Function at 0x40e7fc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 0x1c], 0
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x20], edx
push edi
test esi, esi
je 0x40e888
cmp esi, dword [0x44f75c]
je 0x40e888
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x40e888
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
jne 0x40e888
mov eax, dword [ecx + esi + 0x80]
mov ecx, dword [ecx + esi + 0x84]
add eax, esi
add ecx, eax
mov dword [ebp - 0x28], ecx
test eax, eax
je 0x40e888
cmp eax, ecx
je 0x40ea03
lea ecx, [eax + 0xc]
mov dword [ebp - 8], ecx
cmp dword [ecx - 8], 0
jne 0x40e86a
cmp dword [ecx], 0
je 0x40ea03
mov edx, dword [ecx]
mov edi, dword [ecx - 0xc]
mov ebx, dword [ecx + 4]
lea eax, [esi + edx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0xc], edx
test edi, edi
jne 0x40e88f
mov edi, ebx
test ebx, ebx
jne 0x40e893
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp edi, ebx
jne 0x40e89a
mov dword [ebp - 0x10], 1
add ebx, esi
add edi, esi
je 0x40e9ee
cmp dword [edi], 0
je 0x40e9eb
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 0
je 0x40e9df
lea edx, [eax + 4]
mov dword [ebp - 4], edx
mov eax, dword [edx + 4]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx]
mov dword [ebp - 0x24], ecx
test eax, eax
je 0x40e8f8
cmp dword [ebp - 0xc], 0
je 0x40e8f8
push dword [ebp - 0xc]
push eax
call dword [0x447ad0]
mov edx, dword [ebp - 4]
pop ecx
pop ecx
test eax, eax
jne 0x40e9cf
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x40e975
cmp dword [ebp - 0x10], 0
je 0x40e934
cmp dword [edx], 0
je 0x40e9cf
push dword [edx]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x40e9cc
mov ecx, dword [ebp - 4]
push dword [ecx - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e9cc
cmp dword [ebx], eax
jmp 0x40e973
mov eax, dword [edi]
test eax, eax
jns 0x40e947
movzx eax, ax
cmp ecx, eax
jne 0x40e9cf
jmp 0x40e975
add eax, 2
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40e96c
test dl, dl
je 0x40e968
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40e96c
add ecx, 2
add eax, 2
test dl, dl
jne 0x40e94c
xor eax, eax
jmp 0x40e971
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40e9cc
push 0x451c18
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.0040e7bd
test eax, eax
jne 0x40e9c1
push dword [ebp - 0x18]
xor edx, edx
mov ecx, ebx
push dword [ebp - 0x14]
call fcn.0040e72c
pop ecx
pop ecx
test eax, eax
je 0x40e9c1
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x64], ecx
inc edx
or dword [eax + 0x68], edx
lea ecx, [ebp - 0x2c]
push ecx
push 0x20
push 0x6c
push eax
mov dword [ebp - 0x1c], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x451c18
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 4]
add edx, 0x10
mov dword [ebp - 4], edx
cmp dword [edx + 4], 0
jne 0x40e8c0
add ebx, 4
add edi, 4
jne 0x40e8a4
mov ecx, dword [ebp - 8]
add ecx, 0x14
mov dword [ebp - 8], ecx
add ecx, 0xfffffff4
cmp ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
jne 0x40e85b
mov eax, dword [ebp - 0x1c]
jmp 0x40e88a