Function at 0x7d22169a
Capabilities:
Parse pe header

Disassembly:
jmp 0x7d224ec0
mov eax, 0x201ac
call sub.ntdll.dll__chkstk
push ebx
push ebp
push esi
mov esi, dword [esp + 0x201c8]
lea eax, [esp + 0x1b8]
push edi
mov edi, dword [esp + 0x201c8]
xorps xmm0, xmm0
push 0
push 0x10000
push eax
push esi
push edi
push dword [esp + 0x201d8]
movlpd qword [esp + 0x34], xmm0
call dword [esp + 0x201d8]
mov eax, dword [esp + 0x201d0]
mov dl, byte [eax]
lea ecx, [eax + 1]
cmp dl, 0x23
mov byte [esp + 0x13], dl
cmovne ecx, eax
cmp dword [ecx], 0x2b505845
lea eax, [ecx + 4]
sete bl
test bl, bl
cmove eax, ecx
mov ecx, 0x4d5a
mov dword [esp + 0x18], eax
mov ax, word [esp + 0x1bc]
cmp ax, cx
je 0x7d224f4b
mov ecx, 0x5a4d
cmp ax, cx
jne 0x7d224f66
lea ebp, [esp + 0x1bc]
add ebp, dword [esp + 0x1f8]
mov dword [esp + 0x14], ebp
cmp dword [ebp], 0x4550
je 0x7d224f77
pop edi
pop esi
pop ebp
xor eax, eax
xor edx, edx
pop ebx
add esp, 0x201ac
ret 0x14
movzx eax, word [ebp + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x7d224fc0
cmp dword [ebp + 0x74], 0
je 0x7d225285
push ebp
push dword [esp + 0x1c]
lea eax, [ebp + 0x78]
push eax
mov eax, dword [esp + 0x201d0]
push esi
push edi
push eax
mov eax, dword [esp + 0x201d8]
push eax
call fcn.7d221be5
mov edi, eax
mov ebx, edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x201ac
ret 0x14
mov ecx, 0x20b
cmp ax, cx
jne 0x7d225285
cmp dword [ebp + 0x84], 0
je 0x7d225285
cmp dl, 0x23
jne 0x7d22502c
mov ecx, dword [ebp + 0xd8]
test ecx, ecx
je 0x7d22502c
mov eax, dword [ebp + 0xdc]
cmp eax, 0xd0
jb 0x7d22502c
mov edx, 0x140
push 0
cmp eax, edx
cmova eax, edx
push eax
lea eax, [esp + 0x84]
push eax
push esi
push edi
push ebp
push ecx
call fcn.7d2211ae
push edx
push eax
mov eax, dword [esp + 0x201d8]
push eax
mov eax, dword [esp + 0x201d8]
call eax
mov dl, byte [esp + 0x13]
mov eax, edi
or eax, esi
jne 0x7d22514f
cmp dl, 0x23
je 0x7d225043
test bl, bl
je 0x7d22514f
movzx eax, word [esp + 0x160]
push 0
push 0
push ebp
lea ecx, [eax + eax*4]
movzx eax, word [ebp + 0x14]
add eax, ebp
push dword [eax + ecx*8 - 4]
lea esi, [eax + ecx*8]
call fcn.7d2211ae
mov ecx, dword [esi - 8]
mov esi, 0x10000
cmp ecx, esi
push 0
cmova ecx, esi
push ecx
lea ecx, [esp + 0x101c4]
push ecx
push edx
push eax
push dword [esp + 0x201d8]
call dword [esp + 0x201d8]
lea ecx, [esp + 0x101bc]
add ecx, dword [esp + 0x15c]
mov dword [esp + 0x28], ecx
mov eax, dword [ecx + 0x10]
lea esi, [ecx + 0x14]
add eax, 0x14
add eax, ecx
cmp esi, eax
jae 0x7d225148
mov ebp, esi
add esi, 8
mov dword [esp + 0x24], esi
add dword [ebp + 4], 0xfffffff8
mov eax, dword [ebp + 4]
add eax, esi
cmp esi, eax
jae 0x7d22512d
nop dword [eax + eax]
movzx edi, word [esi]
lea eax, [esp + 0x1c]
mov ebx, edi
add esi, 2
shr ebx, 0xd
xorps xmm0, xmm0
push ebx
push esi
push eax
movlpd qword [esp + 0x28], xmm0
call sub.ntdll.dll_memcpy
and edi, 0xfff
add esp, 0xc
add edi, dword [ebp]
add esi, ebx
cmp edi, 0x10000
jae 0x7d22511e
push ebx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c4]
add eax, edi
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 4]
add eax, dword [esp + 0x24]
cmp esi, eax
jb 0x7d2250d0
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx + 0x10]
add eax, 0x14
add eax, ecx
cmp esi, eax
jb 0x7d2250b2
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x201c8]
mov esi, dword [esp + 0x201cc]
push ebp
push dword [esp + 0x1c]
lea eax, [ebp + 0x88]
push eax
push esi
push edi
push dword [esp + 0x201d8]
push dword [esp + 0x201d8]
call fcn.7d221be5
cmp byte [esp + 0x13], 0x23
mov edi, eax
mov ebx, edx
jne 0x7d22528d
mov ecx, dword [esp + 0x144]
mov eax, ecx
mov edx, dword [esp + 0x148]
or eax, edx
je 0x7d22528d
mov eax, dword [esp + 0x201c8]
or eax, esi
jne 0x7d2251be
sub ecx, dword [ebp + 0x30]
push eax
push eax
push ebp
push ecx
call fcn.7d2211ae
mov ecx, eax
mov dword [esp + 0x148], edx
mov dword [esp + 0x144], ecx
push 0
push 0x50
lea eax, [esp + 0x34]
push eax
push edx
push ecx
push dword [esp + 0x201d8]
call dword [esp + 0x201d8]
mov eax, dword [esp + 0x60]
lea esi, [eax*8]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push esi
mov esi, eax
mov dword [esp + 0x1c], eax
push esi
push dword [esp + 0x201d8]
push dword [esp + 0x201d8]
push ebp
push dword [esp + 0x54]
call fcn.7d2211ae
push edx
push eax
push dword [esp + 0x201d8]
call dword [esp + 0x201d8]
mov ebp, dword [esp + 0x60]
xor eax, eax
test ebp, ebp
je 0x7d225264
mov edx, edi
mov ecx, ebx
sub edx, dword [esp + 0x201c8]
sbb ecx, dword [esp + 0x201cc]
cmp edx, dword [esi + eax*8]
jne 0x7d225249
test ecx, ecx
je 0x7d225250
inc eax
cmp eax, ebp
jb 0x7d225240
jmp 0x7d225264
mov edi, dword [esi + eax*8 + 4]
xor ebx, ebx
add edi, dword [esp + 0x201c8]
adc ebx, dword [esp + 0x201cc]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov edx, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x201ac
ret 0x14
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov eax, edi
mov edx, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x201ac
ret 0x14