Function at 0x414c00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x148
mov esi, esp
mov dword [esi + 0xc], edx
mov dword [esi + 8], esp
mov edi, ecx
mov eax, dword [0x42d00c]
xor eax, ebp
mov dword [esi + 0x140], eax
and dword [ecx + 8], 0xfffffe00
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
push eax
sub esp, 0x14
mov ebx, esp
mov ecx, ebx
push str.crash
call fcn.004225e0
mov ecx, edi
mov dword [esi + 4], edi
push 0x428aa2
push str.type
call fcn.004231d0
mov ecx, eax
push ebx
call fcn.00422740
mov ecx, ebx
call fcn.004202f0
mov ecx, dword [ebp + 8]
mov esp, dword [esi + 8]
mov edi, esp
push eax
sub esp, 0x14
mov ebx, esp
mov dword [ebx + 8], 0x104
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov edx, dword [ecx + 0x10]
cmp dword [ecx + 0x14], 0xf
jbe 0x414cac
mov ecx, dword [ecx]
call fcn.00422690
mov ecx, dword [esi + 4]
mov dword [ebx], eax
push 0x428cfd
push 0x428cfb
call fcn.004231d0
mov ecx, eax
push ebx
call fcn.00422740
mov ecx, ebx
call fcn.004202f0
mov esp, edi
mov ebx, esp
push eax
sub esp, 0x14
mov ecx, dword [esi + 4]
mov edi, esp
mov dword [edi + 8], 1
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 4], 0
mov dword [edi], 4
push 0x428489
push str.version
call fcn.004231d0
mov ecx, eax
push edi
call fcn.00422740
mov ecx, edi
call fcn.004202f0
mov esp, ebx
mov dword [esi + 0x1c], esp
push eax
sub esp, 0x14
mov dword [esi + 0x18], esp
mov dword [esi + 0x14], esp
sub esp, 0x1c
mov ebx, esp
push 0x20
call fcn.0042557a
add esp, 4
mov dword [ebx + 0x14], 0x10
mov dword [ebx + 0x18], 0x1f
mov edi, eax
mov dword [eax + 0xc], 0x5a303030
mov dword [eax + 8], 0x2e30303a
mov dword [eax + 4], 0x30303a48
mov dword [eax], 0x25544625
mov byte [eax + 0x10], 0
mov dword [ebx + 4], eax
lea eax, [esi + 0x128]
mov dword [esi + 8], ebx
mov dword [ebx], eax
lea ebx, [esi + 0x98]
push ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
push ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__gmtime64]
add esp, 4
lea ebx, [esi + 0xb4]
push eax
push edi
push 0x40
push ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
add esp, 0x10
mov eax, 0xf
mov dword [esi + 0x138], 0
mov dword [esi + 0x13c], eax
mov byte [esi + 0x128], 0
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
cmp eax, 0xf
jbe 0x4154da
test edi, edi
js 0x415675
mov dword [esi + 0x10], edi
or edi, 0xf
js 0x415602
cmp edi, 0x16
mov ecx, 0x16
cmova ecx, edi
lea eax, [ecx + 1]
cmp eax, 0x1000
jae 0x4154fe
push eax
mov edi, ecx
call fcn.0042557a
mov ecx, edi
add esp, 4
mov ebx, eax
mov edi, dword [esi + 0x10]
mov dword [esi + 0x138], edi
mov dword [esi + 0x13c], ecx
push edi
lea eax, [esi + 0xb4]
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebx + edi], 0
mov dword [esi + 0x128], ebx
mov ecx, dword [esi + 8]
mov ebx, dword [esi + 0x18]
mov eax, dword [ecx + 0x18]
cmp eax, 0x10
jb 0x414e74
mov ecx, dword [ecx + 4]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x41551a
push edi
push ecx
call fcn.004255af
add esp, 8
mov ecx, dword [esi + 8]
mov esp, dword [esi + 0x14]
mov eax, 0xfffffe00
mov edx, dword [esi + 0x138]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0xf
mov byte [ecx + 4], 0
and eax, dword [ebx + 8]
or eax, 0x104
cmp dword [esi + 0x13c], 0xf
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
jbe 0x4154cf
mov ecx, dword [esi + 0x128]
call fcn.00422690
mov ecx, dword [esi + 4]
mov dword [ebx], eax
push 0x4289e7
push str.creationDate
call fcn.004231d0
mov ecx, eax
push ebx
call fcn.00422740
mov ecx, ebx
call fcn.004202f0
mov esp, dword [esi + 0x1c]
mov eax, dword [esi + 0x13c]
cmp eax, 0x10
jb 0x414f1c
mov ecx, dword [esi + 0x128]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x415537
push edi
push ecx
call fcn.004255af
add esp, 8
mov ecx, dword [ebp + 0x10]
mov ebx, esp
push eax
sub esp, 0x14
mov edi, esp
mov dword [edi + 8], 0x104
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov edx, dword [ecx + 0x10]
cmp dword [ecx + 0x14], 0xf
jbe 0x414f4e
mov ecx, dword [ecx]
call fcn.00422690
mov ecx, dword [esi + 4]
mov dword [edi], eax
push 0x428d94
push str.clientId
call fcn.004231d0
mov ecx, eax
push edi
call fcn.00422740
mov ecx, edi
call fcn.004202f0
mov esp, ebx
and dword [esi + 0x130], 0xfffffe00
lea edi, [esi + 0xb4]
mov dword [esi + 0x134], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x13c], 0
mov ecx, edi
call fcn.0041f0a0
mov eax, 0xf
mov dword [esi + 0xa8], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0xac], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x4c], eax
mov byte [esi + 0x98], 0
mov byte [esi + 0x80], 0
mov byte [esi + 0x68], 0
mov byte [esi + 0x50], 0
mov byte [esi + 0x38], 0
push 0x20
call fcn.0042557a
add esp, 4
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x48], 0x14
mov dword [esi + 0x4c], 0x1f
mov dword [eax + 0x10], 0x746e656d
mov dword [eax + 0xc], 0x6e6f7269
mov dword [eax + 8], 0x766e4579
mov dword [eax + 4], 0x7274656d
mov dword [eax], 0x656c6554
mov byte [eax + 0x14], 0
mov dword [esi + 0x38], eax
lea eax, [esi + 0x38]
lea edx, [esi + 0x20]
push eax
call fcn.0041a4a0
add esp, 4
mov eax, dword [esi + 0x20]
lea edx, [esi + 0x128]
mov ecx, edi
add eax, 0x28
push 0
push edx
push eax
call fcn.0041f180
mov ebx, eax
mov eax, dword [esi + 0x4c]
cmp eax, 0x10
jb 0x41509a
mov ecx, dword [esi + 0x38]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x415554
push edi
push ecx
call fcn.004255af
add esp, 8
test bl, bl
je 0x415312
lea ecx, [esi + 0x128]
push str.build
call fcn.004233e0
test al, al
je 0x4152da
lea ecx, [esi + 0x128]
push 0x428cb2
push str.build
call fcn.004231d0
cmp byte [eax + 8], 7
jne 0x4152da
lea ecx, [esi + 0x128]
push 0x428cb2
push str.build
call fcn.004231d0
lea edi, [esi + 0x38]
mov ecx, edi
push eax
call fcn.00421f70
mov ecx, edi
push str.architecture
call fcn.004233e0
test al, al
je 0x415170
lea ecx, [esi + 0x38]
push 0x428a14
push str.architecture
call fcn.004231d0
cmp byte [eax + 8], 4
jne 0x415170
lea ecx, [esi + 0x38]
push 0x428a14
push str.architecture
call fcn.004231d0
lea edx, [esi + 0x20]
mov ecx, eax
mov edi, edx
push edx
call fcn.00421bb0
lea ecx, [esi + 0x98]
push edi
call fcn.004065f0
mov eax, dword [esi + 0x34]
cmp eax, 0x10
jb 0x415170
mov ecx, dword [esi + 0x20]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x415611
push edi
push ecx
call fcn.004255af
add esp, 8
lea ecx, [esi + 0x38]
push str.xpcomAbi
call fcn.004233e0
test al, al
je 0x4151e8
lea ecx, [esi + 0x38]
push 0x4285a1
push str.xpcomAbi
call fcn.004231d0
cmp byte [eax + 8], 4
jne 0x4151e8
lea ecx, [esi + 0x38]
push 0x4285a1
push str.xpcomAbi
call fcn.004231d0
lea edx, [esi + 0x20]
mov ecx, eax
mov edi, edx
push edx
call fcn.00421bb0
lea ecx, [esi + 0x80]
push edi
call fcn.004065f0
mov eax, dword [esi + 0x34]
cmp eax, 0x10
jb 0x4151e8
mov ecx, dword [esi + 0x20]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x41562a
push edi
push ecx
call fcn.004255af
add esp, 8
lea ecx, [esi + 0x38]
push str.displayVersion
call fcn.004233e0
test al, al
je 0x41525d
lea ecx, [esi + 0x38]
push 0x428498
push str.displayVersion
call fcn.004231d0
cmp byte [eax + 8], 4
jne 0x41525d
lea ecx, [esi + 0x38]
push 0x428498
push str.displayVersion
call fcn.004231d0
lea edx, [esi + 0x20]
mov ecx, eax
mov edi, edx
push edx
call fcn.00421bb0
lea ecx, [esi + 0x68]
push edi
call fcn.004065f0
mov eax, dword [esi + 0x34]
cmp eax, 0x10
jb 0x41525d
mov ecx, dword [esi + 0x20]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x415643
push edi
push ecx
call fcn.004255af
add esp, 8
lea ecx, [esi + 0x38]
push str.platformVersion
call fcn.004233e0
test al, al
je 0x4152d2
lea ecx, [esi + 0x38]
push 0x4284cb
push str.platformVersion
call fcn.004231d0
cmp byte [eax + 8], 4
jne 0x4152d2
lea ecx, [esi + 0x38]
push 0x4284cb
push str.platformVersion
call fcn.004231d0
lea edx, [esi + 0x20]
mov ecx, eax
mov edi, edx
push edx
call fcn.00421bb0
lea ecx, [esi + 0x50]
push edi
call fcn.004065f0
mov eax, dword [esi + 0x34]
cmp eax, 0x10
jb 0x4152d2
mov ecx, dword [esi + 0x20]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x41565c
push edi
push ecx
call fcn.004255af
add esp, 8
lea ecx, [esi + 0x38]
call fcn.004202f0
mov ebx, esp
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x128]
mov ecx, edi
push eax
call fcn.00421f70
mov ecx, dword [esi + 4]
push 0x427fc2
push str.environment
call fcn.004231d0
mov ecx, eax
push edi
call fcn.00422740
mov ecx, edi
call fcn.004202f0
mov esp, ebx
mov dword [esi + 8], esp
push eax
sub esp, 0x14
mov ebx, dword [esi + 0xc]
mov edi, esp
mov ecx, edi
mov edx, ebx
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.00418ff0
add esp, 8
mov ecx, dword [esi + 4]
push 0x428d8b
push str.payload
call fcn.004231d0
mov ecx, eax
push edi
call fcn.00422740
mov ecx, edi
call fcn.004202f0
mov esp, dword [esi + 8]
push eax
sub esp, 0x14
mov eax, 0xf
mov edi, esp
mov dword [esi + 0x48], 6
lea edx, [esi + 0x20]
mov ecx, ebx
mov dword [esi + 0x4c], eax
lea eax, [esi + 0x38]
mov word [esi + 0x3c], 0x726f
mov dword [esi + 0x38], 0x646e6556
mov byte [esi + 0x3e], 0
push eax
call fcn.0041a4a0
add esp, 4
mov edx, dword [esi + 0x20]
lea eax, [esi + 0x80]
lea ebx, [esi + 0x50]
mov ecx, edi
add edx, 0x28
push eax
lea eax, [esi + 0x98]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push ebx
lea eax, [esi + 0x68]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.004198b0
add esp, 0x20
mov ecx, dword [esi + 4]
push 0x428475
push str.application
call fcn.004231d0
mov ecx, eax
push edi
call fcn.00422740
mov ecx, edi
call fcn.004202f0
mov esp, dword [esi + 8]
mov eax, dword [esi + 0x4c]
cmp eax, 0x10
jb 0x415405
mov ecx, dword [esi + 0x38]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x415571
push edi
push ecx
call fcn.004255af
add esp, 8
mov eax, dword [esi + 0x64]
cmp eax, 0x10
jb 0x415429
mov ecx, dword [esi + 0x50]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x41558e
push edi
push ecx
call fcn.004255af
add esp, 8
mov eax, dword [esi + 0x7c]
cmp eax, 0x10
jb 0x41544d
mov ecx, dword [esi + 0x68]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x4155ab
push edi
push ecx
call fcn.004255af
add esp, 8
mov eax, dword [esi + 0x94]
cmp eax, 0x10
jb 0x415477
mov ecx, dword [esi + 0x80]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x4155c8
push edi
push ecx
call fcn.004255af
add esp, 8
mov eax, dword [esi + 0xac]
cmp eax, 0x10
jb 0x4154a1
mov ecx, dword [esi + 0x98]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x4155e5
push edi
push ecx
call fcn.004255af
add esp, 8
lea ecx, [esi + 0xb4]
call fcn.00419c60
lea ecx, [esi + 0x128]
call fcn.004202f0
mov ecx, dword [esi + 0x140]
xor ecx, ebp
call fcn.00425eac
mov eax, dword [esi + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esi + 0x128]
jmp 0x414ec7
mov dword [esi + 0x138], edi
push edi
push ebx
lea eax, [esi + 0x128]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [esi + edi + 0x128], 0
jmp 0x414e47
add ecx, 0x24
push ecx
call fcn.0042557a
add esp, 4
lea ebx, [eax + 0x23]
mov ecx, edi
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
jmp 0x414e1d
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41567a
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x414e67
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41567a
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x414f12
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41567a
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x415090
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41567a
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x4153fb
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41567a
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x41541f
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41567a
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x415443
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41567a
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x41546d
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41567a
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x415497
mov ecx, 0x80000023
mov edi, 0x7fffffff
jmp 0x415501
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41567a
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x415166
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41567a
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x4151de
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41567a
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x415253
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41567a
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x4152c8
call fcn.00401120
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]