Function at 0x1001a7d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x104b0bf4]
add eax, dword [0x104b0d0c]
mov dword [0x104b0c6c], eax
mov ecx, dword [0x104b0dfc]
sub ecx, dword [0x104b0d5c]
mov dword [0x104b0dcc], ecx
mov edx, dword [0x104b0d3c]
and edx, dword [0x104b0c30]
mov dword [0x104b0c34], edx
mov eax, dword [0x104b0c2c]
imul eax, dword [0x104b0e18]
mov dword [0x104b0c34], eax
mov ecx, dword [0x104b0c9c]
add ecx, dword [0x104b0d88]
mov dword [0x104b0d38], ecx
mov edx, dword [0x104b0e94]
and edx, dword [0x104b0cd4]
mov dword [0x104b0d74], edx
mov eax, dword [0x104b0ddc]
imul eax, dword [0x104b0cac]
mov dword [0x104b0e00], eax
mov ecx, dword [0x104b0cb8]
imul ecx, dword [0x104b0e30]
mov dword [0x104b0e0c], ecx
mov edx, dword [0x104b0c08]
sub edx, dword [0x104b0c08]
mov dword [0x104b0c38], edx
mov eax, dword [0x104b0df0]
and eax, dword [0x104b0c98]
mov dword [0x104b0c34], eax
mov ecx, dword [0x104b0c40]
add ecx, dword [0x104b0e0c]
mov dword [0x104b0e60], ecx
mov edx, dword [0x104b0e64]
imul edx, dword [0x104b0dd4]
mov dword [0x104b0d4c], edx
mov eax, dword [0x104b0bf4]
and eax, dword [0x104b0d40]
mov dword [0x104b0c80], eax
mov ecx, dword [0x104b0d9c]
add ecx, dword [0x104b0c04]
mov dword [0x104b0cb8], ecx
mov edx, dword [0x104b0e70]
add edx, dword [0x104b0bf8]
mov dword [0x104b0c78], edx
mov eax, dword [0x104b0cc8]
sub eax, dword [0x104b0c5c]
mov dword [0x104b0ddc], eax
mov ecx, dword [0x104b0e9c]
imul ecx, dword [0x104b0bfc]
mov dword [0x104b0dd8], ecx
mov edx, dword [0x104b0cdc]
sub edx, dword [0x104b0d50]
mov dword [0x104b0c60], edx
mov eax, dword [0x104b0db8]
imul eax, dword [0x104b0e28]
mov dword [0x104b0bf4], eax
mov ecx, dword [0x104b0e1c]
add ecx, dword [0x104b0d7c]
mov dword [0x104b0c88], ecx
mov edx, dword [0x104b0c98]
imul edx, dword [0x104b0cc8]
mov dword [0x104b0d64], edx
mov eax, dword [0x104b0d3c]
and eax, dword [0x104b0bd8]
mov dword [0x104b0d28], eax
mov ecx, dword [0x104b0c64]
add ecx, dword [0x104b0dcc]
mov dword [0x104b0c28], ecx
mov edx, dword [0x104b0d6c]
imul edx, dword [0x104b0e88]
mov dword [0x104b0c84], edx
mov eax, dword [0x104b0e14]
imul eax, dword [0x104b0e68]
mov dword [0x104b0df4], eax
mov ecx, dword [0x104b0bf4]
and ecx, dword [0x104b0db8]
mov dword [0x104b0e04], ecx
mov edx, dword [0x104b0e88]
imul edx, dword [0x104b0c7c]
mov dword [0x104b0c9c], edx
mov eax, dword [0x104b0dbc]
imul eax, dword [0x104b0c80]
mov dword [0x104b0d34], eax
mov ecx, dword [0x104b0e08]
and ecx, dword [0x104b0e64]
mov dword [0x104b0da8], ecx
mov edx, dword [0x104b0c88]
add edx, dword [0x104b0d38]
mov dword [0x104b0d88], edx
mov eax, dword [0x104b0c0c]
and eax, dword [0x104b0c4c]
mov dword [0x104b0de8], eax
mov ecx, dword [0x104b0c20]
add ecx, dword [0x104b0e44]
mov dword [0x104b0e14], ecx
mov edx, dword [0x104b0d18]
and edx, dword [0x104b0e54]
mov dword [0x104b0e90], edx
mov eax, dword [0x104b0d48]
sub eax, dword [0x104b0d80]
mov dword [0x104b0ca8], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x104b0d58]
sub edx, dword [0x104b0e00]
mov dword [0x104b0c64], edx
mov eax, dword [0x104b0d4c]
