Function at 0xaaf744
Capabilities:
Parse pe header

Disassembly:
mov eax, esi
pop esi
pop ebp
ret
cmp esi, 0x7d000000
jmp 0xa7bdfb
jb 0xa8e1aa
jmp loc.0044a33f
add esp, 4
jmp 0xabc448
call fcn.0044a230
jmp 0xa886a4
cmp word [esi], 0x5a4d
jmp 0xaaaea8
push edx
mov edx, esp
add edx, 4
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], ebx
push edi
mov edi, 0x62ec09c
mov dword [esp + 4], edi
pop edi
mov dword [esp], ecx
push ebp
mov ebp, 0x23b7832a
add ecx, ebp
pop ebp
add ecx, 0x36b211e9
add ecx, eax
sub ecx, 0x36b211e9
push esi
mov esi, 0x23b7832a
add ecx, 0x6d4f4d53
sub ecx, esi
sub ecx, 0x6d4f4d53
pop esi
mov ecx, dword [esp]
push eax
mov eax, esp
push ebx
mov ebx, 4
add eax, ebx
pop ebx
add eax, 4
push eax
push dword [esp + 4]
pop eax
pop dword [esp]
mov esp, dword [esp]
push ebp
sub esp, 4
mov dword [esp], edi
mov edi, 0x89e7ea5
mov dword [esp + 4], edi
pop edi
mov dword [esp], esi
push 0x612d6ab5
mov dword [esp], edx
mov edx, esp
add edx, 4
sub edx, 4
xor edx, dword [esp]
xor dword [esp], edx
xor edx, dword [esp]
pop esp
mov dword [esp], ebp
mov dword [esp], ebx
push 0x567174c4
mov dword [esp], ecx
mov ebx, dword [esp]
push ecx
mov ecx, esp
add ecx, 4
push ebp
mov ebp, 4
add ecx, ebp
pop ebp
xchg dword [esp], ecx
pop esp
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push ecx
mov ecx, esp
push edi
mov edi, 0x6f6bd797
sub edi, 0x76ff941b
sub edi, 0xf86c4378
add ecx, edi
pop edi
add ecx, 4
xchg dword [esp], ecx
pop esp
jmp 0xa91cf2
push edi
push 0x709b130f
push esp
pop dword [esp]
add dword [esp], 4
pop edi
add edi, 4
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], edx
sub esp, 4
mov dword [esp], ecx
push dword [esp]
pop edx
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
push dword [esp]
pop edx
push ecx
mov ecx, esp
push edx
mov edx, 0x5dff5f05
xor edx, 0x5dff5f01
add ecx, edx
pop edx
add ecx, 4
xchg dword [esp], ecx
mov esp, dword [esp]
sub esp, 4
mov dword [esp], eax
mov dword [esp], esi
mov dword [esp], eax
mov dword [esp], esi
pop dword [0x64ebd0]
jmp 0xa88ca8
push dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push dword [esp]
push dword [esp]
pop ecx
add esp, 4
add esp, 4
push edx
mov edx, esp
push ebx
mov ebx, 0x6fef5d34
shr ebx, 5
dec ebx
add ebx, 0xfc80851c
add edx, ebx
pop ebx
sub edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
mov dword [esp], edx
mov dword [esp], eax
push edx
mov edx, esp
push esi
mov esi, 4
add edx, esi
pop esi
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], edi
mov dword [esp], ebx
pop eax
mov eax, dword [esp]
push edx
mov edx, esp
push ebp
mov ebp, 0x57cf20fd
dec ebp
xor ebp, 0x7e7b0bad
push edi
mov edi, 0x2ff3c6aa
add edi, 0x17794636
not edi
dec edi
not edi
add edi, 0x8edec7d2
add ebp, edi
pop edi
add edx, ebp
pop ebp
add edx, 4
push edx
push dword [esp + 4]
pop edx
pop dword [esp]
pop esp
jmp 0xa99951
push edi
mov edi, esp
add edi, 4
sub edi, 4
push 0x5a042d18
mov dword [esp], edi
push dword [esp + 4]
pop edi
pop dword [esp]
mov esp, dword [esp]
mov dword [esp], edx
push ebx
mov ebx, esp
add ebx, 4
push edx
mov edx, 4
sub ebx, edx
pop edx
xchg dword [esp], ebx
mov esp, dword [esp]
mov dword [esp], ecx
pop edx
push dword [esp]
pop edx
push edi
mov dword [esp], edx
mov edx, esp
add edx, 4
push esi
mov esi, 0x3fdb798b
shl esi, 2
sub esi, 0xff6de628
add edx, esi
pop esi
xchg dword [esp], edx
pop esp
xor eax, ecx
jmp 0xab5778
push ebx
mov ebx, esp
add ebx, 4
push edx
mov edx, 4
push edx
mov edx, 0x37f7a539
add ebx, edx
pop edx
sub ebx, edx
sub ebx, 0x37f7a539
pop edx
xchg dword [esp], ebx
pop esp
mov dword [esp], edx
push ecx
mov ecx, esp
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], ecx
push dword [esp]
pop edx
add esp, 4
push dword [esp]
mov edx, dword [esp]
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
push esi
mov esi, 4
add ebp, esi
pop esi
xchg dword [esp], ebp
pop esp
push dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [esp]
push eax
mov eax, esp
add eax, 4
push esi
mov esi, 0x5f47df06
push eax
mov eax, 0x37fcace5
sub eax, 0xcceeaa2a
sub esi, eax
pop eax
shl esi, 7
dec esi
not esi
neg esi
add esi, 0xe311da84
add eax, esi
pop esi
xchg dword [esp], eax
pop esp
jmp 0xb0941a
xor eax, ecx
push ebx
push esp
pop ebx
add ebx, 4
push ebp
mov ebp, 4
sub ebx, ebp
pop ebp
xchg dword [esp], ebx
mov esp, dword [esp]
mov dword [esp], eax
push eax
push ebx
mov ebx, 0x973e876
mov dword [esp + 4], ebx
pop ebx
mov dword [esp], ebx
mov eax, dword [esp]
add esp, 4
mov eax, dword [esp]
push edi
mov dword [esp], edx
push esp
pop edx
add edx, 4
add edx, 4
push edx
push dword [esp + 4]
pop edx
pop dword [esp]
pop esp
jmp 0xabc5cf
push eax
push edi
push 0x35114494
pop edi
mov dword [esp + 4], edi
mov edi, dword [esp]
add esp, 4
mov dword [esp], ebx
push edx
mov edx, esp
add edx, 4
sub edx, 4
xor edx, dword [esp]
xor dword [esp], edx
xor edx, dword [esp]
pop esp
mov dword [esp], ecx
mov ebx, dword [esp]
add esp, 4
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push edx
mov edx, esp
add edx, 4
push ebx
mov ebx, 4
add edx, ebx
pop ebx
xchg dword [esp], edx
pop esp
xor eax, ecx
push edi
mov edi, esp
push esi
mov esi, 0x7b560b7c
dec esi
shl esi, 1
push 0
sub dword [esp], esi
pop esi
xor esi, 0x953e90e
add edi, esi
pop esi
sub edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
mov dword [esp], edx
push ebp
mov dword [esp], 0x4a8db7c
mov dword [esp], ecx
push dword [esp]
pop edx
add esp, 4
mov edx, dword [esp]
push ecx
push edi
mov dword [esp], esp
add dword [esp], 4
pop ecx
add ecx, 4
add ecx, 4
push ecx
push dword [esp + 4]
pop ecx
pop dword [esp]
pop esp
jmp 0xac3974
je 0x44a356
jmp 0xa9ff33
add esi, 0x1000
jmp 0xa7bdf0
je 0xa9ff33
jmp 0xa88cb2
jne 0xa9ff33
jmp 0xaaf6f5
mov dword [0x64ee80], eax
jmp 0xaae711
cmp word [eax], 0x4550
jmp 0xa9ff28
sub esp, 4
mov dword [esp], ebx
mov dword [esp], edi
mov edi, esp
add edi, 4
sub edi, 4
push edi
push dword [esp + 4]
pop edi
pop dword [esp]
pop esp
mov dword [esp], eax
push ebx
mov ebx, esp
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
mov esp, dword [esp]
mov dword [esp], ebx
mov eax, dword [esp]
add esp, 4
push dword [esp]
push dword [esp]
pop eax
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
push dword [0x64ebd0]
mov eax, dword [esp]
sub esp, 4
mov dword [esp], edx
mov edx, esp
add edx, 4
add edx, 4
push edx
push dword [esp + 4]
pop edx
pop dword [esp]
pop esp
jmp 0xadf00b
push eax
mov eax, esp
add eax, 4
sub eax, 4
push eax
push dword [esp + 4]
mov eax, dword [esp]
add esp, 4
pop dword [esp]
pop esp
mov dword [esp], eax
mov dword [esp], ecx
push 0x37743ddc
mov dword [esp], ebp
mov ebp, 0x3d7c3bec
and ebp, 0x4fff8d8a
add ebp, 0x7f5ef1c8
or ebp, 0x7fa93592
shl ebp, 7
inc ebp
add ebp, 0x7fc7c3ce
sub ecx, ebp
pop ebp
add ecx, eax
push edx
push 0x7dc7accf
pop edx
add ecx, edx
pop edx
push dword [esp]
pop ecx
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
push ebp
push dword [esp + 4]
mov ebp, dword [esp]
add esp, 4
pop dword [esp]
pop esp
push dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp]
push dword [esp]
pop ecx
add esp, 4
add esp, 4
push ecx
mov ecx, esp
add ecx, 4
push eax
mov eax, 4
sub ecx, eax
pop eax
xchg dword [esp], ecx
pop esp
mov dword [esp], ebp
mov dword [esp], edi
mov dword [esp], ebx
push 0x218cc1f2
mov dword [esp], ebx
mov dword [esp], ecx
push dword [esp]
pop ebx
add esp, 4
mov ebx, dword [esp]
push edx
mov dword [esp], ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
mov esp, dword [esp]
jmp 0xa9f8b7
push es
mov ecx, ebp
sub edi, esi
sub edi, 0xc0
or edi, 0x14
add ecx, 0x8a
mov ecx, dword [ecx]
add ecx, 6
mov esi, dword [ecx]
or edi, edi
mov ebx, ebp
xor edi, 0x3d
sub edi, 0x40
add byte [eax], al
add byte [ecx + 0x8ac3], al
add byte [ecx], al
xor edi, edi
invalid
add byte [eax], al
add byte [ecx + 0x8ac3], al
add byte [ecx], al
xor edi, edi
loopne 0xabc3b9
rcr dl, 0xa6
jnp 0xabc42b
push ecx
int3
add edi, eax
sub esi, esi
push edx
jg 0xabc40e
out 0x6f, eax
mov ah, 0x70
add dword [ebx], 0x69
push esp
jg 0xabc411
xchg esp, eax
std
mov dh, 0xd3
dec ebx
out dx, eax
in eax, dx
inc edi
movsb byte es:[edi], byte [esi]
xchg dword [0x3ce17ca7], ecx
and al, 0x61
and eax, 0x466a9c36
fisubr dword [eax - 3]
push esp
jmp 0xabc4a5
push 0x75eb54fd
movsb byte es:[edi], byte [esi]
and ebx, esi
salc
in eax, dx
push esi
and eax, 0x8b48ca14
ja 0xabc402
mov ebp, dword [ecx + edi*4]
push edx
pushal
dec edx
pop ss
aas
cmp dword [edx], eax
test eax, eax
jmp 0xaaae9d
wait
jae 0xabc4d9
int1
mov edx, 0x8632daee
xor al, 0x77
xor eax, 0xa08acc68
cmp byte [edi], 0x69
sub al, 0x25
mov dword [0x957db4da], eax
cwde
push cs
adc dword [ebx], 0xda25ec23
and ecx, dword [esi + 0x7e3c4bb2]
shr dword [ebp + 0xf], 0x24
or edx, dword [ebx + 0x31]
adc al, 0x81
push ebx
xor dword [ecx + eax*4], edx
scasd eax, dword es:[edi]
pop ebx
int 0x77
jg 0xabc478
or bh, byte [ebp + 0x64]
push ebx
sub byte [ebx + ecx*2 - 0x39], dl
cli
dec edx
xor bl, byte [esi + 0x7e3a9694]
or ch, cl
fld dword [eax + 0x50]
mov dword [ebx], ecx
xor eax, ecx
push ebp
mov ebp, esp
add ebp, 4
push edi
mov edi, 0x5bbe96a9
add edi, 0xa441695b
sub ebp, edi
pop edi
push 0x1adeaaa3
mov dword [esp], ebp
pop ebx
imul eax, dword [ecx - 0x5c], 0x685ffd29
mov dword [0x891adeaa], eax
sub al, 0x24
push dword [esp + 4]
pop ebp
pop dword [esp]
pop esp
mov dword [esp], eax
push ebp
mov dword [esp], eax
mov dword [esp], ebx
push dword [esp]
pop eax
add esp, 4
push dword [esp]
mov eax, dword [esp]
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0xa9bbc6
push ecx
mov ecx, esp
push ebx
mov ebx, 0x3afe8eac
or ebx, 0x57fb9ed3
not ebx
push ebp
mov ebp, 0x80006104
xor ebx, ebp
pop ebp
add ecx, ebx
pop ebx
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], edi
