Function at 0x100063d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov eax, 0x9aa5ab08
mov dword [ebp - 0x14], ecx
jmp 0x100063fa
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx + edx + 0x18]
mov dword [ebp - 0x18], ecx
jmp 0x10006410
mov eax, 0xf31877dc
nop word cs:[eax + eax]
cmp eax, 0x7b6ee870
jg 0x10006430
cmp eax, 0x9aa5ab07
jg 0x10006440
cmp eax, 0x8b59e7b8
jne 0x10006410
mov eax, 0x482a07
jmp 0x10006410
cmp eax, 0x7b6ee871
jne 0x10006410
jmp 0x100063ff
cmp eax, 0xa1b916d2
jg 0x1000647e
cmp eax, 0x9aa5ab08
jne 0x10006410
mov eax, dword [ebp - 0x10]
add eax, 0x48
mov dword [esp + 0xc], edi
mov dword [esp], eax
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0
call ebx
test al, al
mov eax, 0xab3dafb2
mov ecx, 0xa8445e6a
cmovne eax, ecx
jmp 0x10006410
cmp eax, 0xa8445e69
jg 0x10006491
cmp eax, 0xa1b916d3
jne 0x10006410
jmp 0x100066b1
cmp eax, 0xab3dafb1
jg 0x100064ad
cmp eax, 0xa8445e6a
jne 0x10006410
mov eax, 0xfd64ae39
jmp 0x10006410
cmp eax, 0xc7e7e20e
jg 0x100064c4
cmp eax, 0xab3dafb2
jne 0x10006410
jmp 0x100066b1
cmp eax, 0xcd8c5c1e
jg 0x100064e0
cmp eax, 0xc7e7e20f
jne 0x10006410
mov eax, 0xcd8c5c1f
jmp 0x10006410
cmp eax, 0xcfeab243
jg 0x10006526
cmp eax, 0xcd8c5c1f
jne 0x10006410
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x180]
mov dword [esp + 0xc], edi
mov ecx, dword [ebp - 0x14]
mov dword [esp + 8], ecx
mov ecx, dword [ebp - 0x18]
mov dword [esp + 4], ecx
mov dword [esp], eax
call ebx
test al, al
mov eax, 0xa1b916d3
mov ecx, 0xbea5f36
cmovne eax, ecx
jmp 0x10006410
cmp eax, 0xd3fdf529
jg 0x1000655d
cmp eax, 0xcfeab244
jne 0x10006410
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 0xa0]
mov eax, 0x1dbeb925
cmp ecx, 0x10b
jne 0x10006410
mov eax, 0xd3fdf52a
jmp 0x10006410
cmp eax, 0xe9bbecd5
jg 0x1000658f
cmp eax, 0xd3fdf52a
jne 0x10006410
mov ecx, dword [ebp - 0x10]
mov eax, 0x4cc1ae0b
cmp word [ecx + 0x8e], 0
jne 0x10006410
mov eax, 0x1dbeb925
jmp 0x10006410
cmp eax, 0xf1ca97a7
jg 0x100065ad
cmp eax, 0xe9bbecd6
jne 0x10006410
mov eax, 0x373d983d
xor esi, esi
jmp 0x10006410
cmp eax, 0xf31877db
jg 0x100065ce
cmp eax, 0xf1ca97a8
jne 0x10006410
mov eax, 0x373d983d
mov esi, 8
jmp 0x10006410
cmp eax, 0xfd64ae38
jg 0x1000661b
cmp eax, 0xf31877dc
jne 0x10006410
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x84]
mov ecx, dword [ebp - 0x10]
add ecx, 0x88
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 0xf8
call ebx
test al, al
mov eax, 0x10ff508f
mov ecx, 0x8b59e7b8
cmovne eax, ecx
jmp 0x10006410
cmp eax, 0x482a06
jg 0x1000664f
cmp eax, 0xfd64ae39
jne 0x10006410
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 0x48]
mov eax, 0x1820b62b
cmp ecx, 0x5a4d
jne 0x10006410
mov eax, 0x4bb993de
jmp 0x10006410
cmp eax, 0xbea5f35
jg 0x10006683
cmp eax, 0x482a07
jne 0x10006410
mov ecx, dword [ebp - 0x10]
mov eax, 0x1dbeb925
cmp dword [ecx + 0x88], 0x4550
jne 0x10006410
mov eax, 0xcfeab244
jmp 0x10006410
cmp eax, 0x10ff508e
jg 0x1000669f
cmp eax, 0xbea5f36
jne 0x10006410
mov eax, 0xe9bbecd6
jmp 0x10006410
cmp eax, 0x1820b62a
jg 0x100066c0
cmp eax, 0x10ff508f
jne 0x10006410
mov eax, 0x373d983d
mov esi, 0x1e
jmp 0x10006410
cmp eax, 0x1dbeb924
jg 0x100066d4
cmp eax, 0x1820b62b
jne 0x10006410
jmp 0x100066e6
cmp eax, 0x373d983c
jg 0x100066f5
cmp eax, 0x1dbeb925
jne 0x10006410
mov eax, 0x373d983d
mov esi, 0xb
jmp 0x10006410
cmp eax, 0x4bb993de
je 0x10006713
cmp eax, 0x4cc1ae0b
je 0x10006740
cmp eax, 0x373d983d
jne 0x10006410
jmp 0x100067b7
mov ecx, dword [ebp - 0x10]
mov eax, 0x7b6ee871
cmp dword [ecx + 0x84], 0
jne 0x10006410
mov eax, 0x1820b62b
jmp 0x10006410
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x8e]
imul eax, eax, 0x28
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x84]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x9c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1018c360]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, dword [ebp - 0x14]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [ebp - 0x20]
sub esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x180], eax
mov ecx, dword [ebp - 0x10]
mov eax, 0xc7e7e20f
cmp dword [ecx + 0x180], 0
jne 0x100063f0
mov eax, 0xf1ca97a8
jmp 0x100063f0
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8