Function at 0x4285f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43dbc8
push 0x420784
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov edx, dword [esi + 8]
mov dword [ebp - 0x1c], edx
test dl, 3
je 0x428637
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x24], ecx
cmp edx, ecx
jb 0x42864c
cmp edx, dword [eax + 4]
jb 0x428624
mov ebx, dword [esi + 0xc]
mov dword [ebp - 0x20], ebx
cmp ebx, 0xffffffff
je 0x428943
xor edi, edi
xor eax, eax
mov ecx, edx
mov esi, dword [ecx]
cmp esi, 0xffffffff
je 0x42866c
cmp esi, eax
jae 0x428624
cmp dword [ecx + 4], 0
je 0x428677
mov edi, 1
add eax, 1
add ecx, 0xc
cmp eax, ebx
jbe 0x428661
test edi, edi
je 0x428694
mov ecx, dword [ebp + 8]
mov eax, dword [ecx - 8]
cmp eax, dword [ebp - 0x24]
jb 0x428624
cmp eax, ecx
jae 0x428624
mov eax, edx
and eax, 0xfffff000
mov dword [ebp + 8], eax
xor edi, edi
mov ecx, dword [0x445208]
cmp edi, ecx
jge 0x4287af
mov esi, dword [edi*8 + 0x445210]
mov ebx, dword [edi*8 + 0x445214]
cmp esi, eax
jne 0x42882a
mov dword [ebp - 4], 0
mov ecx, ebx
call fcn.00428490
test eax, eax
je 0x4287a8
push edx
mov ecx, dword [ebp - 0x20]
call fcn.00428500
add esp, 4
test eax, eax
je 0x4287a5
mov dword [ebp - 4], 0xffffffff
test edi, edi
jle 0x428943
mov eax, 1
mov ecx, 0x445290
xchg dword [ecx], eax
test eax, eax
jne 0x428943
mov eax, dword [ebp + 8]
cmp dword [edi*8 + 0x445210], eax
je 0x428763
mov ecx, dword [0x445208]
lea edi, [ecx - 1]
test edi, edi
jl 0x428752
lea ebx, [ebx]
cmp dword [edi*8 + 0x445210], eax
je 0x428740
sub edi, 1
jns 0x428730
jmp 0x42874e
mov esi, dword [edi*8 + 0x445210]
mov ebx, dword [edi*8 + 0x445214]
test edi, edi
jge 0x428765
cmp ecx, 0x10
jge 0x428760
add ecx, 1
mov dword [0x445208], ecx
lea edi, [ecx - 1]
test edi, edi
jle 0x428797
xor eax, eax
test edi, edi
jl 0x428797
lea ecx, [ecx]
mov ecx, dword [eax*8 + 0x445210]
mov edx, dword [eax*8 + 0x445214]
mov dword [eax*8 + 0x445210], esi
mov dword [eax*8 + 0x445214], ebx
mov esi, ecx
mov ebx, edx
add eax, 1
cmp eax, edi
jle 0x428770
xor edx, edx
mov eax, 0x445290
xchg dword [eax], edx
jmp 0x428943
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
push 0x1c
lea eax, [ebp - 0x40]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x428943
mov eax, dword [ebp - 0x28]
cmp eax, 0x1000000
je 0x428858
cmp eax, 0x20000
jne 0x428844
cmp dword [0x44520c], 0
jne 0x42883b
mov dword [0x445298], 0x94
push 0x445298
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x428832
mov dword [0x44520c], 1
jmp 0x42883b
add edi, 1
jmp 0x4286a6
cmp dword [0x44520c], 0
je 0x428858
cmp dword [0x4452a8], 1
je 0x428858
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x3c]
cmp word [ebx], 0x5a4d
jne 0x428844
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x428844
cmp word [eax + 0x18], 0x10b
jne 0x428844
test byte [ebp - 0x2c], 0xcc
je 0x42889e
mov edi, dword [ebp - 0x1c]
sub edi, ebx
mov eax, ebx
call fcn.004284c0
test eax, eax
je 0x428624
test dword [eax + 0x24], 0x80000000
jne 0x428624
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.00428500
add esp, 4
test eax, eax
je 0x428624
mov edx, 1
mov eax, 0x445290
xchg dword [eax], edx
test edx, edx
jne 0x428943
mov edi, dword [0x445208]
mov eax, edi
test edi, edi
jle 0x4288e9
lea ecx, [edi*8 + 0x445208]
mov edx, dword [ecx]
cmp edx, dword [ebp + 8]
je 0x4288e9
sub eax, 1
sub ecx, 8
test eax, eax
jg 0x4288d8
test eax, eax
jne 0x42893a
cmp edi, 0xf
mov esi, 0xf
jg 0x4288f9
mov esi, edi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x3c]
test esi, esi
jl 0x42892c
mov eax, 0x445210
lea ebx, [esi + 1]
jmp 0x428910
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov ecx, esi
mov edx, edi
add eax, 8
sub ebx, 1
jne 0x428910
mov edi, dword [0x445208]
cmp edi, 0x10
jge 0x42893a
add edi, 1
mov dword [0x445208], edi
xor eax, eax
mov ecx, 0x445290
xchg dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret