Function at 0x10144ca
Capabilities:
Parse pe header
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [ebx + 8], edi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
jne 0x10147e7
cmp dword [esi + 0x1c], edi
je 0x10147e7
test byte [ebx + 0x28], 1
je 0x10144cb
mov eax, dword [ebx + 0x2c]
cmp eax, reloc.KERNEL32.dll_LocalAlloc
je 0x10144cb
push eax
call fcn.01014365
jmp 0x10144dd
or dword [ebp - 0x50], reloc.KERNEL32.dll_LocalAlloc
or dword [ebp - 0x30], 0xffffffff
lea eax, [ebp - 0x64]
mov dword [ebp - 0x60], 1
cmp eax, edi
je 0x10147e7
cmp dword [ebx + 4], reloc.KERNEL32.dll_LocalAlloc
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x14]
lea edi, [ecx + 1]
mov dword [ebp - 0x1c], edi
mov edi, dword [eax + 4]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], edi
jne 0x1014509
inc edx
mov dword [ebp - 4], edx
jmp 0x1014574
mov edi, dword [esi + 0x14]
mov ebx, dword [esi + 0x10]
imul edi, edi, 0x44
lea edi, [edi + ebx - 0x44]
lea ebx, [ebp - 0x64]
cmp eax, ebx
lea edx, [eax + 0x44]
je 0x1014544
mov eax, dword [esi + 0x14]
cmp eax, 1
jl 0x10147e7
jmp 0x1014536
cmp dword [edx + 0x34], ecx
je 0x101453c
add edx, 0x44
cmp edx, edi
jbe 0x101452e
jmp 0x1014544
mov edx, dword [edx + 0x14]
cmp edx, reloc.KERNEL32.dll_LocalAlloc
jne 0x1014553
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1014551
mov edx, dword [edi + 0x14]
inc edx
jmp 0x1014553
xor edx, edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
cmp eax, 0xffff0001
je 0x1014504
cmp eax, edx
jg 0x10147e7
cmp eax, dword [ebp - 0x18]
jle 0x10147e7
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
cmp dword [esi + 0x18], ecx
jge 0x10145b2
mov edi, dword [esi + 0x10]
add eax, 0xa
mov dword [ebp - 8], eax
imul eax, eax, 0x44
test edi, edi
push eax
je 0x1014598
push edi
call fcn.01010ff7
jmp 0x101459d
call fcn.01010fcd
test eax, eax
mov dword [esi + 0x10], eax
jne 0x10145ac
mov dword [esi + 0x10], edi
jmp 0x10147e7
mov eax, dword [ebp - 8]
mov dword [esi + 0x18], eax
cmp dword [esi + 0x10], 0
je 0x10147e7
mov eax, dword [esi + 0x1c]
and dword [ebp - 8], 0
cmp eax, 1
jle 0x1014613
lea edi, [eax - 1]
imul edi, edi, 0x44
push edi
call fcn.01010fcd
test eax, eax
mov dword [ebp - 8], eax
je 0x10147e7
mov ecx, edi
mov edi, dword [ebp - 8]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor ecx, ecx
inc ecx
cmp dword [esi + 0x1c], ecx
jle 0x1014613
mov eax, dword [ebp - 8]
add eax, 0x18
mov edx, dword [ebp - 4]
mov dword [eax], ecx
mov dword [eax - 4], edx
inc ecx
add eax, 0x44
cmp ecx, dword [esi + 0x1c]
jl 0x1014602
test byte [ebx], 1
je 0x101465a
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x1014624
and dword [ebp - 0xc], eax
jmp 0x101465a
push eax
call fcn.01011c9c
lea esi, [eax + eax + 2]
push esi
call fcn.01010fcd
test eax, eax
mov dword [ebp - 0xc], eax
je 0x10147bd
mov ecx, esi
mov esi, dword [ebx + 0x14]
mov ebx, dword [ebp + 8]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x10]
test byte [ebx + 0x28], 2
je 0x1014696
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x10147bd
mov esi, dword [eax]
push esi
call fcn.01010fcd
test eax, eax
mov dword [ebp - 0x14], eax
je 0x10147bd
mov ecx, esi
mov esi, dword [ebx + 0x30]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 4]
mov ecx, dword [esi + 0x10]
imul ebx, ebx, 0x44
mov eax, dword [esi + 0x14]
add ebx, ecx
test eax, eax
je 0x10146db
imul eax, eax, 0x44
lea eax, [eax + ecx - 0x44]
cmp eax, ebx
jb 0x10146db
mov ecx, dword [eax + 0x3c]
inc dword [eax + 0x14]
cmp ecx, reloc.KERNEL32.dll_LocalAlloc
je 0x10146c7
cmp ecx, dword [ebp - 4]
jl 0x10146c7
inc ecx
mov dword [eax + 0x3c], ecx
lea edi, [eax + 0x44]
mov esi, eax
push 0x11
sub eax, 0x44
cmp eax, ebx
pop ecx
rep movsd dword es:[edi], dword [esi]
jae 0x10146b3
mov esi, dword [ebp - 0x10]
inc dword [esi + 0x14]
mov eax, dword [ebp - 8]
and dword [ebx + 8], 0
or dword [ebx + 0xc], 0xffffffff
mov esi, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
push 0xd
lea edi, [ebx + 0x10]
pop ecx
mov dword [ebx + 4], 1
rep movsd dword es:[edi], dword [esi]
or dword [ebx + 0x38], 1
mov esi, dword [ebp - 0x10]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 4]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x34], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x40], eax
mov eax, dword [ebp - 0x18]
xor edi, edi
cmp eax, reloc.KERNEL32.dll_LocalAlloc
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], edi
je 0x101473e
push eax
mov ecx, esi
call fcn.01014365
cmp eax, edi
je 0x101473e
inc dword [eax + 8]
cmp dword [ebp - 0x20], edi
je 0x1014760
xor edx, edx
lea eax, [ebx - 0x44]
jmp 0x1014753
cmp dword [eax + 0xc], reloc.KERNEL32.dll_LocalAlloc
jne 0x101475a
sub eax, 0x44
cmp eax, dword [esi + 0x10]
jae 0x101474a
jmp 0x1014768
mov edx, dword [eax + 0xc]
inc edx
jmp 0x1014763
or edx, reloc.KERNEL32.dll_LocalAlloc
cmp edx, reloc.KERNEL32.dll_LocalAlloc
je 0x10147b0
push 0xc
mov dword [ebp - 0x54], edi
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push eax
push dword [esi]
mov dword [ebp - 0x50], edx
call fcn.01012c28
cmp eax, reloc.KERNEL32.dll_LocalAlloc
mov dword [ebx + 0xc], eax
je 0x10147b0
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
imul eax, eax, 0x44
lea edx, [eax + ecx - 0x44]
lea eax, [ebx + 0x44]
jmp 0x10147ac
mov ecx, dword [eax + 0xc]
cmp ecx, reloc.KERNEL32.dll_LocalAlloc
je 0x10147a9
inc ecx
mov dword [eax + 0xc], ecx
add eax, 0x44
cmp eax, edx
jbe 0x101479d
mov eax, dword [ebp - 4]
mov byte [ebx + 0x1c], 0
mov byte [ebx + 0x20], 0
jmp 0x10147e9
cmp dword [ebp - 8], 0
je 0x10147cb
push dword [ebp - 8]
call fcn.01010fe6
cmp dword [ebp - 0xc], 0
je 0x10147d9
push dword [ebp - 0xc]
call fcn.01010fe6
cmp dword [ebp - 0x14], 0
je 0x10147e7
push dword [ebp - 0x14]
call fcn.01010fe6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4