Function at 0x100097b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 2
jne 0x100097c8
call fcn.10002ff0
mov edi, eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push 0
push 0
push 4
mov esi, dword [ebx + 4]
mov ecx, esi
push eax
push ebx
call dword [section..rdata]
call esi
add esp, 0x14
test eax, eax
js 0x100099fc
mov eax, dword [ebp - 8]
mov esi, 0x5a4d
mov edx, 0x584c
cmp ax, si
je 0x10009841
cmp eax, 0x4550
je 0x10009841
cmp eax, 0x464c457f
je 0x10009841
cmp ax, dx
je 0x10009841
cmp eax, 0xfeedfacf
je 0x10009841
cmp eax, 0xfefaedfe
je 0x10009841
cmp eax, 0xfeedface
je 0x10009841
cmp eax, 0xcefaedfe
je 0x10009841
cmp eax, 0xcafebabe
je 0x10009841
cmp eax, 0xbebafeca
jne 0x100098f8
xor ecx, ecx
mov dword [ebp - 0xc], 0x454c
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0x454e
cmp ax, si
jne 0x100098cd
mov esi, dword [ebx + 4]
lea eax, [ebp - 4]
push ecx
push 0x3c
push 4
push eax
push ebx
mov ecx, esi
call dword [section..rdata]
call esi
add esp, 0x14
test eax, eax
js 0x100099fc
mov eax, dword [ebp - 4]
cmp eax, 0x40
jbe 0x100098f8
mov esi, dword [ebx + 4]
mov ecx, esi
push 0
push eax
push 4
lea eax, [ebp - 8]
push eax
push ebx
call dword [section..rdata]
call esi
add esp, 0x14
test eax, eax
js 0x100099fc
mov eax, dword [ebp - 8]
cmp eax, 0x4550
je 0x100098f3
mov edx, 0x584c
cmp ax, dx
je 0x100098c5
cmp ax, word [ebp - 0xc]
je 0x100098c5
cmp ax, word [ebp - 0x10]
jne 0x100098f8
mov ecx, dword [ebp - 4]
mov esi, 0x5a4d
cmp eax, 0x4550
jne 0x10009904
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push ecx
push edi
push dword [ebp + 0xc]
push ebx
call fcn.1001c6e0
add esp, 0x1c
mov ecx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
jmp 0x100098d4
pop edi
pop esi
mov eax, 0xfffffda8
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x464c457f
jne 0x10009927
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push ebx
call fcn.10026500
add esp, 0x14
mov ecx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xfeedfacf
je 0x100099e4
cmp eax, 0xfefaedfe
je 0x100099e4
cmp eax, 0xfeedface
je 0x100099e4
cmp eax, 0xcefaedfe
je 0x100099e4
cmp eax, 0xcafebabe
je 0x100099c8
cmp eax, 0xbebafeca
je 0x100099c8
cmp ax, dx
jne 0x10009985
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push ecx
push edi
push dword [ebp + 0xc]
push ebx
call fcn.10029520
add esp, 0x1c
mov ecx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ax, word [ebp - 0xc]
jne 0x10009999
pop edi
mov ecx, 0xfffffda4
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp ax, word [ebp - 0x10]
jne 0x100099ad
pop edi
mov ecx, 0xfffffda3
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
cmp ax, si
pop edi
setne cl
dec ecx
and ecx, 0xfffffffa
add ecx, 0xfffffda8
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push ebx
call fcn.10030960
add esp, 0x14
mov ecx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push ecx
push edi
push dword [ebp + 0xc]
push ebx
call fcn.10030bd0
add esp, 0x1c
mov ecx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret