Function at 0x401570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push esi
push edi
call fcn.00402380
test eax, eax
jne 0x40158b
xor eax, eax
jmp 0x401874
push 0
push 2
call dword [0x402ff0]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xffffffff
jne 0x4015ab
xor eax, eax
jmp 0x401874
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [0x402fe4]
mov byte [ebp - 0x240], 0
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x244]
push eax
call dword [0x402fec]
test eax, eax
je 0x40162d
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp + 8]
jne 0x40162b
lea edi, [ebp - 0x108]
lea edx, [ebp - 0x240]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4015df
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movsx edx, byte [ebp - 0x240]
test edx, edx
jne 0x40164c
xor eax, eax
jmp 0x401874
mov eax, dword [ebp + 8]
push eax
push 8
call dword [0x402ff0]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xffffffff
jne 0x40166e
xor eax, eax
jmp 0x401874
mov ecx, 0x89
xor eax, eax
lea edi, [ebp - 0x468]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x468], 0x224
xor ecx, ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
lea edx, [ebp - 0x468]
push edx
mov eax, dword [ebp - 0x244]
push eax
call dword [0x402fe8]
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x348]
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4016e2
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x450]
mov dword [ebp - 0x138], ecx
lea edx, [ebp - 0x468]
push edx
mov eax, dword [ebp - 0x244]
push eax
call dword [0x402fe0]
test eax, eax
je 0x40172f
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x348]
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x40172d
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x450]
mov dword [ebp - 0x138], ecx
jmp 0x4016e2
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x13c], 0
jne 0x40174c
xor eax, eax
jmp 0x401874
cmp dword [ebp - 0x138], 0x2000
jae 0x401766
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x46c], eax
jmp 0x401770
mov dword [ebp - 0x46c], 0x2000
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40178e
xor eax, eax
jmp 0x401874
mov edx, dword [ebp - 0x46c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x4017b3
xor eax, eax
jmp 0x401874
push 0x402f4c
mov eax, dword [ebp - 0x46c]
push eax
mov ecx, dword [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x13c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x4017ef
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x401874
mov edx, dword [ebp - 0x140]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x5a4d
je 0x401812
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x401874
mov edx, dword [ebp - 0x140]
mov eax, dword [edx + 0x3c]
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
add ecx, dword [ebp - 0x140]
cmp dword [ecx], 0x4550
je 0x401846
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x401874
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x140]
mov ecx, dword [eax + 0x28]
add ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x134]
pop edi
pop esi
mov esp, ebp
pop ebp
ret