Function at 0x401380
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x458
push ebx
push ebp
push esi
push edi
call fcn.004019e0
test eax, eax
jne 0x40139e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x458
ret
push 0
push 2
call dword [0x4087a4]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4013bc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x458
ret
mov ecx, 0x4a
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x128
push eax
push ebx
call dword [0x4087a0]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x368], 0
push ecx
push ebx
call dword [0x40879c]
test eax, eax
je 0x40143c
mov edx, dword [esp + 0x46c]
mov eax, dword [esp + 0x24]
cmp eax, edx
jne 0x40142c
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x368]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push ebx
call dword [0x40879c]
test eax, eax
jne 0x4013f5
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call ebp
mov al, byte [esp + 0x368]
test al, al
jne 0x40145d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x458
ret
mov edx, dword [esp + 0x46c]
push edx
push 8
call dword [0x4087a4]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401481
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x458
ret
mov ecx, 0x89
xor eax, eax
lea edi, [esp + 0x144]
rep stosd dword es:[edi], eax
mov ebx, eax
lea ecx, [esp + 0x144]
mov edi, eax
push ecx
push esi
mov dword [esp + 0x14c], 0x224
mov dword [esp + 0x20], eax
call dword [0x408798]
lea edx, [esp + 0x368]
lea eax, [esp + 0x264]
push edx
push eax
call fcn.00405c60
add esp, 8
test eax, eax
jne 0x4014dd
mov ebx, dword [esp + 0x158]
mov edi, dword [esp + 0x15c]
lea ecx, [esp + 0x144]
push ecx
push esi
call dword [0x408794]
test eax, eax
je 0x40152d
lea edx, [esp + 0x368]
lea eax, [esp + 0x264]
push edx
push eax
call fcn.00405c60
add esp, 8
test eax, eax
jne 0x40151a
mov ebx, dword [esp + 0x158]
mov edi, dword [esp + 0x15c]
lea ecx, [esp + 0x144]
push ecx
push esi
call dword [0x408794]
test eax, eax
jne 0x4014f0
push esi
call ebp
test ebx, ebx
jne 0x401541
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x458
ret
cmp edi, 0x2000
jb 0x40154e
mov edi, 0x2000
mov edx, dword [esp + 0x46c]
push edx
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
jne 0x401571
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x458
ret
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x40158b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x458
ret
push 0x408674
push edi
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x4015b2
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x458
ret
cmp word [esi], 0x5a4d
je 0x4015cd
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x458
ret
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
je 0x4015ed
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x458
ret
mov edi, dword [eax + esi + 0x28]
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x458
ret