Function at 0x10001040
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10001e70
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov esi, dword [edi + 8]
bswap esi
push esi
call fcn.10004f40
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], eax
mov eax, dword [edi]
bswap eax
cmp eax, 0x57bc0000
jne 0x1000109b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
bswap eax
test eax, eax
je 0x10001106
mov esi, dword [ebp - 0x3c]
movzx eax, word [esi]
cmp eax, 0x5a4d
jne 0x100010e8
mov eax, dword [esi + 0x3c]
cmp dword [esi + eax], 0x4550
jne 0x100010e8
mov edi, dword [ebp - 0x30]
add edi, eax
mov eax, dword [edi + 0x50]
sub esp, 0x18
mov dword [esp + 0x10], eax
movaps xmm0, xmmword [0x10043210]
movups xmmword [esp], xmm0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
inc eax
cmp eax, 2
jae 0x10001a99
xor ebx, ebx
push esi
call fcn.10004f30
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
mov dword [0x1004a988], edx
mov ecx, dword [ebp - 0x30]
lea edi, [ecx + esi]
mov dword [0x1004a98c], edi
mov eax, dword [ebp - 0x3c]
mov dword [0x1004a990], eax
lea ebx, [edx + 0x10]
mov dword [0x1004a994], eax
add ecx, esi
inc ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], edi
jmp 0x1000115a
mov dword [0x1004a994], esi
add ebx, 4
mov edx, ebx
mov edi, dword [ebp - 0x28]
mov eax, esi
mov ebx, edx
cmp esi, edi
ja 0x1000109b
movzx ecx, byte [ebx]
cmp ecx, 0x20
jb 0x10001210
test cl, cl
js 0x10001369
cmp cl, 0x40
jb 0x100013a6
movzx edx, byte [ebx + 2]
mov dword [ebp - 0x20], edx
lea esi, [eax + edx]
inc esi
cmp esi, edi
ja 0x1000182e
shl ecx, 8
movzx edx, byte [ebx + 1]
mov dword [ebp - 0x2c], edx
add edx, ecx
mov edi, 0x3fff
sub edi, edx
lea edx, [eax + edi]
mov esi, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x30]
jb 0x1000182e
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp - 0x20]
mov ebx, esi
mov byte [ebp - 0x38], bl
mov ebx, esi
inc ebx
cmp byte [ebp - 0x38], 0xf
jb 0x100011d4
mov esi, dword [ebp - 0x2c]
add ecx, esi
add ecx, 0xffffc001
cmp ecx, 0x10
jae 0x100017f7
mov ecx, ebx
mov esi, eax
mov eax, ecx
and eax, 7
je 0x10001719
mov ebx, ecx
xor edi, edi
nop word [eax + eax]
movzx ecx, byte [edx + edi]
mov byte [esi + edi], cl
inc edi
cmp eax, edi
jne 0x100011f0
add edx, edi
mov ecx, ebx
mov eax, ebx
sub eax, edi
add esi, edi
jmp 0x1000171b
cmp cl, 0x18
jb 0x100012c0
movzx edx, byte [ebx + 3]
mov dword [ebp - 0x20], edx
lea esi, [eax + edx]
inc esi
cmp esi, edi
ja 0x10001140
shl ecx, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
movzx edi, byte [ebx + 2]
lea esi, [ecx + edi]
mov dword [ebp - 0x2c], edx
or esi, edx
mov edx, eax
sub edx, esi
add edx, 0x17ffff
mov esi, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x30]
jb 0x10001140
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp - 0x20]
mov ebx, esi
mov byte [ebp - 0x38], bl
mov ebx, esi
inc ebx
cmp byte [ebp - 0x38], 0xf
jb 0x10001282
mov esi, dword [ebp - 0x2c]
add esi, ecx
add esi, edi
add esi, 0xffe80001
cmp esi, 0x10
jae 0x10001657
mov edi, ebx
mov esi, eax
mov eax, edi
and eax, 7
je 0x100015e9
xor ecx, ecx
nop word cs:[eax + eax]
movzx ebx, byte [edx + ecx]
mov byte [esi + ecx], bl
inc ecx
cmp eax, ecx
jne 0x100012a0
add edx, ecx
mov eax, edi
sub eax, ecx
add esi, ecx
jmp 0x100015eb
cmp cl, 0x10
jb 0x100013b7
movzx edx, word [ebx + 3]
rol dx, 8
movzx edx, dx
mov dword [ebp - 0x20], edx
lea esi, [eax + edx]
inc esi
cmp esi, edi
ja 0x100018f1
shl ecx, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
movzx edi, byte [ebx + 2]
lea esi, [ecx + edi]
mov dword [ebp - 0x2c], edx
or esi, edx
mov edx, eax
sub edx, esi
add edx, 0xfffff
mov esi, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x30]
jb 0x100018f1
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp - 0x20]
lea ebx, [esi + 1]
cmp esi, 0xf
jb 0x10001333
mov esi, dword [ebp - 0x2c]
add esi, ecx
add esi, edi
add esi, 0xfff00001
cmp esi, 0x10
jae 0x100018a4
mov edi, ebx
mov esi, eax
mov eax, edi
and eax, 7
je 0x10001787
xor ecx, ecx
nop word cs:[eax + eax]
movzx ebx, byte [edx + ecx]
mov byte [esi + ecx], bl
inc ecx
cmp eax, ecx
jne 0x10001350
add edx, ecx
mov eax, edi
sub eax, ecx
add esi, ecx
jmp 0x10001789
mov dword [ebp - 0x24], ebx
lea esi, [eax + ecx]
add esi, 0xffffff81
cmp esi, edi
ja 0x10001391
mov edx, dword [ebp - 0x24]
movzx ebx, byte [edx + 1]
movzx edi, bl
not edi
lea edx, [edi + eax]
mov esi, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x30]
jae 0x10001456
mov dword [0x1004a994], esi
mov eax, esi
mov edx, dword [ebp - 0x24]
add edx, 2
mov esi, eax
jmp 0x1000114b
lea esi, [eax + ecx]
add esi, 0xffffffe1
cmp esi, edi
jbe 0x100013ed
mov edx, ecx
jmp 0x100014c1
cmp cl, 8
jb 0x10001403
shl ecx, 8
movzx edx, byte [ebx + 1]
mov dword [ebp - 0x24], edx
add edx, ecx
lea esi, [eax + edx]
add esi, 0xfffff801
cmp esi, edi
ja 0x100016c3
lea edi, [ebx + 2]
cmp edi, dword [ebp + 8]
jae 0x100016a3
mov esi, dword [ebp - 0x34]
jmp 0x100016c3
lea edx, [ebx + 1]
cmp edx, dword [ebp + 8]
jae 0x100014b0
mov esi, dword [ebp - 0x34]
mov edx, ecx
jmp 0x100014c1
cmp cl, 4
je 0x10001559
movzx ecx, cl
cmp ecx, 6
je 0x100014cb
cmp ecx, 7
jne 0x1000109b
movzx ecx, word [ebx + 1]
rol cx, 8
movzx edx, cx
lea esi, [eax + edx]
inc esi
mov ecx, 4
cmp esi, edi
ja 0x100016cb
lea ecx, [ebx + 3]
cmp ecx, dword [ebp + 8]
jae 0x100018ff
mov esi, dword [ebp - 0x34]
mov ecx, 4
jmp 0x100016cb
add ecx, 0xffffff81
je 0x10001399
cmp ecx, 0x10
jb 0x100016e2
cmp bl, 0xf
jb 0x100016e2
mov ebx, ecx
and ebx, 0xf0
add edx, ebx
mov esi, ecx
and esi, 0xf
mov dword [ebp - 0x20], esi
lea esi, [eax + ebx]
mov dword [ebp - 0x2c], ebx
nop dword [eax]
movups xmm0, xmmword [eax + edi]
movups xmmword [eax], xmm0
add eax, 0x10
add ebx, 0xfffffff0
