Function at 0x100b7519
Capabilities:
Parse pe header

Disassembly:
push 0x5f8
mov eax, 0x100f85de
call fcn.100cca34
mov dword [ebp - 0x5f0], ecx
mov eax, dword [0x10201ab4]
push 0x4d
pop ebx
push 0x3c
mov edi, dword [eax + 0xa8]
mov eax, 0x87
pop ecx
mov word [ebp - 0x5bc], ax
push 0x45
pop edx
push 0x50
pop eax
mov word [ebp - 0x5ba], bx
mov word [ebp - 0x5b8], cx
push 0x3d
pop ebx
mov word [ebp - 0x5b6], dx
mov word [ebp - 0x5b4], cx
mov word [ebp - 0x5b2], ax
push 0x3f
pop esi
mov word [ebp - 0x5b0], bx
mov word [ebp - 0x5ae], cx
push 0x39
pop ecx
mov word [ebp - 0x5ac], si
mov word [ebp - 0x5aa], cx
push 0x40
pop ecx
mov word [ebp - 0x5a8], cx
mov word [ebp - 0x5a6], cx
mov word [ebp - 0x5a4], ax
push 0x43
pop eax
mov word [ebp - 0x5a2], ax
push 0x39
pop ebx
mov word [ebp - 0x5a0], bx
mov word [ebp - 0x59e], cx
push 0x4e
pop ecx
mov word [ebp - 0x59c], si
mov word [ebp - 0x59a], ax
push ebx
pop eax
mov word [ebp - 0x598], cx
mov word [ebp - 0x596], ax
mov word [ebp - 0x594], cx
push 0x44
pop ecx
mov word [ebp - 0x592], cx
push 0x3d
pop ecx
push 0x4d
mov word [ebp - 0x590], cx
pop ebx
mov word [ebp - 0x58e], dx
mov word [ebp - 0x58c], ax
push 0x44
pop eax
push 0x50
pop ecx
mov word [ebp - 0x58a], bx
mov word [ebp - 0x588], ax
push 0x41
pop eax
mov word [ebp - 0x586], cx
mov word [ebp - 0x584], ax
push 0x3d
mov word [ebp - 0x582], cx
pop eax
mov word [ebp - 0x580], cx
mov word [ebp - 0x57e], si
mov word [ebp - 0x57c], ax
push 0x42
pop eax
mov word [ebp - 0x57a], ax
push 0x4f
pop eax
mov word [ebp - 0x578], cx
mov word [ebp - 0x576], ax
push 0x51
pop eax
mov word [ebp - 0x574], ax
lea ecx, [ebp - 0x5bc]
add eax, 0x38
mov word [ebp - 0x572], ax
xor eax, eax
mov word [ebp - 0x570], ax
mov ax, word [ebp - 0x5bc]
mov esi, dword [edi]
push 0x60
pop eax
add esi, eax
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.10039bc5
push eax
push edi
call dword [esi]
test eax, eax
js 0x100b81b5
mov ecx, dword [0x10201ab4]
lea edx, [ebp - 0x5e8]
xor ebx, ebx
push edx
push ebx
mov eax, dword [ecx + 0x10]
push ebx
mov edi, dword [eax + 0x48]
mov dword [ebp - 0x5e8], ebx
mov eax, dword [ecx + 0xa8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1e0]
cmp dword [ebp - 0x5e8], ebx
jne 0x100b7835
mov dword [ebp - 0x4ac], 0x2b55
lea ecx, [ebp - 0x4ac]
mov eax, dword [ebp - 0x4ac]
xor eax, 0x78
mov word [ebp - 0x4a8], ax
mov eax, dword [ebp - 0x4ac]
inc eax
push 0x63
pop ebx
xor eax, ebx
mov word [ebp - 0x4a6], ax
mov eax, dword [ebp - 0x4ac]
add eax, 2
xor eax, 0x6c
mov word [ebp - 0x4a4], ax
mov eax, dword [ebp - 0x4ac]
add eax, 3
xor eax, 0x69
mov word [ebp - 0x4a2], ax
mov eax, dword [ebp - 0x4ac]
add eax, 4
xor eax, 0x6f
mov word [ebp - 0x4a0], ax
mov eax, dword [ebp - 0x4ac]
add eax, 5
xor eax, 0x3a
mov word [ebp - 0x49e], ax
mov eax, dword [ebp - 0x4ac]
add eax, 6
xor eax, 0x3a
mov word [ebp - 0x49c], ax
mov eax, dword [ebp - 0x4ac]
add eax, 7
xor eax, 0x20
mov word [ebp - 0x49a], ax
mov eax, dword [ebp - 0x4ac]
add eax, 8
xor eax, ebx
mov word [ebp - 0x498], ax
mov eax, dword [ebp - 0x4ac]
add eax, 9
xor eax, ebx
mov word [ebp - 0x496], ax
mov eax, dword [ebp - 0x4ac]
add eax, 0xa
xor eax, 0x73
mov word [ebp - 0x494], ax
mov eax, dword [ebp - 0x4ac]
add eax, 0xb
xor eax, 0x20
mov word [ebp - 0x492], ax
mov eax, dword [ebp - 0x4ac]
add eax, 0xc
xor eax, 0x66
mov word [ebp - 0x490], ax
mov eax, dword [ebp - 0x4ac]
add eax, 0xd
xor eax, 0x31
mov word [ebp - 0x48e], ax
xor eax, eax
mov word [ebp - 0x48c], ax
mov ax, word [ebp - 0x4a8]
mov esi, dword [edi]
call fcn.10010f53
push eax
push edi
call dword [esi + 0x28]
pop ecx
jmp 0x100b81b4
push dword [ebp - 0x5e8]
lea eax, [ebp - 0x5ec]
push eax
call fcn.1003d0de
pop ecx
pop ecx
mov dword [ebp - 4], ebx
lea esi, [ebp - 0x5e8]
mov eax, dword [0x10201ab4]
mov edx, dword [ebp - 0x5ec]
push esi
push dword [ebp - 0x5e8]
mov eax, dword [eax + 0xa8]
push edx
push eax
mov dword [ebp - 0x5f8], edx
mov ecx, dword [eax]
call dword [ecx + 0x1e0]
mov ecx, eax
test ecx, ecx
jns 0x100b795b
push 0x7c
pop ebx
push 0x67
pop esi
push 0x70
pop eax
mov word [ebp - 0x544], bx
mov word [ebp - 0x542], si
mov word [ebp - 0x540], ax
push 0x6d
pop eax
mov word [ebp - 0x53e], ax
push 0x73
pop eax
mov word [ebp - 0x53c], ax
push 0x3e
pop eax
mov word [ebp - 0x53a], ax
mov word [ebp - 0x538], ax
push 0x24
pop edx
push 0x77
mov word [ebp - 0x536], dx
mov word [ebp - 0x534], si
pop eax
mov word [ebp - 0x532], si
mov word [ebp - 0x530], ax
push 0x6a
pop eax
mov word [ebp - 0x52e], dx
mov word [ebp - 0x52c], ax
push 0x36
pop eax
mov word [ebp - 0x52a], ax
push 0x29
pop eax
mov word [ebp - 0x528], dx
mov word [ebp - 0x526], ax
push 0x34
pop eax
mov word [ebp - 0x524], ax
push 0x3c
pop eax
mov word [ebp - 0x522], ax
xor eax, eax
mov word [ebp - 0x520], bx
mov word [ebp - 0x51e], ax
mov ax, word [ebp - 0x544]
mov esi, dword [edi]
push ecx
lea ecx, [ebp - 0x544]
call fcn.1006773c
push eax
push edi
call dword [esi + 0x28]
add esp, 0xc
jmp 0x100b819c
mov eax, dword [ebp - 0x5e8]
mov edx, ebx
shr eax, 3
mov dword [ebp - 0x5fc], eax
mov dword [ebp - 0x5f4], edx
test eax, eax
je 0x100b819c
push 0x63
pop ebx
push 0x3a
pop esi
mov eax, dword [ebp - 0x5f0]
lea ebx, [ebp - 0x420]
push 0x208
push ebx
mov ebx, dword [ebp - 0x5f8]
mov eax, dword [eax + 0x20]
push dword [ebx + edx*8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov ecx, eax
push 0x63
pop ebx
test ecx, ecx
jns 0x100b7a8b
push 0x6d
pop edx
push 0x76
lea eax, [ebx + 0x1f]
mov word [ebp - 0x56c], ax
pop eax
mov word [ebp - 0x56a], dx
mov word [ebp - 0x568], ax
push 0x73
pop eax
mov word [ebp - 0x566], ax
push 0x79
pop eax
mov word [ebp - 0x564], ax
push 0x44
pop eax
mov word [ebp - 0x562], ax
mov word [ebp - 0x560], ax
push 0x2a
pop eax
mov word [ebp - 0x55e], ax
mov word [ebp - 0x55c], dx
push 0x7d
