Function at 0x9d7ba9
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
clc
test esp, 0x2f911d62
test ebx, esp
sub esp, 0x114
push edi
cmp ecx, 0x39e941e0
mov edi, dword [ebp + 8]
stc
test edi, edi
je 0xf6e514
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jmp 0xe85add
mov dword [ebp + 8], esi
jmp 0xe93c1f
jne 0xf62884
pop esi
or bl, 0x67
rol bx, cl
pop ebx
xor eax, eax
pop edi
jmp 0xeff9d6
jle 0xb5d136
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 8]
cmp esi, dword [eax + edi + 0x14]
jmp 0xef61e7
push edi
not ah
cwde
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0xf6121f
lea ecx, [esi + 1]
jmp 0xb47bc8
mov eax, dword [ebp + 0xc]
jmp 0xb1fbd5
push eax
jmp 0xa6d9c5
jne 0xe93c1f
inc esi
jmp 0x9e3d70
jb 0xec0ad1
mov eax, dword [ebp + 8]
movzx ecx, sp
bswap ecx
setns cl
lea ecx, [ebp - 0x114]
push ecx
jmp 0xe81ba4
lea edx, [ecx + edx*2 - 0x30]
mov cl, byte [esi]
test cl, cl
jmp 0xf7f70f
push edx
lahf
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0xf427d4
mov esp, ebp
pop ebp
jmp 0xe86017
call fcn.009d7ba9
add esp, 0xc
not di
pop esi
pop ebx
movsx edi, dx
pop edi
jmp 0xec6c2c
pop edi
jmp 0xeb05db
ret
mov edx, dword [edi + 0x3c]
clc
cmc
cmp ebp, 0x62121258
add edx, edi
cmp dword [edx], 0x4550
jmp 0xe6e67d
sub bl, 0x30
inc esi
cmp bl, 9
jmp 0xf6605d
call fcn.009d7ba9
add esp, 0xc
pop esi
movsx ebx, bp
pop ebx
jmp 0xe76de3
push eax
not ax
jmp 0x9efbaf
je 0xf7f715
mov bl, cl
cmp dh, 0x96
jmp 0xa5e5e8
mov dword [ebp - 8], ecx
jmp 0xec764f
je 0xf19e53
push 0
jmp 0xe9beca
ja 0xe798b1
sub ecx, dword [eax + edi + 0x10]
clc
stc
cmp ecx, dword [eax + edi + 0x14]
jmp 0xb5da3f
cmp byte [esi + 1], 0x23
not cl
movsx ecx, dx
jmp 0x9f3306
mov esp, ebp
xchg ebp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
xor esi, 0x40025746
rcl ah, 0xcc
mov edx, dword [ebp - 0xc]
bt eax, edi
dec esi
mov eax, dword [ebp + 8]
btc esi, 4
bsr si, cx
lea esi, [ebx + eax]
xor ax, 0x1efc
mov eax, dword [ebp + 0x10]
push eax
bts ax, si
sar esi, 1
sbb al, 0x5d
sal ah, cl
bswap eax
mov eax, dword [edx + esi*4]
add eax, edi
call fcn.00a113bb
lea esp, [esp + 4]
cmc
jmp 0xeb156b
jae 0xebb37d
mov edx, dword [eax + edi + 0x1c]
lea ecx, [edx + ecx*4]
mov ecx, dword [ecx + edi]
cmp ebp, 0x1851742f
test ecx, ecx
jmp 0x9e4845
je 0xa0c058
mov byte [ebx + eax], dl
mov edx, dword [ebp + 8]
jmp 0xe6f988
jne 0xb4d571
cmp byte [ebp + 0x10], 0
je 0x9f33be
mov ebx, dword [ebp + 0xc]
adc cl, 0xae
lea eax, [ebp - 0x114]
rol cl, cl
ror cl, cl
xor edx, edx
adc esi, edx
cmp bp, cx
sub ebx, eax
mov edi, edi
mov eax, 0x618a14fa
bt si, 0x6f
movzx esi, ax
mov cl, dl
jmp 0xf76447
pop esi
seta bh
pop ebx
movzx eax, bp
mov ah, 0x59
lea eax, [ecx + edi]
cmovle edi, edx
pop edi
jmp 0xf547de
jmp 0xe93c1f
jne 0xf6e514
mov eax, dword [edx + 0x78]
cmc
test si, bp
mov dword [ebp - 4], eax
cmc
test esp, esi
test eax, eax
jmp 0xf61e6b
inc edx
jmp 0xeb6e41
pop edi
jmp 0xf9bfd8
mov ebx, dword [eax + edi + 0x18]
cmp bp, 0x36e2
test ebx, ebx
jmp 0xf8aa9c
mov byte [ebp + eax - 0x114], 0
movzx eax, sp
movsx ax, ah
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0xf7ec56
je 0xf6e514
mov eax, 0x5a4d
cmp word [edi], ax
jmp 0xf6e50e
ret
je 0xebb37d
mov edi, edi
cmp sp, 0x7016
test si, 0x7419
stc
cmp cl, 0x2e
jmp 0xf6d386
lea ebx, [esi - 1]
cmp dword [ebp + 8], ebx
jmp 0x9ed387
push ecx
jmp 0xf35344
jne 0xf427de
lea edx, [ebp - 0x114]
jmp 0xa109eb
mov esp, ebp
pop ebp
jmp 0xee9333
cmp eax, 0xffffffff
jmp 0xf6fa8f
inc eax
jmp 0xf1f695
jne 0xe8cdd2
pop esi
shld edi, ebx, 0x17
bt bx, di
pop ebx
xor eax, eax
cmovnp di, di
not di
bswap edi
pop edi
jmp 0xa13a8e
sub ecx, eax
cmc
cmp ecx, 0x104
jmp 0xf8b09f
jbe 0xa0c058
lea ebx, [ebp - 0x114]
rcl dl, cl
xchg dl, dl
dec dl
sub ebx, eax
mov dl, byte [eax]
test dl, dl
jmp 0xb620a8
mov esp, ebp
bswap bp
cmovb bp, bx
pop ebp
jmp 0xf18101
mov dword [ebp + 8], edx
jmp 0xb7e553
je 0xf73d9b
cmp eax, 1
jmp 0x9fec7f
push eax
mov ah, cl
push edi
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
pop esi
setb bh
movzx bx, al
pop ebx
bswap edi
xchg edi, edi
pop edi
jmp 0xb594a1
ret
je 0xef2e91
inc edx
cmp edx, 0x104
jb 0xb6b347
lea eax, [ebp - 0x114]
jmp 0xede2ee
jae 0xebb37d
mov ecx, dword [eax + edi + 0x1c]
neg dx
lea edx, [ecx + esi*4]
xchg cl, ch
sub cx, 0x4fff
mov ecx, dword [edx + edi]
cmc
test ecx, ecx
jmp 0xf6287e
mov esp, ebp
not bp
xchg ebp, ebp
mov ebp, 0x22631802
pop ebp
jmp 0xa53aa7
dec ebx
test dx, 0x67ed
lea edx, [edx + edi]
clc
mov dword [ebp + 8], 0
stc
cmc
mov dword [ebp - 0xc], edx
test ebx, ebx
jmp 0xf85729
ret
mov cl, byte [esi + 2]
cmp bp, 0x626a
jmp 0xf2e21f
mov dword [ebp + 8], edx
stc
cmc
cmp edx, ecx
jmp 0xa0c052
add esi, 2
test ecx, edi
xor edx, edx
cmp cl, 0xd4
cmc
test cl, cl
jmp 0xb30308
push eax
jmp 0xa1d1a4
call eax
test eax, eax
je 0xebb37d
cmp eax, edi
jmp 0xb6b31c
mov esp, ebp
movsx ebp, sp
pop ebp
jmp 0xf8a5df
call eax
pop esi
pop ebx
pop edi
mov esp, ebp
mov bp, si
xchg bp, bp
pop ebp
ret
je 0xf6e514
mov edx, dword [edx + 0x7c]
cmp edi, ebp
test dx, 0x5c20
push ebx
cmc
push esi
cmc
stc
or esi, 0xffffffff
test si, 0x1570
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], esi
cmp ecx, 0xffff
jmp 0xb4a9f3
je 0xebb37d
cmp ecx, eax
jb 0xb7bec7
mov edx, dword [ebp - 0x10]
cmp si, dx
test bp, bp
lea edx, [edx + eax]
cmp ecx, edx
jmp 0xf73e53
mov edx, dword [ecx + edi + 0x24]
lea eax, [edx + esi*2]
movzx ecx, di
movzx ecx, word [eax + edi]
mov dx, 0x108a
lea edx, [ebx + 1]
jmp 0xb3ba93
ja 0xf7f715
movsx ecx, cl
cmc
lea edx, [edx + edx*4]
jmp 0xa0f3f9
je 0xf9ae32
mov cl, byte [esi + 1]
inc esi
test di, di
cmc
test cl, cl
jmp 0xebb377
je 0xa5a2c6
xor eax, eax
jmp 0xa5123f
je 0xe93c1c
test eax, eax
jmp 0xed001a
mov ecx, dword [ebp - 4]
bswap eax
jmp 0xf646e4
jae 0xb7bec7
lea eax, [ecx + edi]
shl cl, cl
add cl, 0x2b
mov cl, byte [eax]
mov esi, eax
clc
test cl, cl
jmp 0xe8cdbf
rol eax, cl
lea esi, [ebp + edx - 0x114]
stc
cmp ecx, 0x64f40cb6
add al, dl
clc
cmp ax, 0x54d2
test dh, ah
xor al, byte [ebx + esi]
jmp 0xf7a630
mov byte [esi], al
jmp 0xef2e7e
call eax
test eax, eax
jmp 0xea2313
jne 0xb3030e
push 0
push edx
jmp 0x9f3ee6
jl 0x9ed393
jmp 0xb5d149
ret
je 0x9ed393
mov edx, dword [eax + edi + 0x20]
jmp 0xf0cad6
jae 0xebb37d
mov dword [ebp + 8], 0
cmc
test ecx, ecx
jmp 0xec0abd
mov ecx, esi
test al, 0xaf
jmp 0xebc9e9
mov esp, ebp
not bp
movzx ebp, sp
mov bp, si
pop ebp
ret