Function at 0x10001390
Capabilities:
Allocate or change rwx memory
Encode data using xor
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
cmp word [eax], 0x5a4d
push ebx
push ebp
push esi
push edi
je 0x100013ac
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov ecx, dword [eax + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0x100013c3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
cmp word [eax + 0x18], 0x10b
je 0x100013d5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov ebx, dword [eax + 0x50]
push 0x40
push 0x3000
push 0x10000
push 0
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp + 0x10], eax
mov ebp, 0x10000
add ebx, 0x20000
jmp 0x10001405
mov eax, dword [esp + 0x10]
xor edi, edi
mov dword [esp + 0x18], ebp
test ebx, ebx
jbe 0x10001483
lea esi, [eax + ebp]
push 0x40
push 0x3000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10001441
add edi, 0x10000
add esi, 0x10000
add ebp, 0x10000
cmp ebx, edi
jbe 0x1000147f
jmp 0x10001412
test edi, edi
jl 0x10001475
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
lea esi, [edi + edx]
add edi, 0x10000
add esi, ecx
shr edi, 0x10
push 0x8000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
sub esi, 0x10000
dec edi
jne 0x1000145b
add ebp, 0x10000
test ebx, ebx
ja 0x10001401
mov eax, dword [esp + 0x10]
add eax, dword [esp + 0x18]
lea ebp, [eax + 0x10000]
mov eax, dword [esp + 0x28]
push ebp
push eax
call fcn.10001310
add esp, 8
test eax, eax
jne 0x100014d1
mov eax, dword [0x1001f484]
test eax, eax
je 0x100014b9
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
push 0x8000
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov ebx, dword [esp + 0x30]
test bl, 2
jne 0x10001602
mov eax, dword [esp + 0x20]
mov ecx, ebx
mov edx, ebx
shr ecx, 8
not edx
and ecx, 1
and edx, 1
push ecx
push edx
push eax
push ebp
call fcn.100010d0
add esp, 0x10
test eax, eax
je 0x1000149f
mov cl, 0x6f
mov al, 0x74
mov byte [esp + 0x11], cl
mov byte [esp + 0x19], cl
mov ecx, dword [ebp + 0x3c]
mov byte [esp + 0x13], al
mov byte [esp + 0x16], al
mov dl, 0x44
lea eax, [ecx + ebp + 0xf8]
mov byte [esp + 0x10], dl
mov byte [esp + 0x18], dl
mov byte [esp + 0x12], 0x53
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
add edx, ebp
xor eax, eax
test ecx, ecx
mov byte [esp + 0x14], 0x61
mov byte [esp + 0x15], 0x72
mov byte [esp + 0x1a], 0x45
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x64
mov dword [esp + 0x28], ecx
jle 0x100015b1
mov ecx, 7
lea edi, [esp + 0x10]
lea esi, [eax + edx]
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x10001570
sbb ebx, ebx
sbb ebx, 0xffffffff
test ebx, ebx
jne 0x100015a4
mov ecx, 5
lea edi, [esp + 0x18]
lea esi, [edx + eax + 2]
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x100015a4
mov bl, byte [eax + edx]
mov ecx, 5
xor bl, 0x11
lea edi, [esp + 0x18]
mov byte [eax + edx], bl
inc eax
xor ebx, ebx
lea esi, [edx + eax + 2]
repe cmpsb byte [esi], byte es:[edi]
jne 0x10001587
mov ecx, dword [esp + 0x28]
inc eax
cmp eax, ecx
jl 0x10001559
mov ebx, dword [esp + 0x30]
test bl, 1
jne 0x100015ce
mov edx, dword [esp + 0x20]
push 0
push edx
push ebp
call fcn.10001630
add esp, 0xc
test eax, eax
je 0x1000149f
mov eax, ebx
shr eax, 9
and eax, 1
push eax
push ebp
call fcn.10001680
add esp, 8
test eax, eax
jne 0x10001602
mov eax, dword [0x1001f484]
test eax, eax
je 0x100014b9
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x2c]
push ebx
push ecx
push ebp
call fcn.10001620
add esp, 0xc
inc eax
neg eax
sbb eax, eax
pop edi
and eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x14
ret