Function at 0x10002d40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x190
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x174], eax
mov eax, dword [0x10069400]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x170], 0x2dd9570a
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x17c], eax
sub eax, 0x82d78195
je 0x10003661
jmp 0x10002d90
mov eax, dword [ebp - 0x17c]
sub eax, 0x9a91e566
je 0x100034ca
jmp 0x10002da6
mov eax, dword [ebp - 0x17c]
sub eax, 0x9d9f5932
je 0x100031d2
jmp 0x10002dbc
mov eax, dword [ebp - 0x17c]
sub eax, 0xa8c069ef
je 0x10003155
jmp 0x10002dd2
mov eax, dword [ebp - 0x17c]
sub eax, 0xa8c9bc03
je 0x1000324f
jmp 0x10002de8
mov eax, dword [ebp - 0x17c]
sub eax, 0xab7490d6
je 0x100033ab
jmp 0x10002dfe
mov eax, dword [ebp - 0x17c]
sub eax, 0xb2a4647e
je 0x1000352b
jmp 0x10002e14
mov eax, dword [ebp - 0x17c]
sub eax, 0xb7a62aad
je 0x10003483
jmp 0x10002e2a
mov eax, dword [ebp - 0x17c]
sub eax, 0xb8fd65b9
je 0x10003311
jmp 0x10002e40
mov eax, dword [ebp - 0x17c]
sub eax, 0xca00cf52
je 0x100035b4
jmp 0x10002e56
mov eax, dword [ebp - 0x17c]
sub eax, 0xd3486da1
je 0x10003164
jmp 0x10002e6c
mov eax, dword [ebp - 0x17c]
sub eax, 0xd50734c5
je 0x1000308c
jmp 0x10002e82
mov eax, dword [ebp - 0x17c]
sub eax, 0xecb6d865
je 0x10003622
jmp 0x10002e98
mov eax, dword [ebp - 0x17c]
sub eax, 0xfe0c770f
je 0x1000328a
jmp 0x10002eae
mov eax, dword [ebp - 0x17c]
sub eax, 0x455ac4b
je 0x10003670
jmp 0x10002ec4
mov eax, dword [ebp - 0x17c]
sub eax, 0x217e7f4f
je 0x10003302
jmp 0x10002eda
mov eax, dword [ebp - 0x17c]
sub eax, 0x2848c34a
je 0x10003002
jmp 0x10002ef0
mov eax, dword [ebp - 0x17c]
sub eax, 0x2dd9570a
je 0x10002fe7
jmp 0x10002f06
mov eax, dword [ebp - 0x17c]
sub eax, 0x321e81b7
je 0x10003240
jmp 0x10002f1c
mov eax, dword [ebp - 0x17c]
sub eax, 0x38dd210b
je 0x10003546
jmp 0x10002f32
mov eax, dword [ebp - 0x17c]
sub eax, 0x498759e6
je 0x100032e9
jmp 0x10002f48
mov eax, dword [ebp - 0x17c]
sub eax, 0x4c39ad74
je 0x10003474
jmp 0x10002f5e
mov eax, dword [ebp - 0x17c]
sub eax, 0x4fe72123
je 0x1000343a
jmp 0x10002f74
mov eax, dword [ebp - 0x17c]
sub eax, 0x54931a57
je 0x10003335
jmp 0x10002f8a
mov eax, dword [ebp - 0x17c]
sub eax, 0x588cef0b
je 0x1000368b
jmp 0x10002fa0
mov eax, dword [ebp - 0x17c]
sub eax, 0x5a9737c4
je 0x100030fa
jmp 0x10002fb6
mov eax, dword [ebp - 0x17c]
sub eax, 0x70ab071d
je 0x1000345b
jmp 0x10002fcc
mov eax, dword [ebp - 0x17c]
sub eax, 0x7d813bbe
je 0x10003648
jmp 0x10002fe2
jmp 0x10003695
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x170], 0x2848c34a
jmp 0x10003695
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x40
call fcn.100092e0
mov dword [ebp - 0x148], 0
mov edx, dword [ebp - 0x164]
mov esi, dword [ebp - 0x168]
lea ecx, [ebp - 0x4c]
lea eax, [ebp - 0x148]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
movzx edx, word [ebp - 0x4c]
mov eax, 0xa8c9bc03
mov ecx, 0xd50734c5
cmp edx, 0x5a4d
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10003695
mov ecx, dword [0x1006a77c]
mov eax, dword [0x1006a778]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7d813bbe
mov ecx, 0x5a9737c4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10003695
mov dword [ebp - 0x160], 0
mov eax, dword [0x1006a77c]
mov ecx, dword [0x1006a778]
mov edx, eax
sub edx, 0x7e7557fc
sub edx, 1
add edx, 0x7e7557fc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7d813bbe
mov ecx, 0xa8c069ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10003695
mov dword [ebp - 0x170], 0xd3486da1
jmp 0x10003695
mov ecx, dword [0x1006a77c]
mov eax, dword [0x1006a778]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x82d78195
mov ecx, 0x9d9f5932
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10003695
mov ecx, dword [0x1006a77c]
mov eax, dword [0x1006a778]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x82d78195
mov ecx, 0x321e81b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10003695
mov dword [ebp - 0x170], 0xb2a4647e
jmp 0x10003695
lea eax, [ebp - 0x144]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xf8
call fcn.100092e0
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x170], 0xfe0c770f
jmp 0x10003695
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x15c]
add edx, eax
mov esi, dword [ebp - 0x168]
lea ecx, [ebp - 0x144]
lea eax, [ebp - 0x148]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xf8
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
mov eax, 0xb8fd65b9
mov ecx, 0x498759e6
cmp dword [ebp - 0x144], 0x4550
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10003695
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x170], 0x217e7f4f
jmp 0x10003695
mov dword [ebp - 0x170], 0xb2a4647e
jmp 0x10003695
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x170], 0x54931a57
jmp 0x10003695
mov ecx, dword [0x1006a77c]
mov eax, dword [0x1006a778]
mov edx, ecx
sub edx, 0xdcef0076
sub edx, 1
add edx, 0xdcef0076
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x455ac4b
mov ecx, 0xab7490d6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10003695
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x154]
cmp eax, ecx
setae al
and al, 1
mov byte [ebp - 0x14d], al
mov ecx, dword [0x1006a77c]
mov eax, dword [0x1006a778]
mov edx, ecx
sub edx, 0xc206247b
sub edx, 1
add edx, 0xc206247b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x455ac4b
mov ecx, 0x4fe72123
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10003695
mov dl, byte [ebp - 0x14d]
mov eax, 0xb7a62aad
mov ecx, 0x70ab071d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10003695
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x170], 0x4c39ad74
jmp 0x10003695
mov dword [ebp - 0x170], 0xb2a4647e
jmp 0x10003695
mov dword [esp], 8
call fcn.1000856e
mov dword [ebp - 0x180], eax
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 8
call fcn.100092e0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x170], 0x9a91e566
jmp 0x10003695
mov ecx, dword [ebp - 0x16c]
lea edx, [ebp - 0x144]
add edx, 0x18
add edx, 0x60
mov eax, dword [ebp + 0x10]
shl eax, 3
add edx, eax
mov esi, dword [ebp - 0x168]
lea eax, [ebp - 0x148]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 8
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x170], 0xb2a4647e
jmp 0x10003695
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x170], 0x38dd210b
jmp 0x10003695
mov ecx, dword [0x1006a77c]
mov eax, dword [0x1006a778]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x588cef0b
mov ecx, 0xca00cf52
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10003695
mov ecx, dword [0x1006a77c]
mov eax, dword [0x1006a778]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x588cef0b
mov ecx, 0xecb6d865
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x170], eax
jmp 0x10003695
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x184], eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10008560
mov eax, dword [ebp - 0x184]
add esp, 0x190
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x170], 0x5a9737c4
jmp 0x10003695
mov dword [ebp - 0x170], 0x9d9f5932
jmp 0x10003695
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x170], 0xab7490d6
jmp 0x10003695
mov dword [ebp - 0x170], 0xca00cf52
jmp 0x10002d74