Function at 0x415520
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
jmp 0x41558c
mov eax, 0x8e1c68
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415594
sub eax, edx
mov eax, 0
sete al
push ebx
push esi
push edi
cmp eax, 0x1e
jge 0x415af6
xor eax, eax
mov dword [0x8e1c68], eax
mov dword [0x8e1c6c], eax
mov dword [0x8e1c70], eax
mov dword [0x8e1c74], eax
mov dword [0x8e1c78], eax
mov dword [0x8e1c7c], eax
mov dword [0x8e1c80], eax
mov dword [0x8e1c84], eax
mov byte [0x8e1c88], al
jmp 0x415646
jmp 0x4156ac
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call sub.ntdll.dll_RtlImageNtHeader
mov edi, eax
jmp 0x415721
test edi, edi
je 0x415f71
jmp 0x41578f
movzx ecx, word [edi + 0x14]
lea ebx, [ecx + edi + 0x18]
jmp 0x4157fd
xor edx, edx
xor esi, esi
cmp dx, word [edi + 6]
jae 0x415f71
jmp 0x415810
jmp 0x415876
mov edx, 0x3e
xor ecx, ecx
lea ecx, [ecx]
mov al, byte [ecx + 0x6cbbd4]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ebp + ecx - 6], al
jns 0x41589d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 5
jl 0x415880
movzx eax, si
lea ecx, [eax + eax*4]
mov byte [ebp - 1], 0
lea edx, [ebp - 6]
lea ecx, [ebx + ecx*8]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4158d3
test al, al
je 0x4158cf
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4158d3
add ecx, 2
add edx, 2
test al, al
jne 0x4158b3
xor eax, eax
jmp 0x4158d8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete cl
xor eax, eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
test cl, cl
jne 0x4158fc
inc esi
cmp si, word [edi + 6]
jb 0x415810
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jmp 0x415962
jmp 0x4159c8
jmp 0x415a2e
movzx eax, si
lea edx, [eax + eax*4]
mov eax, dword [ebx + edx*8 + 0xc]
add eax, dword [edi + 0x34]
lea ecx, [ebx + edx*8]
jmp 0x415aa4
mov ecx, dword [ecx + 8]
push ecx
push eax
lea edi, [ebp - 0x28]
call fcn.0041edf0
mov esi, 0x10
add esp, 8
cmp dword [eax + 0x18], esi
jb 0x415ac3
mov ecx, dword [eax + 4]
jmp 0x415ac6
lea ecx, [eax + 4]
mov edx, 0x8e1c68
jmp 0x415ad0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x415ad0
cmp dword [ebp - 0x10], esi
jb 0x415f71
mov edx, dword [ebp - 0x24]
push edx
call fcn.005bd360
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jmp 0x415b5c
jmp 0x415bc2
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call sub.ntdll.dll_RtlImageNtHeader
mov edi, eax
jmp 0x415c38
test edi, edi
je 0x415f71
jmp 0x415ca6
movzx eax, word [edi + 0x14]
lea ebx, [eax + edi + 0x18]
jmp 0x415d14
xor ecx, ecx
xor esi, esi
cmp cx, word [edi + 6]
jae 0x415f71
jmp 0x415d88
mov edx, 0xfe
xor ecx, ecx
nop
mov al, byte [ecx + str.eyv]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ebp + ecx - 6], al
jns 0x415dad
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 5
jl 0x415d90
movzx eax, si
lea ecx, [eax + eax*4]
mov byte [ebp - 1], 0
lea edx, [ebp - 6]
lea ecx, [ebx + ecx*8]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x415de3
test al, al
je 0x415ddf
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x415de3
add ecx, 2
add edx, 2
test al, al
jne 0x415dc3
xor eax, eax
jmp 0x415de8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete cl
xor eax, eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
test cl, cl
jne 0x415e0c
inc esi
cmp si, word [edi + 6]
jb 0x415d22
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, si
lea edx, [eax + eax*4]
mov eax, dword [ebx + edx*8 + 0xc]
add eax, dword [edi + 0x34]
lea ecx, [ebx + edx*8]
jmp 0x415e82
mov ecx, dword [ecx + 8]
push ecx
push eax
lea edi, [ebp - 0x28]
call fcn.0041edf0
mov esi, 0x10
add esp, 8
cmp dword [eax + 0x18], esi
jb 0x415ea1
mov eax, dword [eax + 4]
jmp 0x415ea4
add eax, 4
push eax
push 0x8e1c68
call fcn.005e1af0
add esp, 8
test eax, eax
sete bl
cmp dword [ebp - 0x10], esi
jb 0x415ec8
mov edx, dword [ebp - 0x24]
push edx
call fcn.005bd360
add esp, 4
test bl, bl
je 0x415f0b
mov ecx, 0x65d4550d
lea eax, [ebp - 8]
call fcn.0041d260
mov edi, str.RELMQ_
sub edi, 0x18e348e2
lea esi, [ebp - 0x28]
mov ebx, eax
call fcn.0041d2c0
mov edi, ebx
push 0
mov ebx, eax
call fcn.00414f50
add esp, 4
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005e9a35
jmp 0x415f71
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret