmp 0x5369fd
push ebx
push 0x67
jmp 0x5369fd
push edi
push 0x68
jmp 0x5369fd
push 2
push 0x69
jmp 0x5369fd
push 2
push 0x6a
jmp 0x5369fd
push edi
push 0x6b
jmp 0x5369fd
push 2
push 0x6c
jmp 0x5369fd
push 4
push 0x6d
jmp 0x5369fd
push edi
push 0x6e
jmp 0x5369fd
push edi
push 0x6f
jmp 0x5369fd
push 2
push 0x70
jmp 0x5369fd
push edi
push 0x71
jmp 0x5369fd
push 3
push 0x72
jmp 0x5369fd
push 4
push 0x73
jmp 0x5369fd
push 2
push 0x74
jmp 0x5369fd
push 2
push 0x75
jmp 0x5369fd
push 3
push 0x76
jmp 0x5369fd
push ebx
push 0x77
jmp 0x5369fd
push ebx
push 0x78
jmp 0x5369fd
push edi
push 0x79
jmp 0x5369fd
push 2
push 0x7a
jmp 0x5369fd
push 2
push 0x7b
jmp 0x5369fd
push edi
push 0x7c
jmp 0x5369fd
push 2
push 0x7d
jmp 0x5369fd
push edi
push 0x80
jmp 0x5369fd
push 2
push 0x81
jmp 0x5369fd
push ebx
push 0x82
jmp 0x5369fd
push ebx
push 0x83
jmp 0x5369fd
push ebx
push 0x84
jmp 0x5369fd
push ebx
push 0x85
jmp 0x5369fd
push edi
push 0x86
jmp 0x5369fd
push 3
push 0x87
jmp 0x5369fd
push 2
push 0x88
jmp 0x5369fd
push 3
push 0x89
jmp 0x5369fd
push ebx
push 0x8a
jmp 0x5369fd
push ebx
push 0x8b
jmp 0x5369fd
push edi
push 0x8c
jmp 0x5369fd
push 2
push 0x8d
jmp 0x5369fd
push 3
push 0x8e
jmp 0x5369fd
push 2
push 0x8f
jmp 0x5369fd
push 3
push 0x90
jmp 0x5369fd
push ebx
push 0x91
jmp 0x5369fd
push ebx
push 0x92
jmp 0x5369fd
push edi
push 0x93
jmp 0x5369fd
push 2
push 0x94
jmp 0x5369fd
push 5
push 0x95
jmp 0x5369fd
push ebx
push 0x96
jmp 0x5369fd
push edi
push 0x97
jmp 0x5369fd
push ebx
push 0x98
jmp 0x5369fd
push ebx
push 0x99
jmp 0x5369fd
push 2
push 0x9a
jmp 0x5369fd
push 3
push 0x9b
jmp 0x5369fd
push ebx
push 0x9c
jmp 0x5369fd
push ebx
push 0x9d
jmp 0x5369fd
push edi
push 0x9e
jmp 0x5369fd
push 2
push 0x9f
jmp 0x5369fd
push ebx
push 0xa0
jmp 0x5369fd
push edi
push 0xa1
jmp 0x5369fd
push ebx
push 0xa2
jmp 0x5369fd
push edi
push 0xa3
jmp 0x5369fd
push 2
push 0xa4
jmp 0x5369fd
push edi
push 0xa5
jmp 0x5369fd
push ebx
push 0xa6
jmp 0x5369fd
push edi
push 0xa7
jmp 0x5369fd
push edi
push 0xa8
jmp 0x5369fd
push edi
push 0xa9
jmp 0x5369fd
push edi
push 0xaa
jmp 0x5369fd
push 2
push 0xab
jmp 0x5369fd
push 5
push 0xac
jmp 0x5369fd
push edi
push 0xad
jmp 0x5369fd
push 2
push 0xae
jmp 0x5369fd
push 5
push 0xaf
jmp 0x5369fd
push 2
push 0xb0
jmp 0x5369fd
push 3
push 0xb1
jmp 0x5369fd
push ebx
push 0xb2
jmp 0x5369fd
push ebx
push 0xb3
jmp 0x5369fd
push edi
push 0xb4
jmp 0x5369fd
push edi
push 0xb5
jmp 0x5369fd
push ebx
push 0xb6
jmp 0x5369fd
push edi
push 0xb7
jmp 0x5369fd
push ebx
push 0xb8
jmp 0x5369fd
push edi
push 0xb9
jmp 0x5369fd
push edi
push 0xba
jmp 0x5369fd
push 2
push 0xbb
jmp 0x5369fd
push edi
push 0xbc
jmp 0x5369fd
push edi
push 0xbd
jmp 0x5369fd
push edi
push 0xbe
jmp 0x5369fd
push edi
push 0xbf
jmp 0x5369fd
push edi
push 0xc0
jmp 0x5369fd
push ebx
push 0xc1
jmp 0x5369fd
push ebx
push 0xc2
jmp 0x5369fd
push edi
push 0xc3
jmp 0x5369fd
push edi
push 0xc4
jmp 0x5369fd
push edi
push 0xc5
jmp 0x5369fd
push edi
push 0xc6
jmp 0x5369fd
push edi
push 0xc7
jmp 0x5369fd
push 2
push 0xc8
jmp 0x5369fd
push 2
push 0xc9
jmp 0x5369fd
push 2
push 0xca
jmp 0x5369fd
push edi
push 0xcb
jmp 0x5369fd
push edi
push 0xcc
jmp 0x5369fd
push 2
push 0xcd
jmp 0x5369fd
push edi
push 0xce
jmp 0x5369fd
push edi
push 0xcf
jmp 0x5369fd
push 3
push 0xd0
jmp 0x5369fd
push edi
push 0xd1
jmp 0x5369fd
push 3
push 0xd2
jmp 0x5369fd
push edi
push 0xd3
jmp 0x5369fd
push edi
push 0xd4
jmp 0x5369fd
push edi
push 0xd5
jmp 0x5369fd
push edi
push 0xd6
jmp 0x5369fd
push 2
push 0xd7
jmp 0x5369fd
push 2
push 0xd8
jmp 0x5369fd
push edi
push 0xd9
jmp 0x5369fd
push edi
push 0xda
jmp 0x5369fd
push edi
push 0xdb
jmp 0x5369fd
push edi
push 0xdc
jmp 0x5369fd
push edi
push 0xdd
jmp 0x5369fd
push edi
push 0xde
jmp 0x5369fd
push edi
push 0xdf
jmp 0x5369fd
push edi
push pe_nt_image_headers32
jmp 0x5369fd
push edi
push 0xe1
jmp 0x5369fd
push 2
push 0xe2
jmp 0x5369fd
push edi
push 0xe3
jmp 0x5369fd
push 2
push 0xe4
jmp 0x5369fd
push 2
push 0xe5
jmp 0x5369fd
push 2
push 0xe6
jmp 0x5369fd
push edi
push 0xe7
jmp 0x5369fd
push 2
push 0xe8
jmp 0x5369fd
push 2
push 0xe9
jmp 0x5369fd
push edi
push 0xea
jmp 0x5369fd
push 2
push 0xeb
jmp 0x5369fd
push 2
push 0xec
jmp 0x5369fd
push 2
push 0xed
jmp 0x5369fd
push 2
push 0xee
jmp 0x5369fd
push edi
push 0xef
jmp 0x5369fd
push 2
push 0xf0
jmp 0x5369fd
push 2
push 0xf1
jmp 0x5369fd
push edi
push 0xf2
jmp 0x5369fd
push 2
push 0xf3
jmp 0x5369fd
push edi
push 0xf4
jmp 0x5369fd
push 2
push 0xf5
jmp 0x5369fd
push edi
push 0xfd
jmp 0x5369fd
push 3
push 0xfe
jmp 0x5369fd
push edi
push 0xf6
jmp 0x5369fd
push 2
push 0xf7
jmp 0x5369fd
push 2
push 0xf8
jmp 0x5369fd
push 2
push 0xf9
jmp 0x5369fd
push 2
push 0xfa
jmp 0x5369fd
push 2
push 0xfb
jmp 0x5369fd
push 2
push 0xfc
jmp 0x5369fd
push edi
push 0xff
jmp 0x5369fd
push 2
push 0x100
jmp 0x5369fd
push ebx
push 0x101
jmp 0x5369fd
push edi
push 0x102
jmp 0x5369fd
push edi
push 0x103
jmp 0x5369fd
push edi
push 0x104
jmp 0x5369fd
push edi
push 0x105
jmp 0x5369fd
push edi
push 0x106
jmp 0x5369fd
push 2
push 0x107
jmp 0x5369fd
push edi
push 0x108
jmp 0x5369fd
push edi
push 0x109
jmp 0x5369fd
push 2
push 0x10a
jmp 0x5369fd
push edi
push 0x10b
jmp 0x5369fd
push edi
push 0x10c
jmp 0x5369fd
push edi
push 0x10d
jmp 0x5369fd
push edi
push 0x10e
jmp 0x5369fd
push edi
push 0x10f
jmp 0x5369fd
push 2
push 0x110
jmp 0x5369fd
push edi
push 0x111
jmp 0x5369fd
push ebx
push 0x112
jmp 0x5369fd
push ebx
push 0x113
jmp 0x5369fd
push ebx
push 0x114
jmp 0x5369fd
push edi
push 0x115
jmp 0x5369fd
push edi
push 0x116
jmp 0x5369fd
push ebx
push 0x117
jmp 0x5369fd
push edi
push 0x118
jmp 0x5369fd
push edi
push 0x119
jmp 0x5369fd
push ebx
push 0x11a
jmp 0x5369fd
push ebx
push 0x11b
jmp 0x5369fd
push ebx
push 0x11c
jmp 0x5369fd
push ebx
push 0x11d
jmp 0x5369fd
push ebx
push 0x11e
jmp 0x5369fd
push ebx
push 0x11f
jmp 0x5369fd
push ebx
push 0x120
jmp 0x5369fd
push edi
push 0x121
jmp 0x5369fd
push 2
push 0x122
jmp 0x5369fd
push ebx
push 0x123
jmp 0x5369fd
push ebx
push 0x124
jmp 0x5369fd
push ebx
push 0x125
jmp 0x5369fd
push ebx
push 0x126
jmp 0x5369fd
push ebx
push 0x127
jmp 0x5369fd
push ebx
push 0x128
mov ecx, dword [0x610128]
call fcn.0047d6bd
mov eax, dword [0x610114]
mov ecx, dword [ebp - 4]
neg esi
lea eax, [eax + esi*2]
mov dword [0x610114], eax
movsx edx, word [eax]
sub dword [0x610110], ecx
cmp edx, ebx
mov ecx, dword [ebp - 8]
movsx ecx, word [ecx + 0x6037b8]
jne 0x536a89
cmp ecx, ebx
jne 0x536a89
inc eax
inc eax
push 0x28
mov dword [0x610114], eax
pop esi
mov word [eax], si
add dword [0x610110], 4
mov eax, dword [0x61010c]
mov ecx, dword [0x610110]
mov dword [ecx], eax
mov eax, dword [0x610118]
cmp eax, ebx
jge 0x536a7c
mov ecx, dword [0x610128]
call fcn.0047d6bd
cmp eax, ebx
mov dword [0x610118], eax
jge 0x536a7c
xor eax, eax
mov dword [0x610118], eax
cmp eax, ebx
jne 0x535d98
xor eax, eax
jmp 0x536bbe
lea esi, [ecx + ecx]
movsx ecx, word [esi + 0x604898]
cmp ecx, ebx
je 0x536abd
add ecx, edx
js 0x536abd
cmp ecx, 0xd88
jg 0x536abd
add ecx, ecx
movsx ebx, word [ecx + 0x606498]
cmp ebx, edx
jne 0x536abb
movsx esi, word [ecx + 0x604980]
xor ebx, ebx
jmp 0x536ac4
xor ebx, ebx
movsx esi, word [esi + 0x604020]
cmp eax, 0x610106
jae 0x536baa
inc eax
inc eax
mov dword [0x610114], eax
mov word [eax], si
mov eax, dword [0x61010c]
jmp 0x536b85
cmp dword [0x61011c], ebx
jne 0x536b08
push 0x40b1a8
push dword [0x610128]
call fcn.0047d6bd
inc dword [0x610120]
mov eax, dword [0x610118]
pop ecx
pop ecx
push 3
pop ecx
cmp dword [0x61011c], ecx
jge 0x536b9e
mov dword [0x61011c], ecx
mov ecx, dword [0x610114]
mov edx, 0x100
movsx eax, word [ecx]
movsx eax, word [eax*2 + 0x604108]
cmp eax, ebx
je 0x536b4c
add eax, edx
js 0x536b4c
cmp eax, 0xd88
jg 0x536b4c
cmp word [eax*2 + 0x606498], dx
je 0x536b65
cmp ecx, 0x60fd20
jbe 0x536bbc
dec ecx
dec ecx
sub dword [0x610110], 4
mov dword [0x610114], ecx
jmp 0x536b28
cmp ecx, 0x610106
jae 0x536baa
movsx esi, word [eax*2 + 0x604980]
inc ecx
inc ecx
mov dword [0x610114], ecx
mov word [ecx], si
mov eax, dword [0x610108]
add dword [0x610110], 4
mov ecx, dword [0x610110]
mov dword [ecx], eax
mov eax, dword [0x610118]
jmp 0x535d98
cmp eax, ebx
je 0x536bbc
or eax, 0xffffffff
jmp 0x535d93
push 0x40b1b8
push dword [0x610128]
call fcn.0047d6bd
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret