Function at 0x10001fd0
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [0x1001164c]
sub esp, 0x10
test eax, eax
jne 0x10001fe1
call fcn.10001e30
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
test ebx, ebx
push edi
je 0x1000260f
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0x40
push ebx
call edi
cmp eax, 1
je 0x1000260f
cmp word [ebx], 0x5a4d
jne 0x1000260f
mov esi, dword [ebx + 0x3c]
push 0xf8
add esi, ebx
push esi
call edi
cmp eax, 1
je 0x1000260f
cmp dword [esi], 0x4550
jne 0x1000260f
cmp word [esi + 0x14], 0xe0
jne 0x10002602
cmp word [esi + 0x18], 0x10b
jne 0x10002602
cmp word [esi + 6], 1
jb 0x1000260f
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x80]
test eax, eax
je 0x100025f5
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpA]
add eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov dword [esp + 0x14], eax
mov edi, eax
mov eax, dword [edi + 4]
test eax, eax
jne 0x1000208d
mov eax, dword [edi + 0xc]
test eax, eax
je 0x100025e8
mov esi, dword [edi + 0xc]
mov ecx, dword [esp + 0x24]
add esi, ecx
mov dword [esp + 0x10], 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.Kernel32.dll
push esi
call fcn.10002980
add esp, 0xc
test eax, eax
jne 0x100020c0
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.User32.dll
push esi
call fcn.10002980
add esp, 0xc
test eax, eax
jne 0x100020e2
mov dword [esp + 0x10], 2
mov eax, dword [edi]
test eax, eax
jne 0x100020eb
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x24]
mov esi, dword [edi + 0x10]
add eax, ecx
add esi, ecx
mov dword [esp + 0x18], eax
mov eax, dword [eax]
test eax, eax
je 0x100025dc
mov ecx, dword [edi]
test ecx, ecx
je 0x10002114
mov edx, dword [esp + 0x24]
add edx, eax
mov dword [esp + 0x1c], edx
test eax, 0x80000000
jne 0x100025bc
mov eax, dword [esp + 0x10]
test ecx, ecx
je 0x10002384
cmp eax, 2
jne 0x10002173
mov eax, dword [esp + 0x28]
cmp byte [eax + 9], 1
jne 0x100025bc
mov ecx, dword [esp + 0x1c]
push str.SetClipboardData
lea edi, [ecx + 2]
push edi
call ebp
test eax, eax
jne 0x10002159
mov edx, dword [0x100115bc]
mov dword [esi], edx
push str.OpenClipboard
push edi
call ebp
test eax, eax
jne 0x100025bc
mov eax, dword [0x100115ac]
jmp 0x100025ba
cmp eax, 1
jne 0x100025bc
mov ecx, dword [esp + 0x1c]
push str.CreateFileA
lea edi, [ecx + 2]
push edi
call ebp
test eax, eax
jne 0x10002197
mov edx, dword [0x10011624]
mov dword [esi], edx
push str.CreateFileW
push edi
call ebp
test eax, eax
jne 0x100021aa
mov eax, dword [0x10011620]
mov dword [esi], eax
push str._lopen
push edi
call ebp
test eax, eax
jne 0x100021be
mov ecx, dword [0x100115fc]
mov dword [esi], ecx
push str._lclose
push edi
call ebp
test eax, eax
jne 0x100021d2
mov edx, dword [0x100115e8]
mov dword [esi], edx
push str._lread
push edi
call ebp
test eax, eax
jne 0x100021e5
mov eax, dword [0x100115f0]
mov dword [esi], eax
push str._llseek
push edi
call ebp
test eax, eax
jne 0x100021f9
mov ecx, dword [0x100115ec]
mov dword [esi], ecx
push str.CloseHandle
push edi
call ebx
test eax, eax
jne 0x1000220d
mov edx, dword [0x10011600]
mov dword [esi], edx
push str.SetFilePointerEx
push edi
call ebx
test eax, eax
jne 0x10002220
mov eax, dword [0x10011618]
mov dword [esi], eax
push str.SetFilePointer
push edi
call ebx
test eax, eax
jne 0x10002234
mov ecx, dword [0x10011614]
mov dword [esi], ecx
push str.ReadFile
push edi
call ebx
test eax, eax
jne 0x10002248
mov edx, dword [0x10011610]
mov dword [esi], edx
push str.ReadFileEx
push edi
call ebx
test eax, eax
jne 0x1000225b
mov eax, dword [0x1001160c]
mov dword [esi], eax
push str.GetFileSizeEx
push edi
call ebx
test eax, eax
jne 0x1000226f
mov ecx, dword [0x10011604]
mov dword [esi], ecx
push str.GetFileSize
push edi
call ebx
test eax, eax
jne 0x10002283
mov edx, dword [0x10011608]
mov dword [esi], edx
push str.OpenFile
push edi
call ebp
test eax, eax
jne 0x10002296
mov eax, dword [0x100115e0]
mov dword [esi], eax
push str._lcreat
push edi
call ebp
test eax, eax
jne 0x100022aa
mov ecx, dword [0x100115e4]
mov dword [esi], ecx
push str.CreateFileMappingW
push edi
call ebp
test eax, eax
jne 0x100022be
mov edx, dword [0x100115dc]
mov dword [esi], edx
push str.CreateFileMappingA
push edi
call ebp
test eax, eax
jne 0x100022d1
mov eax, dword [0x100115d8]
mov dword [esi], eax
push str.MapViewOfFile
push edi
call ebp
test eax, eax
jne 0x100022e5
mov ecx, dword [0x100115d4]
mov dword [esi], ecx
push str.MapViewOfFileEx
push edi
call ebp
test eax, eax
jne 0x100022f9
mov edx, dword [0x100115d0]
mov dword [esi], edx
push str.GetFileInformationByHandle
push edi
call ebp
test eax, eax
jne 0x1000230c
mov eax, dword [0x100115cc]
mov dword [esi], eax
push str.WriteFile
push edi
call ebp
test eax, eax
jne 0x10002320
mov ecx, dword [0x100115c4]
mov dword [esi], ecx
push str.WriteFileEx
push edi
call ebp
test eax, eax
jne 0x10002334
mov edx, dword [0x100115c0]
mov dword [esi], edx
push str._lwrite
push edi
call ebp
test eax, eax
jne 0x10002347
mov eax, dword [0x100115c8]
mov dword [esi], eax
push str.FlushViewOfFile
push edi
call ebp
test eax, eax
jne 0x1000235b
mov ecx, dword [0x100115b4]
mov dword [esi], ecx
push str.UnmapViewOfFile
push edi
call ebp
test eax, eax
jne 0x1000236f
mov edx, dword [0x100115b8]
mov dword [esi], edx
push str.SetEndOfFile
push edi
call ebp
test eax, eax
jne 0x100025bc
jmp 0x100025b5
cmp eax, 2
jne 0x100023c5
mov ecx, dword [esp + 0x28]
cmp byte [ecx + 9], 1
jne 0x100025bc
mov edx, dword [esi]
mov eax, dword [0x10011654]
cmp edx, eax
jne 0x100023a9
mov eax, dword [0x100115bc]
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, dword [0x10011650]
cmp ecx, eax
jne 0x100025bc
mov edx, dword [0x100115ac]
mov dword [esi], edx
jmp 0x100025bc
cmp eax, 1
jne 0x100025bc
mov eax, dword [esi]
mov ecx, dword [0x100116bc]
cmp eax, ecx
jne 0x100023e2
mov ecx, dword [0x10011624]
mov dword [esi], ecx
mov edx, dword [esi]
mov eax, dword [0x100116b8]
cmp edx, eax
jne 0x100023f4
mov eax, dword [0x10011620]
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, dword [0x100116b4]
cmp ecx, eax
jne 0x10002407
mov edx, dword [0x100115fc]
mov dword [esi], edx
mov eax, dword [esi]
mov ecx, dword [0x100116b0]
cmp eax, ecx
jne 0x1000241b
mov ecx, dword [0x100115e8]
mov dword [esi], ecx
mov edx, dword [esi]
mov eax, dword [0x100116ac]
cmp edx, eax
jne 0x1000242d
mov eax, dword [0x100115f0]
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, dword [0x100116a8]
cmp ecx, eax
jne 0x10002440
mov edx, dword [0x100115ec]
mov dword [esi], edx
mov eax, dword [esi]
mov ecx, dword [0x100116a4]
cmp eax, ecx
jne 0x10002454
mov ecx, dword [0x10011600]
mov dword [esi], ecx
mov edx, dword [esi]
mov eax, dword [0x100116a0]
cmp edx, eax
jne 0x10002466
mov eax, dword [0x10011618]
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, dword [0x1001169c]
cmp ecx, eax
jne 0x10002479
mov edx, dword [0x10011614]
mov dword [esi], edx
mov eax, dword [esi]
mov ecx, dword [0x10011698]
cmp eax, ecx
jne 0x1000248d
mov ecx, dword [0x10011610]
mov dword [esi], ecx
mov edx, dword [esi]
mov eax, dword [0x10011694]
cmp edx, eax
jne 0x1000249f
mov eax, dword [0x1001160c]
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, dword [0x10011690]
cmp ecx, eax
jne 0x100024b2
mov edx, dword [0x10011604]
mov dword [esi], edx
mov eax, dword [esi]
mov ecx, dword [0x1001168c]
cmp eax, ecx
jne 0x100024c6
mov ecx, dword [0x10011608]
mov dword [esi], ecx
mov edx, dword [esi]
mov eax, dword [0x10011688]
cmp edx, eax
jne 0x100024d8
mov eax, dword [0x100115e0]
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, dword [0x10011684]
cmp ecx, eax
jne 0x100024eb
mov edx, dword [0x100115e4]
mov dword [esi], edx
mov eax, dword [esi]
mov ecx, dword [0x10011680]
cmp eax, ecx
jne 0x100024ff
mov ecx, dword [0x100115dc]
mov dword [esi], ecx
mov edx, dword [esi]
mov eax, dword [0x1001167c]
cmp edx, eax
jne 0x10002511
mov eax, dword [0x100115d8]
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, dword [0x10011678]
cmp ecx, eax
jne 0x10002524
mov edx, dword [0x100115d4]
mov dword [esi], edx
mov eax, dword [esi]
mov ecx, dword [0x10011674]
cmp eax, ecx
jne 0x10002538
mov ecx, dword [0x100115d0]
mov dword [esi], ecx
mov edx, dword [esi]
mov eax, dword [0x10011670]
cmp edx, eax
jne 0x1000254a
mov eax, dword [0x100115cc]
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, dword [0x1001166c]
cmp ecx, eax
jne 0x1000255d
mov edx, dword [0x100115c4]
mov dword [esi], edx
mov eax, dword [esi]
mov ecx, dword [0x10011668]
cmp eax, ecx
jne 0x10002571
mov ecx, dword [0x100115c0]
mov dword [esi], ecx
mov edx, dword [esi]
mov eax, dword [0x10011664]
cmp edx, eax
jne 0x10002583
mov eax, dword [0x100115c8]
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, dword [0x10011660]
cmp ecx, eax
jne 0x10002596
mov edx, dword [0x100115b4]
mov dword [esi], edx
mov eax, dword [esi]
mov ecx, dword [0x1001165c]
cmp eax, ecx
jne 0x100025aa
mov ecx, dword [0x100115b8]
mov dword [esi], ecx
mov edx, dword [esi]
mov eax, dword [0x10011658]
cmp edx, eax
jne 0x100025bc
mov eax, dword [0x100115b0]
mov dword [esi], eax
test esi, esi
je 0x1000260f
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
add eax, 4
add esi, 4
mov dword [esp + 0x18], eax
mov eax, dword [eax]
test eax, eax
jne 0x10002104
add edi, 0x14
mov dword [esp + 0x14], edi
jmp 0x1000207b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret