Function at 0x413120
Capabilities:
Access peb ldr_data
Parse pe header
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x124
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [eax + 0x20]
mov dword [esp + 0x2c], edx
test edx, edx
jne 0x413150
lea eax, [edx - 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413155
sub ecx, esi
sar ecx, 1
cmp word [edx + ecx*2], 0x5c
lea eax, [edx + ecx*2]
je 0x413179
nop
sub eax, 2
cmp word [eax], 0x5c
jne 0x413170
push edx
push str.fullPath:__S_n
add eax, 2
push 0x100000
push 0x420410
mov dword [esp + 0x20], eax
call fcn.00401010
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
push dword [esp + 0x10]
push str.name:__S_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
mov ebx, dword [esp + 0x10]
xorps xmm0, xmm0
xor esi, esi
movaps xmmword [esp + 0x70], xmm0
mov dword [esp + 0x80], 0
mov eax, 0x917567d2
mov dword [esp + 0x14], 0x76028531
xor edx, edx
nop
movzx ecx, word [ebx + edx*2]
test ecx, ecx
je 0x41324b
imul ecx, dword [esp + 0x14]
inc edx
add eax, ecx
mov dword [esp + 0x14], ecx
mov esi, eax
mov dword [esp + 0x10], eax
shl eax, 0xf
shr esi, 0x11
or esi, eax
mov eax, dword [esp + 0x10]
cmp edx, 3
jb 0x413220
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
test esi, esi
jne 0x413294
push str.generate_name_seed_failed_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
mov eax, 0xfffffff6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x90]
mov ecx, esi
push eax
call fcn.00415670
add esp, 4
movups xmm1, xmmword [eax]
movq xmm0, qword [eax + 0x10]
movd ecx, xmm1
movaps xmmword [esp + 0x30], xmm1
psrldq xmm1, 4
movd eax, xmm1
movq qword [esp + 0x40], xmm0
or ecx, eax
je 0x413bd9
mov eax, dword [esp + 0x38]
or eax, dword [esp + 0x3c]
je 0x413bd9
mov eax, dword [esp + 0x40]
or eax, dword [esp + 0x44]
je 0x413bd9
push ecx
mov edx, esi
lea ecx, [esp + 0x74]
call fcn.00416190
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x413341
push str.:_BawInitializeFirstfunctionTable_failed_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
mov eax, dword [esp + 0x10]
neg eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x30]
push eax
lea edx, [esp + 0x74]
call fcn.00415700
mov esi, eax
add esp, 4
test esi, esi
jne 0x413397
push str.findKeyValue_returned_0_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
mov eax, 0xfffffff3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x88
lea eax, [esp + 0xac]
push 0
push eax
call fcn.004020a0
add esp, 0xc
lea eax, [esp + 0x90]
mov ecx, esi
push eax
call fcn.00415670
add esp, 4
movups xmm1, xmmword [eax]
movaps xmmword [esp + 0x50], xmm1
movq xmm0, qword [eax + 0x10]
movd ecx, xmm1
psrldq xmm1, 4
movd eax, xmm1
movq qword [esp + 0x60], xmm0
or ecx, eax
je 0x413b9c
mov eax, dword [esp + 0x58]
or eax, dword [esp + 0x5c]
je 0x413b9c
mov eax, dword [esp + 0x60]
or eax, dword [esp + 0x64]
je 0x413b9c
lea eax, [esp + 0x50]
mov edx, esi
push eax
lea ecx, [esp + 0xac]
call fcn.00414690
add esp, 4
test eax, eax
je 0x41345b
push str.BawInitializeFunctionTable_failed_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1f40
push str.portNumber:__d_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
lea eax, [esp + 0xa8]
mov ecx, str.C:UsersUserDownloadspdf_for_test.pdf
push eax
lea edx, [esp + 0x28]
call fcn.00415e70
add esp, 4
mov edi, eax
push dword [esp + 0x24]
push str.123_dwSizePdf:__d_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test edi, edi
jne 0x41352d
push str.loadFileW_failed_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push edi
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xa8]
mov ecx, str.hello_x86.exe
push eax
lea edx, [esp + 0x2c]
call fcn.00415e70
add esp, 4
mov dword [esp + 0x14], eax
push dword [esp + 0x28]
push str._dwPayloadSize:__d_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
cmp dword [esp + 0x14], 0
jne 0x4135cb
push str.loadFileW_failed_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xa8]
call fcn.00416790
test eax, eax
jne 0x413618
push str.generateTempFileName_failed_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.saveAndRunPdf_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
push str.checkHeaders_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
mov ecx, dword [esp + 0x14]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x413693
push str.not_MZ
jmp 0x4136f5
mov eax, dword [ecx + 0x3c]
add ecx, eax
push eax
push str.e_lfnew:__x_n
push 0x100000
push 0x420410
mov dword [esp + 0x20], ecx
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
mov eax, dword [esp + 0x10]
mov ecx, 0x4550
cmp word [eax], cx
je 0x4136e5
push str.not_PE
jmp 0x4136f5
mov ecx, 0x14c
cmp word [eax + 4], cx
je 0x413760
push str.machine_is_not_HOST_MACHINE
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
push str.Header_is_not_OK_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.loadSections_n
xorps xmm0, xmm0
push 0x100000
push 0x420410
movlpd qword [esp + 0x24], xmm0
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xa8]
push eax
lea edx, [esp + 0x1c]
call fcn.00413eb0
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4137f9
push str.loadSections_failed_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push str.baseAddress_after_loadSections:__p_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
push dword [esp + 0x18]
push str.baseDif_after_loadSections:__p_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
mov ecx, dword [esp + 0x18]
mov eax, ecx
mov edx, dword [esp + 0x1c]
or eax, edx
mov esi, dword [esp + 0x10]
je 0x4138c3
push edx
push ecx
mov ecx, esi
call fcn.004163d0
add esp, 8
test eax, eax
jne 0x4138c3
push str.fixRelocationTable_failed_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0xa8]
mov ecx, esi
call fcn.00415990
test eax, eax
jne 0x413912
push str.resolveImportTable_failed_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x3c]
movzx edi, word [eax + ecx + 0x16]
push edi
push str.characteristics:__x_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
test edi, 0x2000
je 0x413a07
mov edi, dword [ecx + eax + 0x28]
add edi, dword [esp + 0x10]
push edi
push str.dll_oep:__p_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 1
push dword [esp + 0x18]
call edi
add esp, 0xc
test eax, eax
jne 0x4139fb
push str.dllEntryPoint_failed_n_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x138
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ebx, word [ecx + eax + 0x16]
push ebx
push str.characteristics:__x_n
push 0x100000
push 0x420410
call fcn.00401010
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call edi
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test bl, 2
je 0x413b5b
push str.is_exe_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x28]
test eax, eax
jne 0x413ad8
push str.oep_getProcAddress_failed_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call edi
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, dword [esp + 0x10]
push eax
push str.oep:__p_n
push 0x100000
push 0x420410
mov dword [esp + 0x20], eax
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call edi
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
push dword [esp + 0x2c]
call dword [esp + 0x14]
add esp, 4
push str.foo_end_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call edi
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.neither_.exe_nor_.dll_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call edi
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.generate_random_key_reg_failed_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.generate_random_rng_first_failed__n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebx
push 0
push 0x420408
push esi
push 0x420410
push eax
call edi
pop edi
pop esi
mov eax, 0xfffffff5
pop ebx
mov esp, ebp
pop ebp
ret