Function at 0x131656c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, ecx
mov ecx, 0x5a4d
push esi
push edi
mov dword [ebp - 8], eax
cmp word [eax], cx
jne 0x13165ac9
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [ebp - 0x18], edi
cmp dword [edi], 0x4550
jne 0x13165ac9
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push dword [edi + 0x50]
push dword [edi + 0x34]
call esi
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x13165723
push 4
push 0x2000
push dword [edi + 0x50]
push eax
call esi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x13165ac9
push ebx
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword [ebp - 0xc]
push 4
push 0x1000
mov dword [ebp - 4], ebx
mov dword [ebx + 4], eax
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
push dword [edi + 0x50]
push eax
call esi
push 4
push 0x1000
push dword [edi + 0x54]
push dword [ebp - 0xc]
call esi
mov ecx, dword [edi + 0x54]
mov esi, eax
mov eax, dword [ebp - 8]
add ecx, dword [eax + 0x3c]
push ecx
push eax
push esi
call fcn.1319b500
mov ecx, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 0x14], 0
mov eax, dword [ecx + 0x3c]
mov ecx, dword [ebp - 0xc]
add eax, esi
mov dword [ebx], eax
xor esi, esi
mov dword [eax + 0x34], ecx
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [ebp - 0x10], edx
movzx eax, word [ecx + 0x14]
add eax, 0x28
cmp si, word [ecx + 6]
jae 0x1316583d
lea edi, [eax + ecx]
nop dword [eax]
mov eax, dword [edi]
test eax, eax
jne 0x131657f2
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 0x38]
test esi, esi
jle 0x13165820
mov eax, dword [edi - 4]
push 4
push 0x1000
push esi
add eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
push 0
push eax
mov dword [edi - 8], eax
call fcn.1319ba80
jmp 0x1316581a
push 4
push 0x1000
push eax
mov eax, dword [edi - 4]
add eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [edi]
mov ecx, dword [edi + 4]
mov esi, eax
add ecx, dword [ebp - 8]
push ecx
push esi
call fcn.1319b500
mov dword [edi - 8], esi
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov ecx, dword [ebx]
add edi, 0x28
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
movzx eax, word [ecx + 6]
cmp esi, eax
jl 0x131657c0
mov edx, dword [ebx + 4]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov esi, edx
sub eax, dword [edi + 0x34]
mov dword [ebp - 0x14], eax
mov eax, ecx
mov dword [ebp - 8], esi
je 0x131658da
cmp dword [ecx + 0xa4], 0
mov dword [ebp - 8], esi
jbe 0x131658da
mov edi, dword [ecx + 0xa0]
add edi, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x18], ecx
mov eax, dword [edi]
test eax, eax
je 0x131658d7
mov ecx, dword [edi + 4]
add eax, edx
mov dword [ebp - 0x18], eax
lea edx, [edi + 8]
xor esi, esi
lea eax, [ecx - 8]
test eax, 0xfffffffe
jbe 0x131658be
mov ebx, dword [ebp - 0x18]
nop dword [eax]
movzx eax, word [edx]
mov ecx, eax
and ecx, 0xf000
cmp ecx, 0x3000
jne 0x131658ae
mov ecx, dword [ebp - 0x14]
and eax, 0xfff
add dword [eax + ebx], ecx
mov ecx, dword [edi + 4]
inc esi
add edx, 2
lea eax, [ecx - 8]
shr eax, 1
cmp esi, eax
jb 0x13165890
mov eax, dword [edi + ecx]
add edi, ecx
mov edx, dword [ebp - 0x10]
test eax, eax
jne 0x13165873
mov ebx, dword [ebp - 4]
mov esi, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [ebp - 8], esi
jmp 0x131658da
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x84], 0
jbe 0x131659cc
mov ebx, dword [eax + 0x80]
mov eax, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add ebx, esi
push 0x14
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
call eax
test eax, eax
jne 0x131659cc
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
nop dword [eax + eax]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x131659cc
add eax, esi
push eax
call ecx
mov esi, dword [ebp - 4]
mov edi, eax
cmp edi, 0xffffffff
je 0x13165ab9
mov ecx, dword [esi + 0xc]
lea ecx, [ecx*4 + 4]
push ecx
push dword [esi + 8]
call fcn.131a89d9
add esp, 8
mov dword [esi + 8], eax
test eax, eax
je 0x13165ab9
mov ecx, dword [esi + 0xc]
mov dword [eax + ecx*4], edi
inc dword [esi + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x13165971
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebp - 8]
mov ebx, dword [ebx + 0x10]
add ebx, ecx
lea esi, [ecx + eax]
mov eax, dword [esi]
test eax, eax
je 0x131659af
sub ebx, esi
test eax, eax
jns 0x1316598d
movzx eax, ax
jmp 0x13165992
add ecx, 2
add eax, ecx
push eax
push edi
call dword [ebp - 0x18]
mov dword [ebx + esi], eax
test eax, eax
je 0x13165ab6
mov eax, dword [esi + 4]
add esi, 4
mov ecx, dword [ebp - 8]
test eax, eax
jne 0x13165986
mov ebx, dword [ebp - 0x14]
add ebx, 0x14
push 0x14
push ebx
mov dword [ebp - 0x14], ebx
call dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
test eax, eax
je 0x13165920
mov esi, dword [ebp - 4]
xor ecx, ecx
mov dword [ebp - 0x18], 0
mov edi, dword [esi]
movzx eax, word [edi + 0x14]
add eax, 0x28
cmp cx, word [edi + 6]
jae 0x13165a8d
lea esi, [eax + edi]
nop
mov ebx, dword [esi + 0x14]
mov edx, dword [esi]
test ebx, 0x2000000
je 0x13165a0e
push 0x4000
push edx
push dword [esi - 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x13165a6f
mov ecx, ebx
mov eax, ebx
shr eax, 0x1e
and eax, 1
shr ecx, 0x1d
and ecx, 1
lea ecx, [eax + ecx*2]
mov eax, ebx
shr eax, 0x1f
lea eax, [eax + ecx*2]
mov ecx, dword [eax*4 + 0x131db96c]
mov eax, ebx
mov dword [ebp - 0x10], ecx
or dword [ebp - 0x10], 0x200
and eax, 0x4000000
mov eax, dword [ebp - 0x10]
cmove eax, ecx
test edx, edx
jne 0x13165a60
test bl, 0x40
je 0x13165a55
mov edx, dword [edi + 0x20]
jmp 0x13165a5c
test bl, bl
jns 0x13165a6f
mov edx, dword [edi + 0x24]
test edx, edx
je 0x13165a6f
lea ecx, [ebp - 0x1c]
push ecx
push eax
push edx
push dword [esi - 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
add esi, 0x28
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
mov edi, dword [eax]
movzx eax, word [edi + 6]
cmp ecx, eax
jl 0x131659f0
mov esi, dword [ebp - 4]
mov eax, dword [edi + 0x28]
test eax, eax
je 0x13165aad
mov ecx, dword [ebp - 0xc]
add eax, ecx
je 0x13165ab9
push 0
push 1
push ecx
call eax
test eax, eax
je 0x13165ab9
mov dword [esi + 0x10], 1
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.13165b70
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret