Function at 0x100032b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x10066800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], 0xb3683409
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
sub eax, 0x8ca4e779
je 0x10003976
jmp 0x100032f2
mov eax, dword [ebp - 0x58]
sub eax, 0x8d9e264b
je 0x10003885
jmp 0x10003305
mov eax, dword [ebp - 0x58]
sub eax, 0x915d823d
je 0x10003982
jmp 0x10003318
mov eax, dword [ebp - 0x58]
sub eax, 0x978f7e22
je 0x10003848
jmp 0x1000332b
mov eax, dword [ebp - 0x58]
sub eax, 0x97b8baec
je 0x10003829
jmp 0x1000333e
mov eax, dword [ebp - 0x58]
sub eax, 0x9fffe52b
je 0x10003c75
jmp 0x10003351
mov eax, dword [ebp - 0x58]
sub eax, 0xa7071054
je 0x10003ac8
jmp 0x10003364
mov eax, dword [ebp - 0x58]
sub eax, 0xa76b7b90
je 0x10003792
jmp 0x10003377
mov eax, dword [ebp - 0x58]
sub eax, 0xadd09dd3
je 0x10003689
jmp 0x1000338a
mov eax, dword [ebp - 0x58]
sub eax, 0xafae5cc5
je 0x10003ad4
jmp 0x1000339d
mov eax, dword [ebp - 0x58]
sub eax, 0xb3683409
je 0x10003531
jmp 0x100033b0
mov eax, dword [ebp - 0x58]
sub eax, 0xbee14fb6
je 0x1000383c
jmp 0x100033c3
mov eax, dword [ebp - 0x58]
sub eax, 0xbfeb69b9
je 0x10003b47
jmp 0x100033d6
mov eax, dword [ebp - 0x58]
sub eax, 0xc1958e59
je 0x10003be7
jmp 0x100033e9
mov eax, dword [ebp - 0x58]
sub eax, 0xc92196d5
je 0x10003bcc
jmp 0x100033fc
mov eax, dword [ebp - 0x58]
sub eax, 0xd0c2f973
je 0x10003727
jmp 0x1000340f
mov eax, dword [ebp - 0x58]
sub eax, 0xd499ec79
je 0x10003a82
jmp 0x10003422
mov eax, dword [ebp - 0x58]
sub eax, 0x108c3842
je 0x100038f8
jmp 0x10003435
mov eax, dword [ebp - 0x58]
sub eax, 0x1319e9f2
je 0x10003c94
jmp 0x10003448
mov eax, dword [ebp - 0x58]
sub eax, 0x15b8476e
je 0x100036c6
jmp 0x1000345b
mov eax, dword [ebp - 0x58]
sub eax, 0x2377f58a
je 0x100036a7
jmp 0x1000346e
mov eax, dword [ebp - 0x58]
sub eax, 0x2a9df733
je 0x1000396a
jmp 0x10003481
mov eax, dword [ebp - 0x58]
sub eax, 0x3c5f489e
je 0x10003a0f
jmp 0x10003494
mov eax, dword [ebp - 0x58]
sub eax, 0x3c6a9fac
je 0x100036ba
jmp 0x100034a7
mov eax, dword [ebp - 0x58]
sub eax, 0x41afb441
je 0x10003866
jmp 0x100034ba
mov eax, dword [ebp - 0x58]
sub eax, 0x526f8cd9
je 0x1000357f
jmp 0x100034cd
mov eax, dword [ebp - 0x58]
sub eax, 0x581963e0
je 0x1000367d
jmp 0x100034e0
mov eax, dword [ebp - 0x58]
sub eax, 0x5f9a13b6
je 0x10003c88
jmp 0x100034f3
mov eax, dword [ebp - 0x58]
sub eax, 0x684221f9
je 0x10003c66
jmp 0x10003506
mov eax, dword [ebp - 0x58]
sub eax, 0x6a41ad49
je 0x1000380e
jmp 0x10003519
mov eax, dword [ebp - 0x58]
sub eax, 0x7593dd92
je 0x10003bc0
jmp 0x1000352c
jmp 0x10003c9b
mov eax, dword [0x10067b8c]
mov ecx, dword [0x10067b88]
mov edx, eax
add edx, 0xafc6ca57
sub edx, 1
sub edx, 0xafc6ca57
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc1958e59
mov ecx, 0x526f8cd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x54]
push eax
sub esp, 0x3c
mov esi, esp
mov dword [ebp - 0x34], esi
push eax
mov esi, esp
mov dword [ebp - 0x30], esi
sub esp, 0xf8
mov esi, esp
mov dword [ebp - 0x2c], esi
push eax
mov esi, esp
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x40
call fcn.10009e80
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov dword [eax], 0
mov edx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x34]
movzx eax, word [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x10067b8c]
mov eax, dword [0x10067b88]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc1958e59
mov ecx, 0x581963e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov dword [ebp - 0x48], 0xadd09dd3
jmp 0x10003c9b
mov edx, dword [ebp - 0x24]
mov eax, 0x15b8476e
mov ecx, 0x2377f58a
cmp edx, 0x5a4d
cmovne eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x48], 0x3c6a9fac
jmp 0x10003c9b
mov dword [ebp - 0x48], 0xafae5cc5
jmp 0x10003c9b
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xf8
call fcn.10009e80
add esp, 0xc
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
add edx, dword [eax + 0x3c]
mov esi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xf8
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x48], 0xd0c2f973
jmp 0x10003c9b
mov ecx, dword [0x10067b8c]
mov eax, dword [0x10067b88]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x684221f9
mov ecx, 0xa76b7b90
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0x4550
setne al
and al, 1
mov byte [ebp - 0x1d], al
mov ecx, dword [0x10067b8c]
mov eax, dword [0x10067b88]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x684221f9
mov ecx, 0x6a41ad49
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov dl, byte [ebp - 0x1d]
mov eax, 0x978f7e22
mov ecx, 0x97b8baec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x48], 0xbee14fb6
jmp 0x10003c9b
mov dword [ebp - 0x48], 0xafae5cc5
jmp 0x10003c9b
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x18
add eax, 0x5c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x48], 0x41afb441
jmp 0x10003c9b
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
mov edx, dword [ebp - 0x1c]
mov eax, 0x915d823d
mov ecx, 0x8d9e264b
cmp edx, esi
cmovae eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov ecx, dword [0x10067b8c]
mov eax, dword [0x10067b88]
mov edx, ecx
add edx, 0x9327ecb7
sub edx, 1
sub edx, 0x9327ecb7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9fffe52b
mov ecx, 0x108c3842
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov dword [ebp - 0x38], 0
mov ecx, dword [0x10067b8c]
mov eax, dword [0x10067b88]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9fffe52b
mov ecx, 0x2a9df733
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov dword [ebp - 0x48], 0x8ca4e779
jmp 0x10003c9b
mov dword [ebp - 0x48], 0xafae5cc5
jmp 0x10003c9b
sub esp, 4
mov dword [esp], 8
call fcn.1000910e
add esp, 4
mov dword [ebp - 0x5c], eax
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 8
call fcn.10009e80
mov ecx, dword [ebp - 0x5c]
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x2c]
add edx, 0x18
add edx, 0x60
mov eax, dword [ebp - 0x3c]
shl eax, 3
add edx, eax
mov esi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 8
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x3c5f489e
jmp 0x10003c9b
mov ecx, dword [0x10067b8c]
mov eax, dword [0x10067b88]
mov edx, ecx
sub edx, 0xf2f8356d
sub edx, 1
add edx, 0xf2f8356d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5f9a13b6
mov ecx, 0xd499ec79
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov eax, dword [0x10067b8c]
mov ecx, dword [0x10067b88]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5f9a13b6
mov ecx, 0xa7071054
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov dword [ebp - 0x48], 0xafae5cc5
jmp 0x10003c9b
mov ecx, dword [0x10067b8c]
mov eax, dword [0x10067b88]
mov edx, ecx
sub edx, 0x57a7b9b9
sub edx, 1
add edx, 0x57a7b9b9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1319e9f2
mov ecx, 0xbfeb69b9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x10067b8c]
mov eax, dword [0x10067b88]
mov edx, ecx
sub edx, 0x1bc7b752
sub edx, 1
add edx, 0x1bc7b752
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1319e9f2
mov ecx, 0x7593dd92
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x48], eax
jmp 0x10003c9b
mov dword [ebp - 0x48], 0xc92196d5
jmp 0x10003c9b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10009100
mov eax, dword [ebp - 0x60]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x54]
push eax
sub esp, 0x3c
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov edi, esp
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x40
call fcn.10009e80
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
add esp, 0xc
mov dword [eax], 0
mov edx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x44]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x48], 0x526f8cd9
jmp 0x10003c9b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], 0xa76b7b90
jmp 0x10003c9b
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x48], 0x108c3842
jmp 0x10003c9b
mov dword [ebp - 0x48], 0xd499ec79
jmp 0x10003c9b
mov dword [ebp - 0x48], 0xbfeb69b9
jmp 0x100032dc