Function at 0x131488c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.13143c14
lea esi, [ebp - 0x178]
xor eax, eax
push ebp
push 0x13148ba9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.13143c24
push eax
call fcn.131449e8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x13148926
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x13148b88
xor edx, edx
push ebp
push 0x13148b81
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
lea eax, [ebp - 0x14]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.13144ae0
cmp word [ebp - 0x58], 0x5a4d
je 0x13148962
mov dword [ebp - 8], 3
call fcn.131432b0
jmp 0x13148b88
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_RtlUnwind
push 0
lea eax, [ebp - 0x14]
push eax
push 0xf8
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.13144ae0
cmp dword [ebp - 0x150], 0x4550
je 0x131489ab
mov dword [ebp - 8], 3
call fcn.131432b0
jmp 0x13148b88
xor edi, edi
xor eax, eax
mov dword [ebp - 0x10], eax
movzx ebx, word [ebp - 0x14a]
dec ebx
test ebx, ebx
jl 0x13148a1e
inc ebx
push 0
lea eax, [ebp - 0x14]
push eax
push 0x28
push esi
mov eax, dword [ebp - 0xc]
push eax
call fcn.13144ae0
lea eax, [ebp - 0x17c]
mov edx, esi
call fcn.13143980
mov eax, dword [ebp - 0x17c]
mov edx, 0x13148bc4
call fcn.13143b70
jne 0x13148a01
mov dword [ebp - 8], 2
call fcn.131432b0
jmp 0x13148b88
mov eax, dword [esi + 0x14]
add eax, dword [esi + 0x10]
cmp edi, eax
jae 0x13148a0d
mov edi, eax
mov eax, dword [esi + 0xc]
add eax, dword [esi + 8]
cmp eax, dword [ebp - 0x10]
jbe 0x13148a1b
mov dword [ebp - 0x10], eax
dec ebx
jne 0x131489bf
mov ebx, 0x131488bc
sub ebx, fcn.13148728
add ebx, 0xab
mov edx, esi
mov ecx, 5
mov eax, 0x13148bd4
call fcn.13142644
mov dword [esi + 8], ebx
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
xor eax, eax
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], 0
mov eax, dword [esi + 0xc]
mov edx, eax
and edx, 0xfff
test edx, edx
jbe 0x13148a78
shr eax, 0xc
inc eax
shl eax, 0xc
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
mov edx, eax
and edx, 0x1ff
test edx, edx
jbe 0x13148a91
shr eax, 9
inc eax
shl eax, 9
mov dword [esi + 0x14], eax
mov dword [esi + 0x24], 0xe00000e0
push 0
lea eax, [ebp - 0x18]
push eax
push 0x28
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov eax, dword [ebp - 0x128]
mov dword [0x1314b857], eax
mov eax, dword [ebp - 0x11c]
mov dword [0x1314b853], eax
mov eax, dword [esi + 0xc]
add eax, 0xab
add eax, 0x13148734
sub eax, fcn.13148728
mov dword [ebp - 0x128], eax
add dword [ebp - 0x100], ebx
xor eax, eax
mov dword [ebp - 0x80], eax
inc word [ebp - 0x14a]
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_RtlUnwind
push 0
lea eax, [ebp - 0x18]
push eax
push 0xf8
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
push 0
push 0
mov eax, dword [esi + 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_RtlUnwind
push 0
lea eax, [ebp - 0x18]
push eax
push 0xab
push 0x1314b7b0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, 0x131488bc
sub eax, fcn.13148728
push eax
mov eax, fcn.13148728
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov dword [ebp - 8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13148b88
mov eax, dword [ebp - 0xc]
push eax
call fcn.131449e0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13148bb0
lea eax, [ebp - 0x17c]
call fcn.131437a4
lea eax, [ebp - 4]
call fcn.131437a4
ret