Function at 0x10009d28
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000e598
push 0x1000c600
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x50], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x10009f51
mov edi, dword [eax + 0x3c]
add edi, eax
push 0xf8
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10009f51
cmp dword [edi], 0x4550
jne 0x10009f51
mov eax, dword [edi + 0x2c]
mov ebx, dword [edi + 0x34]
add ebx, eax
mov dword [ebp - 0x68], ebx
add eax, dword [esi]
mov dword [ebp - 0x60], eax
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x24], str.KeRaiseIrqlToDpcLevel
mov eax, dword [esi + 8]
cmp eax, 5
jne 0x10009dc3
cmp dword [esi + 0xc], 2
jne 0x10009dc3
cmp word [esi + 0x10], 1
jae 0x10009dc8
cmp eax, 6
jb 0x10009dcf
mov dword [ebp - 0x24], str.KeRaiseIrqlToSynchLevel
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x10009f51
push str.RtlImageDirectoryEntryToData
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009f51
lea ecx, [ebp - 0x44]
push ecx
push 1
push 1
push dword [esi]
call eax
mov edi, eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x10009f1b
mov eax, dword [edi + 0xc]
test eax, eax
je 0x10009f1b
cmp dword [edi + 0x10], 0
je 0x10009f1b
add eax, dword [esi]
push eax
push str.HAL.dll
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x10009f13
mov edi, dword [edi + 0x10]
test edi, edi
je 0x10009ecf
add edi, dword [esi]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x70], edi
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
test eax, eax
je 0x10009ecf
and dword [ebp - 4], 0
mov ecx, eax
shr ecx, 0x1f
mov byte [ebp - 0x7c], cl
test cl, cl
jne 0x10009ebf
add eax, dword [esi]
mov dword [ebp - 0x78], eax
add eax, 2
mov dword [ebp - 0x74], eax
push str.KeGetCurrentIrql
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x10009e9d
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x2c], eax
sub eax, dword [ebp - 0x60]
mov dword [ebp - 0x20], eax
add eax, ebx
mov dword [ebp - 0x58], eax
push dword [ebp - 0x24]
push dword [ebp - 0x74]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x10009ebf
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x50], eax
sub eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
add eax, ebx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x2c], 0
je 0x10009edd
cmp dword [ebp - 0x50], 0
je 0x10009edd
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x2c], 0
je 0x10009f51
cmp dword [ebp - 0x50], 0
jne 0x10009f1b
jmp 0x10009f51
add dword [ebp - 0x70], 4
add edi, 4
mov dword [ebp - 0x6c], edi
or dword [ebp - 4], 0xffffffff
jmp 0x10009e57
add edi, 0x14
jmp 0x10009e18
push str.RtlUnwind
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009f51
cmp dword [esi + 8], 6
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x58]
push dword [ebp - 0x54]
push dword [ebp - 0x60]
push esi
jae 0x10009f4a
call fcn.10009f62
add esp, 0x18
jmp 0x10009f53
call fcn.1000a05b
jmp 0x10009f45
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret