Function at 0x10001000
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
cmp ecx, 0x40
jb 0x100012a9
mov ebx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x100012a9
mov edx, dword [ebx + 0x3c]
lea eax, [edx + 0xf8]
cmp ecx, eax
jl 0x100012a9
cmp dword [edx + ebx], 0x4550
lea esi, [edx + ebx]
jne 0x100012a9
mov eax, 0x2000
test word [esi + 0x16], ax
jne 0x100012a9
mov eax, 0xe0
cmp word [esi + 0x14], ax
jne 0x100012a9
lea eax, [esi + 0xf8]
push eax
push esi
push ecx
push ebx
call fcn.10001560
mov ecx, dword [ebp + 0x1c]
add esp, 0x10
mov dword [ecx], eax
test eax, eax
je 0x100012a9
push 0x40
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], ecx
mov dword [eax], ecx
test ecx, ecx
je 0x1000129e
movzx edx, word [esi + 6]
mov ecx, dword [esi + 0x54]
push edi
xor edi, edi
test edx, edx
je 0x100011b2
cmp edx, 8
jb 0x100011b2
cmp dword [0x10125a94], 2
jl 0x100011b2
movups xmm6, xmmword [0x1005d290]
mov eax, edx
and eax, 0xfffffff8
movd xmm0, ecx
mov dword [ebp + 0xc], eax
lea eax, [esi + 0x15c]
mov ecx, dword [ebp + 0xc]
pshufd xmm4, xmm0, 0
movaps xmm5, xmm4
nop
movd xmm2, dword [eax + 0x28]
lea eax, [eax + 0x140]
movd xmm0, dword [eax - 0x140]
add edi, 8
movd xmm1, dword [eax - 0x168]
movd xmm3, dword [eax - 0x190]
punpckldq xmm3, xmm0
movaps xmm0, xmm4
punpckldq xmm1, xmm2
movd xmm2, dword [eax - 0x78]
punpckldq xmm3, xmm1
xorps xmm1, xmm1
pcmpeqd xmm1, xmm3
andnps xmm1, xmm6
pminud xmm0, xmm3
movd xmm3, dword [eax - 0xf0]
andps xmm0, xmm1
andnps xmm1, xmm4
orps xmm0, xmm1
movd xmm1, dword [eax - 0xc8]
punpckldq xmm1, xmm2
movaps xmm4, xmm0
movd xmm0, dword [eax - 0xa0]
punpckldq xmm3, xmm0
movaps xmm0, xmm5
punpckldq xmm3, xmm1
xorps xmm1, xmm1
pcmpeqd xmm1, xmm3
andnps xmm1, xmm6
pminud xmm0, xmm3
andps xmm0, xmm1
andnps xmm1, xmm5
orps xmm0, xmm1
movaps xmm5, xmm0
cmp edi, ecx
jl 0x100010f0
pminud xmm4, xmm5
movaps xmm0, xmm4
psrldq xmm0, 8
pminud xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 4
pminud xmm4, xmm0
movd ecx, xmm4
cmp edi, edx
jge 0x100011d7
lea eax, [edi + edi*4]
lea esi, [esi + eax*8]
add esi, 0x10c
sub edx, edi
mov eax, dword [esi]
test eax, eax
je 0x100011cf
cmp eax, ecx
cmovb ecx, eax
add esi, 0x28
sub edx, 1
jne 0x100011c4
push ecx
push ebx
push dword [ebp - 4]
call fcn.10014920
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebx], eax
add eax, 0xf8
mov dword [ecx], eax
mov eax, dword [ebx]
push dword [eax + 0x38]
push dword [eax + 0x54]
call fcn.10001780
mov esi, eax
add esp, 0x14
add esi, dword [edi]
xor eax, eax
xor edi, edi
mov dword [0x10125a88], edi
mov edx, dword [ebx]
cmp ax, word [edx + 6]
jae 0x1000129d
xor ebx, ebx
lea ecx, [ebx + ebx*4]
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x1000123b
mov esi, dword [ebp + 0x18]
mov esi, dword [esi]
add esi, eax
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x10001275
push eax
mov eax, dword [ecx + 0x14]
add eax, dword [ebp + 8]
push eax
push esi
call fcn.10014920
mov edi, dword [0x10125a88]
add esp, 0xc
mov eax, dword [ebx]
lea ecx, [edi + edi*4]
mov edx, dword [eax + ecx*8 + 8]
mov ecx, dword [eax + ecx*8 + 0x10]
cmp edx, ecx
cmovae ecx, edx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov eax, dword [eax + 0x38]
jmp 0x1000127b
mov ecx, dword [ecx + 8]
mov eax, dword [edx + 0x38]
push eax
inc edi
push ecx
mov ebx, edi
mov dword [0x10125a88], edi
call fcn.10001780
add esi, eax
add esp, 8
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
movzx eax, word [edx + 6]
cmp ebx, eax
jl 0x10001222
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret