Function at 0x1001580a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100c47a0]
push 0x12
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
pop ecx
idiv ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x18], ebx
cmp edx, 0xe
jne 0x10015858
xor ecx, ecx
inc ecx
cmp esi, ecx
jle 0x10015852
mov eax, esi
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, esi
jl 0x10015846
mov dword [0x100c47a0], ecx
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x10015874
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10015ad8
push edi
mov edi, dword [ebx + 0x3c]
add edi, ebx
mov dword [ebp - 0x20], edi
cmp dword [edi], 0x4550
je 0x10015895
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10015ad5
push 0x1008bab4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x1008bac4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x10015ad5
push 4
pop eax
push eax
push 0x3000
push dword [edi + 0x50]
push dword [edi + 0x34]
call ebx
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x100158ef
push 4
pop edx
push edx
push 0x3000
push dword [edi + 0x50]
push eax
call ebx
mov esi, eax
mov dword [ebp - 0x1c], eax
test esi, esi
jne 0x100158ef
push 0xe
jmp 0x1001588a
push 0x24
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x10015920
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10015ad5
xor eax, eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 4], esi
mov ecx, dword [0x100c47a0]
push 0x11
lea eax, [ecx + 1]
imul eax, ecx
cdq
pop ecx
idiv ecx
cmp edx, 0xa
jne 0x10015952
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x20], eax
call fcn.100155ab
test al, al
jne 0x10015979
dec dword [0x100c5190]
push 4
pop eax
push eax
push 0x1000
push dword [edi + 0x54]
push esi
call dword [ebp - 0x14]
push dword [edi + 0x54]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x18]
push eax
call fcn.1006cdb0
mov esi, dword [0x100c47a0]
mov ecx, esi
imul ecx, esi
imul ecx, esi
add esp, 0xc
and ecx, 0x8000000f
jns 0x100159b6
dec ecx
or ecx, 0xfffffff0
inc ecx
push 4
pop eax
cmp ecx, eax
jne 0x10015a0f
jmp 0x10015a0b
mov ecx, esi
and ecx, 0x80000001
jns 0x100159ce
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x100159db
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x100159e2
lea esi, [esi*2 + 1]
mov eax, esi
push 3
cdq
pop ecx
idiv ecx
mov dword [0x100c47a0], esi
sub edx, 0
je 0x100159fe
dec edx
dec edx
je 0x10015a01
dec edx
je 0x10015a02
jmp 0x10015a0b
add esi, 2
inc esi
add esi, 2
mov dword [0x100c47a0], esi
test esi, esi
jne 0x100159bf
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 0x14]
mov dword [ebx], eax
mov dword [eax + 0x34], esi
call fcn.100155cd
test al, al
jne 0x10015a62
mov esi, str.B2imU3zkca
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x10]
push eax
movsb byte es:[edi], byte [esi]
call fcn.1006d400
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006c443
push eax
call fcn.1006dc4d
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
add esp, 0xc
push ebx
push edi
push dword [ebp - 0x18]
call fcn.100151da
mov eax, esi
add esp, 0xc
sub eax, dword [edi + 0x34]
je 0x10015a7f
push eax
push ebx
call fcn.10015414
pop ecx
pop ecx
push ebx
call fcn.10015038
pop ecx
test eax, eax
je 0x10015ace
push ebx
call fcn.10015359
pop ecx
call fcn.10015583
test al, al
jne 0x10015aa4
call fcn.1006daf8
mov dword [0x100c47a0], eax
push ebx
call fcn.10015324
mov eax, dword [ebx]
pop ecx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x10015ae9
push 0
xor edi, edi
inc edi
push edi
add eax, esi
push esi
call eax
test eax, eax
jne 0x10015ae6
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call fcn.10015619
pop ecx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1006d48b
leave
ret
mov dword [ebx + 0x10], edi
mov eax, ebx
jmp 0x10015ad7