Function at 0x41e580
Capabilities:
Allocate or change rwx memory
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0x14
xor ecx, ecx
mov dword [esp + 0x14], 0x5f59d4
call fcn.00527f40
mov esi, eax
mov edi, 0x5a4d
test esi, esi
je 0x41e650
cmp word [esi], di
jne 0x41e5fd
mov eax, dword ds:[esi + 0x3c]
test eax, eax
je 0x41e5fd
cmp eax, 0x7fffffff
jae 0x41e5fd
cmp dword [eax + esi], 0x4550
jne 0x41e5fd
lea edx, ds:[eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x41e5fd
cmp dword [edx + 4], 0
je 0x41e5fd
push 0
add eax, esi
mov ecx, esi
push 0x5f59ec
push eax
call fcn.005281c0
jmp 0x41e5ff
xor eax, eax
mov dword [0x6341d0], eax
mov ecx, esi
mov edx, 0x3c
cmp word [esi], di
jne 0x41e649
mov eax, dword [ecx + edx]
test eax, eax
je 0x41e649
cmp eax, 0x7fffffff
jae 0x41e649
cmp dword [eax + esi], 0x4550
jne 0x41e649
lea edx, [esi + 0x78]
add edx, eax
mov eax, dword [edx]
test eax, eax
je 0x41e649
cmp dword [edx + 4], 0
je 0x41e649
push 0
add eax, esi
push 0x5f59fc
push eax
call fcn.005281c0
jmp 0x41e64b
xor eax, eax
mov dword [0x6341c4], eax
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0x16
xor ecx, ecx
mov dword [esp + 0x14], str.uxtheme.dll
call fcn.00527f40
mov ecx, eax
test ecx, ecx
je 0x41e6ba
cmp word [ecx], di
jne 0x41e6b3
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x41e6b3
lea ecx, [ecx]
cmp eax, 0x7fffffff
jae 0x41e6b3
cmp dword [eax + ecx], 0x4550
jne 0x41e6b3
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x41e6b3
cmp dword [edx + 4], 0
je 0x41e6b3
push 0
add eax, ecx
push str.DrawThemeBackground
push eax
call fcn.005281c0
jmp 0x41e6b5
xor eax, eax
mov dword [0x6341bc], eax
cmp dword [0x636410], 0
je 0x41e6d6
mov esi, 0xc0000476
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x41e838
mov eax, dword fs:[0x18]
mov edx, 0x636410
mov ecx, dword [eax + 0x24]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x41e705
mov esi, 0xc0000476
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
lea esp, [esp]
jmp 0x41e838
mov edi, dword [0x63641c]
mov dword [0x636424], 0
mov dword [0x636420], 0
mov dword [0x636418], 0
test edi, edi
je 0x41e76b
lea ecx, [ecx]
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0x40
lea eax, [esp + 0x14]
mov dword [esp + 0x18], edi
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0x10000
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov esi, eax
test esi, esi
js 0x41e76d
mov edi, dword [edi + 4]
test edi, edi
jne 0x41e730
xor esi, esi
mov dword [0x63640c], esi
test esi, esi
js 0x41e7e8
cmp byte [0x63361f], 0
mov edi, edi
jne 0x41e78b
cmp byte [0x633a34], 0
je 0x41e7bc
sub esp, 0xc
mov edx, 0x41e320
mov ecx, 0x6341bc
call fcn.005334a0
mov esi, eax
test esi, esi
js 0x41e7e8
sub esp, 0xc
mov edx, 0x41e4e0
mov ecx, 0x6341c4
call fcn.005334a0
mov esi, eax
test esi, esi
js 0x41e7e8
sub esp, 0xc
mov edx, 0x41e440
mov ecx, 0x6341d0
call fcn.005334a0
mov esi, eax
test esi, esi
js 0x41e7e8
call fcn.005331e0
mov esi, eax
jmp 0x41e7e0
test esi, esi
jns 0x41e894
cmp esi, 0xc0000022
je 0x41e815
cmp esi, 0xc0000005
je 0x41e815
mov eax, esi
shr eax, 0x10
and eax, 0xfff
cmp eax, 7
jne 0x41e80c
movzx eax, si
jmp 0x41e81f
cmp eax, 0xb
jne 0x41e824
mov eax, esi
jmp 0x41e81f
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
nop
test eax, eax
jne 0x41e82f
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x41e838
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x41e87e
lfence
lfence
push dword [esi + 4]
push 0x5cc39c
push str.Unable_to_commit_detours_transaction.
push 0xfffe
push 0x20
push 0
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x41e894
lfence
call fcn.004fbe40
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.Unable_to_commit_detours_transaction.
push 0x5cc39c
push 0x10
push 0
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret