Function at 0x1001841d
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
and dword [ebp - 0xc], 0
and dword [ebp - 0x18], 0
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
xor eax, eax
mov word [ebp - 0x1c], ax
and dword [ebp - 0x28], 0
and dword [ebp - 0x20], 0
xor eax, eax
mov word [ebp - 0x10], ax
and dword [ebp - 0x14], 0
and dword [ebp - 0x2c], 0
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10018474
xor eax, eax
je 0x1001846d
jmp 0x10018467
xor eax, eax
jmp 0x100186d2
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp dword [eax], 0x4550
je 0x10018498
xor eax, eax
je 0x10018491
jmp 0x1001848b
xor eax, eax
jmp 0x100186d2
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + 4]
cmp eax, 0x14c
jne 0x100184c2
xor eax, eax
je 0x100184ac
jmp 0x100184a6
mov eax, dword [ebp - 0x28]
mov ax, word [eax + 6]
mov word [ebp - 0x10], ax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x2c], eax
jmp 0x10018503
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + 4]
cmp eax, 0x8664
jne 0x100184f6
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
and dword [ebp - 0x28], 0
xor eax, eax
je 0x100184e0
jmp 0x100184da
mov eax, dword [ebp - 0x20]
mov ax, word [eax + 6]
mov word [ebp - 0x10], ax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x2c], eax
jmp 0x10018503
xor eax, eax
je 0x100184fc
jmp 0x100184f6
xor eax, eax
jmp 0x100186d2
xor eax, eax
je 0x10018509
jmp 0x10018503
cmp dword [ebp + 0x10], 0
je 0x10018580
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + 4]
cmp eax, 0x14c
jne 0x1001854a
push 0x40
push 0x1000
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
push dword [eax + 0x34]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10018544
xor eax, eax
je 0x10018542
jmp 0x1001853c
jmp 0x1001854a
xor eax, eax
je 0x1001854a
jmp 0x10018544
cmp dword [ebp - 0xc], 0
jne 0x10018565
push 0x40
push 0x1000
push dword [ebp - 0x2c]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10018578
xor eax, eax
je 0x10018571
jmp 0x1001856b
xor eax, eax
jmp 0x100186d2
xor eax, eax
je 0x1001857e
jmp 0x10018578
jmp 0x100185a5
push dword [ebp - 0x2c]
call fcn.10011198
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1001859f
xor eax, eax
je 0x10018598
jmp 0x10018592
xor eax, eax
jmp 0x100186d2
xor eax, eax
je 0x100185a5
jmp 0x1001859f
cmp dword [ebp - 0x20], 0
je 0x100185dc
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax + 0x108]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
push dword [eax + 0x54]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
call fcn.10011255
pop ecx
pop ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x54]
mov dword [ebp - 4], eax
jmp 0x1001860b
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax + 0xf8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
push dword [eax + 0x54]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
call fcn.10011255
pop ecx
pop ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x54]
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
jmp 0x10018618
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
movzx eax, word [ebp - 0x10]
cmp dword [ebp - 8], eax
jae 0x100186c9
push 9
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.100112b0
add esp, 0xc
push 8
mov eax, dword [ebp - 8]
imul eax, eax, 0x28
add eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
push ecx
call fcn.10011255
pop ecx
pop ecx
mov eax, dword [ebp - 8]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x14]
push dword [ecx + eax + 0x10]
mov eax, dword [ebp - 8]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x14]
mov eax, dword [ebp - 8]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
add esi, dword [ecx + eax + 0xc]
push esi
mov eax, edx
call fcn.10011255
pop ecx
pop ecx
mov eax, dword [ebp - 8]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x14]
mov eax, dword [ebp - 8]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x14]
add edx, dword [ecx + eax + 0x10]
cmp edx, dword [ebp - 0x18]
jbe 0x100186c4
mov eax, dword [ebp - 8]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x14]
mov eax, dword [ebp - 8]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x14]
add edx, dword [ecx + eax + 0x10]
mov dword [ebp - 0x18], edx
jmp 0x10018611
xor eax, eax
je 0x100186cf
jmp 0x100186c9
mov eax, dword [ebp - 0xc]
pop esi
leave
ret