Function at 0x416ad0
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x45c4b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0xf4]
mov ecx, dword [eax + 0x298]
push edi
mov edi, dword [eax + 0x294]
test edi, edi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x50], edi
jne 0x416b15
xor eax, eax
jmp 0x416b7c
mov eax, dword [edi + 0x48]
test eax, eax
jne 0x416b23
mov eax, 1
jmp 0x416b7c
mov eax, dword [esp + 0xcc]
test eax, eax
mov byte [esp + 0xb], 0
je 0x416b3b
lea ecx, [ebx + 0x60]
call fcn.00405390
mov edx, dword [edi + 0x48]
push ebp
push esi
push 0x2c
lea ecx, [ebx + 0x60]
push edx
call fcn.004043a0
mov ebp, eax
test ebp, ebp
jne 0x416b95
push str.Error:_Could_not_locate_TOC_Extensions__ROMPID__r_n_Is_this_a_part_of_multixip__
push 0x4753f0
call fcn.0040bd40
add esp, 8
mov dword [ebx + 0x5c], 1
mov byte [esp + 0x13], 1
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, cl
sete al
pop esi
pop ebp
mov ecx, dword [esp + 0xbc]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0xc0
ret 4
mov edx, dword [ebx + 0x110]
mov eax, dword [edi + 0x48]
push edx
mov edx, dword [str.0_2_ROMHDR_Ext_]
push 0
push 0
push 0
push 0
push edx
push 0x2c
lea ecx, [ebx + 0x128]
push eax
call fcn.004168a0
push str.ROMHDR_Extensions______________________________
push 0x4753f0
call fcn.0040bd40
add esp, 8
xor esi, esi
mov eax, dword [ebp + esi*4]
push eax
push esi
push str.____PID__d___0x_08X
push 0x4753f0
call fcn.0040bd40
add esp, 0x10
inc esi
cmp esi, 0xa
jl 0x416bd0
mov ecx, dword [ebp + 0x28]
lea esi, [ebp + 0x28]
push ecx
push str.____Next:__08x
push 0x4753f0
mov dword [esp + 0x34], esi
call fcn.0040bd40
mov esi, dword [esi]
add esp, 0xc
test esi, esi
mov dword [esp + 0x24], 0
je 0x41746d
lea ecx, [ecx]
mov ecx, dword [esp + 0x24]
push esi
inc ecx
push str._r_n_______Location:__08x
push 0x4753f0
mov dword [esp + 0x30], ecx
call fcn.0040bd40
mov edx, dword [esp + 0x34]
mov eax, dword [edx]
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 0x2c
push eax
add ecx, 0x60
call fcn.004043a0
mov ebp, eax
test ebp, ebp
je 0x4174a6
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 0x110]
mov edx, dword [str.N_2_ROMHDR_Ext]
xor ecx, ecx
add ebx, 0x128
mov dword [esp + 0x74], esi
mov esi, dword [ebx + 8]
mov dword [esp + 0x90], eax
mov dword [esp + 0x7c], edx
mov edx, dword [esp + 0x24]
push 0xffffffffffffffff
lea eax, [esi + 1]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], ecx
push eax
mov ecx, ebx
mov dword [esp + 0x80], 0x2c
mov dword [esp + 0x88], ebp
mov dword [esp + 0x8c], edx
call fcn.00415920
mov edx, dword [ebx + 4]
lea ecx, [esi + esi*8]
lea edi, [edx + ecx*4]
lea eax, [ebp + 0x28]
mov ecx, 9
lea esi, [esp + 0x70]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
push eax
push ecx
push ebp
push str.____Name:___24s_r_n____Type:______08x_r_n____pData:_____08x_r_n____Length:____08x_r_n____Reserved:__08x_r_n____Next:______08x
push 0x4753f0
call fcn.0040bd40
add esp, 0x20
mov edi, str.chain_information
mov esi, ebp
mov ecx, 0x12
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4173a3
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x1c]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
add ecx, 0x60
call fcn.004043a0
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x416d3e
push str.chain_information_data_not_found_
jmp 0x4173c2
mov eax, dword [esp + 0x14]
mov esi, dword [eax + 0x110]
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [esp + 0x9c], ecx
mov ecx, dword [str.0_F_chain_information]
mov dword [esp + 0xb4], esi
mov esi, dword [ebx + 8]
mov dword [esp + 0x98], edx
push 0xffffffffffffffff
lea edx, [esi + 1]
mov dword [esp + 0xa4], ecx
push edx
mov ecx, ebx
mov dword [esp + 0x9c], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
call fcn.00415920
mov ecx, dword [ebx + 4]
lea eax, [esi + esi*8]
lea edi, [ecx + eax*4]
xor eax, eax
mov ecx, 9
lea esi, [esp + 0x94]
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0x1b], 0
mov dword [esp + 0x3c], 0x463634
mov dword [esp + 0x40], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0xcc], eax
mov ebp, dword [ebp + 0x20]
shr ebp, 4
cmp ebp, eax
mov dword [esp + 0x54], ebp
mov dword [esp + 0x2c], eax
jbe 0x417376
mov ebp, dword [esp + 0x1c]
add ebp, 0xa
mov dword [esp + 0x20], ebp
mov edx, dword [ebp + 2]
movzx ebx, word [ebp]
movzx eax, word [ebp - 2]
mov esi, dword [ebp - 0xa]
mov edi, dword [ebp - 6]
push edx
mov edx, dword [esp + 0x30]
push ebx
push eax
lea ecx, [edi + esi]
push ecx
push edi
push esi
push edx
push str.____chain_data__d_:_r_n______Addr:______08x_r_n______MaxLength:_08x_______08x__r_n______Order:_____04x_r_n______Flags:_____04x_r_n______reserved:__08x
push 0x4753f0
call fcn.0040bd40
add esp, 0x24
test bl, 1
jne 0x417174
push esi
push str._________Location:__08x
push 0x4753f0
call fcn.0040bd40
add esp, 0xc
test esi, esi
jne 0x416e70
push str.______Error:_bad_address___
push 0x4753f0
call fcn.0040bd40
add esp, 8
mov byte [esp + 0x13], 1
jmp 0x4171ac
mov edi, dword [esp + 0x14]
push 4
push esi
lea ecx, [edi + 0x60]
call fcn.004043a0
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x50], ebx
je 0x417135
mov eax, dword [ebx]
cmp eax, 8
jae 0x417135
mov edx, dword [str.0_I_xipchain_entries]
imul eax, eax, 0x290
add eax, 4
mov edi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x110]
push ecx
push 0
push 0
push 0
push 0
push edx
push edi
push esi
lea ecx, [eax + 0x128]
call fcn.004168a0
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x416ef5
mov ecx, dword [esp + 0x14]
push 0
push esi
add ecx, 0x60
call fcn.00405aa0
mov ecx, dword [esp + 0x14]
push 1
add edi, esi
push edi
add ecx, 0x60
call fcn.00405aa0
mov eax, dword [ebx]
push eax
push str._______Num_XIPCHAIN_ENTRY___d
push 0x4753f0
call fcn.0040bd40
mov ebx, dword [ebx]
add esp, 0xc
cmp ebx, 1
jbe 0x416f16
mov byte [esp + 0x1b], 1
test ebx, ebx
mov dword [esp + 0x34], 0
jbe 0x4171ac
add esi, 4
mov dword [esp + 0x30], esi
lea ecx, [ecx]
mov ecx, dword [esp + 0x30]
push 0x290
push ecx
mov ecx, dword [esp + 0x1c]
add ecx, 0x60
call fcn.004043a0
mov ebp, eax
test ebp, ebp
je 0x417118
mov bx, word [ebp + 0xe]
test bl, 2
mov dword [esp + 0x1c], str.ROMXIP_IS_SIGNED
jne 0x416f69
mov dword [esp + 0x1c], 0x45f743
test bl, 1
mov edx, str.ROMXIP_OK_TO_LOAD
jne 0x416f78
mov edx, 0x45f743
mov edi, dword [ebp + 0x38]
push edi
mov edi, dword [ebp + 0x34]
push edi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp]
mov esi, dword [ebp + 4]
lea edi, [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
push edi
mov edi, dword [esp + 0x2c]
push edi
push edx
movzx edx, bx
push edx
movzx edx, word [ebp + 0xc]
push edx
lea edx, [eax + ecx]
push edx
mov edx, dword [esp + 0x58]
push ecx
lea ecx, [esi + eax]
push ecx
push esi
push eax
push edx
push str._______XIPCHAIN_ENTRY__d_:_r_n_________pvAddr:______08x_r_n_________dwLength:____08x_______08x__r_n_________dwMaxLength:_08x_______08x__r_n_________usOrder:_____04x_r_n_________usFlags:_____04x__s__s_r_n_________dwVersion:___08x_r_n_________szName:______s_r_n_________dwAlgoFlags:_08x_r_n_________dwKeyLen:____08x
push 0x4753f0
call fcn.0040bd40
mov eax, dword [esp + 0x114]
mov edi, dword [esp + 0x54]
add esp, 0x40
test eax, eax
je 0x417007
mov eax, dword [ebp]
push 0
lea esi, [edi + 0x60]
push eax
mov ecx, esi
call fcn.00405aa0
mov ecx, dword [ebp]
add ecx, dword [ebp + 4]
push 1
push ecx
mov ecx, esi
call fcn.00405aa0
mov eax, dword [ebp + 4]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp]
sub edx, eax
add ecx, eax
push edx
push ecx
mov ecx, esi
call fcn.00405b70
mov edx, dword [edi + 0xf4]
mov eax, dword [ebp]
mov ecx, dword [edx]
xor ebx, ebx
cmp eax, ecx
jne 0x41702c
push str.__________Main_XIP
push 0x4753f0
call fcn.0040bd40
add esp, 8
jmp 0x417043
mov ebx, dword [edi + 0xf8]
push 0xffffffffffffffff
lea ecx, [ebx + 1]
push ecx
lea ecx, [edi + 0xf0]
call fcn.00415b80
mov eax, dword [esp + 0x14]
imul ebx, ebx, 0x2c4
mov edi, dword [eax + 0xf4]
add edi, ebx
mov ecx, 0xa4
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp]
push 4
add edx, 0x40
push edx
lea ecx, [eax + 0x60]
call fcn.004043a0
test eax, eax
jne 0x41708b
mov eax, dword [ebp]
push eax
push str.Warning:_probably_bad_address:__08x
push 0x4753f0
call fcn.0040bd40
add esp, 0xc
jmp 0x4170cb
cmp dword [eax], 0x43454345
jne 0x4170b9
push str.____________ROM_SIGNATURE__ECEC_
push 0x4753f0
call fcn.0040bd40
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 0xf4]
mov dword [ebx + edx + 0x290], 1
jmp 0x4170c8
push str.____________unknown_type
push 0x4753f0
call fcn.0040bd40
add esp, 8
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 4]
jae 0x4170ea
push str.ERROR:_dwLength___dwMaxLength
push 0x4753f0
call fcn.0040bd40
add esp, 8
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x50]
mov edx, dword [ecx]
inc eax
add esi, 0x290
cmp eax, edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], esi
jb 0x416f30
mov ebp, dword [esp + 0x20]
jmp 0x4171ac
push str.XIPCHAIN_ENTRY_Error_
push 0x4753f0
call fcn.0040bd40
mov ebp, dword [esp + 0x28]
add esp, 8
mov byte [esp + 0x13], 1
jmp 0x4171ac
push str.Error:_bad_address_or_a_part_of_multixip
push str._______s
push 0x4753f0
call fcn.0040bd40
mov eax, dword [edi + 0x1a0]
add esp, 0xc
cmp eax, 1
jne 0x416e66
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x416e66
push str.______Try_to_load_with_Options____nb0:_last_record_end__Image_End
jmp 0x416e59
mov ebx, dword [esp + 0x44]
mov dx, word [ebp - 2]
push 0xffffffffffffffff
lea eax, [ebx + 1]
push eax
lea ecx, [esp + 0x44]
mov word [esp + 0xc8], dx
call fcn.00415f60
mov edx, dword [esp + 0x40]
lea ecx, [ebx + ebx*2]
lea eax, [edx + ecx*4]
mov ecx, dword [esp + 0xc0]
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x54]
inc eax
add ebp, 0x10
cmp eax, ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], ebp
jb 0x416e03
mov al, byte [esp + 0x1b]
test al, al
je 0x417376
push str.multiXIP_detected
push 0x4753f0
call fcn.0040bd40
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x4c]
mov eax, dword [edx + 0xf8]
add esp, 8
cmp edi, eax
je 0x417214
push str.Error:_number_of_chain_data_flag1_must_be_equal_to_number_of_XIPCHAIN_ENTRY
push 0x4753f0
call fcn.0040bd40
add esp, 8
mov byte [esp + 0x13], 1
jmp 0x417376
lea ecx, [esp + 0x5c]
call fcn.0043b5d0
mov byte [esp + 0xcc], 1
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x64]
call fcn.0043b2c0
test edi, edi
jle 0x417337
mov ebx, dword [esp + 0x40]
lea eax, [ebx + 8]
xor ebp, ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edi
lea ebx, [ebx]
mov ecx, dword [esp + 0x14]
mov esi, dword [ecx + 0xf4]
mov ax, word [esi + ebp + 0xc]
add esi, ebp
cmp ax, 1
jb 0x417279
movzx ecx, ax
cmp ecx, edi
jg 0x417279
mov edx, dword [esp + 0x60]
mov byte [edx + ecx - 1], 1
jmp 0x417295
movzx eax, ax
push eax
push edi
push str.Error:_XIPCHAIN_ENTRY::usOrder_must_be_1..._d___d_
push 0x4753f0
call fcn.0040bd40
add esp, 0x10
mov byte [esp + 0x13], 1
mov ecx, dword [esp + 0x20]
movzx eax, word [ecx]
cmp eax, edi
jl 0x4172c2
movzx edx, word [esi + 0xc]
push edx
lea eax, [edi - 1]
push eax
push str.Error:_XIPCHAIN_SUMMARY::usOrder_must_be_0..._d___d_
push 0x4753f0
call fcn.0040bd40
add esp, 0x10
mov byte [esp + 0x13], 1
jmp 0x4172ca
mov ecx, dword [esp + 0x60]
or byte [eax + ecx], 2
mov edx, dword [esi]
xor eax, eax
mov ecx, ebx
cmp dword [ecx], edx
je 0x4172e8
inc eax
add ecx, 0xc
cmp eax, edi
jl 0x4172d0
mov ecx, dword [esi + 8]
push ecx
push edx
push str.Error:_no_appropriate_chain_data___found_for_XIPCHAIN_ENTRY__X__X
jmp 0x417305
lea edx, [eax + eax*2]
mov eax, dword [ebx + edx*4 + 4]
lea ecx, [ebx + edx*4]
cmp eax, dword [esi + 8]
jb 0x4172fc
cmp eax, dword [esi + 4]
jae 0x417317
push eax
mov eax, dword [ecx]
push eax
push str.Error:_chain_data___MaxLength_must_not_be_lower_XIPCHAIN_ENTRY_lengths:__X__X
push 0x4753f0
call fcn.0040bd40
add esp, 0x10
mov byte [esp + 0x13], 1
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add ecx, 0xc
add ebp, 0x2c4
dec eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
jne 0x417250
xor eax, eax
test edi, edi
jle 0x417365
mov ecx, dword [esp + 0x60]
cmp byte [ecx + eax], 3
jne 0x41734e
inc eax
cmp eax, edi
jl 0x417341
jmp 0x417365
push str.Error:_usOrder_sequence_is_wrong
push 0x4753f0
call fcn.0040bd40
add esp, 8
mov byte [esp + 0x13], 1
mov byte [esp + 0xcc], 0
lea ecx, [esp + 0x5c]
call fcn.0043b5f0
mov dword [esp + 0xcc], 0xffffffff
mov eax, dword [esp + 0x40]
test eax, eax
mov dword [esp + 0x3c], 0x463634
je 0x417457
push eax
call fcn.0042dc47
add esp, 4
jmp 0x417457
mov ecx, dword [ebp + 0x20]
mov esi, dword [esp + 0x14]
mov edx, dword [ebp + 0x1c]
push ecx
lea edi, [esi + 0x60]
push edx
mov ecx, edi
call fcn.004043a0
test eax, eax
jne 0x4173d9
push str.Error:_ROMHDR_ext_data_not_found_
push 0x4753f0
call fcn.0040bd40
add esp, 8
mov byte [esp + 0x13], 1
jmp 0x417457
mov eax, dword [ebp + 0x20]
test eax, eax
jne 0x4173e7
mov ecx, dword [ebp + 0x24]
test ecx, ecx
jne 0x41740b
mov ecx, dword [esi + 0x110]
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [str.N_2_ROMHDR_Ext_data]
push 0
push 0
push edx
mov edx, dword [ebp + 0x1c]
push ebp
push ecx
push eax
push edx
mov ecx, ebx
call fcn.004168a0
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
cmp ecx, eax
jae 0x417457
sub eax, ecx
push eax
mov eax, dword [ebp + 0x1c]
add eax, ecx
push eax
mov ecx, edi
call fcn.004043a0
test eax, eax
je 0x417457
mov ecx, dword [esi + 0x110]
mov edx, dword [esp + 0x24]
mov eax, dword [ebp + 0x20]
push ecx
mov ecx, dword [str.N_2_ROMHDR_Ext_data_reserved]
push 0
push 0
push edx
mov edx, dword [ebp + 0x24]
push ebp
push ecx
mov ecx, dword [ebp + 0x1c]
sub edx, eax
add ecx, eax
push edx
push ecx
mov ecx, ebx
call fcn.004168a0
mov edx, dword [esp + 0x28]
mov esi, dword [edx]
test esi, esi
jne 0x416c20
mov edi, dword [esp + 0x58]
mov ebx, dword [esp + 0x14]
mov eax, dword [edi + 0x48]
push 4
sub eax, 4
lea esi, [ebx + 0x60]
push eax
mov ecx, esi
call fcn.004043a0
mov ecx, dword [edi + 0x48]
push ecx
push str._r_nsearching_pTOC_pointer_just_before_TOC_extension_in_NK.EXE____08X
push 0x4753f0
mov ebp, eax
call fcn.0040bd40
add esp, 0xc
test ebp, ebp
jne 0x4174bf
push str.ERROR:_Couldnt_locate_NK.EXE_pTOC_Pointer
jmp 0x41755e
push str.Couldnt_locate_TOC_Extension__ROMPID_
push 0x4753f0
call fcn.0040bd40
add esp, 8
xor eax, eax
jmp 0x416b7a
mov eax, dword [ebp]
mov ecx, dword [esp + 0x38]
cmp eax, ecx
jne 0x4174e1
push str.NK.EXE_pTOC_pointer_found_OK
push 0x4753f0
call fcn.0040bd40
add esp, 8
jmp 0x416b6f
mov edx, eax
xor edx, ecx
test edx, 0xffffff
push eax
jne 0x417505
push str.WARNING:_probably_bad_NK.EXE_pTOC_pointer_:__08X
push 0x4753f0
call fcn.0040bd40
add esp, 0xc
jmp 0x416b6f
push str.ERROR:_NK.EXE_pTOC_pointer___pToc_:__08X
push 0x4753f0
call fcn.0040bd40
push str.Lets_look_a_little_higher...
push 0x4753f0
call fcn.0040bd40
mov eax, dword [edi + 0x48]
add esp, 0x14
push 4
sub eax, 8
push eax
mov ecx, esi
call fcn.004043a0
test eax, eax
je 0x417559
mov ecx, dword [esp + 0x38]
cmp dword [eax], ecx
jne 0x417559
push str.NK.EXE_pTOC_pointer_found_a_little_higher._OK.
push 0x4753f0
call fcn.0040bd40
add esp, 8
jmp 0x416b6f
push str._b_Nope.
push 0x4753f0
call fcn.0040bd40
mov eax, dword [ebx + 0x58]
add esp, 8
test eax, eax
je 0x416b6a
push str.Not_actual_for_non_first_xip_parts
push 0x4753f0
call fcn.0040bd40
add esp, 8
jmp 0x416b6f