mov dword [esp], eax
push ebx
mov eax, dword [esp]
sub esp, 4
mov dword [esp], edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
mov eax, dword [esp]
push edx
push 0x18d7428c
mov dword [esp], esp
add dword [esp], 4
pop edx
add edx, 4
add edx, 4
xor edx, dword [esp]
xor dword [esp], edx
xor edx, dword [esp]
pop esp
push dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [esp]
mov ecx, dword [esp]
add esp, 4
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
jmp fcn.00ae8959
push ecx
push esp
pop ecx
push ebx
mov ebx, 4
add ecx, ebx
pop ebx
sub ecx, 4
push ecx
push dword [esp + 4]
pop ecx
pop dword [esp]
pop esp
mov dword [esp], ebx
push ecx
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push edi
mov edi, esp
add edi, 4
push ebp
mov ebp, 4
add edi, ebp
pop ebp
xchg dword [esp], edi
pop esp
push dword [sym.imp.KERNEL32.dll_GetFileType]
push dword [esp]
pop ecx
push ebp
mov ebp, esp
add ebp, 4
push eax
mov eax, 4
add ebp, eax
pop eax
xchg dword [esp], ebp
pop esp
push edi
push edx
push 0x6d2c5018
pop edx
mov dword [esp + 4], edx
mov edx, dword [esp]
add esp, 4
mov dword [esp], ebx
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], ecx
mov ebx, dword [esp]
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
mov ebx, dword [esp]
push esi
push ecx
mov dword [esp], esp
add dword [esp], 4
pop esi
add esi, 4
add esi, 4
xchg dword [esp], esi
mov esp, dword [esp]
jmp 0xa9d814
sub eax, 0x47b964b2
add eax, 0x2dfe4f78
add eax, esi
sub eax, 0x2dfe4f78
push ecx
push 0x77f7726c
pop ecx
not ecx
and ecx, 0x7fdc048f
not ecx
shl ecx, 3
inc ecx
sub ecx, 0x7806772f
sub eax, 0x3defea43
add eax, ecx
add eax, 0x3defea43
pop ecx
push ecx
mov ecx, esp
push ebx
mov ebx, 0x79ff9d3c
sub ebx, 0x79ff9d38
add ecx, ebx
pop ebx
push ebp
mov ebp, 4
add ecx, 0x6fe6292e
sub ecx, ebp
sub ecx, 0x6fe6292e
pop ebp
xchg dword [esp], ecx
pop esp
mov dword [esp], edx
push 0x57cf6f0c
mov dword [esp], eax
mov dword [esp], ecx
mov edx, dword [esp]
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
mov edx, dword [esp]
sub esp, 4
mov dword [esp], edx
mov dword [esp], 0x765c3154
mov dword [esp], esi
mov esi, esp
add esi, 4
add esi, 4
xchg dword [esp], esi
pop esp
jmp 0xaae707
push dword [eax + 0x3c]
mov eax, dword [esp]
push ebx
push esp
pop ebx
add ebx, 4
add ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
pop esp
push edx
push esp
pop edx
add edx, 4
push edi
push 4
pop edi
sub edx, edi
pop edi
xchg dword [esp], edx
pop esp
mov dword [esp], edx
push ebp
mov ebp, esp
add ebp, 4
push eax
mov eax, 4
sub ebp, eax
mov eax, dword [esp]
add esp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], ecx
pop edx
push dword [esp]
pop edx
push eax
mov eax, esp
push edi
mov edi, 4
add eax, edi
pop edi
add eax, 4
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
pop esp
jmp 0xac52ab
xor eax, ecx
push esi
push ecx
push ebx
mov ebx, 0x18ecce0e
mov ecx, ebx
pop ebx
mov dword [esp + 4], ecx
pop ecx
mov dword [esp], edi
mov dword [esp], edx
push ebx
mov dword [esp], ecx
push dword [esp]
mov edx, dword [esp]
add esp, 4
add esp, 4
push dword [esp]
pop edx
push edx
mov edx, esp
add edx, 4
push ecx
mov ecx, 4
add edx, ecx
pop ecx
xchg dword [esp], edx
mov esp, dword [esp]
jmp 0xa98b31