Function at 0x10003030
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x44
mov eax, dword [0x10005004]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
mov ebp, ecx
mov esi, edx
push edi
test ebp, ebp
je 0x10003306
test esi, esi
je 0x10003306
push 0x40
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x2e
push ebp
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
mov edi, eax
add esp, 8
test edi, edi
je 0x100032ee
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
push str..vbs
push edi
call ebx
add esp, 8
test eax, eax
jne 0x1000309e
mov dword [esi + 0x14], 5
mov dword [esi + 0x18], 0xffffffff
jmp 0x1000310e
push 0x1000b5b8
push edi
call ebx
add esp, 8
test eax, eax
jne 0x100030bd
mov dword [esi + 0x14], 6
mov dword [esi + 0x18], 0xffffffff
jmp 0x1000310e
push str..xsl
push edi
call ebx
add esp, 8
test eax, eax
jne 0x100030dc
mov dword [esi + 0x14], 7
mov dword [esi + 0x18], 0xffffffff
jmp 0x1000310e
push str..exe
push edi
call ebx
add esp, 8
test eax, eax
jne 0x100030f4
mov dword [esi + 0x14], 4
jmp 0x1000310e
push str..dll
push edi
call ebx
add esp, 8
test eax, eax
jne 0x100032ee
mov dword [esi + 0x14], 3
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 8
test eax, eax
je 0x10003139
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10001000
add esp, 0x44
ret
cmp dword [esp + 0x2c], 0
jne 0x10003158
mov eax, 2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10001000
add esp, 0x44
ret
push 0
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__open]
mov ecx, eax
add esp, 8
mov dword [esi], ecx
test ecx, ecx
jns 0x10003184
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10001000
add esp, 0x44
ret
mov eax, dword [esp + 0x2c]
cdq
mov ebx, eax
mov dword [esi + 0xc], edx
push ecx
mov dword [esi + 8], ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
add esp, 4
push 0
push ebx
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
jne 0x100031b8
or edx, 0xffffffff
or eax, edx
jmp 0x100031d8
push ebx
push 0
push 0
push 5
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
test edx, edx
jne 0x100031d6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or edx, 0xffffffff
mov eax, edx
lea ebx, [esi + 0x10]
xor ebp, ebp
mov ecx, ebx
mov dword [ecx], eax
mov eax, dword [esi + 0x14]
cmp eax, 3
je 0x100031f2
cmp eax, 4
jne 0x100032d9
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x100032c2
mov eax, dword [edx + 0x3c]
test eax, eax
je 0x100032c2
cmp dword [eax + edx], 0x4550
lea edi, [eax + edx]
jne 0x100032c2
mov ecx, edx
call fcn.100034d0
test eax, eax
je 0x100032c2
mov edx, dword [eax + 0x70]
xor eax, eax
movzx ecx, word [edi + 0x16]
mov dword [esp + 0x14], edx
and ecx, 0x2000
mov edx, 0x14c
cmp word [edi + 4], dx
setne al
inc eax
mov dword [esi + 0x18], eax
cmp dword [esp + 0x14], ebp
je 0x100032d9
neg ecx
lea edi, [esi + 0x1c]
push 0x1f
sbb ecx, ecx
add ecx, 2
push str.v4.0.30319
push edi
mov dword [esi + 0x14], ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov esi, dword [ebx]
add esp, 0xc
mov edx, dword [esp + 0x14]
mov ecx, esi
call fcn.10003440
cmp eax, 0xffffffff
je 0x100032d9
mov edx, dword [esi + eax + 8]
test edx, edx
je 0x100032d9
mov ecx, esi
call fcn.10003440
cmp eax, 0xffffffff
je 0x100032d9
add eax, 0x10
push 0x1f
add eax, esi
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10001000
add esp, 0x44
ret
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
add esp, 4
mov ebp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10001000
add esp, 0x44
ret
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10001000
add esp, 0x44
ret
mov ecx, dword [esp + 0x4c]
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001000
add esp, 0x44
ret