Function at 0x50f620
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov edx, 0x630d88
xor ecx, ecx
push ebx
push esi
push edi
call fcn.00527f40
test eax, eax
je 0x50f668
mov edx, 0x630dc8
xor ecx, ecx
call fcn.00527f40
test eax, eax
je 0x50f668
mov edx, 0x630dd0
xor ecx, ecx
call fcn.00527f40
jmp 0x50f660
test eax, eax
jne 0x510045
xor ebx, ebx
mov dword [esp + 0x18], 0
push ebx
push 0x630da0
push 0xfffffffffffffffd
push 0x20019
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], ebx
push eax
call sym.SystemInformer.exe_PhOpenKey
or esi, 0xffffffff
test eax, eax
js 0x50f8f3
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x14
push eax
push dword [esp + 0x10]
mov dword [esp + 0x28], str.KitsRoot10
call sym.SystemInformer.exe_PhQueryRegistryString
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x50f6cc
cmp dword [edi], ebx
jne 0x50f756
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x14
push eax
push dword [esp + 0x10]
mov dword [esp + 0x28], str.KitsRoot81
call sym.SystemInformer.exe_PhQueryRegistryString
mov ecx, edi
mov dword [esp + 0x1c], eax
mov edi, eax
test ecx, ecx
je 0x50f708
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x50f708
call fcn.004fbe40
test edi, edi
je 0x50f710
cmp dword [edi], ebx
jne 0x50f756
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x10
push eax
push dword [esp + 0x10]
mov dword [esp + 0x28], str.KitsRoot
mov dword [esp + 0x18], edi
call sym.SystemInformer.exe_PhQueryRegistryString
mov edi, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], edi
test eax, eax
je 0x50f756
lea ecx, [eax - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x50f756
call fcn.004fbe40
push dword ds:[esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
je 0x50f8f3
mov eax, dword [edi]
add eax, 0x1e
mov dword [esp + 0x14], ebx
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 0
push eax
call sym.SystemInformer.exe_PhCreateString3
push dword [edi]
mov esi, eax
push dword [edi + 4]
mov dword [esp + 0x18], esi
push dword [esi + 4]
call fcn.00581150
mov eax, dword [esp + 0x28]
mov ecx, 7
mov edi, dword [esi + 4]
add esp, 0xc
mov esi, str.Debuggersx86_
add edi, dword [eax]
rep movsd dword es:[edi], dword [esi]
lea ecx, [eax - 8]
movsw word es:[edi], word [esi]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x50f7cb
call fcn.004fbe40
push 0x630d88
push dword [esp + 0x14]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x609600
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x50f8d3
push dword ds:[eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov dword [esp + 0x18], edi
add ecx, 0xfffffff8
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x50f825
lea esp, [esp]
call fcn.004fbe40
test edi, edi
je 0x50f8d5
push 0x630dc8
push dword [esp + 0x14]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x609600
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x50f8d5
push dword ds:[eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov ebx, eax
add ecx, 0xfffffff8
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x50f87d
call fcn.004fbe40
lea ecx, [ecx]
test ebx, ebx
je 0x50f8d5
push 0x630dd0
push dword [esp + 0x14]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x609600
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x50f8d5
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov edx, esi
mov dword [esp + 0x24], eax
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], edx
dec edx
jne 0x50f8d5
call fcn.004fbe40
jmp 0x50f8d5
xor edi, edi
mov ecx, dword [esp + 0x10]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x50f8eb
call fcn.004fbe40
test edi, edi
jne 0x50fa4f
call sym.SystemInformer.exe_PhGetApplicationDirectoryWin32
mov edi, eax
test edi, edi
je 0x50fa0c
push 0x630d88
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x609600
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x50f9a5
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x50f952
call fcn.004fbe40
cmp dword [esp + 0x18], 0
je 0x50f9a5
push 0x630dc8
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x609600
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword ds:[esp + 0x1c], eax
test eax, eax
je 0x50f9a5
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov ebx, eax
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x50f9a5
nop
call fcn.004fbe40
test ebx, ebx
je 0x50f9f3
push 0x630dd0
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
mov dword [esp + 0x2c], 0x609600
call sym.SystemInformer.exe_PhConcatStringRef3
mov dword [esp + 0x1c], eax
test eax, eax
je 0x50f9f3
push dword [eax + 4]
call sym.SystemInformer.exe_PhLoadLibrary
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x50f9f3
call fcn.004fbe40
lea ecx, [edi - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x50fa05
mov edi, edi
call fcn.004fbe40
cmp dword [esp + 0x18], 0
jne 0x50fa4f
push 0x800
push 0
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, edi
test eax, eax
jne 0x50fa4f
push 0x200
push eax
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x50fa4f
cmp dword [0x62dbb0], 0x3e
jae 0x50fa4f
push eax
push eax
push str.dbgcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test ebx, ebx
jne 0x50faa6
push 0x800
push ebx
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x50faa6
push 0x200
push eax
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x50faa6
cmp dword [0x62dbb0], 0x3e
jae 0x50faa4
push eax
push eax
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x50faa6
xor ebx, ebx
cmp dword [esp + 0x24], 0
jne 0x50faef
push 0x800
push 0
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop
test eax, eax
jne 0x50faef
push 0x200
push eax
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x50faef
cmp dword [0x62dbb0], 0x3e
jae 0x50faef
push eax
push eax
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test ebx, ebx
je 0x510045
mov esi, 0x5a4d
cmp word [ebx], si
jne 0x50fb42
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50fb42
cmp eax, 0x7fffffff
jae 0x50fb42
cmp dword [eax + ebx], 0x4550
jne 0x50fb42
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fb42
cmp dword [edx + 4], 0
je 0x50fb42
push 0
add eax, ebx
mov ecx, ebx
push str.SymInitializeW
push eax
call fcn.005281c0
nop
jmp 0x50fb44
xor eax, eax
mov ecx, ebx
mov edx, 0x3c
mov dword [0x6340e0], eax
cmp word [ebx], si
jne 0x50fb93
mov eax, dword [ecx + edx]
test eax, eax
je 0x50fb93
lea esp, [esp]
cmp eax, 0x7fffffff
jae 0x50fb93
cmp dword [eax + ebx], 0x4550
jne 0x50fb93
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fb93
cmp dword [edx + 4], 0
je 0x50fb93
push 0
add eax, ebx
push str.SymCleanup
push eax
call fcn.005281c0
jmp 0x50fb95
xor eax, eax
mov dword [0x6340e8], eax
cmp word [ebx], si
jne 0x50fbdd
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50fbdd
cmp eax, 0x7fffffff
jae 0x50fbdd
cmp dword [eax + ebx], 0x4550
jne 0x50fbdd
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fbdd
cmp dword [edx + 4], 0
je 0x50fbdd
push 0
add eax, ebx
mov ecx, ebx
push str.SymFromAddrW
push eax
call fcn.005281c0
jmp 0x50fbdf
xor eax, eax
mov dword [0x634110], eax
cmp word [ebx], si
jne 0x50fc27
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50fc27
cmp eax, 0x7fffffff
jae 0x50fc27
cmp dword ds:[eax + ebx], 0x4550
jne 0x50fc27
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fc27
cmp dword [edx + 4], 0
je 0x50fc27
push 0
add eax, ebx
mov ecx, ebx
push str.SymFromNameW
push eax
call fcn.005281c0
jmp 0x50fc29
xor eax, eax
mov dword [0x6340f0], eax
cmp word [ebx], si
jne 0x50fc75
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50fc75
lea ebx, [ebx]
cmp eax, 0x7fffffff
jae 0x50fc75
cmp dword [eax + ebx], 0x4550
jne 0x50fc75
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fc75
cmp dword [edx + 4], 0
je 0x50fc75
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetLineFromAddrW64
push eax
call fcn.005281c0
jmp 0x50fc77
xor eax, eax
mov dword [0x6340ec], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x50fcc2
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50fcc2
cmp eax, 0x7fffffff
jae 0x50fcc2
cmp dword [eax + ebx], 0x4550
jne 0x50fcc2
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fcc2
cmp dword [edx + 4], 0
je 0x50fcc2
push 0
add eax, ebx
mov ecx, ebx
push str.SymLoadModuleExW
push eax
call fcn.005281c0
nop
jmp 0x50fcc4
xor eax, eax
mov dword [0x6340f4], eax
cmp word [ebx], si
jne 0x50fd0a
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50fd0a
cmp eax, 0x7fffffff
jae 0x50fd0a
cmp dword [eax + ebx], 0x4550
jne 0x50fd0a
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fd0a
cmp dword [edx + 4], 0
je 0x50fd0a
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetOptions
push eax
call fcn.005281c0
jmp 0x50fd0c
xor eax, eax
mov dword [0x63411c], eax
cmp word [ebx], si
jne 0x50fd55
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50fd55
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x50fd55
cmp dword [eax + ebx], 0x4550
jne 0x50fd55
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fd55
cmp dword [edx + 4], 0
je 0x50fd55
push 0
add eax, ebx
mov ecx, ebx
push str.SymSetOptions
push eax
call fcn.005281c0
jmp 0x50fd57
xor eax, eax
mov dword [0x634100], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x50fda2
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50fda2
cmp eax, 0x7fffffff
jae 0x50fda2
cmp dword [eax + ebx], 0x4550
jne 0x50fda2
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fda2
cmp dword [edx + 4], 0
je 0x50fda2
push 0
add eax, ebx
mov ecx, ebx
push str.SymSetSearchPathW
push eax
call fcn.005281c0
nop
jmp 0x50fda4
xor eax, eax
mov dword [0x634120], eax
cmp word [ebx], si
jne 0x50fdea
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50fdea
cmp eax, 0x7fffffff
jae 0x50fdea
cmp dword [eax + ebx], 0x4550
jne 0x50fdea
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fdea
cmp dword [edx + 4], 0
je 0x50fdea
push 0
add eax, ebx
mov ecx, ebx
push str.SymFunctionTableAccess64
push eax
call fcn.005281c0
jmp 0x50fdec
xor eax, eax
mov dword [0x634118], eax
cmp word [ebx], si
jne 0x50fe35
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50fe35
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x50fe35
cmp dword [eax + ebx], 0x4550
jne 0x50fe35
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fe35
cmp dword [edx + 4], 0
je 0x50fe35
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetModuleBase64
push eax
call fcn.005281c0
jmp 0x50fe37
xor eax, eax
mov dword [0x6340e4], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x50fe82
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50fe82
cmp eax, 0x7fffffff
jae 0x50fe82
cmp dword [eax + ebx], 0x4550
jne 0x50fe82
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fe82
cmp dword [edx + 4], 0
je 0x50fe82
push 0
add eax, ebx
mov ecx, ebx
push str.SymRegisterCallbackW64
push eax
call fcn.005281c0
nop
jmp 0x50fe84
xor eax, eax
mov dword [0x6340fc], eax
cmp word [ebx], si
jne 0x50feca
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50feca
cmp eax, 0x7fffffff
jae 0x50feca
cmp dword [eax + ebx], 0x4550
jne 0x50feca
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50feca
cmp dword [edx + 4], 0
je 0x50feca
push 0
add eax, ebx
mov ecx, ebx
push str.StackWalk64
push eax
call fcn.005281c0
jmp 0x50fecc
xor eax, eax
mov dword [0x634104], eax
cmp word [ebx], si
jne 0x50ff15
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50ff15
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x50ff15
cmp dword [eax + ebx], 0x4550
jne 0x50ff15
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50ff15
cmp dword [edx + 4], 0
je 0x50ff15
push 0
add eax, ebx
mov ecx, ebx
push str.StackWalkEx
push eax
call fcn.005281c0
jmp 0x50ff17
xor eax, eax
mov dword [0x63410c], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x50ff62
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50ff62
cmp eax, 0x7fffffff
jae 0x50ff62
cmp dword [eax + ebx], 0x4550
jne 0x50ff62
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50ff62
cmp dword [edx + 4], 0
je 0x50ff62
push 0
add eax, ebx
mov ecx, ebx
push str.SymFromInlineContextW
push eax
call fcn.005281c0
nop
jmp 0x50ff64
xor eax, eax
mov dword [0x6340f8], eax
cmp word [ebx], si
jne 0x50ffaa
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50ffaa
cmp eax, 0x7fffffff
jae 0x50ffaa
cmp dword [eax + ebx], 0x4550
jne 0x50ffaa
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50ffaa
cmp dword [edx + 4], 0
je 0x50ffaa
push 0
add eax, ebx
mov ecx, ebx
push str.SymGetLineFromInlineContextW
push eax
call fcn.005281c0
jmp 0x50ffac
xor eax, eax
mov dword [0x634114], eax
cmp word [ebx], si
jne 0x50fff5
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x50fff5
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x50fff5
cmp dword [eax + ebx], 0x4550
jne 0x50fff5
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x50fff5
cmp dword [edx + 4], 0
je 0x50fff5
push 0
add eax, ebx
mov ecx, ebx
push str.MiniDumpWriteDump
push eax
call fcn.005281c0
jmp 0x50fff7
xor eax, eax
mov dword [0x634108], eax
lea esp, [esp]
cmp word [ebx], si
jne 0x510045
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x510045
cmp eax, 0x7fffffff
jae 0x510045
cmp dword ds:[eax + ebx], 0x4550
jne 0x510045
lea edx, [eax + 0x78]
mov eax, dword [edx + ebx]
add edx, ebx
test eax, eax
je 0x510045
cmp dword [edx + 4], 0
je 0x510045
push 0
add eax, ebx
mov ecx, ebx
push str.UnDecorateSymbolNameW
push eax
call fcn.005281c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret