Function at 0xe560aa
Capabilities:
Link function at runtime on windows
Parse pe header
Resolve function by parsing pe exports

Disassembly:
cmp byte [esi + 1], 0x23
lea ecx, [esi + 1]
jmp 0xe57d67
jb 0xe52668
mov eax, dword [ebp + 8]
movzx ecx, di
cmovs cx, sp
movsx ecx, si
lea ecx, [ebp - 0x114]
jmp 0xe5c7c4
ja 0xe55e96
sub ecx, dword [eax + edi + 0x10]
stc
cmp ecx, dword [eax + edi + 0x14]
jmp 0xe4b5af
mov cl, byte [esi + 2]
add esi, 2
clc
cmp si, 0x7a89
sub edx, edx
test ecx, 0x119f74bf
test cl, cl
jmp 0xf0b1e0
push edi
cbw
nop
movzx eax, dx
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0xf1087f
je 0xf149e2
mov eax, 0x5a4d
cmp edi, ebp
clc
cmp word [edi], ax
jmp 0xf149dc
call eax
test eax, eax
jmp 0xe3fd23
mov dword [ebp + 8], edx
jmp 0xe4059f
mov byte [esi], al
jmp 0xf0580e
jne 0xf0627c
lea edx, [ebp - 0x114]
jmp 0xef87d2
jmp 0xebe128
call fcn.00e560aa
add esp, 0xc
pop esi
seto bl
mov edi, edi
pop ebx
xchg edi, edi
pop edi
jmp 0xe49cf2
jne 0xf0b1e6
push 0
push edx
jmp 0xf194db
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
ror ax, 7
sar ah, cl
mov eax, dword [ebp + 8]
cmp eax, 0x6bd80614
lea esi, [ebx + eax]
clc
mov eax, dword [ebp + 0x10]
cmp edx, 0x79787605
push eax
shl ah, 0x53
sar esi, 1
rcr al, cl
rol eax, cl
mov eax, dword [edx + esi*4]
clc
add eax, edi
jmp 0xe47a7b
call fcn.00e40d62
add esp, 4
cmc
cmp eax, 0xffffffff
je 0xec1411
test eax, eax
je 0xf138a7
cmp eax, 1
jmp 0xf0be8b
test edi, edi
jmp 0xe5d999
mov dword [ebp + 8], esi
jmp 0xf1d8fe
mov esp, ebp
pop ebp
ret
test ecx, ecx
jmp 0xf104b2
jae 0xe54d50
mov edx, dword [eax + edi + 0x1c]
test al, 0xd9
cmc
lea ecx, [edx + ecx*4]
stc
test ebx, edi
mov ecx, dword [ecx + edi]
cmp ax, bx
jmp 0xe4b245
push eax
bswap ax
jmp 0xa060a9
mov dword [ebp - 8], ecx
jmp 0xa102f5
jne 0xa00fa8
cmp byte [ebp + 0x10], 0
je 0xe57777
mov ebx, dword [ebp + 0xc]
rol eax, cl
lea eax, [ebp - 0x114]
btc esi, 0x66
sub edx, edx
sub ebx, eax
not esi
btr esi, 0x44
mov edi, edi
mov eax, 0x45b40fa5
mov cl, dl
bt esi, ebp
bts si, si
rol eax, cl
test ax, 0x6346
cmovbe si, di
movsx esi, ax
lea esi, [ebp + edx - 0x114]
stc
add al, dl
xor al, byte [ebx + esi]
jmp 0xa11c54
call fcn.00e560aa
add esp, 0xc
pop esi
jmp 0xf0b4fb
jbe 0xa0316d
lea ebx, [ebp - 0x114]
sub ebx, eax
and dl, 0x95
mov dl, byte [eax]
test dl, dl
je 0xa0316d
mov byte [ebx + eax], dl
mov edx, dword [ebp + 8]
jmp 0xe53b1e
inc edx
jmp 0xf050af
jne 0xf04c3e
pop esi
bts ebx, eax
btc bx, 2
pop ebx
sub eax, eax
pop edi
jmp 0xf0b525
mov ebx, dword [eax + edi + 0x18]
clc
stc
test esi, ebp
test ebx, ebx
je 0xe601a2
mov edx, dword [eax + edi + 0x20]
jmp 0xe60276
push ebp
mov ebp, esp
test bp, 0x4523
sub esp, 0x114
cmp edi, 0x4575f6f
jmp 0xf0700e
call eax
test eax, eax
jmp 0xf06276
jne 0xf149e2
mov eax, dword [edx + 0x78]
mov dword [ebp - 4], eax
clc
cmp edi, 0xfe660b8
test esi, 0x59b12128
test eax, eax
je 0xf149e2
mov edx, dword [edx + 0x7c]
push ebx
push esi
or esi, 0xffffffff
jmp 0xf1f74d
mov eax, dword [ebp + 0xc]
jmp 0xe4c54a
je 0xa04476
push 0
push ecx
jmp 0xf19c3c
mov esp, ebp
not bp
mov bp, sp
pop ebp
ret
push ecx
jmp 0xf0ad6f
je 0xf149e2
mov ecx, dword [ebp + 0xc]
cmp di, 0x7c5c
test di, 0x39ad
clc
test ecx, ecx
jmp 0xa083e6