sub eax, dword [0x104b0d24]
mov dword [0x104b0d98], eax
mov ecx, dword [0x104b0e08]
imul ecx, dword [0x104b0bf8]
mov dword [0x104b0d7c], ecx
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x1001aad5
xor eax, eax
jmp 0x1001b691
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [0x104b0e20]
and edx, dword [0x104b0d3c]
mov dword [0x104b0cbc], edx
mov eax, dword [0x104b0d24]
add eax, dword [0x104b0cb8]
mov dword [0x104b0e54], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0x4550
je 0x1001ab6c
xor eax, eax
jmp 0x1001b691
push 4
push 0x2000
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x50]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
mov edx, dword [0x104b0c7c]
and edx, dword [0x104b0cb4]
mov dword [0x104b0cd4], edx
mov eax, dword [0x104b0c18]
add eax, dword [0x104b0d50]
mov dword [0x104b0e18], eax
mov ecx, dword [0x104b0e9c]
sub ecx, dword [0x104b0e90]
mov dword [0x104b0ce8], ecx
mov edx, dword [0x104b0c74]
and edx, dword [0x104b0cf4]
mov dword [0x104b0bec], edx
cmp dword [ebp - 8], 0
jne 0x1001acea
push 4
push 0x2000
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x50]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
mov edx, dword [0x104b0e40]
sub edx, dword [0x104b0c1c]
mov dword [0x104b0c3c], edx
mov eax, dword [0x104b0c88]
add eax, dword [0x104b0c74]
mov dword [0x104b0e80], eax
mov ecx, dword [0x104b0d3c]
imul ecx, dword [0x104b0d7c]
mov dword [0x104b0e0c], ecx
mov edx, dword [0x104b0c68]
imul edx, dword [0x104b0d28]
mov dword [0x104b0c54], edx
mov eax, dword [0x104b0d44]
and eax, dword [0x104b0d6c]
mov dword [0x104b0c58], eax
cmp dword [ebp - 8], 0
jne 0x1001acea
xor eax, eax
jmp 0x1001b691
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
mov eax, dword [0x104b0c08]
sub eax, dword [0x104b0d2c]
mov dword [0x104b0cb0], eax
mov ecx, dword [0x104b0c20]
and ecx, dword [0x104b0d74]
mov dword [0x104b0c9c], ecx
mov edx, dword [0x104b0dd8]
sub edx, dword [0x104b0e40]
mov dword [0x104b0d10], edx
mov eax, dword [0x104b0dec]
and eax, dword [0x104b0c14]
mov dword [0x104b0c9c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [0x104b0ca8]
add eax, dword [0x104b0c40]
mov dword [0x104b0e30], eax
mov ecx, dword [0x104b0ddc]
sub ecx, dword [0x104b0d78]
mov dword [0x104b0dcc], ecx
mov edx, dword [0x104b0cfc]
sub edx, dword [0x104b0d94]
mov dword [0x104b0c44], edx
mov eax, dword [0x104b0e64]
sub eax, dword [0x104b0c1c]
mov dword [0x104b0ce8], eax
mov ecx, dword [0x104b0e5c]
add ecx, dword [0x104b0ddc]
mov dword [0x104b0bfc], ecx
mov edx, dword [0x104b0d70]
sub edx, dword [0x104b0d8c]
mov dword [0x104b0ce8], edx
mov eax, dword [0x104b0de0]
imul eax, dword [0x104b0dc4]
mov dword [0x104b0ca0], eax
mov ecx, dword [0x104b0d2c]
sub ecx, dword [0x104b0c88]
mov dword [0x104b0c64], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], 0
mov eax, dword [0x104b0c90]
sub eax, dword [0x104b0c64]
mov dword [0x104b0db8], eax
mov ecx, dword [0x104b0d88]
and ecx, dword [0x104b0cd0]
mov dword [0x104b0c48], ecx
mov edx, dword [0x104b0c30]
and edx, dword [0x104b0dc8]
mov dword [0x104b0c00], edx
