Function at 0x1000d670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [0x1021fcc0]
sub edx, dword [0x1021fd50]
mov eax, dword [0x1021fbc0]
sub eax, edx
mov dword [ebp - 8], ecx
mov dword [0x1021fd4c], eax
mov eax, dword [0x1021fbe8]
imul eax, dword [0x1021fc30]
push ebx
mov ebx, dword [0x1021fbdc]
mov ecx, dword [0x1021fc4c]
and ecx, dword [0x1021fbb0]
mov dword [ebp - 4], eax
mov dword [0x1021fd08], eax
mov eax, dword [0x1021fe38]
sub eax, dword [0x1021fbfc]
mov dword [0x1021fe34], eax
mov eax, ebx
imul eax, dword [0x1021fcc4]
mov dword [ebp - 0xc], ecx
mov dword [0x1021fd78], ecx
mov ecx, dword [0x1021fc6c]
push esi
mov dword [0x1021fd6c], eax
mov eax, dword [0x1021fcf0]
sub eax, dword [0x1021fd48]
mov dword [ebp - 0x14], eax
mov dword [0x1021fdac], eax
mov eax, dword [0x1021fd44]
add eax, dword [0x1021fcec]
mov dword [0x1021fd38], eax
mov eax, dword [0x1021fdd4]
imul eax, dword [0x1021fc08]
mov esi, dword [0x1021fca8]
sub esi, dword [0x1021fd88]
push edi
mov edi, dword [0x1021fd64]
mov dword [ebp - 0x10], eax
mov dword [0x1021fc5c], eax
mov eax, dword [0x1021fba4]
add eax, dword [0x1021fc30]
mov dword [0x1021fc90], eax
mov eax, dword [0x1021fd0c]
and eax, dword [0x1021fe00]
mov dword [0x1021fbac], eax
mov eax, dword [0x1021fc48]
and eax, dword [0x1021fc34]
mov dword [0x1021fd28], eax
sub eax, dword [0x1021fd70]
mov dword [0x1021fdbc], eax
mov eax, dword [0x1021fdb0]
sub eax, dword [0x1021fbfc]
mov dword [0x1021fda8], eax
mov eax, dword [0x1021fc24]
add edi, dword [0x1021fd7c]
sub eax, ecx
mov dword [0x1021fd1c], eax
mov eax, dword [0x1021fcf4]
imul eax, dword [0x1021fdf0]
mov dword [0x1021fd98], edx
mov edx, dword [0x1021fc58]
sub edx, dword [0x1021fe24]
mov dword [0x1021fe3c], edx
mov dword [0x1021fcd8], eax
mov eax, dword [0x1021fbb8]
add eax, dword [0x1021fe00]
mov dword [0x1021fd54], eax
mov eax, dword [0x1021fc44]
sub eax, dword [0x1021fc50]
mov dword [0x1021fdc8], eax
mov eax, edi
imul eax, dword [0x1021fcb0]
mov dword [0x1021fe08], edi
mov dword [0x1021fbbc], esi
mov dword [0x1021fcd0], eax
mov eax, dword [0x1021fce0]
add eax, edx
mov dword [0x1021fc80], eax
lea eax, [ecx + ebx]
mov dword [0x1021fd8c], eax
mov eax, dword [0x1021fd2c]
add eax, dword [0x1021fe10]
mov ecx, dword [ebp - 0xc]
mov dword [0x1021fdb4], eax
mov eax, dword [0x1021fccc]
imul eax, dword [0x1021fc94]
mov edx, dword [0x1021fde8]
and edx, 0xdf06b3
mov dword [0x1021fc6c], edx
and edx, dword [0x1021fc14]
mov dword [0x1021fcb0], eax
mov eax, ecx
imul eax, dword [ebp - 4]
imul ecx, dword [0x1021fd10]
mov dword [0x1021fe2c], edx
mov dword [0x1021fba0], eax
mov eax, dword [0x1021fda0]
and eax, dword [0x1021fba4]
mov dword [0x1021fdfc], eax
mov eax, dword [0x1021fe14]
add eax, esi
mov dword [0x1021fd40], ecx
mov dword [0x1021fc10], eax
mov ecx, 0x5a4d
mov eax, dword [0x1021fc84]
sub eax, dword [0x1021fc9c]
mov dword [0x1021fd14], eax
mov eax, dword [0x1021fd18]
sub eax, dword [0x1021fc40]
mov dword [0x1021fc78], eax
mov eax, dword [ebp - 0x10]
imul eax, dword [0x1021fc04]
mov dword [0x1021fbf8], eax
mov eax, dword [0x1021fc98]
add eax, dword [0x1021fe10]
mov dword [0x1021fcec], eax
mov eax, dword [0x1021fd80]
sub eax, dword [0x1021fc04]
mov dword [0x1021fbb0], eax
mov eax, dword [0x1021fca8]
add eax, edi
mov dword [0x1021fbc4], eax
mov eax, dword [0x1021fd5c]
sub eax, dword [0x1021fde8]
mov dword [0x1021fbfc], eax
mov eax, dword [ebp - 8]
cmp word [eax], cx
jne 0x1000deab
mov esi, dword [eax + 0x3c]
add esi, eax
mov eax, dword [ebp - 0x14]
imul eax, dword [0x1021fd70]
mov dword [ebp - 0xc], esi
cmp dword [esi], 0x4550
mov dword [0x1021fc40], eax
jne 0x1000deab
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push dword [esi + 0x50]
push dword [esi + 0x34]
call ebx
mov ecx, dword [0x1021fd2c]
mov edi, eax
add ecx, dword [0x1021fd64]
mov dword [ebp - 4], edi
mov dword [0x1021fc9c], ecx
test edi, edi
jne 0x1000d9e9
push 4
push 0x2000
push dword [esi + 0x50]
push eax
call ebx
mov edi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x1021fc60]
and eax, dword [0x1021fda0]
mov dword [0x1021fc84], eax
mov eax, dword [0x1021fbf0]
imul eax, dword [0x1021fd4c]
mov dword [0x1021fd24], eax
mov eax, dword [0x1021fd70]
imul eax, dword [0x1021fbe8]
mov dword [0x1021fce4], eax
mov eax, dword [0x1021fdc4]
sub eax, dword [0x1021fc58]
mov dword [0x1021fd20], eax
mov eax, dword [0x1021fc70]
and eax, dword [0x1021fdb4]
mov dword [0x1021fd5c], eax
mov eax, dword [0x1021fe20]
sub eax, dword [0x1021fc78]
mov dword [0x1021fc64], eax
mov eax, dword [0x1021fdcc]
and eax, dword [0x1021fd40]
mov dword [0x1021fd50], eax
mov eax, dword [0x1021fca4]
and eax, dword [0x1021fce0]
mov dword [0x1021fc30], eax
test edi, edi
je 0x1000deab
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov ecx, dword [0x1021fd5c]
mov eax, dword [0x1021fccc]
and eax, dword [0x1021fc58]
mov dword [0x1021fcc0], eax
mov eax, dword [0x1021fc28]
imul eax, dword [0x1021fde4]
and ecx, dword [0x1021fbbc]
mov edx, dword [0x1021fbd4]
mov dword [ebx + 4], edi
mov edi, 0xf1c439
mov dword [0x1021fc38], ecx
mov ecx, edx
mov dword [0x1021fc18], eax
mov eax, dword [0x1021fd7c]
and eax, dword [0x1021fd50]
mov dword [0x1021fe30], eax
mov eax, edi
sub eax, dword [0x1021fc04]
imul ecx, dword [0x1021fdb8]
mov dword [0x1021fcec], eax
mov eax, dword [0x1021fc68]
imul eax, dword [0x1021fc40]
and edx, dword [0x1021fdd0]
push 4
mov dword [0x1021fdb8], ecx
mov ecx, dword [0x1021fc10]
imul ecx, dword [0x1021fd78]
mov dword [0x1021fd9c], eax
mov eax, dword [0x1021fd68]
and eax, dword [0x1021fdbc]
mov dword [0x1021fce4], eax
mov eax, dword [0x1021fd38]
sub eax, dword [0x1021fcb8]
mov dword [0x1021fd28], eax
mov eax, dword [0x1021fca0]
imul eax, dword [0x1021fc88]
push 0x1000
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
push dword [esi + 0x50]
mov dword [0x1021fd90], eax
mov eax, dword [0x1021fc8c]
push dword [ebp - 4]
and eax, 0xcb28f5
mov dword [0x1021fbdc], ecx
mov dword [0x1021fc34], eax
mov eax, dword [0x1021fde8]
and eax, dword [0x1021fe08]
mov dword [0x1021fc14], edx
mov dword [0x1021fba8], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1021fdfc]
add eax, dword [0x1021fd78]
push 4
push 0x1000
push dword [esi + 0x54]
mov dword [0x1021fe18], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x1021fd34]
mov esi, eax
imul ecx, dword [0x1021fe00]
mov eax, dword [0x1021fe20]
mov dword [0x1021fdb8], ecx
mov ecx, dword [0x1021fc54]
add ecx, dword [0x1021fd88]
mov dword [0x1021fdd0], ecx
mov ecx, dword [0x1021fdc4]
and ecx, dword [0x1021fba4]
add eax, ecx
mov dword [0x1021fdc0], ecx
mov dword [0x1021fc70], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0x3c]
push eax
push ecx
push esi
call fcn.10146b50
mov eax, dword [0x1021fe04]
sub eax, dword [0x1021fbe8]
mov dword [0x1021fcf0], eax
mov eax, dword [0x1021fd94]
add eax, dword [0x1021fc88]
mov dword [0x1021fd8c], eax
mov eax, dword [ebp - 8]
push ebx
mov ecx, dword [eax + 0x3c]
mov eax, dword [0x1021fd80]
add ecx, esi
and eax, dword [0x1021fbe8]
mov esi, dword [ebp - 0xc]
mov edx, esi
mov dword [0x1021fc48], eax
mov eax, dword [ebp - 4]
mov dword [ebx], ecx
mov dword [ecx + 0x34], eax
mov eax, dword [0x1021fe3c]
add eax, dword [0x1021fd44]
mov ecx, dword [ebp - 8]
mov dword [0x1021fc24], eax
mov eax, dword [0x1021fda0]
imul eax, dword [0x1021fe10]
mov dword [0x1021fc3c], eax
call fcn.1000c060
mov eax, dword [0x1021fbe4]
add esp, 0x10
and eax, dword [0x1021fc1c]
mov dword [0x1021fe14], eax
mov eax, dword [0x1021fbf4]
add eax, dword [0x1021fbd8]
mov dword [0x1021fd14], eax
mov eax, dword [0x1021fdc4]
imul eax, dword [0x1021fbf0]
mov edx, dword [ebp - 4]
sub edx, dword [esi + 0x34]
sub edi, dword [0x1021fc28]
mov dword [0x1021fc08], edi
mov dword [0x1021fca8], eax
mov eax, dword [0x1021fcbc]
and eax, dword [0x1021fdf0]
mov dword [0x1021fbec], eax
mov eax, dword [0x1021fc38]
add eax, dword [0x1021fd4c]
mov dword [0x1021fbd4], eax
mov eax, dword [0x1021fcac]
and eax, dword [0x1021fbf8]
mov dword [0x1021fb9c], eax
mov eax, dword [0x1021fd30]
and eax, dword [0x1021fc98]
mov dword [0x1021fcf0], eax
test edx, edx
je 0x1000dcdd
mov ecx, ebx
call fcn.1000c850
mov eax, dword [0x1021fc58]
sub eax, dword [0x1021fe20]
mov dword [0x1021fc20], eax
mov eax, dword [0x1021fcd8]
add eax, dword [0x1021fd44]
mov dword [0x1021fbc0], eax
mov eax, dword [0x1021fd90]
imul eax, dword [0x1021fc58]
mov dword [0x1021fdb0], eax
mov eax, dword [0x1021fd78]
sub eax, dword [0x1021fd44]
mov dword [0x1021fc14], eax
mov eax, dword [0x1021fda8]
and eax, 0xf1c439
mov dword [0x1021fde4], eax
mov ecx, ebx
call fcn.1000ccf0
test eax, eax
je 0x1000de94
mov ecx, ebx
call fcn.1000c420
mov eax, dword [0x1021fc54]
imul eax, dword [0x1021fdf0]
mov dword [0x1021fc88], eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x1000de8b
mov edx, dword [ebp - 4]
lea esi, [eax + edx]
mov eax, dword [0x1021fc0c]
imul eax, dword [0x1021fdbc]
mov dword [0x1021fc04], eax
mov eax, dword [0x1021fd24]
imul eax, dword [0x1021fe10]
mov dword [0x1021fd28], eax
mov eax, dword [0x1021fc2c]
add eax, dword [0x1021fdb0]
mov dword [0x1021fc84], eax
mov eax, dword [0x1021fd60]
add eax, dword [0x1021fc44]
mov dword [0x1021fbd0], eax
mov eax, dword [0x1021fd94]
sub eax, dword [0x1021fd74]
mov dword [0x1021fbd4], eax
mov eax, dword [0x1021fca8]
add eax, dword [0x1021fcc0]
mov dword [0x1021fda0], eax
mov eax, dword [0x1021fd04]
and eax, dword [0x1021fe14]
mov dword [0x1021fdfc], eax
test esi, esi
je 0x1000de94
push 0
push 1
push edx
call esi
mov edi, dword [0x1021fc18]
mov esi, eax
mov eax, dword [0x1021fd38]
mov ecx, dword [0x1021fb9c]
add eax, edi
mov dword [0x1021fdc4], eax
and ecx, 0x22dc4e
mov eax, dword [0x1021fc6c]
add eax, 0xf1c439
mov dword [0x1021fd5c], ecx
mov ecx, dword [0x1021fcbc]
and ecx, dword [0x1021fd14]
mov dword [0x1021fbbc], eax
mov eax, dword [0x1021fd78]
and eax, dword [0x1021fcf0]
mov dword [0x1021fc9c], eax
mov eax, dword [0x1021fdb4]
add eax, dword [0x1021fcbc]
mov dword [0x1021fd54], ecx
mov dword [0x1021fcc0], eax
test esi, esi
je 0x1000de94
mov eax, dword [0x1021fe28]
and eax, dword [0x1021fc40]
mov ecx, dword [0x1021fd04]
sub ecx, dword [0x1021fe00]
mov dword [0x1021fce0], eax
mov eax, dword [0x1021fc20]
imul eax, dword [0x1021fd88]
imul edi, dword [0x1021fc08]
mov dword [ebx + 0x10], 1
mov dword [0x1021fdfc], ecx
mov dword [0x1021fd50], eax
mov eax, dword [0x1021fd3c]
and eax, dword [0x1021fd1c]
mov dword [0x1021fd10], eax
mov eax, dword [0x1021fc0c]
add eax, ecx
mov dword [0x1021fda0], edi
mov dword [0x1021fbcc], eax
mov eax, dword [0x1021fc8c]
imul eax, dword [0x1021fc60]
mov dword [0x1021fc98], eax
mov eax, dword [0x1021fdf8]
and eax, dword [0x1021fd08]
mov dword [0x1021fe24], eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.1000e350
mov eax, dword [0x1021fc1c]
and eax, dword [0x1021fbe8]
mov dword [0x1021fd58], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret