Function at 0x10005012
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
pushal
mov eax, esp
add eax, 0x1c
mov dword [ebp - 0x130], eax
push dword [ebp + 8]
call dword [ebx + 0x402404]
cmp eax, 0xffffffff
je 0x1000552f
mov dword [ebp - 0x14], eax
push pe_nt_image_headers32
push dword [ebp + 8]
call dword [ebx + 0x40240c]
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [ebx + 0x402400]
cmp eax, 0xffffffff
je 0x10005515
mov dword [ebp - 4], eax
push eax
call dword [ebx + 0x402428]
cmp eax, 1
jne 0x1000550a
push 0
push dword [ebp - 4]
call dword [ebx + 0x40241c]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [ebx + 0x402420]
push 0
push 0
push 0
push 4
push 0
push dword [ebp - 4]
call dword [ebx + 0x402410]
or eax, eax
je 0x100054f5
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 6
push eax
call dword [ebx + 0x402414]
or eax, eax
je 0x100054ec
mov dword [ebp - 0xc], eax
cmp word [eax], 0x5a4d
jne 0x100054e3
add eax, dword [eax + 0x3c]
cmp byte [eax], 0x50
jne 0x100054e3
cmp byte [eax + 1], 0x45
jne 0x100054e3
mov ecx, dword [eax + 8]
add ch, cl
cmp ch, 0xff
jne 0x1000511e
push eax
push 3
push dword [eax + 0x28]
push dword [ebp - 0xc]
call fcn.100055a5
mov al, byte [eax]
cmp al, 0xe8
je 0x1000511d
mov ch, 0
pop eax
cmp dword [eax + 0x4c], 0
jne 0x100054d7
cmp ch, 0xff
je 0x100054d7
bt dword [eax + 0x16], 0xd
jb 0x100054e3
push 3
call fcn.10005990
or edx, edx
jne 0x10005148
inc edx
mov dh, 0xff
sub dh, dl
mov dword [ebp - 0x134], edx
cmp dword [ebp + 0xc], 0
je 0x10005177
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.1000566f
mov eax, dword [ebp - 0x130]
mov dword [eax], 0xffffffff
jmp 0x100054d5
lea edi, [ebp - 0x12c]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push 0x1c
pop ecx
push ecx
push 0xfa
push edx
push eax
call fcn.10005540
or eax, eax
je 0x100051e1
push eax
push 0
push eax
push dword [ebp - 0xc]
call fcn.100055a5
cmp eax, 0xffffffff
je 0x100051cb
mov ecx, eax
pop eax
push eax
pushal
add eax, edx
dec eax
push 0
push eax
push dword [ebp - 0xc]
call fcn.100055a5
sub eax, ecx
inc eax
cmp eax, edx
je 0x100051ca
popal
mov eax, 0xffffffff
jmp 0x100051cb
popal
cmp eax, 1
pop eax
jl 0x100051d5
stosd dword es:[edi], eax
xchg edx, eax
stosd dword es:[edi], eax
xchg edx, eax
add eax, edx
mov ecx, eax
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub edx, ecx
or eax, eax
pop ecx
loopne 0x10005186
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 4
pop edx
jmp 0x1000526a
cmp dword ss:[edx + ebp - 0x12c], 0x1b5d
jb 0x1000522b
mov eax, dword ss:[edx + ebp - 0x130]
mov dword [ebp - 0x12c], eax
mov eax, dword ss:[edx + ebp - 0x12c]
mov dword [ebp - 0x128], eax
xor eax, eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
jmp 0x10005279
cmp dword ss:[edx + ebp - 0x12c], 0x227
jb 0x10005267
mov eax, dword ss:[edx + ebp - 0x130]
xchg dword [ebp - 0x12c], eax
mov dword ss:[edx + ebp - 0x130], eax
mov eax, dword ss:[edx + ebp - 0x12c]
xchg dword [ebp - 0x128], eax
mov dword ss:[edx + ebp - 0x12c], eax
jmp 0x10005279
add edx, 8
cmp dword ss:[edx + ebp - 0x12c], 0
jne 0x100051ef
push 4
pop edx
xor eax, eax
jmp 0x1000528b
add eax, dword ss:[edx + ebp - 0x12c]
add edx, 8
cmp dword ss:[edx + ebp - 0x12c], 0
jne 0x10005280
cmp dword [ebp - 0x128], 0x227
jb 0x100054c9
cmp dword [ebp - 0x128], 0x1b5d
jae 0x100052bd
cmp eax, 0x1b5d
jb 0x100054bb
mov eax, 0x1b5d
lea edx, [ebp - 0x12c]
lea esi, [ebx + 0x401000]
mov edi, dword [edx]
sub edi, dword [ebp - 0xc]
mov dword [ebp - 0x138], edi
jmp 0x1000531c
cmp dword [edx + 4], eax
jb 0x100052e3
mov dword [edx + 4], eax
mov edi, dword [edx]
mov ecx, dword [edx + 4]
push eax
push edx
lea eax, [ebp - 0x12c]
cmp eax, edx
jne 0x100052f8
rep movsb byte es:[edi], byte [esi]
jmp 0x10005310
mov edx, dword [ebp - 0x134]
mov al, byte [esi]
or al, al
je 0x1000530a
cmp al, dl
je 0x1000530a
xor al, dl
mov byte [edi], al
inc edi
inc esi
loop 0x100052fe
pop edx
pop eax
sub eax, dword [edx + 4]
or eax, eax
je 0x10005321
add edx, 8
cmp dword [edx], 0
jne 0x100052db
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ebp - 0x12c]
mov edi, dword [esi]
add edi, 0x13f
mov edx, esi
jmp 0x1000534c
push 2
push dword [edx]
push dword [ebp - 0xc]
call fcn.100055a5
mov dword [edx], eax
add edx, 8
cmp dword [edx], 0
jne 0x1000533b
push 0x3a
pop ecx
pushal
rep movsd dword es:[edi], dword [esi]
popal
mov edx, dword [ebp - 0xc]
add edx, dword [edx + 0x3c]
push 3
push dword [edx + 0x28]
push dword [ebp - 0xc]
call fcn.100055a5
mov esi, eax
mov cl, byte [esi]
mov byte [edi - 5], cl
mov ecx, dword [esi + 1]
mov dword [edi - 4], ecx
sub edi, 0x13f
push 2
push edi
push dword [ebp - 0xc]
call fcn.100055a5
pushal
mov edx, dword [ebp - 0xc]
add edx, dword [edx + 0x3c]
movzx ecx, word [edx + 6]
add edx, 0xf8
jmp 0x10005402
mov edi, dword [edx + 0x14]
add edi, dword [ebp - 0xc]
cmp esi, edi
jbe 0x100053fe
add edi, dword [edx + 0x10]
cmp esi, edi
jae 0x100053fe
push eax
sub edi, 5
sub edi, 2
push 0
push edi
push dword [ebp - 0xc]
call fcn.100055a5
pushal
mov esi, eax
mov eax, dword [ebp - 0x138]
add eax, dword [ebp - 0xc]
add eax, 0x12f
mov dword [eax], esi
mov ecx, dword [edi]
mov dword [eax + 4], ecx
mov cx, word [edi + 4]
mov word [eax + 8], cx
mov cl, byte [edi + 6]
mov byte [eax + 0xa], cl
popal
sub dword [esp], eax
pop eax
sub eax, 5
sub eax, 2
mov word [edi], 0xc033
mov byte [edi + 2], 0xe9
mov dword [edi + 3], eax
jmp 0x10005406
dec ecx
add edx, 0x28
or ecx, ecx
jne 0x1000539c
or ecx, ecx
je 0x10005416
sub edi, esi
sub edi, 5
mov dword [esp + 0x1c], edi
popal
jmp 0x10005420
popal
sub eax, dword [edx + 0x34]
sub eax, dword [edx + 0x28]
sub eax, 5
mov byte [esi], 0xe8
mov dword [esi + 1], eax
movzx eax, word [edx + 0x14]
add eax, 0x18
movzx ecx, word [edx + 6]
add edx, eax
mov eax, dword [edx + 0x10]
cmp dword [edx + 8], eax
jae 0x10005449
mov dword [edx + 8], eax
add eax, dword [edx + 0xc]
mov dword [ebp - 0x13c], eax
jmp 0x10005453
mov dword [ebp - 0x13c], 0
mov eax, dword [edx + 0x14]
cmp dword [ebp - 0x138], eax
jbe 0x10005470
add eax, dword [edx + 0x10]
cmp dword [ebp - 0x138], eax
jae 0x10005470
or dword [edx + 0x24], 0x20000020
add edx, 0x28
or ecx, ecx
je 0x10005479
loop 0x10005433
cmp dword [ebp - 0x13c], 0
je 0x10005491
mov eax, dword [ebp - 0xc]
add eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x13c]
mov dword [eax + 0x50], ecx
mov eax, dword [ebp - 0xc]
add eax, dword [eax + 0x3c]
mov edx, dword [ebp - 0x134]
mov dword [eax + 8], edx
mov dword [eax + 0x58], 0
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.10005721
mov ecx, eax
pop eax
mov dword [eax + 0x58], ecx
jmp 0x100054d5
mov eax, dword [ebp - 0x130]
mov dword [eax], 0xfffffffe
jmp 0x100054d5
mov eax, dword [ebp - 0x130]
mov dword [eax], 0xfffffffe
jmp 0x100054e3
mov eax, dword [ebp - 0x130]
mov dword [eax], 0xffffffff
push dword [ebp - 0xc]
call dword [ebx + 0x402418]
push dword [ebp - 8]
call dword [ebx + 0x40242c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [ebx + 0x402424]
push dword [ebp - 4]
call dword [ebx + 0x40242c]
jmp 0x10005521
mov eax, dword [ebp - 0x130]
mov dword [eax], 0xffffffff
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [ebx + 0x40240c]
jmp 0x1000553b
mov eax, dword [ebp - 0x130]
mov dword [eax], 0xffffffff
popal
leave
ret 8