jle 0xe4479e
mov eax, dword [ebp - 4]
add si, bp
mov esi, dword [ebp - 8]
cmp ebx, edi
cmp esi, dword [eax + edi + 0x14]
jmp 0xf18ff3
dec ebx
test dx, ax
lea edx, [edx + edi]
mov dword [ebp + 8], 0
test ax, 0x56a
mov dword [ebp - 0xc], edx
clc
cmc
test ebx, ebx
jl 0xe601a2
jmp 0xe447aa
call eax
pop esi
movzx ebx, bx
pop ebx
movzx edi, di
pop edi
mov esp, ebp
xchg bp, bp
bswap ebp
pop ebp
ret
ret
cmp dword [ebp + 8], ebx
jmp 0xe60191
mov esp, ebp
pop ebp
jmp 0xec41b5
ret
lea ebx, [esi - 1]
cmc
cmp bl, al
jmp 0xebe128
inc esi
test sp, 0x681
test cl, cl
jmp 0xe54d4a
pop esi
sete al
movsx bx, dl
pop ebx
jmp 0xef930d
ret
push edi
cmovb eax, eax
cwde
xchg ah, al
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0xe619ea
jb 0xe4d177
lea eax, [ebp - 0x114]
jmp 0xf1364e
push edx
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0xe562cf
lea eax, [ecx + edi]
pop edi
jmp 0xebf849
mov esi, eax
test ebx, 0x1ca167c1
test cl, cl
je 0xe54d50
mov edi, edi
clc
stc
cmp cl, 0x2e
jmp 0xf20a2f
inc eax
mov dword [ebp + 8], edx
cmp edx, ecx
jmp 0xa03167
je 0xec5e53
inc edx
test ch, 0x2a
cmp edx, 0x104
jmp 0xec5e4d
je 0xe54d50
cmp eax, edi
jmp 0xe4d14c
push edi
stc
adc di, ax
mov edi, dword [ebp + 8]
jmp 0xe480e1
mov byte [ebp + eax - 0x114], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0xa0dd30
je 0xe4246d
mov bl, cl
cmp edi, esi
cmp dl, 0x9c
sub bl, 0x30
jmp 0xf215e4
jae 0xec3b26
lea eax, [ecx + edi]
shr esi, 0x12
ror cl, cl
sub cl, 0x11
mov cl, byte [eax]
jmp 0xf04c2a
pop ebx
mov edi, 0x37205dab
pop edi
jmp 0xe5aa9e
mov esp, ebp
pop ebp
jmp 0xec0dd3
jae 0xe54d50
mov dword [ebp + 8], 0
test ecx, ecx
jmp 0xe52657
jne 0xebe128
inc esi
jmp 0xe48cad
mov esp, ebp
movsx ebp, di
xchg ebp, ebp
pop ebp
jmp 0xebdfad
jne 0xf19018
pop esi
xor di, si
mov edi, ecx
pop ebx
sub eax, eax
pop edi
jmp 0xf224c0
mov ecx, esi
sub ecx, eax
test bp, si
cmp ecx, 0x104
jmp 0xf0b57a
call eax
pop esi
pop ebx
pop edi
jmp 0xf0c6ce
mov edx, dword [edi + 0x3c]
clc
cmp ah, 0x5b
lea edx, [edx + edi]
test edx, 0x3f9f662f
cmp dword [edx], 0x4550
jmp 0xe56be1
push eax
mov eax, esp
jmp 0xec51c1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edi + 0x24]
setb ch
xchg cx, cx
mov eax, 0x15940bcf
lea eax, [edx + esi*2]
cmovo ecx, esi
movzx ecx, word [eax + edi]
cdq
lea edx, [ebx + 1]
jmp 0xe4c620
je 0xf1244e
xor eax, eax
movsx edi, cx
movzx edi, di
pop edi
mov esp, ebp
bswap bp
pop ebp
ret
jb 0xec3b26
mov edx, dword [ebp - 0x10]
cmp bp, 0x2643
lea edx, [edx + eax]
cmp ecx, edx
jmp 0xf0b424
jae 0xe54d50
mov ecx, dword [eax + edi + 0x1c]
mov dh, 0xa0
dec edx
adc dx, cx
lea edx, [ecx + esi*4]
mov ecx, dword [edx + edi]
clc
test cx, 0x5b82
test ecx, ecx
je 0xe54d50
cmp ecx, eax
jmp 0xf14d3c
push eax
jmp 0xe4e82a
push eax
jmp 0xe40d39
jmp 0xebe128
mov dword [ebp - 0x10], edx
cmp bp, 0x23e8
stc
mov dword [ebp - 8], esi
cmp ecx, 0xffff
jmp 0xa03eea
je 0xf107e4
mov cl, byte [esi + 1]
jmp 0xec1548
inc esi
clc
cmp eax, eax
cmp bl, 9
jmp 0xf235d6
mov esp, ebp
movsx ebp, bp
cmove bp, sp
pop ebp
ret
ja 0xe4246d
movsx ecx, cl
lea edx, [edx + edx*4]
test ecx, 0x5f0e5939
stc
lea edx, [ecx + edx*2 - 0x30]
sbb cl, bl
sub cl, 0xb1
ror cl, 0xb2
mov cl, byte [esi]
test cl, cl
jmp 0xe42467