Function at 0x10167825
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x10285008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x5dc], ecx
xor ecx, ecx
push esi
mov esi, edx
mov byte [ebp - 0x420], cl
mov ebx, ecx
mov byte [ebp - 0x110], cl
mov word [ebp - 0x318], cx
mov ecx, eax
push edi
mov dword [ebp - 0x5e0], esi
mov dword [ebp - 0x60c], eax
call fcn.100b5cd3
test esi, esi
je 0x1016787c
xor eax, eax
xor ecx, ecx
jmp 0x10167882
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 0x40
lea edx, [ebp - 0x5d8]
mov dword [ebp - 0x5f4], ecx
push edx
mov edx, dword [ebp - 0x5e0]
mov edi, ecx
push ecx
mov ecx, dword [ebp - 0x5dc]
mov esi, eax
push eax
mov dword [ebp - 0x5fc], eax
call fcn.10167790
test eax, eax
jne 0x101678bc
mov eax, 0x8007001e
jmp 0x10168108
mov eax, 0x5a4d
cmp word [ebp - 0x5d8], ax
jne 0x101678e1
mov eax, dword [ebp - 0x59c]
cdq
mov esi, eax
mov edi, edx
add esi, dword [ebp - 0x5fc]
adc edi, dword [ebp - 0x5f4]
mov edx, dword [ebp - 0x5e0]
lea eax, [ebp - 0x610]
mov ecx, dword [ebp - 0x5dc]
push 4
push eax
push edi
push esi
call fcn.10167790
test eax, eax
je 0x101678b2
cmp dword [ebp - 0x610], 0x4550
mov ecx, dword [ebp - 0x5dc]
je 0x10167972
mov edx, dword [ebp - 0x5e0]
lea eax, [ebp - 0x490]
push 0x4c
push eax
push edi
push esi
call fcn.10167790
test eax, eax
je 0x101678b2
add esi, 0x4c
mov eax, 0x107
push 0
pop edx
adc edi, edx
cmp word [ebp - 0x47c], ax
jne 0x10167968
movzx eax, word [ebp - 0x47e]
movzx ecx, word [ebp - 0x48e]
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x5e8], edx
mov dword [ebp - 0x604], edx
jmp 0x10167a45
mov eax, 0xd000007b
jmp 0x10168108
mov ebx, dword [ebp - 0x5e0]
lea eax, [ebp - 0x598]
push 0xf8
push eax
push edi
push esi
mov edx, ebx
call fcn.10167790
test eax, eax
je 0x101678b2
mov eax, 0x20b
cmp word [ebp - 0x580], ax
jne 0x10167a03
mov ecx, dword [ebp - 0x5dc]
lea eax, [ebp - 0x598]
push 0x108
push eax
push edi
push esi
mov edx, ebx
call fcn.10167790
test eax, eax
je 0x101678b2
movzx eax, word [ebp - 0x582]
add esi, 0x108
mov dword [ebp - 0x608], eax
mov eax, dword [ebp - 0x4dc]
adc edi, 0
push 0x1c
xor edx, edx
pop ebx
div ebx
mov edx, dword [ebp - 0x4e0]
mov ebx, dword [ebp - 0x510]
mov dword [ebp - 0x604], eax
mov dword [ebp - 0x5e8], edx
jmp 0x10167a3e
movzx eax, word [ebp - 0x582]
add esi, 0xf8
mov dword [ebp - 0x608], eax
mov eax, dword [ebp - 0x4ec]
adc edi, 0
push 0x1c
pop ebx
xor edx, edx
div ebx
mov ebx, dword [ebp - 0x520]
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x5e8], eax
movzx ecx, word [ebp - 0x592]
movzx eax, cx
mov dword [ebp - 0x5e4], eax
cmp eax, 0x6666666
jbe 0x10167a5f
mov eax, 0x80070216
jmp 0x10168108
imul eax, eax, 0x28
push eax
mov dword [ebp - 0x5ec], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 0x600], eax
pop ecx
test eax, eax
jne 0x10167a84
mov eax, 0x8007000e
jmp 0x10168108
push dword [ebp - 0x5ec]
mov ecx, dword [ebp - 0x5dc]
push eax
push edi
mov edi, dword [ebp - 0x5e0]
mov edx, edi
push esi
call fcn.10167790
test eax, eax
jne 0x10167aae
mov esi, 0x8007001e
jmp 0x101680f9
mov edx, dword [ebp - 0x5e4]
test ebx, ebx
je 0x10167c01
xor esi, esi
test edx, edx
jle 0x10167ae0
mov ecx, dword [ebp - 0x600]
add ecx, 0xc
cmp ebx, dword [ecx]
jb 0x10167ad8
mov eax, dword [ecx + 4]
add eax, dword [ecx]
cmp ebx, eax
jb 0x10167ae0
inc esi
add ecx, 0x28
cmp esi, edx
jl 0x10167acb
cmp esi, edx
jge 0x10167c01
and dword [ebp - 0x5f0], 0
and dword [ebp - 0x5ec], 0
test edi, edi
je 0x10167b0d
mov edx, dword [ebp - 0x600]
imul eax, esi, 0x28
mov ecx, dword [eax + edx + 0x14]
sub ecx, dword [eax + edx + 0xc]
add ebx, ecx
push 4
lea eax, [ebp - 0x5f0]
mov edx, edi
push eax
lea ecx, [ebx + 0xc]
xor eax, eax
add ecx, dword [ebp - 0x5fc]
mov ebx, dword [ebp - 0x5dc]
adc eax, dword [ebp - 0x5f4]
push eax
push ecx
mov ecx, ebx
call fcn.10167790
test eax, eax
je 0x10167bfb
test edi, edi
je 0x10167b6b
imul eax, esi, 0x28
xor edx, edx
mov esi, dword [ebp - 0x600]
mov ecx, dword [eax + esi + 0x14]
sub ecx, dword [eax + esi + 0xc]
mov esi, dword [ebp - 0x5f0]
sbb edx, edx
add esi, ecx
mov ecx, dword [ebp - 0x5ec]
adc ecx, edx
jmp 0x10167b77
mov ecx, dword [ebp - 0x5ec]
mov esi, dword [ebp - 0x5f0]
add esi, dword [ebp - 0x5fc]
mov dword [ebp - 0x5f0], esi
adc ecx, dword [ebp - 0x5f4]
xor edi, edi
mov dword [ebp - 0x5ec], ecx
mov edx, dword [ebp - 0x5e0]
lea eax, [ebp - 0x5f5]
push 1
push eax
push ecx
push esi
mov ecx, ebx
call fcn.10167790
test eax, eax
je 0x10167be7
mov esi, dword [ebp - 0x5f0]
mov ecx, dword [ebp - 0x5ec]
add esi, 1
mov al, byte [ebp - 0x5f5]
adc ecx, 0
mov byte [ebp + edi - 0x420], al
inc edi
mov dword [ebp - 0x5f0], esi
mov dword [ebp - 0x5ec], ecx
test al, al
je 0x10167bee
cmp edi, 0x104
jb 0x10167b91
jmp 0x10167bee
mov byte [ebp - 0x420], 0
mov edi, dword [ebp - 0x5e0]
mov byte [ebp - 0x31d], 0
mov edx, dword [ebp - 0x5e4]
mov ebx, dword [ebp - 0x5e8]
test ebx, ebx
je 0x10167d5f
cmp dword [ebp - 0x604], 0
je 0x10167d5f
xor ecx, ecx
test edx, edx
jle 0x10167c40
mov esi, dword [ebp - 0x600]
add esi, 0xc
cmp ebx, dword [esi]
jb 0x10167c38
mov eax, dword [esi + 4]
add eax, dword [esi]
cmp ebx, eax
jb 0x10167c40
inc ecx
add esi, 0x28
cmp ecx, edx
jl 0x10167c2b
cmp ecx, edx
jge 0x10167d5f
mov edx, dword [ebp - 0x600]
imul eax, ecx, 0x28
mov ecx, dword [ebp - 0x5e8]
sub ecx, dword [eax + edx + 0xc]
test edi, edi
je 0x10167c65
add ecx, dword [eax + edx + 0x14]
jmp 0x10167c69
add ecx, dword [eax + edx + 0xc]
xor ebx, ebx
mov dword [ebp - 0x5e8], ecx
mov dword [ebp - 0x5e0], ebx
cmp dword [ebp - 0x604], ebx
jle 0x10167d5f
push 0x1c
pop eax
push eax
lea eax, [ebp - 0x43c]
mov edx, edi
push eax
xor eax, eax
add ecx, dword [ebp - 0x5fc]
adc eax, dword [ebp - 0x5f4]
push eax
push ecx
mov ecx, dword [ebp - 0x5dc]
call fcn.10167790
test eax, eax
je 0x10167d5f
cmp dword [ebp - 0x430], 4
jne 0x10167ed5
mov ebx, dword [ebp - 0x424]
test edi, edi
jne 0x10167cd8
cmp dword [ebp - 0x428], 0
jne 0x10167ce0
jmp 0x10167fa2
test ebx, ebx
je 0x10167fa2
push dword [ebp - 0x42c]
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 0x5ec], eax
mov esi, eax
pop ecx
test eax, eax
je 0x10167d5f
xor ecx, ecx
test edi, edi
jne 0x10167d11
mov ebx, dword [ebp - 0x428]
add ebx, dword [ebp - 0x5fc]
adc ecx, dword [ebp - 0x5f4]
push dword [ebp - 0x42c]
mov edx, edi
push eax
push ecx
mov ecx, dword [ebp - 0x5dc]
push ebx
call fcn.10167790
jmp 0x10167d3d
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10167d42
cmp eax, ecx
jb 0x10167d42
cmp dword [esi], 1
je 0x10167d9e
sub eax, ecx
add esi, ecx
cmp eax, 0x10
jae 0x10167d29
xor ebx, ebx
push dword [ebp - 0x5ec]
call dword [sym.imp.msvcrt.dll_free]
cmp word [ebp - 0x318], 0
pop ecx
je 0x10167fa4
xor ebx, ebx
cmp byte [ebp + 0x14], 0
je 0x101680a4
cmp byte [ebp - 0x420], 0
jne 0x101680c4
cmp word [ebp - 0x318], 0
jne 0x101680e2
cmp byte [ebp - 0x110], 0
je 0x101680db
lea eax, [ebp - 0x110]
jmp 0x101680ca
cmp byte [esi + 8], 0
lea edx, [esi + 0xc]
push 0x104
jne 0x10167dcb
lea eax, [ebp - 0x318]
xor ebx, ebx
push eax
push 0xffffffffffffffff
push edx
push ebx
push ebx
call dword [0x102a9cb8]
xor eax, eax
mov word [ebp - 0x112], ax
jmp 0x10167dda
push 0xffffffffffffffff
lea ecx, [ebp - 0x318]
call fcn.102105bd
xor ebx, ebx
lea esi, [ebp - 0x318]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x10167de3
sub esi, ecx
sar esi, 1
cmp esi, 4
jbe 0x10167d44
lea eax, [ebp + esi*2 - 0x320]
push 0x1008a4bc
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10167d44
lea ecx, [ebp - 0x318]
call fcn.102111c7
mov edx, eax
lea eax, [ebp - 0x318]
cmp edx, eax
jbe 0x10167e35
xor eax, eax
mov word [edx - 2], ax
lea esi, [esi*2 - 8]
cmp esi, 0x208
jae 0x1016811b
xor eax, eax
lea ecx, [ebp - 0x318]
mov word [ebp + esi - 0x318], ax
mov esi, 0x104
lea eax, [ebp - 0x310]
push esi
push 0xffffffffffffffff
cmp edx, eax
jne 0x10167ea7
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x614], eax
call fcn.102105bd
push esi
mov edx, 0x10062c50
lea ecx, [ebp - 0x318]
call fcn.10210639
push esi
lea edx, [ebp - 0x618]
lea ecx, [ebp - 0x318]
jmp 0x10167ec4
call fcn.102105bd
test dword [ebp - 0x608], 0x2000
lea ecx, [ebp - 0x318]
push esi
je 0x10167ece
mov edx, 0x10061124
call fcn.10210639
jmp 0x10167d44
mov edx, 0x1008a4c8
jmp 0x10167ec4
cmp dword [ebp - 0x430], 2
jne 0x10167fa4
mov esi, dword [ebp - 0x424]
test edi, edi
jne 0x10167efa
cmp dword [ebp - 0x428], 0
jne 0x10167f02
jmp 0x10167fa4
test esi, esi
je 0x10167fa4
cmp dword [ebp - 0x42c], 0x10
jbe 0x10167fa4
test edi, edi
jne 0x10167f27
mov esi, dword [ebp - 0x428]
xor ebx, ebx
add esi, dword [ebp - 0x5fc]
adc ebx, dword [ebp - 0x5f4]
mov ecx, dword [ebp - 0x5dc]
lea eax, [ebp - 0x5e4]
push 4
push eax
push ebx
push esi
mov edx, edi
call fcn.10167790
test eax, eax
je 0x10167fa2
mov eax, 0x3031424e
cmp dword [ebp - 0x5e4], eax
je 0x10167f5c
cmp dword [ebp - 0x5e4], 0x53445352
jne 0x10167fa2
xor ecx, ecx
cmp dword [ebp - 0x5e4], eax
mov eax, dword [ebp - 0x42c]
setne cl
lea ecx, [ecx*8 + 0x10]
cmp eax, ecx
jb 0x10167fa2
sub eax, ecx
cmp eax, 0x104
ja 0x10167fa2
push eax
lea eax, [ebp - 0x110]
mov edx, edi
push eax
xor eax, eax
add ecx, esi
adc eax, ebx
push eax
push ecx
mov ecx, dword [ebp - 0x5dc]
call fcn.10167790
test eax, eax
jne 0x10167fd3
xor ebx, ebx
mov eax, dword [ebp - 0x5e0]
mov ecx, dword [ebp - 0x5e8]
inc eax
push 0x1c
pop edx
add ecx, edx
mov dword [ebp - 0x5e0], eax
mov dword [ebp - 0x5e8], ecx
cmp eax, dword [ebp - 0x604]
jl 0x10167c83
jmp 0x10167d5f
xor ebx, ebx
lea ecx, [ebp - 0x110]
mov byte [ebp - 0xd], bl
call fcn.1021120b
mov edi, eax
push 0x2e
push edi
call dword [sym.imp.msvcrt.dll_strrchr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10168049
push 5
push 0x1008a4d4
push esi
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10168032
push 5
push 0x1008a4dc
push esi
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10168032
push 5
push 0x1008a4e4
push esi
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x10168049
push 0x104
mov edx, edi
lea ecx, [ebp - 0x110]
call fcn.10210488
jmp 0x10167d61
test dword [ebp - 0x608], 0x2000
je 0x10168084
test esi, esi
je 0x1016805b
mov byte [esi], bl
mov esi, 0x104
lea ecx, [ebp - 0x110]
push esi
mov edx, edi
call fcn.10210488
mov edx, 0x1008a4dc
push esi
lea ecx, [ebp - 0x110]
call fcn.102104cc
jmp 0x10167d61
test esi, esi
je 0x1016808a
mov byte [esi], bl
mov esi, 0x104
lea ecx, [ebp - 0x110]
push esi
mov edx, edi
call fcn.10210488
mov edx, 0x1008a4d4
jmp 0x10168073
cmp word [ebp - 0x318], 0
jne 0x101680e2
cmp byte [ebp - 0x110], 0
jne 0x10167d93
cmp byte [ebp - 0x420], 0
je 0x101680db
lea eax, [ebp - 0x420]
mov ecx, dword [ebp - 0x60c]
push ebx
push 0xffffffffffffffff
push eax
call fcn.100cd6fc
jmp 0x101680f7
mov esi, 0x80004002
jmp 0x101680f9
mov ecx, dword [ebp - 0x60c]
lea eax, [ebp - 0x318]
push ebx
push 0xffffffffffffffff
push eax
call fcn.100b5c1c
mov esi, eax
push dword [ebp - 0x600]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10236010
mov esp, ebp
pop ebp
ret 0x10
call fcn.10236265
int3