Function at 0xf003a7
Capabilities:
Parse pe header

Disassembly:
push 0x60
push eax
pushf
push ebx
sbb ebx, 0x356c4760
jmp 0xf003b6
bnd jmp 0xf003ba
lea ebx, [ebp + esi + 0xa]
lea ebx, [ebx - 0xa]
lea ebx, [ebp + esi + 0x5b]
sub ebx, esi
lea ebx, [esp + ecx + 0x66]
sub ebx, ecx
lea ebx, [ebx + edx - 0x66]
sub ebx, edx
lea ebx, [ebx + 6]
jmp 0xf003db
push 0x4db720
pop dword [ebx]
pop ebx
popf
call fcn.00f00d25
jmp 0xf007b4
push eax
push dword [ebp - 0x20]
jmp 0xf00a79
pop ecx
mov dword [ebp - 0x28], eax
jmp 0xf039b8
cmp dword [ecx + 0x74], 0xe
jmp 0xf039dd
test eax, eax
jmp 0xf0058f
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0049d2ff
jmp 0xf0091d
jmp 0xf039fe
push 9
call fcn.00f004f9
jmp 0xf01143
test eax, eax
jmp 0xf03a09
jmp 0xf007b9
add edi, 0x18e3b1d0
jmp 0xf007c3
push 0xedd4d306
pushf
push ecx
notrack jmp 0xf007d0
lea ecx, [ebp + esi + 0x1b]
sub ecx, esi
sub ecx, 0xffffffad
rcr ecx, 0x69
jmp 0xf007e1
sub ecx, ecx
jmp 0xf007e6
lea ecx, [esp + ebp + 0x61]
sub ecx, ebp
bnd jmp 0xf007f0
lea ecx, [ecx + ebp - 0x61]
sub ecx, ebp
lea ecx, [ecx + eax + 6]
sub ecx, eax
push eax
xor eax, 0xeec8928a
bnd jmp 0xf00807
lea eax, [ebp + 0x94]
sub eax, ebp
jmp 0xf00813
mov dword [ecx], eax
pop eax
pop ecx
popf
sbb edi, 0x987c5148
pop edi
jmp 0xf00e7d
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0xf0113b
movzx eax, word [ebp - 0x40]
jmp 0xf004d9
mov dword [0x4fb8ac], esi
cmp ecx, 2
je 0xf0089c
or esi, 0x8000
mov dword [0x4fb8ac], esi
shl eax, 8
add eax, edx
mov dword [0x4fb8b0], eax
xor esi, esi
push esi
jmp 0xf008ad
sbb edi, edx
bnd jmp 0xf008b3
mov edi, 0x47166a
sub edi, 0x71
jmp 0xf008c0
or edi, ecx
bnd jmp 0xf008c6
lea edi, [esi + ebp + sym.imp.KERNEL32.dll_GetModuleHandleA]
sub edi, ebp
sub edi, esi
push dword [edi]
add edi, dword [esp + 0x38]
add edi, dword [esp + 0x18]
pop edi
call edi
cmp word [eax], 0x5a4d
jne 0xf00954
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jmp 0xf03a14
pop ecx
test eax, eax
jne 0xf01bb8
push 0x1c
call fcn.00f00d0b
jmp 0xf01bb7
cmp eax, 0x20b
je 0xf00b2d
mov dword [ebp - 0x1c], esi
jmp 0xf0056d
pop ecx
jmp 0xf0116e
pop ecx
call fcn.00f009da
jmp 0xf01780
push esi
push esi
call edi
push eax
call fcn.004aebce
jmp 0xf00eb2
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0xf00567
cmp dword [ecx + 0x84], 0xe
jmp 0xf03a2a
or eax, 0xe4e883d2
and eax, ecx
jmp 0xf00e89
lea eax, [edx + edi*2 + 0x50]
jmp 0xf00e92
lea eax, [edi + ebp + 0x2d]
sub eax, ebp
lea eax, [eax - 0x2d]
call fcn.0049a270
jmp 0xf011ef
mov edi, 0x478b8e
mov edi, 0x486bc6
ror edi, 0xdb
mov edi, 0x489f6e
lea edi, [eax + 0xc]
jmp 0xf00ecd
lea edi, [edi + ecx - 0xc]
sub edi, ecx
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0xf0162c
push edi
call fcn.00f01ac3
jmp 0xf0162c
mov dword [0x4fb864], eax
call fcn.00f01b5f
jmp 0xf0103a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
jmp 0xf03a65
test eax, eax
jge 0xf01601
push 8
call fcn.00f004f9
jmp 0xf01600
push 0x1b
call fcn.00f004f9
jmp 0xf0179b
jmp 0xf01bde
push 0xa
pop eax
jmp 0xf004d9
pop ecx
push 1
call fcn.00f01820
jmp 0xf004e2
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.00f01c2e
jmp 0xf0085c
test eax, eax
jmp 0xf03aac
mov dword [ebp - 0x18], esp
jmp 0xf011f5
mov esi, 0x42c0ee
bnd jmp 0xf011fe
or esi, 0x79
mov esi, 0x460362
sbb esi, 0x2d
sub esi, 0x7ccc77e
lea esi, [esp + ecx + 0x3a]
sub esi, ecx
lea esi, [esi - 0x3a]
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4fb8a8], ecx
mov eax, dword [esi + 4]
mov dword [0x4fb8b4], eax
mov edx, dword [esi + 8]
mov dword [0x4fb8b8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
jmp 0xf00881
pop ecx
call fcn.0049c8c0
jmp 0xf00687
call fcn.00f01165
jmp 0xf010f8
mov dword [ebp - 4], esi
call fcn.0049cd92
jmp 0xf011be
pop ecx
call fcn.0049ccf3
jmp 0xf01ba8
push eax
call fcn.00f004f9
jmp 0xf00a13
ret
push 0x10
call fcn.00f00d0b
jmp 0xf00a19
mov dword [0x4fd284], eax
call fcn.0049cb89
jmp 0xf00fe2
pop ecx
call fcn.0049d1f6
jmp 0xf00558
or dword [ebp - 4], 0xffffffff
jmp 0xf01be7
lea eax, [edi + eax*2 + 0x25]
sbb eax, 0xffffff99
mov eax, 0x425f2a
xor eax, 0x58aed786
lea eax, [edi + ecx + 0xa]
sub eax, ecx
lea eax, [eax + ebp - 0xa]
sub eax, ebp
lea esp, [ebp - 0x7c]
call fcn.00f01129
jmp 0xf01a17
cmp eax, esi
je 0xf0116e
jmp 0xf0193d
jbe 0xf00954
jmp 0xf0055f
jne 0xf00a1a
jmp 0xf01a5a
jge 0xf01144
jmp 0xf00594
jne 0xf00954
jmp 0xf01022
jbe 0xf00954
jmp 0xf00a99
je 0xf0052b
jmp 0xf00949
jge 0xf0179c
jmp 0xf0107b