mov eax, dword [0x104b0bfc]
and eax, dword [0x104b0e14]
mov dword [0x104b0d2c], eax
mov ecx, dword [0x104b0c78]
sub ecx, dword [0x104b0e34]
mov dword [0x104b0c40], ecx
mov edx, dword [0x104b0cfc]
imul edx, dword [0x104b0c98]
mov dword [0x104b0e64], edx
mov eax, dword [0x104b0e5c]
add eax, dword [0x104b0e8c]
mov dword [0x104b0e58], eax
mov ecx, dword [0x104b0c78]
add ecx, dword [0x104b0dbc]
mov dword [0x104b0bf0], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [0x104b0dd0]
and eax, dword [0x104b0dac]
mov dword [0x104b0d24], eax
mov ecx, dword [0x104b0e54]
sub ecx, dword [0x104b0cac]
mov dword [0x104b0e4c], ecx
mov edx, dword [0x104b0cc0]
and edx, dword [0x104b0d14]
mov dword [0x104b0c38], edx
mov eax, dword [0x104b0e18]
and eax, dword [0x104b0dbc]
mov dword [0x104b0cac], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [0x104b0c8c]
and edx, dword [0x104b0cf4]
mov dword [0x104b0bfc], edx
mov eax, dword [0x104b0c94]
imul eax, dword [0x104b0e98]
mov dword [0x104b0e6c], eax
mov ecx, dword [0x104b0c90]
sub ecx, dword [0x104b0d9c]
mov dword [0x104b0d64], ecx
mov edx, dword [0x104b0e28]
imul edx, dword [0x104b0d14]
mov dword [0x104b0e38], edx
mov eax, dword [0x104b0be0]
add eax, dword [0x104b0ccc]
mov dword [0x104b0d88], eax
mov ecx, dword [0x104b0c94]
imul ecx, dword [0x104b0cc4]
mov dword [0x104b0e3c], ecx
mov edx, dword [0x104b0e04]
and edx, dword [0x104b0c14]
mov dword [0x104b0e9c], edx
mov eax, dword [0x104b0d80]
sub eax, dword [0x104b0c1c]
mov dword [0x104b0dfc], eax
push 4
push 0x1000
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x50]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x104b0c54]
and ecx, dword [0x104b0d08]
mov dword [0x104b0c84], ecx
mov edx, dword [0x104b0d58]
imul edx, dword [0x104b0d14]
mov dword [0x104b0d14], edx
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
mov eax, dword [0x104b0d9c]
add eax, dword [0x104b0db0]
mov dword [0x104b0cbc], eax
mov ecx, dword [0x104b0d38]
sub ecx, dword [0x104b0ea0]
mov dword [0x104b0ca0], ecx
mov edx, dword [0x104b0e0c]
imul edx, dword [0x104b0cc8]
mov dword [0x104b0dc8], edx
mov eax, dword [0x104b0e08]
and eax, dword [0x104b0e68]
mov dword [0x104b0e74], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 0xc]
add edx, dword [eax + 0x54]
push edx
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.10153a90
add esp, 0xc
mov eax, dword [0x104b0c58]
imul eax, dword [0x104b0c48]
mov dword [0x104b0c40], eax
mov ecx, dword [0x104b0c48]
add ecx, dword [0x104b0cc8]
mov dword [0x104b0e88], ecx
mov edx, dword [0x104b0dac]
and edx, dword [0x104b0be4]
mov dword [0x104b0d8c], edx
mov eax, dword [0x104b0d28]
sub eax, dword [0x104b0e5c]
mov dword [0x104b0c4c], eax
mov ecx, dword [0x104b0e78]
and ecx, dword [0x104b0dcc]
mov dword [0x104b0d24], ecx
mov edx, dword [0x104b0d38]
and edx, dword [0x104b0d7c]
mov dword [0x104b0e70], edx
mov eax, dword [0x104b0e58]
and eax, dword [0x104b0cb0]
mov dword [0x104b0cec], eax
mov ecx, dword [0x104b0cb4]
imul ecx, dword [0x104b0cec]
mov dword [0x104b0cfc], ecx
mov edx, dword [0x104b0d4c]
sub edx, dword [0x104b0cf0]
mov dword [0x104b0e60], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
add ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, dword [0x104b0cd8]
sub eax, dword [0x104b0d28]
mov dword [0x104b0da4], eax
mov ecx, dword [0x104b0db8]
and ecx, dword [0x104b0e30]
mov dword [0x104b0e58], ecx
mov edx, dword [0x104b0d54]
sub edx, dword [0x104b0cb8]
mov dword [0x104b0d88], edx
mov eax, dword [0x104b0d24]
add eax, dword [0x104b0e30]
mov dword [0x104b0c90], eax
mov ecx, dword [0x104b0e9c]
imul ecx, dword [0x104b0da8]
mov dword [0x104b0e8c], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x34], ecx
mov edx, dword [0x104b0c04]
sub edx, dword [0x104b0e38]
mov dword [0x104b0cd4], edx
mov eax, dword [0x104b0cac]
imul eax, dword [0x104b0c94]
mov dword [0x104b0df4], eax
mov ecx, dword [0x104b0da0]
imul ecx, dword [0x104b0c10]
mov dword [0x104b0e44], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10018a60
add esp, 0xc
mov edx, dword [0x104b0d78]
imul edx, dword [0x104b0c78]
mov dword [0x104b0e24], edx
mov eax, dword [0x104b0e24]
and eax, dword [0x104b0df0]
mov dword [0x104b0bec], eax
mov ecx, dword [0x104b0cdc]
imul ecx, dword [0x104b0e9c]
mov dword [0x104b0e08], ecx
mov edx, dword [0x104b0e34]
sub edx, dword [0x104b0d5c]
mov dword [0x104b0c40], edx
mov eax, dword [0x104b0d54]
imul eax, dword [0x104b0de8]
mov dword [0x104b0e78], eax
mov ecx, dword [0x104b0ca8]
imul ecx, dword [0x104b0ca8]
mov dword [0x104b0c54], ecx
mov edx, dword [0x104b0c38]
imul edx, dword [0x104b0ce0]
mov dword [0x104b0e78], edx
mov eax, dword [0x104b0de4]
add eax, dword [0x104b0e54]
mov dword [0x104b0d24], eax
mov ecx, dword [0x104b0ca8]
sub ecx, dword [0x104b0da4]
mov dword [0x104b0e14], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
sub eax, dword [edx + 0x34]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x104b0e84]
and ecx, dword [0x104b0e24]
mov dword [0x104b0cf8], ecx
mov edx, dword [0x104b0d6c]
and edx, dword [0x104b0dc8]
mov dword [0x104b0d30], edx
mov eax, dword [0x104b0d8c]
imul eax, dword [0x104b0d1c]
mov dword [0x104b0e40], eax
mov ecx, dword [0x104b0e70]
sub ecx, dword [0x104b0c20]
mov dword [0x104b0c74], ecx
mov edx, dword [0x104b0e0c]
sub edx, dword [0x104b0d50]
mov dword [0x104b0e88], edx
mov eax, dword [0x104b0d94]
sub eax, dword [0x104b0e54]
mov dword [0x104b0d88], eax
mov ecx, dword [0x104b0ce8]
sub ecx, dword [0x104b0bf8]
mov dword [0x104b0c54], ecx
mov edx, dword [0x104b0dd8]
add edx, dword [0x104b0e3c]
mov dword [0x104b0df0], edx
mov eax, dword [0x104b0cac]
imul eax, dword [0x104b0d54]
mov dword [0x104b0ca4], eax
cmp dword [ebp - 0x18], 0
je 0x1001b365
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.10019600
add esp, 8
mov eax, dword [0x104b0dc4]
imul eax, dword [0x104b0ddc]
mov dword [0x104b0e2c], eax
mov ecx, dword [0x104b0c0c]
and ecx, dword [0x104b0d50]
mov dword [0x104b0df4], ecx
mov edx, dword [0x104b0c84]
and edx, dword [0x104b0e18]
mov dword [0x104b0e3c], edx
mov eax, dword [0x104b0e2c]
add eax, dword [0x104b0d3c]
mov dword [0x104b0e58], eax
mov ecx, dword [0x104b0ce8]
add ecx, dword [0x104b0e08]
mov dword [0x104b0e90], ecx
mov edx, dword [0x104b0db0]
imul edx, dword [0x104b0c20]
mov dword [0x104b0ce0], edx
mov eax, dword [0x104b0c24]
and eax, dword [0x104b0c3c]
mov dword [0x104b0c74], eax
mov ecx, dword [0x104b0d0c]
sub ecx, dword [0x104b0e6c]
mov dword [0x104b0c88], ecx
mov edx, dword [0x104b0d04]
add edx, dword [0x104b0c34]
mov dword [0x104b0d50], edx
mov eax, dword [ebp - 4]
push eax
call fcn.10017d30
add esp, 4
test eax, eax
jne 0x1001b411
jmp 0x1001b628
mov eax, dword [ebp - 4]
push eax
call fcn.10019000
add esp, 4
mov ecx, dword [0x104b0ca0]
add ecx, dword [0x104b0d54]
mov dword [0x104b0cb4], ecx
mov edx, dword [0x104b0e30]
and edx, dword [0x104b0cd0]
mov dword [0x104b0dd0], edx
mov eax, dword [0x104b0d58]
sub eax, dword [0x104b0c8c]
mov dword [0x104b0c9c], eax
mov ecx, dword [0x104b0c48]
add ecx, dword [0x104b0c28]
mov dword [0x104b0cf0], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
cmp dword [eax + 0x28], 0
je 0x1001b5eb
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
add eax, dword [edx + 0x28]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x104b0e4c]
imul ecx, dword [0x104b0e84]
mov dword [0x104b0be4], ecx
mov edx, dword [0x104b0cb4]
imul edx, dword [0x104b0c68]
mov dword [0x104b0d80], edx
mov eax, dword [0x104b0e40]
and eax, dword [0x104b0e54]
mov dword [0x104b0d78], eax
mov ecx, dword [0x104b0d08]
add ecx, dword [0x104b0ce8]
mov dword [0x104b0e28], ecx
mov edx, dword [0x104b0e04]
sub edx, dword [0x104b0bec]
mov dword [0x104b0e88], edx
mov eax, dword [0x104b0e14]
and eax, dword [0x104b0dcc]
mov dword [0x104b0d48], eax
cmp dword [ebp - 0x1c], 0
jne 0x1001b50d
jmp 0x1001b628
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
push 0
push 1
mov eax, dword [ebp - 8]
push eax
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x104b0c54]
and ecx, dword [0x104b0c38]
mov dword [0x104b0c74], ecx
mov edx, dword [0x104b0d28]
and edx, dword [0x104b0e18]
mov dword [0x104b0db4], edx
cmp dword [ebp - 0x24], 0
jne 0x1001b566
jmp 0x1001b628
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 1
mov edx, dword [0x104b0d20]
imul edx, dword [0x104b0d2c]
mov dword [0x104b0cdc], edx
mov eax, dword [0x104b0d78]
add eax, dword [0x104b0e80]
mov dword [0x104b0d4c], eax
mov ecx, dword [0x104b0dc0]
add ecx, dword [0x104b0da4]
mov dword [0x104b0c78], ecx
mov edx, dword [0x104b0d8c]
add edx, dword [0x104b0e98]
mov dword [0x104b0d08], edx
mov eax, dword [0x104b0d48]
and eax, dword [0x104b0dbc]
mov dword [0x104b0d3c], eax
mov ecx, dword [0x104b0e48]
sub ecx, dword [0x104b0dac]
mov dword [0x104b0d90], ecx
mov edx, dword [0x104b0c14]
sub edx, dword [0x104b0db0]
mov dword [0x104b0e70], edx
mov eax, dword [ebp - 4]
jmp 0x1001b691
mov eax, dword [ebp - 4]
push eax
call fcn.10019c70
add esp, 4
mov ecx, dword [0x104b0e20]
add ecx, dword [0x104b0cfc]
mov dword [0x104b0cd4], ecx
mov edx, dword [0x104b0e1c]
add edx, dword [0x104b0c18]
mov dword [0x104b0cd4], edx
mov eax, dword [0x104b0d54]
imul eax, dword [0x104b0c6c]
mov dword [0x104b0d68], eax
xor eax, eax
jmp 0x1001b691
mov esp, ebp
pop ebp
ret