jne 0x10001490
cmp ecx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x20]
je 0x10001391
jmp 0x100016e6
add ecx, 0xffffffe1
push ecx
push edx
push eax
call fcn.10003680
add esp, 0xc
movzx edx, byte [ebx]
mov ecx, 0xffffffe2
jmp 0x100016cb
mov edx, ebx
movzx ecx, byte [ebx + 4]
mov dword [ebp - 0x20], ecx
lea esi, [eax + ecx]
inc esi
cmp esi, edi
ja 0x10001a42
movzx ecx, byte [edx + 1]
shl ecx, 0x10
movzx edi, byte [edx + 2]
shl edi, 8
movzx ebx, byte [edx + 3]
mov dword [ebp - 0x2c], ecx
add ecx, ebx
or ecx, edi
not ecx
add ecx, eax
mov esi, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x30]
jb 0x10001a42
mov dword [ebp - 0x24], edx
mov esi, dword [ebp - 0x20]
mov edx, esi
mov byte [ebp - 0x38], dl
mov edx, esi
inc edx
cmp byte [ebp - 0x38], 0xf
jb 0x1000152e
mov esi, dword [ebp - 0x2c]
or esi, edi
add esi, ebx
inc esi
cmp esi, 0x10
jae 0x10001a07
mov edi, edx
mov esi, eax
mov eax, edi
and eax, 7
je 0x10001920
xor edx, edx
nop
movzx ebx, byte [ecx + edx]
mov byte [esi + edx], bl
inc edx
cmp eax, edx
jne 0x10001540
add ecx, edx
mov eax, edi
sub eax, edx
add esi, edx
jmp 0x10001922
movzx ecx, word [ebx + 4]
rol cx, 8
mov edx, ebx
movzx ebx, cx
lea esi, [eax + ebx]
inc esi
cmp esi, edi
ja 0x10001a8b
movzx ecx, byte [edx + 1]
shl ecx, 0x10
movzx esi, byte [edx + 2]
shl esi, 8
movzx edi, byte [edx + 3]
mov dword [ebp - 0x2c], ecx
add ecx, edi
mov dword [ebp - 0x20], esi
or ecx, esi
not ecx
add ecx, eax
mov esi, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x30]
jb 0x10001a8b
mov dword [ebp - 0x24], edx
lea edx, [ebx + 1]
cmp ebx, 0xf
jb 0x100015bd
mov ebx, dword [ebp - 0x2c]
mov esi, ebx
or esi, dword [ebp - 0x20]
add esi, edi
inc esi
cmp esi, 0x10
jae 0x10001a50
mov edi, edx
mov esi, eax
mov eax, edi
and eax, 7
je 0x10001997
xor edx, edx
nop
movzx ebx, byte [ecx + edx]
mov byte [esi + edx], bl
inc edx
cmp eax, edx
jne 0x100015d0
add ecx, edx
mov eax, edi
sub eax, edx
add esi, edx
jmp 0x10001999
mov eax, edi
dec edi
cmp edi, 7
mov ebx, dword [ebp - 0x24]
jb 0x10001140
xor ecx, ecx
nop word [eax + eax]
movzx ebx, byte [edx + ecx]
mov byte [esi + ecx], bl
movzx ebx, byte [edx + ecx + 1]
mov byte [esi + ecx + 1], bl
movzx ebx, byte [edx + ecx + 2]
mov byte [esi + ecx + 2], bl
movzx ebx, byte [edx + ecx + 3]
mov byte [esi + ecx + 3], bl
movzx ebx, byte [edx + ecx + 4]
mov byte [esi + ecx + 4], bl
movzx ebx, byte [edx + ecx + 5]
mov byte [esi + ecx + 5], bl
movzx ebx, byte [edx + ecx + 6]
mov byte [esi + ecx + 6], bl
movzx ebx, byte [edx + ecx + 7]
mov byte [esi + ecx + 7], bl
add ecx, 8
cmp eax, ecx
jne 0x10001600
add esi, ecx
mov ebx, dword [ebp - 0x24]
jmp 0x10001140
mov esi, ebx
and esi, 0xfffffff0
mov dword [ebp - 0x20], esi
add edx, esi
mov esi, ebx
and esi, 0xf
mov dword [ebp - 0x38], esi
add edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x20]
add esi, eax
xor edi, 0x17ffff
sub edi, ecx
mov ecx, dword [ebp - 0x20]
nop dword [eax]
movups xmm0, xmmword [eax + edi]
movups xmmword [eax], xmm0
add eax, 0x10
add ecx, 0xfffffff0
jne 0x10001680
cmp ebx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x38]
je 0x10001140
jmp 0x10001286
mov edx, dword [ebp - 0x24]
add ecx, edx
add ecx, 0xfffff801
push ecx
push edi
push eax
call fcn.10003680
add esp, 0xc
movzx eax, word [ebx]
rol ax, 8
movzx edx, ax
mov edi, dword [ebp - 0x28]
mov ecx, 0xfffff803
add edx, ecx
mov dword [0x1004a994], esi
add edx, ebx
cmp edx, ebx
jne 0x1000114e
jmp 0x1000109b
mov edi, ecx
mov esi, eax
mov eax, edi
and eax, 7
je 0x1000183c
xor ecx, ecx
nop word cs:[eax + eax]
movzx ebx, byte [edx + ecx]
mov byte [esi + ecx], bl
inc ecx
cmp eax, ecx
jne 0x10001700
add edx, ecx
mov eax, edi
sub eax, ecx
add esi, ecx
jmp 0x1000183e
mov eax, ecx
dec ecx
cmp ecx, 7
mov ebx, dword [ebp - 0x24]
jb 0x1000182e
xor ecx, ecx
nop word [eax + eax]
movzx ebx, byte [edx + ecx]
mov byte [esi + ecx], bl
movzx ebx, byte [edx + ecx + 1]
mov byte [esi + ecx + 1], bl
movzx ebx, byte [edx + ecx + 2]
mov byte [esi + ecx + 2], bl
movzx ebx, byte [edx + ecx + 3]
mov byte [esi + ecx + 3], bl
movzx ebx, byte [edx + ecx + 4]
mov byte [esi + ecx + 4], bl
movzx ebx, byte [edx + ecx + 5]
mov byte [esi + ecx + 5], bl
movzx ebx, byte [edx + ecx + 6]
mov byte [esi + ecx + 6], bl
movzx ebx, byte [edx + ecx + 7]
mov byte [esi + ecx + 7], bl
add ecx, 8
cmp eax, ecx
jne 0x10001730
add esi, ecx
mov ebx, dword [ebp - 0x24]
jmp 0x1000182e
mov eax, edi
dec edi
cmp edi, 7
mov ebx, dword [ebp - 0x24]
jb 0x100018f1
xor ecx, ecx
nop dword [eax + eax]
movzx ebx, byte [edx + ecx]
mov byte [esi + ecx], bl
movzx ebx, byte [edx + ecx + 1]
mov byte [esi + ecx + 1], bl
movzx ebx, byte [edx + ecx + 2]
mov byte [esi + ecx + 2], bl
movzx ebx, byte [edx + ecx + 3]
mov byte [esi + ecx + 3], bl
movzx ebx, byte [edx + ecx + 4]
mov byte [esi + ecx + 4], bl
movzx ebx, byte [edx + ecx + 5]
mov byte [esi + ecx + 5], bl
movzx ebx, byte [edx + ecx + 6]
mov byte [esi + ecx + 6], bl
movzx ebx, byte [edx + ecx + 7]
mov byte [esi + ecx + 7], bl
add ecx, 8
cmp eax, ecx
jne 0x100017a0
add esi, ecx
mov ebx, dword [ebp - 0x24]
jmp 0x100018f1
mov esi, ebx
and esi, 0xfffffff0
add edx, esi
mov ecx, ebx
and ecx, 0xf
mov dword [ebp - 0x20], ecx
mov ecx, esi
add esi, eax
mov dword [ebp - 0x2c], ecx
nop dword [eax]
movups xmm0, xmmword [eax + edi]
movups xmmword [eax], xmm0
add eax, 0x10
add ecx, 0xfffffff0
jne 0x10001810
cmp ebx, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
jne 0x100011d8
mov dword [0x1004a994], esi
add ebx, 3
jmp 0x10001149
mov eax, edi
dec edi
cmp edi, 7
jb 0x10001391
xor ecx, ecx
nop word [eax + eax]
movzx ebx, byte [edx + ecx]
mov byte [esi + ecx], bl
movzx ebx, byte [edx + ecx + 1]
mov byte [esi + ecx + 1], bl
movzx ebx, byte [edx + ecx + 2]
mov byte [esi + ecx + 2], bl
movzx ebx, byte [edx + ecx + 3]
mov byte [esi + ecx + 3], bl
movzx ebx, byte [edx + ecx + 4]
mov byte [esi + ecx + 4], bl
movzx ebx, byte [edx + ecx + 5]
mov byte [esi + ecx + 5], bl
movzx ebx, byte [edx + ecx + 6]
mov byte [esi + ecx + 6], bl
movzx ebx, byte [edx + ecx + 7]
mov byte [esi + ecx + 7], bl
add ecx, 8
cmp eax, ecx
jne 0x10001850
add esi, ecx
jmp 0x10001391
mov esi, ebx
and ebx, 0xfffffff0
add edx, ebx
mov dword [ebp - 0x38], esi
and esi, 0xf
mov dword [ebp - 0x20], esi
add edi, dword [ebp - 0x2c]
lea esi, [eax + ebx]
xor edi, 0xfffff
sub edi, ecx
mov dword [ebp - 0x2c], ebx
nop word cs:[eax + eax]
movups xmm0, xmmword [eax + edi]
movups xmmword [eax], xmm0
add eax, 0x10
add ebx, 0xfffffff0
jne 0x100018d0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
jne 0x10001337
mov dword [0x1004a994], esi
add ebx, 5
jmp 0x10001149
inc edx
push edx
push ecx
push eax
call fcn.10003680
add esp, 0xc
movzx eax, word [ebx + 1]
rol ax, 8
movzx edx, ax
mov ecx, 4
jmp 0x100016cb
mov eax, edi
dec edi
cmp edi, 7
mov edx, dword [ebp - 0x24]
jb 0x10001a42
xor edx, edx
nop word cs:[eax + eax]
movzx ebx, byte [ecx + edx]
mov byte [esi + edx], bl
movzx ebx, byte [ecx + edx + 1]
mov byte [esi + edx + 1], bl
movzx ebx, byte [ecx + edx + 2]
mov byte [esi + edx + 2], bl
movzx ebx, byte [ecx + edx + 3]
mov byte [esi + edx + 3], bl
movzx ebx, byte [ecx + edx + 4]
mov byte [esi + edx + 4], bl
movzx ebx, byte [ecx + edx + 5]
mov byte [esi + edx + 5], bl
movzx ebx, byte [ecx + edx + 6]
mov byte [esi + edx + 6], bl
movzx ebx, byte [ecx + edx + 7]
mov byte [esi + edx + 7], bl
add edx, 8
cmp eax, edx
jne 0x10001940
add esi, edx
mov edx, dword [ebp - 0x24]
jmp 0x10001a42
mov eax, edi
dec edi
cmp edi, 7
mov edx, dword [ebp - 0x24]
jb 0x10001a8b
xor edx, edx
nop dword [eax + eax]
movzx ebx, byte [ecx + edx]
mov byte [esi + edx], bl
movzx ebx, byte [ecx + edx + 1]
mov byte [esi + edx + 1], bl
movzx ebx, byte [ecx + edx + 2]
mov byte [esi + edx + 2], bl
movzx ebx, byte [ecx + edx + 3]
mov byte [esi + edx + 3], bl
movzx ebx, byte [ecx + edx + 4]
mov byte [esi + edx + 4], bl
movzx ebx, byte [ecx + edx + 5]
mov byte [esi + edx + 5], bl
movzx ebx, byte [ecx + edx + 6]
mov byte [esi + edx + 6], bl
movzx ebx, byte [ecx + edx + 7]
mov byte [esi + edx + 7], bl
add edx, 8
cmp eax, edx
jne 0x100019b0
add esi, edx
mov edx, dword [ebp - 0x24]
jmp 0x10001a8b
mov esi, edx
and esi, 0xfffffff0
add ecx, esi
mov dword [ebp - 0x20], edx
and edx, 0xf
mov dword [ebp - 0x38], edx
mov edx, esi
add ebx, edi
add esi, eax
not ebx
sub ebx, dword [ebp - 0x2c]
mov edi, edx
movups xmm0, xmmword [eax + ebx]
movups xmmword [eax], xmm0
add eax, 0x10
add edi, 0xfffffff0
jne 0x10001a24
cmp dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x38]
jne 0x10001532
mov dword [0x1004a994], esi
add edx, 5
jmp 0x1000114b
mov esi, edx
and esi, 0xfffffff0
add ecx, esi
mov dword [ebp - 0x38], edx
and edx, 0xf
mov dword [ebp - 0x40], edx
add edi, dword [ebp - 0x20]
mov edx, esi
add esi, eax
not edi
sub edi, ebx
mov ebx, edx
movups xmm0, xmmword [eax + edi]
movups xmmword [eax], xmm0
add eax, 0x10
add edx, 0xfffffff0
jne 0x10001a6d
cmp dword [ebp - 0x38], ebx
mov edx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x40]
jne 0x100015c1
mov dword [0x1004a994], esi
add edx, 6
jmp 0x1000114b
push dword [edi + 0x50]
push 0
push 0
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x10001b56
mov dword [ebp - 0x24], ebx
push dword [edi + 0x54]
push esi
push eax
mov ebx, eax
call fcn.10003680
add esp, 0xc
cmp word [edi + 6], 0
mov ecx, edi
mov dword [ebp - 0x28], ebx
je 0x10001b1c
mov edx, esi
movzx eax, word [ecx + 0x14]
lea esi, [ecx + eax]
add esi, 0x18
add esi, 0x14
xor edi, edi
mov dword [ebp - 0x30], ecx
nop word cs:[eax + eax]
mov eax, dword [esi - 8]
add eax, ebx
mov ecx, dword [esi]
add ecx, edx
push dword [esi - 4]
push ecx
push eax
mov ebx, edx
call fcn.10003680
mov edx, ebx
mov ecx, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x28]
add esp, 0xc
inc edi
movzx eax, word [ecx + 6]
add esi, 0x28
cmp edi, eax
jb 0x10001af0
mov eax, dword [ecx + 0x50]
test eax, eax
je 0x10001b62
js 0x10001dfe
mov dword [ebp - 0x10], 0
cmp eax, 0x1000
mov dword [ebp - 0x34], eax
jb 0x10001b6e
add eax, 0x23
push eax
call fcn.10001e7a
add esp, 4
mov esi, dword [ebp - 0x3c]
mov edi, eax
add edi, 0x23
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x10001b7c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100010e8
xor ebx, ebx
xor edi, edi
mov esi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
jmp 0x10001b98
push eax
call fcn.10001e7a
add esp, 4
mov esi, dword [ebp - 0x3c]
mov edi, eax
mov eax, dword [ebp - 0x34]
lea ecx, [edi + eax]
mov dword [ebp - 0x30], ecx
push eax
mov ebx, dword [ebp - 0x28]
push ebx
push edi
call fcn.10003680
mov eax, ebx
mov ebx, dword [ebp - 0x30]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub ebx, edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, ebx
mov ebx, eax
test eax, eax
je 0x10001bd3
push ecx
push edi
push ebx
mov dword [ebp - 0x30], ecx
call fcn.10003680
mov ecx, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x28], ebx
test edi, edi
je 0x10001c02
cmp ecx, 0x1000
jb 0x10001bf8
mov eax, dword [edi - 4]
add edi, 0xfffffffc
sub edi, eax
cmp edi, 0x20
jae 0x10001e0a
add ecx, 0x23
mov edi, eax
push ecx
push edi
call fcn.10001eaf
add esp, 8
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x100010e8
movzx eax, word [edi]
cmp eax, 0x5a4d
jne 0x100010e8
mov ebx, dword [edi + 0x3c]
cmp dword [edi + ebx], 0x4550
jne 0x100010e8
push 0x40
push 0x3000
push dword [edi + ebx + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x100010e8
mov dword [ebp - 0x34], ebx
cmp dword [edi + ebx + 0x84], 0
je 0x10001cf7
mov eax, dword [ebp - 0x34]
mov ecx, dword [edi + eax + 0x80]
mov eax, ecx
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x10001cf7
mov eax, dword [ebp - 0x20]
mov eax, dword [edi + eax + 0xc]
test eax, eax
je 0x10001cf7
add dword [ebp - 0x20], edi
lea ecx, [edi + 2]
mov dword [ebp - 0x24], ecx
jmp 0x10001c9a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0x20]
add ecx, 0x14
mov dword [ebp - 0x20], ecx
test eax, eax
mov edi, dword [ebp - 0x28]
je 0x10001cf7
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10001c87
mov ebx, eax
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + edi]
test eax, eax
je 0x10001c87
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x30], ecx
mov esi, dword [ebp - 0x28]
jmp 0x10001ce2
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x30]
mov dword [esi + ecx], eax
mov eax, dword [esi + edi + 4]
add esi, 4
test eax, eax
je 0x10001c87
test eax, eax
js 0x10001cc6
add eax, dword [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10001cd1
jmp 0x10001cd7
mov eax, dword [ebp - 0x34]
mov ebx, dword [edi + eax + 0xa4]
test ebx, ebx
je 0x10001dc9
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
sub edx, dword [eax + ecx + 0x34]
mov esi, dword [eax + ecx + 0xa0]
add esi, eax
movzx eax, dx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], edx
shr edx, 0x10
mov dword [ebp - 0x2c], edx
xor ecx, ecx
jmp 0x10001d4a
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
mov ebx, dword [eax + ecx + 0xa4]
mov ecx, dword [ebp - 0x38]
add ecx, edx
mov esi, edi
cmp ecx, ebx
jae 0x10001dc9
lea edi, [esi + 8]
mov edx, dword [esi + 4]
mov eax, edx
and eax, 0xfffffffe
cmp eax, 8
je 0x10001d42
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], ecx
xor ebx, ebx
jmp 0x10001d94
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
mov edx, dword [esi]
and ecx, 0xfff
add ecx, dword [ebp - 0x28]
add dword [edx + ecx], eax
mov edx, dword [esi + 4]
add edi, 2
inc ebx
lea eax, [edx - 8]
shr eax, 1
cmp ebx, eax
jae 0x10001d32
movzx ecx, word [edi]
mov esi, ecx
shr esi, 0xc
dec esi
cmp esi, 9
ja case.0x10001da5.4
mov eax, dword [ebp - 0x30]
jmp dword [esi*4 + 0x10043344]
mov eax, dword [ebp - 0x2c]
jmp case.0x10001da5.3
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x34]
movzx esi, word [eax + esi + 4]
mov eax, dword [ebp - 0x30]
cmp esi, 0x8664
je case.0x10001da5.3
jmp case.0x10001da5.4
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x34]
push dword [esi + edi + 0x50]
push esi
mov ebx, dword [ebp - 0x40]
push ebx
call fcn.10003680
add esp, 0xc
mov eax, dword [esi + edi + 0x28]
add eax, ebx
mov dword [ebp - 0x10], 0
push 0
push 1
push ebx
call eax
mov bl, 1
mov esi, dword [ebp - 0x3c]
jmp 0x100010ea
mov dword [ebp - 0x10], 0
call fcn.10001e20
call fcn.10004a5f
nop
push ebp
sub esp, 0x18
add ebp, 0xc
call fcn.10003296
int3