Function at 0x414920
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x184
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x54], 0xf04f385e
mov eax, dword [ebp - 0x54]
mov ecx, eax
sub ecx, 0x82afa701
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
jg 0x4149b2
jmp 0x41499c
mov eax, dword [ebp - 0x58]
sub eax, 0x800e5a00
mov dword [ebp - 0x60], eax
je 0x4153dc
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x8a67cea3
mov dword [ebp - 0x64], eax
jg 0x4149de
jmp 0x4149c8
mov eax, dword [ebp - 0x58]
sub eax, 0x82afa702
mov dword [ebp - 0x68], eax
je 0x4152a6
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x9040d264
mov dword [ebp - 0x6c], eax
jg 0x414a0a
jmp 0x4149f4
mov eax, dword [ebp - 0x58]
sub eax, 0x8a67cea4
mov dword [ebp - 0x70], eax
je 0x41542a
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x9975bf89
mov dword [ebp - 0x74], eax
jg 0x414a36
jmp 0x414a20
mov eax, dword [ebp - 0x58]
sub eax, 0x9040d265
mov dword [ebp - 0x78], eax
je 0x4153fd
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0xa33d1eee
mov dword [ebp - 0x7c], eax
jg 0x414a62
jmp 0x414a4c
mov eax, dword [ebp - 0x58]
sub eax, 0x9975bf8a
mov dword [ebp - 0x80], eax
je 0x4153d0
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0xacf89c85
mov dword [ebp - 0x84], eax
jg 0x414a94
jmp 0x414a7b
mov eax, dword [ebp - 0x58]
sub eax, 0xa33d1eef
mov dword [ebp - 0x88], eax
je 0x41528b
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0xbc686dc4
mov dword [ebp - 0x8c], eax
jg 0x414ac6
jmp 0x414aad
mov eax, dword [ebp - 0x58]
sub eax, 0xacf89c86
mov dword [ebp - 0x90], eax
je 0x415443
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0xbf126a8b
mov dword [ebp - 0x94], eax
jg 0x414af8
jmp 0x414adf
mov eax, dword [ebp - 0x58]
sub eax, 0xbc686dc5
mov dword [ebp - 0x98], eax
je 0x4153b6
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0xc72ef5cb
mov dword [ebp - 0x9c], eax
jg 0x414b2a
jmp 0x414b11
mov eax, dword [ebp - 0x58]
sub eax, 0xbf126a8c
mov dword [ebp - 0xa0], eax
je 0x4152f8
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0xc96be676
mov dword [ebp - 0xa4], eax
jg 0x414b5c
jmp 0x414b43
mov eax, dword [ebp - 0x58]
sub eax, 0xc72ef5cc
mov dword [ebp - 0xa8], eax
je 0x4152e5
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0xe946f737
mov dword [ebp - 0xac], eax
jg 0x414b8e
jmp 0x414b75
mov eax, dword [ebp - 0x58]
sub eax, 0xc96be677
mov dword [ebp - 0xb0], eax
je 0x415388
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0xedb5cc1d
mov dword [ebp - 0xb4], eax
jg 0x414bc0
jmp 0x414ba7
mov eax, dword [ebp - 0x58]
sub eax, 0xe946f738
mov dword [ebp - 0xb8], eax
je 0x41541e
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0xf04f385d
mov dword [ebp - 0xbc], eax
jg 0x414bf2
jmp 0x414bd9
mov eax, dword [ebp - 0x58]
sub eax, 0xedb5cc1e
mov dword [ebp - 0xc0], eax
je 0x41510e
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0xf75c8e22
mov dword [ebp - 0xc4], eax
jg 0x414c24
jmp 0x414c0b
mov eax, dword [ebp - 0x58]
sub eax, 0xf04f385e
mov dword [ebp - 0xc8], eax
je 0x41505c
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0xfd6faf62
mov dword [ebp - 0xcc], eax
jg 0x414c56
jmp 0x414c3d
mov eax, dword [ebp - 0x58]
sub eax, 0xf75c8e23
mov dword [ebp - 0xd0], eax
je 0x4151b8
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x8951f
mov dword [ebp - 0xd4], eax
jg 0x414c88
jmp 0x414c6f
mov eax, dword [ebp - 0x58]
sub eax, 0xfd6faf63
mov dword [ebp - 0xd8], eax
je 0x415362
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x640e6a0
mov dword [ebp - 0xdc], eax
jg 0x414cba
jmp 0x414ca1
mov eax, dword [ebp - 0x58]
sub eax, 0x89520
mov dword [ebp - 0xe0], eax
je 0x415375
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x1350dbbb
mov dword [ebp - 0xe4], eax
jg 0x414cec
jmp 0x414cd3
mov eax, dword [ebp - 0x58]
sub eax, 0x640e6a1
mov dword [ebp - 0xe8], eax
je 0x4153c3
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x140dacac
mov dword [ebp - 0xec], eax
jg 0x414d1e
jmp 0x414d05
mov eax, dword [ebp - 0x58]
sub eax, 0x1350dbbc
mov dword [ebp - 0xf0], eax
je 0x41516a
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x16cf884c
mov dword [ebp - 0xf4], eax
jg 0x414d50
jmp 0x414d37
mov eax, dword [ebp - 0x58]
sub eax, 0x140dacad
mov dword [ebp - 0xf8], eax
je 0x415189
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x1abaf9a6
mov dword [ebp - 0xfc], eax
jg 0x414d82
jmp 0x414d69
mov eax, dword [ebp - 0x58]
sub eax, 0x16cf884d
mov dword [ebp - 0x100], eax
je 0x4151f5
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x74aba185
mov dword [ebp - 0x104], eax
jg 0x41503e
jmp 0x414d9b
mov eax, dword [ebp - 0x58]
sub eax, 0x746b147d
mov dword [ebp - 0x108], eax
jg 0x415025
jmp 0x414db4
mov eax, dword [ebp - 0x58]
sub eax, 0x6904158e
mov dword [ebp - 0x10c], eax
jg 0x41500c
jmp 0x414dcd
mov eax, dword [ebp - 0x58]
sub eax, 0x518c7705
mov dword [ebp - 0x110], eax
jg 0x414ff3
jmp 0x414de6
mov eax, dword [ebp - 0x58]
sub eax, 0x4d163e1d
mov dword [ebp - 0x114], eax
jg 0x414fda
jmp 0x414dff
mov eax, dword [ebp - 0x58]
sub eax, 0x472762ad
mov dword [ebp - 0x118], eax
jg 0x414fc1
jmp 0x414e18
mov eax, dword [ebp - 0x58]
sub eax, 0x40b1e36f
mov dword [ebp - 0x11c], eax
jg 0x414fa8
jmp 0x414e31
mov eax, dword [ebp - 0x58]
sub eax, 0x3f0b5e27
mov dword [ebp - 0x120], eax
jg 0x414f8f
jmp 0x414e4a
mov eax, dword [ebp - 0x58]
sub eax, 0x32eac6d4
mov dword [ebp - 0x124], eax
jg 0x414f76
jmp 0x414e63
mov eax, dword [ebp - 0x58]
sub eax, 0x32984d38
mov dword [ebp - 0x128], eax
jg 0x414f5d
jmp 0x414e7c
mov eax, dword [ebp - 0x58]
sub eax, 0x2de237f4
mov dword [ebp - 0x12c], eax
jg 0x414f44
jmp 0x414e95
mov eax, dword [ebp - 0x58]
sub eax, 0x27e81db7
mov dword [ebp - 0x130], eax
jg 0x414f2b
jmp 0x414eae
mov eax, dword [ebp - 0x58]
sub eax, 0x1f8406a9
mov dword [ebp - 0x134], eax
jg 0x414f12
jmp 0x414ec7
mov eax, dword [ebp - 0x58]
sub eax, 0x1abaf9a7
mov dword [ebp - 0x138], eax
je 0x41540a
jmp 0x414ee0
mov eax, dword [ebp - 0x58]
sub eax, 0x1ac587f0
mov dword [ebp - 0x13c], eax
je 0x4150b4
jmp 0x414ef9
mov eax, dword [ebp - 0x58]
sub eax, 0x1d2f6cba
mov dword [ebp - 0x140], eax
je 0x415129
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x1f8406aa
mov dword [ebp - 0x144], eax
je 0x4150a1
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x27e81db8
mov dword [ebp - 0x148], eax
je 0x415213
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x2de237f5
mov dword [ebp - 0x14c], eax
je 0x41546d
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x32984d39
mov dword [ebp - 0x150], eax
je 0x41513c
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x32eac6d5
mov dword [ebp - 0x154], eax
je 0x41507a
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x3f0b5e28
mov dword [ebp - 0x158], eax
je 0x4150de
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x40b1e370
mov dword [ebp - 0x15c], eax
je 0x415394
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x472762ae
mov dword [ebp - 0x160], eax
je 0x415437
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x4d163e1e
mov dword [ebp - 0x164], eax
je 0x415479
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x518c7706
mov dword [ebp - 0x168], eax
je 0x415244
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x6904158f
mov dword [ebp - 0x16c], eax
je 0x415157
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x746b147e
mov dword [ebp - 0x170], eax
je 0x4150eb
jmp 0x415057
mov eax, dword [ebp - 0x58]
sub eax, 0x74aba186
mov dword [ebp - 0x174], eax
je 0x415251
jmp 0x415057
jmp 0x415487
mov eax, 0x6904158f
mov ecx, 0x32eac6d5
mov edx, dword [ebp - 0x10]
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x415487
mov eax, 0x1ac587f0
mov ecx, 0x1f8406aa
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x2c]
movzx edx, word [edx]
cmp edx, 0x5a4d
cmovne eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x415487
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x54], 0x8a67cea4
jmp 0x415487
mov eax, 0x3f0b5e28
mov ecx, 0x1d2f6cba
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
add edx, dword [esi + 0x3c]
mov dword [ebp - 0x30], edx
mov edx, dword [ebp - 0x30]
cmp dword [edx], 0x4550
cmovne eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x415487
mov eax, 0x746b147e
mov dword [ebp - 0x54], eax
jmp 0x415487
mov eax, 0xedb5cc1e
mov ecx, dword [ebp - 0x30]
movzx ecx, word [ecx + 0x18]
cmp ecx, 0x10b
setne dl
and dl, 1
mov byte [ebp - 0xa], dl
mov dword [ebp - 0x54], eax
jmp 0x415487
mov eax, 0x32984d39
mov ecx, 0x1d2f6cba
mov dl, byte [ebp - 0xa]
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x415487
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x54], 0x8a67cea4
jmp 0x415487
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
add eax, dword [ecx + 0x80]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x54], 0x6904158f
jmp 0x415487
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x54], 0x1350dbbc
jmp 0x415487
mov eax, 0x9040d265
mov ecx, 0x140dacad
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0xc], 0
cmovne eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x415487
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx + 0xc]
mov dword [esp], eax
call fcn.00406180
mov ecx, 0x800e5a00
mov edx, 0xf75c8e23
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x1c]
cmove ecx, edx
mov dword [ebp - 0x54], ecx
jmp 0x415487
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx + 0xc]
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x54], 0x16cf884d
jmp 0x415487
mov eax, 0xbc686dc5
mov ecx, 0x27e81db8
mov edx, dword [ebp - 0x38]
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x415487
mov eax, 0x518c7706
mov ecx, 0x40b1e370
mov edx, 0xffffffff
mov esi, dword [ebp - 0x38]
mov esi, dword [esi]
xor edx, 0x80000000
mov edi, esi
xor edi, edx
and edi, esi
cmp edi, 0
cmovne eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x415487
mov eax, 0x74aba186
mov dword [ebp - 0x54], eax
jmp 0x415487
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add eax, 2
mov dword [esp], eax
call fcn.00406180
mov ecx, 0xa33d1eef
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x18]
sete dl
and dl, 1
mov byte [ebp - 9], dl
mov dword [ebp - 0x54], ecx
jmp 0x415487
mov eax, 0xc96be677
mov ecx, 0x82afa702
mov dl, byte [ebp - 9]
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x54], eax
jmp 0x415487
mov eax, dword [ebp - 0x34]
mov ecx, esp
lea edx, [ebp - 0x50]
mov dword [ecx + 0xc], edx
mov dword [ecx], eax
mov dword [ecx + 8], 4
mov dword [ecx + 4], 4
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov ecx, 0xc72ef5cc
mov edx, 0xbf126a8c
cmp eax, 0
cmovne ecx, edx
mov dword [ebp - 0x54], ecx
jmp 0x415487
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x54], 0x8a67cea4
jmp 0x415487
mov eax, 4
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x34]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
mov dword [ebp - 0x178], eax
call fcn.00406d30
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x34]
mov esi, esp
lea edi, [ebp - 0x50]
mov dword [esi + 0xc], edi
mov dword [esi + 8], ecx
mov dword [esi], edx
mov dword [esi + 4], 4
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x17c], eax
call ecx
sub esp, 0x10
mov ecx, 0xfd6faf63
mov edx, 0x89520
cmp eax, 0
cmovne ecx, edx
mov dword [ebp - 0x54], ecx
jmp 0x415487
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x54], 0x8a67cea4
jmp 0x415487
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x54], 0x8a67cea4
jmp 0x415487
mov dword [ebp - 0x54], 0x40b1e370
jmp 0x415487
mov eax, dword [ebp - 0x34]
add eax, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x38]
add eax, 4
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x54], 0x16cf884d
jmp 0x415487
mov eax, 0x640e6a1
mov dword [ebp - 0x54], eax
jmp 0x415487
mov eax, 0x9975bf8a
mov dword [ebp - 0x54], eax
jmp 0x415487
mov dword [ebp - 0x54], 0x800e5a00
jmp 0x415487
mov eax, dword [ebp - 0x24]
add eax, 0x2ad087b8
add eax, 0x14
sub eax, 0x2ad087b8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x54], 0x1350dbbc
jmp 0x415487
mov eax, 0x1abaf9a7
mov dword [ebp - 0x54], eax
jmp 0x415487
mov eax, 0xe946f738
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x54], eax
jmp 0x415487
mov dword [ebp - 0x54], 0x8a67cea4
jmp 0x415487
mov eax, dword [ebp - 0x14]
add esp, 0x184
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x54], 0x746b147e
jmp 0x415487
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add eax, 2
mov dword [esp], eax
call fcn.00406180
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x54], 0x74aba186
jmp 0x415487
mov dword [ebp - 0x54], 0x640e6a1
jmp 0x415487
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x54], 0x1abaf9a7
jmp 0x414980