Function at 0x401570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
test ecx, ecx
jne 0x40157e
xor eax, eax
leave
ret
or dword [ebp - 0x24], 0xffffffff
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], 0x41fdc4
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.0040344a
test al, al
je 0x4018a4
cmp dword [ebp - 0x24], 0xffffffff
push esi
push edi
je 0x40189a
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x40189a
mov edx, dword [ebp - 0x18]
cmp edx, 0x40
jb 0x40189a
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x40189a
mov ecx, dword [edi + 0x3c]
lea eax, [ecx + 0xf8]
cmp edx, eax
jb 0x40189a
cmp dword [ecx + edi], 0x4550
jne 0x40189a
movzx eax, word [ecx + edi + 4]
mov esi, 0x8664
mov dword [ebp - 0xc], 0x14c
cmp ax, word [ebp - 0xc]
je 0x40161b
cmp ax, si
je 0x40189a
add ecx, 0x98
add ecx, edi
mov dword [ebp - 0xc], ecx
mov eax, dword [ecx]
test eax, eax
je 0x40189a
add eax, 0xc
cmp edx, eax
jb 0x40189a
test ecx, ecx
je 0x40189a
mov esi, dword [ecx]
add esi, edi
lea ecx, [esi + 8]
test ecx, ecx
je 0x40189a
add edx, edi
lea eax, [ecx + 4]
mov dword [ebp - 4], edx
cmp eax, edx
jae 0x40189a
cmp byte [ecx], 0x30
lea edx, [ecx + 1]
jne 0x40189a
cmp byte [edx], 0x82
jne 0x40189a
movzx ecx, byte [edx + 1]
movzx eax, byte [edx + 2]
shl ecx, 8
add eax, 0x13
add eax, ecx
and eax, 0xffffff8
je 0x40189a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
lea ecx, [eax + esi]
mov dword [ebp - 8], ecx
cmp ecx, dword [ebp - 4]
ja 0x40189a
cmp eax, 0xc
jl 0x40189a
lea eax, [ecx - 0xc]
mov dword [ebp - 0xc], eax
jmp 0x4016c8
cmp esi, dword [ebp - 0xc]
je 0x40189a
inc esi
push 0xc
push esi
push 0x41fdb4
call fcn.00418874
add esp, 0xc
test eax, eax
jne 0x4016be
cmp esi, dword [ebp - 8]
jae 0x40189a
movzx ecx, byte [esi + 0xc]
mov eax, pe_nt_image_headers32
imul ecx, eax
movzx eax, byte [esi + 0xd]
add cx, ax
movzx eax, cx
test ax, ax
je 0x40189a
add eax, 1
mov dword [ebp - 8], eax
je 0x40189a
cmp eax, 0x10000
jge 0x40189a
push eax
call fcn.0041879b
mov dword [ebp - 0xc], eax
mov eax, 0x5a4d
pop ecx
cmp word [edi], ax
jne 0x401891
mov edx, dword [edi + 0x3c]
mov ecx, dword [ebp - 0x18]
lea eax, [edx + 0xf8]
cmp ecx, eax
jb 0x401891
cmp dword [edx + edi], 0x4550
jne 0x401891
movzx eax, word [edx + edi + 4]
mov esi, 0x14c
cmp ax, si
je 0x401771
mov esi, 0x8664
cmp ax, si
je 0x401891
add edx, 0x98
add edx, edi
mov eax, dword [edx]
test eax, eax
je 0x401891
add eax, 0xc
cmp ecx, eax
jb 0x401891
test edx, edx
je 0x401891
mov esi, dword [edx]
add esi, edi
lea ecx, [esi + 8]
test ecx, ecx
je 0x401891
lea eax, [ecx + 4]
cmp eax, dword [ebp - 4]
jae 0x401891
cmp byte [ecx], 0x30
lea edx, [ecx + 1]
jne 0x401891
cmp byte [edx], 0x82
jne 0x401891
movzx ecx, byte [edx + 1]
movzx eax, byte [edx + 2]
shl ecx, 8
add eax, 0x13
add eax, ecx
test eax, 0xffffff8
je 0x401891
mov eax, dword [edi + 0x3c]
mov dword [ebp - 0x10], esi
mov eax, dword [eax + edi + 0x9c]
mov dword [ebp - 0x14], eax
lea edi, [eax + esi]
cmp edi, dword [ebp - 4]
ja 0x401891
cmp eax, 0xc
jl 0x401891
push 0xc
push esi
push 0x41fdb4
call fcn.00418874
add esp, 0xc
test eax, eax
je 0x40183c
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
lea eax, [edi - 0xc]
cmp esi, eax
je 0x401891
push 0xc
inc esi
push esi
push 0x41fdb4
call fcn.00418874
add esp, 0xc
test eax, eax
jne 0x401820
cmp esi, edi
jae 0x401891
movzx ecx, byte [esi + 0xc]
mov eax, pe_nt_image_headers32
imul ecx, eax
movzx eax, byte [esi + 0xd]
add cx, ax
movzx eax, cx
test ax, ax
je 0x401891
mov edi, eax
lea eax, [edi + 1]
cmp dword [ebp - 8], eax
jl 0x401891
lea eax, [esi + 0xe]
mov esi, dword [ebp - 0xc]
push edi
push eax
push esi
call fcn.004081e0
mov byte [edi + esi], bl
add esp, 0xc
mov al, byte [esi]
mov ecx, esi
jmp 0x401886
cmp al, 0x22
je 0x40188e
inc ecx
mov al, byte [ecx]
test al, al
jne 0x40187f
mov ebx, esi
jmp 0x40189a
push esi
jmp 0x401894
push dword [ebp - 0xc]
call fcn.004185b1
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004034e2
pop edi
pop esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x41fdc4
call fcn.004034e2
mov eax, ebx
pop ebx
leave
ret