Function at 0x5160ce
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports
Terminate process

Disassembly:
sub esp, 0x18
mov edx, dword fs:[0x30]
add byte [eax], al
add byte [ebx - 0x3f7cf3be], cl
invalid
mov eax, dword [eax]
cmp dword [eax + 0x30], 0
je 0x5160de
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov esi, dword [0x58cc70]
mov ecx, dword [edx + 0xc]
add ecx, 0xc
mov ecx, dword [ecx]
mov ebp, dword [ecx + 0x30]
test ebp, ebp
je 0x5160f8
test esi, esi
je 0x51615f
movzx eax, word [ebp]
xor ebx, ebx
test eax, eax
je 0x51614f
xor edx, edx
inc edx
movzx edi, word [ebp + edx*4 - 4]
cmp edi, 0x41
jl 0x516125
cmp edi, 0x5a
lea eax, [edi + 0x20]
cmovle edi, eax
movzx eax, di
add ebx, eax
movzx eax, word [ebp + edx*4 - 2]
test eax, eax
je 0x51614f
cmp eax, 0x41
jl 0x516144
lea edi, [eax + 0x20]
movzx edi, di
cmp eax, 0x5a
cmovle eax, edi
add ebx, eax
movzx eax, word [ebp + edx*4]
test eax, eax
invalid
jne 0x516111
nop dword [eax + eax]
nop dword [eax]
cmp esi, ebx
jne 0x5160f8
mov ebx, dword [ecx + 0x18]
mov eax, dword [0x58cc5c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
push 0x104
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor eax, eax
inc eax
movzx ecx, word [ebp + eax*4 - 4]
cmp ecx, 0x5c
je 0x51636b
test ecx, ecx
je 0x5161a9
movzx ecx, word [ebp + eax*4 - 2]
cmp ecx, 0x5c
je 0x516362
test ecx, ecx
jne 0x516184
mov esi, dword [0x58cc78]
lea ebp, [ebp + edx*2 + 2]
cmp dword [esi], 0
je 0x516205
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
movzx eax, al
cmp al, byte [esi]
je 0x5161cf
cmp al, byte [esi + 1]
jne 0x5162b4
movzx eax, word [ebp]
xor edx, edx
test eax, eax
je 0x5161f7
xor eax, eax
inc eax
movzx ecx, word [ebp + eax*4 - 4]
add edx, ecx
movzx ecx, word [ebp + eax*4 - 2]
test ecx, ecx
je 0x5161f7
add edx, ecx
movzx ecx, word [ebp + eax*4]
test ecx, ecx
jne 0x5161db
cmp edx, dword [esi + 4]
je 0x516205
cmp edx, dword [esi + 8]
jne 0x5162b4
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, eax
mov eax, dword [0x58cc5c]
push eax
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
mov eax, dword [0x58cc64]
test eax, eax
jbe 0x516250
xor eax, eax
mov edx, dword [str.VirtualProtect]
mov ecx, dword [edx + eax]
mov dword [ebp + eax], ecx
mov esi, dword [0x58cc80]
add eax, esi
mov edi, dword [0x58cc64]
cmp eax, edi
jb 0x516231
test ebx, ebx
je 0x5162b4
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
js 0x5161e7
inc esp
sbb dword [eax], esp
mov edi, dword [ecx + ebx + 0x18]
add eax, ebx
test edi, edi
jbe 0x5162b4
mov dl, byte [ebp]
xor esi, esi
mov dword [esp + 8], ecx
mov dword [esp + 0x14], ebp
mov ebp, ebx
add ebp, dword [eax + esi*4]
cmp dl, byte [ebp]
jne 0x5162af
mov dword [esp + 0x10], edi
xor ecx, ecx
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x14]
cmp byte [ecx + ebp], 0
je 0x5162bc
cmp byte [ecx + edi], 0
je 0x5162bc
inc ecx
mov al, byte [ecx + ebp]
cmp al, byte [ecx + edi]
je 0x51628e
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
inc esi
cmp esi, edi
jb 0x516276
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 8]
mov eax, dword [ecx + ebx + 0x1c]
mov ecx, dword [ecx + ebx + 0x24]
add eax, ebx
add ecx, ebx
movzx edx, word [ecx + esi*2]
mov ebp, dword [eax + edx*4]
add ebx, ebp
je 0x5162b4
mov esi, dword [0x58cc68]
lea ebp, [esp + 4]
push ebp
mov edx, dword [0x58cc88]
mov eax, dword [0x58cc64]
push eax
push edx
push esi
call ebx
mov eax, dword [0x58cc98]
mov edx, dword [esp]
add edx, eax
mov ecx, dword [0x58cc88]
mov dword [esp], edx
mov eax, dword [edx + 4]
cmp ecx, 8
jbe 0x51632c
mov ecx, 8
mov edi, dword [edx + ecx]
add edi, eax
mov dword [esi + ecx], edi
mov edi, dword [0x58cc80]
add ecx, edi
mov edi, dword [0x58cc88]
cmp ecx, edi
jb 0x516312
mov eax, dword [0x58cc8c]
push ebp
mov dword [esi + 8], eax
push dword [esp + 8]
mov edx, dword [0x58cc88]
push edx
push esi
call ebx
mov ecx, dword [esi + 0xc]
add ecx, esi
mov eax, dword [0x58cc94]
add ecx, eax
mov edx, dword [0x58cc94]
add esi, edx
push esi
call ecx
add esp, 4
jmp 0x5162b4
lea edx, [eax + eax - 1]
jmp 0x516184
invalid
invalid
lea edx, [eax + eax - 2]
jmp 0x516197