mov word [ebp - 0x55a], dx
pop edx
mov word [ebp - 0x558], dx
mov word [ebp - 0x556], ax
push 0x70
pop eax
mov word [ebp - 0x554], ax
push 0x3d
pop eax
mov word [ebp - 0x552], ax
push 0x2a
pop eax
mov word [ebp - 0x550], ax
push 0x2f
pop eax
mov word [ebp - 0x54e], ax
mov word [ebp - 0x54c], si
push 0x42
pop eax
mov word [ebp - 0x54a], ax
add eax, 0x40
mov word [ebp - 0x548], ax
xor eax, eax
mov word [ebp - 0x546], ax
mov ax, word [ebp - 0x56c]
mov esi, dword [edi]
push ecx
lea ecx, [ebp - 0x56c]
call fcn.100118f2
push eax
push edi
call dword [esi + 0x28]
add esp, 0xc
jmp 0x100b8180
mov eax, dword [ebp - 0x5f0]
lea edx, [ebp - 0x604]
push edx
lea edx, [ebp - 0x420]
push edx
mov eax, dword [eax + 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2bc]
mov edx, eax
test edx, edx
jns 0x100b7c49
mov dword [ebp - 0x44c], 0xf49c
mov ecx, dword [ebp - 0x44c]
push 0x78
pop eax
xor ecx, eax
mov word [ebp - 0x448], cx
mov ecx, dword [ebp - 0x44c]
inc ecx
xor ecx, ebx
mov word [ebp - 0x446], cx
mov eax, dword [ebp - 0x44c]
add eax, 2
xor eax, 0x6c
mov word [ebp - 0x444], ax
mov eax, dword [ebp - 0x44c]
add eax, 3
xor eax, 0x69
mov word [ebp - 0x442], ax
mov eax, dword [ebp - 0x44c]
add eax, 4
xor eax, 0x6f
mov word [ebp - 0x440], ax
mov eax, dword [ebp - 0x44c]
add eax, 5
xor eax, esi
mov word [ebp - 0x43e], ax
mov eax, dword [ebp - 0x44c]
add eax, 6
xor eax, esi
mov word [ebp - 0x43c], ax
mov eax, dword [ebp - 0x44c]
add eax, 7
xor eax, 0x20
mov word [ebp - 0x43a], ax
mov eax, dword [ebp - 0x44c]
add eax, 8
xor eax, ebx
mov word [ebp - 0x438], ax
mov eax, dword [ebp - 0x44c]
add eax, 9
xor eax, ebx
mov word [ebp - 0x436], ax
mov eax, dword [ebp - 0x44c]
add eax, 0xa
push 0x73
pop ecx
xor eax, ecx
mov word [ebp - 0x434], ax
mov eax, dword [ebp - 0x44c]
add eax, 0xb
xor eax, 0x20
mov word [ebp - 0x432], ax
mov eax, dword [ebp - 0x44c]
add eax, 0xc
xor eax, 0x66
mov word [ebp - 0x430], ax
mov eax, dword [ebp - 0x44c]
add eax, 0xd
xor eax, 0x34
mov word [ebp - 0x42e], ax
mov eax, dword [ebp - 0x44c]
add eax, 0xe
xor eax, 0x20
mov word [ebp - 0x42c], ax
mov eax, dword [ebp - 0x44c]
add eax, 0xf
xor eax, 0x25
mov word [ebp - 0x42a], ax
mov eax, dword [ebp - 0x44c]
add eax, 0x10
xor eax, 0x30
mov word [ebp - 0x428], ax
mov eax, dword [ebp - 0x44c]
push 0x38
add eax, 0x11
pop ecx
xor eax, ecx
mov word [ebp - 0x426], ax
mov eax, dword [ebp - 0x44c]
add eax, 0x12
push 0x78
pop ecx
xor eax, ecx
lea ecx, [ebp - 0x44c]
mov word [ebp - 0x424], ax
xor eax, eax
mov word [ebp - 0x422], ax
mov ax, word [ebp - 0x448]
mov esi, dword [edi]
push edx
call fcn.10010e68
jmp 0x100b7a7e
lea eax, [ebp - 0x5e4]
push eax
lea eax, [ebp - 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], 7
mov word [ebp - 0x4d8], ax
mov byte [ebp - 4], 1
push 0x2b
pop eax
push 0x36
pop edx
mov word [ebp - 0x4f8], ax
push 0x6a
pop ecx
mov word [ebp - 0x4f6], dx
push 0x33
mov word [ebp - 0x4f4], si
mov word [ebp - 0x4f2], cx
pop ecx
push 0x38
mov word [ebp - 0x4f0], cx
pop ecx
mov word [ebp - 0x4ee], ax
mov word [ebp - 0x4ec], dx
push 0x6a
pop edx
mov word [ebp - 0x4ea], cx
push 0x33
mov word [ebp - 0x4e8], dx
pop edx
push 0x36
mov word [ebp - 0x4e6], dx
mov word [ebp - 0x4e4], ax
pop edx
push 0x6a
pop eax
mov word [ebp - 0x4e2], dx
mov word [ebp - 0x4e0], cx
lea ecx, [ebp - 0x4f8]
mov word [ebp - 0x4de], ax
push 0x60
pop eax
mov word [ebp - 0x4dc], ax
xor eax, eax
mov word [ebp - 0x4da], ax
mov ax, word [ebp - 0x4f8]
movzx eax, word [ebp - 0x5de]
push eax
movzx eax, word [ebp - 0x5e2]
push eax
movzx eax, word [ebp - 0x5e4]
push eax
call fcn.100cc05d
push eax
lea eax, [ebp - 0x4d8]
push eax
call fcn.10004b9e
add esp, 0x14
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x4d8]
push eax
call fcn.100396c3
test al, al
jne 0x100b8171
cmp dword [ebp - 0x4c4], 8
lea ecx, [ebp - 0x4d8]
push 0x20
cmovae ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x488], 0x6264
mov eax, dword [ebp - 0x488]
xor eax, 0x78
mov word [ebp - 0x484], ax
mov eax, dword [ebp - 0x488]
inc eax
xor eax, ebx
mov word [ebp - 0x482], ax
mov eax, dword [ebp - 0x488]
add eax, 2
xor eax, 0x6c
mov word [ebp - 0x480], ax
mov eax, dword [ebp - 0x488]
add eax, 3
xor eax, 0x69
mov word [ebp - 0x47e], ax
mov eax, dword [ebp - 0x488]
add eax, 4
xor eax, 0x6f
mov word [ebp - 0x47c], ax
mov eax, dword [ebp - 0x488]
add eax, 5
xor eax, esi
mov word [ebp - 0x47a], ax
mov eax, dword [ebp - 0x488]
add eax, 6
xor eax, esi
mov word [ebp - 0x478], ax
mov eax, dword [ebp - 0x488]
add eax, 7
pop edx
xor eax, edx
mov word [ebp - 0x476], ax
mov eax, dword [ebp - 0x488]
add eax, 8
xor eax, ebx
mov word [ebp - 0x474], ax
mov eax, dword [ebp - 0x488]
add eax, 9
xor eax, ebx
mov word [ebp - 0x472], ax
mov eax, dword [ebp - 0x488]
add eax, 0xa
push 0x73
pop esi
xor eax, esi
mov word [ebp - 0x470], ax
mov eax, dword [ebp - 0x488]
add eax, 0xb
xor eax, edx
mov word [ebp - 0x46e], ax
mov eax, dword [ebp - 0x488]
add eax, 0xc
xor eax, 0x66
mov word [ebp - 0x46c], ax
mov eax, dword [ebp - 0x488]
add eax, 0xd
xor eax, 0x35
mov word [ebp - 0x46a], ax
mov eax, dword [ebp - 0x488]
add eax, 0xe
xor eax, edx
mov word [ebp - 0x468], ax
mov eax, dword [ebp - 0x488]
add eax, 0xf
xor eax, 0x25
mov word [ebp - 0x466], ax
mov eax, dword [ebp - 0x488]
add eax, 0x10
xor eax, 0x6c
mov word [ebp - 0x464], ax
mov eax, dword [ebp - 0x488]
add eax, 0x11
xor eax, esi
mov word [ebp - 0x462], ax
mov eax, dword [ebp - 0x488]
add eax, 0x12
xor eax, edx
mov word [ebp - 0x460], ax
mov eax, dword [ebp - 0x488]
add eax, 0x13
xor eax, 0x25
mov word [ebp - 0x45e], ax
mov eax, dword [ebp - 0x488]
add eax, 0x14
xor eax, 0x6c
mov word [ebp - 0x45c], ax
mov eax, dword [ebp - 0x488]
add eax, 0x15
xor eax, esi
mov word [ebp - 0x45a], ax
mov eax, dword [ebp - 0x488]
add eax, 0x16
xor eax, edx
mov word [ebp - 0x458], ax
mov eax, dword [ebp - 0x488]
add eax, 0x17
xor eax, 0x25
mov word [ebp - 0x456], ax
mov eax, dword [ebp - 0x488]
add eax, 0x18
xor eax, 0x6c
mov word [ebp - 0x454], ax
mov eax, dword [ebp - 0x488]
add eax, 0x19
xor eax, esi
mov word [ebp - 0x452], ax
xor eax, eax
mov word [ebp - 0x450], ax
mov ax, word [ebp - 0x484]
mov esi, dword [edi]
lea eax, [ebp - 0x218]
push ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x488]
call fcn.1000b55a
push eax
push edi
call dword [esi + 0x28]
xor eax, eax
add esp, 0x14
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5c0], 7
mov word [ebp - 0x5d4], ax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4d8]
cmp dword [ebp - 0x4c4], 8
push 0x58
cmovae ecx, dword [ebp - 0x4d8]
pop eax
push 0x39
pop edx
mov word [ebp - 0x51c], ax
push 0x4e
mov word [ebp - 0x51a], ax
pop esi
push 0x5a
mov word [ebp - 0x518], dx
mov word [ebp - 0x516], si
mov word [ebp - 0x514], ax
pop eax
push 0x4f
mov word [ebp - 0x512], ax
pop eax
push 0x2b
mov word [ebp - 0x510], ax
pop eax
push 0x54
mov word [ebp - 0x50e], ax
pop eax
push 0x79
mov word [ebp - 0x50c], ax
pop eax
mov word [ebp - 0x50a], ax
add eax, 8
mov word [ebp - 0x508], ax
mov word [ebp - 0x506], si
push 0x7d
pop eax
mov word [ebp - 0x504], ax
push 0x7f
pop eax
mov word [ebp - 0x502], ax
push 0x5f
pop eax
mov word [ebp - 0x500], ax
push 0x78
pop eax
mov word [ebp - 0x4fe], ax
xor eax, eax
mov word [ebp - 0x4fc], dx
mov word [ebp - 0x4fa], ax
mov ax, word [ebp - 0x51c]
mov dword [ebp - 0x4c0], 0x612f
mov eax, dword [ebp - 0x4c0]
xor eax, 0x25
mov word [ebp - 0x4bc], ax
mov eax, dword [ebp - 0x4c0]
inc eax
xor eax, 0x6c
mov word [ebp - 0x4ba], ax
mov eax, dword [ebp - 0x4c0]
add eax, 2
push 0x73
pop edx
xor eax, edx
mov word [ebp - 0x4b8], ax
mov eax, dword [ebp - 0x4c0]
add eax, 3
xor eax, 0x25
mov word [ebp - 0x4b6], ax
mov eax, dword [ebp - 0x4c0]
add eax, 4
xor eax, 0x6c
mov word [ebp - 0x4b4], ax
mov eax, dword [ebp - 0x4c0]
add eax, 5
xor eax, edx
mov word [ebp - 0x4b2], ax
xor eax, eax
mov word [ebp - 0x4b0], ax
mov ax, word [ebp - 0x4bc]
push ecx
lea ecx, [ebp - 0x51c]
call fcn.10051ad5
push eax
lea ecx, [ebp - 0x4c0]
call fcn.10049497
push eax
lea eax, [ebp - 0x5d4]
push eax
call fcn.10004b9e
mov eax, dword [0x10201ab0]
lea ecx, [ebp - 0x5d4]
add esp, 0x10
cmp dword [ebp - 0x5c0], 8
cmovae ecx, dword [ebp - 0x5d4]
mov edx, dword [eax + 0x14c]
push ecx
push 5
push 1
mov eax, dword [edx]
push edx
call dword [eax + 0x20]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5d4]
call fcn.1000b2cc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4d8]
call fcn.1000b2cc
mov edx, dword [ebp - 0x5f4]
inc edx
push 0x3a
mov dword [ebp - 0x5f4], edx
pop esi
cmp edx, dword [ebp - 0x5fc]
jb 0x100b7980
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x5ec], 0
je 0x100b81b5
push dword [ebp - 0x5ec]
call fcn.100ccb15
pop ecx
call fcn.100cc9de
ret