Function at 0x4355a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], 0
mov edi, dword [ebx + 0x24]
mov eax, dword [edi + 0x10]
or esi, 0xffffffff
cmp byte [eax], 0x3c
jne 0x4358cc
cmp byte [eax + 1], 0x21
jne 0x4358cc
cmp byte [eax + 2], 0x45
jne 0x4358cc
cmp byte [eax + 3], 0x4c
jne 0x4358cc
cmp byte [eax + 4], 0x45
jne 0x4358cc
cmp byte [eax + 5], 0x4d
jne 0x4358cc
cmp byte [eax + 6], 0x45
jne 0x4358cc
cmp byte [eax + 7], 0x4e
jne 0x4358cc
cmp byte [eax + 8], 0x54
jne 0x4358cc
add dword [ebx + 0xc8], 9
lea edx, [eax + 9]
mov dword [edi + 0x10], edx
add dword [edi + 0x20], 9
cmp byte [eax + 9], 0x25
jne 0x435634
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParserHandlePEReference
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x10]
cmp byte [edx], 0
jne 0x43565b
mov dword [esp + 4], 0xfa
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlParserInputGrow
test eax, eax
jg 0x43565b
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlPopInput
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
mov al, byte [eax]
lea edx, [eax - 9]
cmp dl, 1
jbe 0x435684
cmp al, 0x20
je 0x435684
cmp al, 0xd
je 0x435684
mov ecx, str.Space_required_after_ELEMENT_n
mov edx, 0x41
mov eax, ebx
call fcn.0042bf2c
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlSkipBlankChars
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParseName
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x4356b2
mov ecx, str.xmlParseElementDecl:_no_name_for_Element_n
mov edx, 0x44
jmp 0x4357fa
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlPopInput
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
mov al, byte [eax]
test al, al
jne 0x4356c4
cmp dword [ebx + 0x28], 1
jg 0x4356aa
lea edx, [eax - 9]
cmp dl, 1
jbe 0x4356e5
cmp al, 0x20
je 0x4356e5
cmp al, 0xd
je 0x4356e5
mov ecx, str.Space_required_after_the_element_name_n
mov edx, 0x41
mov eax, ebx
call fcn.0042bf2c
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlSkipBlankChars
mov edx, dword [ebx + 0x24]
mov eax, dword [edx + 0x10]
mov cl, byte [eax]
cmp cl, 0x45
jne 0x43574e
cmp byte [eax + 1], 0x4d
jne 0x4357f0
cmp byte [eax + 2], 0x50
jne 0x4357f0
cmp byte [eax + 3], 0x54
jne 0x4357f0
cmp byte [eax + 4], 0x59
jne 0x4357f0
add dword [ebx + 0xc8], 5
lea ecx, [eax + 5]
mov dword [edx + 0x10], ecx
add dword [edx + 0x20], 5
cmp byte [eax + 5], 0x25
jne 0x435741
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParserHandlePEReference
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x10]
mov esi, 1
jmp 0x435791
cmp cl, 0x41
jne 0x4357b4
cmp byte [eax + 1], 0x4e
jne 0x4357f0
cmp byte [eax + 2], 0x59
jne 0x4357f0
add dword [ebx + 0xc8], 3
lea ecx, [eax + 3]
mov dword [edx + 0x10], ecx
add dword [edx + 0x20], 3
cmp byte [eax + 3], 0x25
jne 0x435786
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParserHandlePEReference
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x10]
mov esi, 2
cmp byte [edx], 0
jne 0x435809
mov dword [esp + 4], 0xfa
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlParserInputGrow
test eax, eax
jg 0x435809
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlPopInput
jmp 0x435809
cmp cl, 0x28
jne 0x4357d3
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParseElementContentDecl
mov esi, eax
jmp 0x435809
cmp cl, 0x25
jne 0x4357f0
cmp dword [ebx + 0x60], 0
jne 0x4357f0
cmp dword [ebx + 0x28], 1
jne 0x4357f0
mov ecx, str.PEReference:_forbidden_within_markup_decl_in_internal_subset_n
mov edx, 0x15
jmp 0x4357fa
mov ecx, str.xmlParseElementDecl:_EMPTY__ANY_or___expected_n
mov edx, 0x36
mov eax, ebx
call fcn.0042bf2c
or esi, 0xffffffff
jmp 0x4358cc
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlSkipBlankChars
jmp 0x43581b
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlPopInput
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0
jne 0x43582c
cmp dword [ebx + 0x28], 1
jg 0x435813
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlSkipBlankChars
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x10]
cmp byte [edx], 0x3e
je 0x43584f
xor ecx, ecx
mov edx, 0x49
mov eax, ebx
call fcn.0042bda9
jmp 0x4358b6
cmp edi, eax
je 0x435864
mov ecx, str.Element_declaration_doesnt_start_and_stop_in_the_same_entity_n
mov edx, 0x5a
mov eax, ebx
call fcn.0042bf2c
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNextChar
mov eax, dword [ebx]
test eax, eax
je 0x4358b6
cmp dword [ebx + 0xd4], 0
jne 0x4358b6
mov edx, dword [eax + 0x24]
test edx, edx
je 0x4358b6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x435890
mov dword [eax + 0x14], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call edx
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4358cc
cmp dword [eax + 0x14], 0
jne 0x4358cc
jmp 0x4358bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4358cc
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlFreeDocElementContent
mov eax, esi
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret