Function at 0x10001000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], ebx
push esi
push edi
cmp edx, 0x40
jb 0x10001202
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x10001202
mov ecx, dword [ebx + 0x3c]
mov dword [ebp - 0x10], ecx
lea eax, [ecx + 0xf8]
cmp edx, eax
jb 0x10001202
cmp dword [ecx + ebx], 0x4550
lea esi, [ecx + ebx]
mov dword [ebp - 4], esi
jne 0x10001202
mov eax, dword [ebp + 8]
push 0x40
push 0x3000
push dword [esi + 0x50]
mov eax, dword [eax + 4]
push 0
call eax
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x10001202
mov edx, dword [esi + 0x54]
test edx, edx
je 0x1000108e
mov ecx, edi
sub ebx, edi
nop dword [eax + eax]
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x10001080
movzx ecx, word [esi + 0x14]
xor eax, eax
add ecx, esi
xor ebx, ebx
mov dword [ebp - 8], ecx
cmp ax, word [esi + 6]
jae 0x100010dc
mov esi, dword [ebp - 8]
movzx eax, bx
lea eax, [eax + eax*4]
mov edx, dword [ecx + eax*8 + 0x28]
mov ecx, dword [ecx + eax*8 + 0x24]
mov esi, dword [esi + eax*8 + 0x2c]
add ecx, edi
add esi, dword [ebp - 0xc]
test edx, edx
je 0x100010cf
sub esi, ecx
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x100010c1
mov esi, dword [ebp - 4]
inc ebx
mov ecx, dword [ebp - 8]
cmp bx, word [esi + 6]
jb 0x100010a1
cmp dword [esi + 0xa4], 0
je 0x10001154
mov esi, dword [esi + 0xa0]
add esi, edi
cmp dword [esi], 0
je 0x10001151
mov ebx, dword [esi + 4]
lea eax, [esi + 4]
sub ebx, 8
mov dword [ebp - 0x18], eax
shr ebx, 1
mov edx, 0
mov dword [ebp - 8], ebx
je 0x1000114a
nop word [eax + eax]
movzx eax, word [esi + edx*2 + 8]
mov ecx, eax
and ecx, 0xf000
cmp ecx, 0x3000
jne 0x10001142
mov ebx, dword [ebp - 0xc]
and eax, 0xfff
add eax, dword [esi]
mov ecx, edi
add eax, edi
mov edi, dword [ebp - 0x10]
sub ecx, dword [edi + ebx + 0x34]
add dword [eax], ecx
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 8]
inc edx
cmp edx, ebx
jb 0x10001110
mov eax, dword [ebp - 0x18]
add esi, dword [eax]
cmp dword [esi], 0
jne 0x100010f2
mov esi, dword [ebp - 4]
cmp dword [esi + 0x84], 0
je 0x1000120e
mov ebx, dword [esi + 0x80]
add ebx, edi
mov dword [ebp - 8], ebx
cmp dword [ebx + 0xc], 0
je 0x1000120e
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], ecx
nop
mov eax, dword [ebx + 0xc]
add eax, edi
push eax
call ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100011f2
mov edx, dword [ebx]
mov esi, dword [ebx + 0x10]
lea ecx, [edx + edi]
test ecx, ecx
lea ebx, [esi + edi]
cmovne esi, edx
add esi, edi
mov eax, dword [esi]
test eax, eax
je 0x100011de
mov ecx, eax
nop dword [eax]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
test eax, eax
jns 0x100011be
movzx eax, cx
jmp 0x100011c3
lea eax, [ecx + 2]
add eax, edi
push eax
push dword [ebp - 0xc]
call edx
mov dword [ebx], eax
test eax, eax
je 0x100011f2
mov eax, dword [esi + 4]
add esi, 4
add ebx, 4
mov ecx, eax
test eax, eax
jne 0x100011b0
mov ebx, dword [ebp - 8]
add ebx, 0x14
mov dword [ebp - 8], ebx
cmp dword [ebx + 0xc], 0
je 0x1000120b
mov ecx, dword [ebp - 0x18]
jmp 0x10001180
mov eax, dword [ebp + 8]
push 0x8000
push 0
push edi
mov eax, dword [eax + 8]
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0x28]
test eax, eax
je 0x10001222
push 0
push 1
push edi
add eax, edi
call eax
test eax, eax
je 0x100011f2
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret