Function at 0x401b20
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
cmp word [esi], 0x5a4d
je 0x401b3c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
mov ebp, dword [esi + 0x3c]
mov cl, 0x73
mov byte [esp + 0x28], cl
mov byte [esp + 0x29], cl
add ebp, esi
mov al, 0x65
mov bl, 0x48
mov dl, 0x61
mov cl, 0x70
mov byte [esp + 0x20], 0x47
mov byte [esp + 0x21], al
mov byte [esp + 0x22], 0x74
mov byte [esp + 0x23], 0x50
mov byte [esp + 0x24], 0x72
mov byte [esp + 0x25], 0x6f
mov byte [esp + 0x26], 0x63
mov byte [esp + 0x27], al
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], dl
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2e], 0
cmp dword [ebp], 0x4550
je 0x401ba1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
mov byte [esp + 0x15], al
mov al, 0x6c
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], al
mov eax, dword [0x41658c]
push str.VirtualAlloc
push eax
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], 0x41
mov byte [esp + 0x23], 0x6f
mov byte [esp + 0x24], 0x63
mov byte [esp + 0x25], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp + 0x50]
mov edx, dword [ebp + 0x34]
push 4
push 0x2000
push ecx
mov edi, eax
push edx
call edi
mov ebx, eax
test ebx, ebx
jne 0x401c15
mov eax, dword [ebp + 0x50]
push 4
push 0x2000
push eax
push ebx
call edi
mov ebx, eax
test ebx, ebx
jne 0x401c15
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov edx, dword [0x41658c]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x41658c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x14
push 0
call eax
push eax
call dword [esp + 0x1c]
xor ecx, ecx
mov dword [eax + 4], ebx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ecx
mov edx, dword [ebp + 0x50]
push 4
push 0x1000
push edx
push ebx
mov dword [esp + 0x20], eax
call edi
mov eax, dword [ebp + 0x54]
push 4
push 0x1000
push eax
push ebx
call edi
mov ecx, dword [esi + 0x3c]
mov edi, dword [ebp + 0x54]
add ecx, edi
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x10]
push esi
push ebp
mov edx, dword [ecx + 0x3c]
push ecx
add eax, edx
mov dword [esi], eax
mov dword [eax + 0x34], ebx
call fcn.00401d40
mov ecx, dword [ebp + 0x34]
mov eax, ebx
add esp, 0xc
sub eax, ecx
je 0x401cbe
push eax
push esi
call fcn.00402000
add esp, 8
push esi
call fcn.00402080
add esp, 4
test eax, eax
je 0x401d0f
push esi
call fcn.00401f30
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x64
call ebp
mov eax, dword [esi]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x401d29
push 0x64
call ebp
mov ecx, dword [esi]
push 0x64
mov edi, dword [ecx + 0x28]
add edi, ebx
call ebp
test edi, edi
je 0x401d0f
push 0x64
call ebp
push 0
push 1
push ebx
call edi
push 0x64
mov edi, eax
call ebp
test edi, edi
jne 0x401d22
push esi
call fcn.00402320
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov dword [esi + 0x10], 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret