Function at 0x817e60
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ecx]
mov esi, ecx
mov ecx, dword [ecx + 4]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov ebp, dword [eax + 8]
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0x2c]
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], ebp
test eax, eax
je 0x81829b
lea edx, [eax - 1]
imul ebx, edx, 0x58
mov edi, dword [esi + ebx + 0x338]
cmp byte [esi + ebx + 0x325], 0xad
lea ecx, [esi + ebx + 0x325]
mov dword [esp + 0xc], ecx
mov dword [esp], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], edx
je 0x818039
cmp byte [esi + 0x2f], 2
mov dword [esp + 4], 0
jne 0x817faa
movzx ecx, byte [esi + 0x2c]
cmp eax, ecx
jne 0x817faa
test byte [edi + 0x25], 2
je 0x817faa
mov eax, dword [edi + 0x20]
cmp byte [eax + 0x38], 0
jns 0x817faa
movzx edi, word [edi + 0x1e]
test edi, edi
je 0x817faa
mov eax, dword [eax + 8]
cmp word [eax + edi*2], 0x24
jl 0x817faa
mov eax, dword [esp + 0x1c]
mov ecx, ebx
lea ecx, [esi + ebx + 0x2f8]
mov ebx, ebp
xor ebp, ebp
mov eax, dword [eax + 0x2c]
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x20]
mov ecx, ebx
mov edx, 0x59
lea eax, [ebp + eax]
push eax
push ebp
mov eax, dword [esp + 0xc]
push dword [eax]
call fcn.007d10f0
add esp, 0xc
inc ebp
cmp ebp, edi
jne 0x817f30
mov ecx, dword [esp + 0x1c]
mov ebp, ebx
mov eax, dword [ecx + 0x2c]
lea eax, [edi + eax + 1]
mov dword [ecx + 0x2c], eax
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp byte [ecx], 4
mov ecx, ebx
setne al
lea edx, [eax + eax*2 + 0x16]
push edi
push dword [esp + 0x24]
push 0
mov eax, dword [esp + 0x10]
push dword [eax]
call fcn.0078dfd0
add esp, 0x10
mov dword [esp + 4], eax
mov ecx, ebx
mov edx, 0xb
mov ebx, dword [esp]
push dword [esi + ebx + 0x32c]
push 1
call fcn.007d10d0
add esp, 8
mov edx, dword [esi + ebx + 0x308]
mov ecx, ebp
call fcn.007fbd70
mov ecx, dword [esp + 0xc]
movzx eax, byte [esi + ebx + 0x326]
movzx edx, byte [ecx]
mov ecx, ebp
push eax
push dword [esi + ebx + 0x32c]
push dword [esi + ebx + 0x328]
call fcn.007d10f0
add esp, 0xc
movzx edx, byte [esi + ebx + 0x327]
mov ecx, ebp
call fcn.0078e010
cmp dword [esi + ebx + 0x314], 0
je 0x818024
mov edx, dword [esi + ebx + 0x318]
mov ecx, ebp
lea edi, [esi + ebx + 0x32c]
call fcn.007fbd70
mov eax, dword [edi]
mov ecx, ebp
mov edx, 0x3b
dec eax
push eax
push dword [edi - 0x18]
call fcn.007d10d0
add esp, 8
mov edx, dword [esp + 4]
mov edi, dword [esp + 0x14]
test edx, edx
je 0x818047
mov ecx, ebp
call fcn.007f75c0
jmp 0x818047
mov edx, dword [esi + ebx + 0x308]
mov ecx, ebp
call fcn.007fbd70
test byte [edi + 0x25], 8
lea eax, [esi + ebx + 0x2f0]
mov dword [esp + 4], eax
je 0x818164
mov eax, dword [esp]
cmp dword [esi + eax + 0x330], 0
jle 0x818164
mov eax, dword [esp]
mov ecx, ebp
mov edx, dword [esi + eax + 0x300]
lea edi, [esi + eax + 0x330]
call fcn.007fbd70
mov edi, dword [edi]
test edi, edi
jle 0x818164
mov edx, dword [esp]
lea ecx, [edi + edi*4]
mov eax, dword [esi + edx + 0x334]
lea ebx, [eax + ecx*4 - 0x14]
lea ecx, [esi + edx + 0x2f8]
mov dword [esp + 0x2c], ecx
mov edx, dword [ebx + 4]
mov ecx, ebp
inc edx
call fcn.007f75c0
cmp byte [ebx + 0x10], 0xad
je 0x81814f
mov ebp, dword [ebx + 0xc]
test ebp, ebp
je 0x818138
mov eax, dword [esp + 0x14]
test byte [eax + 0x25], 4
jne 0x81810f
mov eax, dword [ebx + 8]
mov dword [esp + 0x20], eax
mov esi, dword [esp + 0x18]
mov ecx, esi
call fcn.007fdcb0
mov ecx, dword [esp + 4]
mov edx, 0x1b
cmp dword [ecx], 1
mov ecx, esi
sbb eax, 0xffffffff
add eax, 2
push ebp
push dword [esp + 0x24]
mov esi, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x38]
push dword [eax]
call fcn.0078dfd0
add esp, 0x10
mov eax, dword [esp + 4]
cmp dword [eax], 0
je 0x818138
mov ebp, dword [esp + 0x18]
mov ecx, ebp
call fcn.007fdcb0
add eax, 2
mov ecx, ebp
mov edx, 0x1a
push eax
push dword [ebx]
call fcn.007d10d0
add esp, 8
mov ebp, dword [esp + 0x18]
movzx edx, byte [ebx + 0x10]
mov ecx, ebp
push dword [ebx + 4]
push dword [ebx]
call fcn.007d10d0
add esp, 8
mov edx, dword [ebx + 4]
mov ecx, ebp
dec edx
call fcn.007f75c0
add ebx, 0xffffffec
dec edi
jg 0x8180ab
mov edi, dword [esp]
mov ecx, ebp
mov edx, dword [esi + edi + 0x2fc]
call fcn.007fbd70
mov edx, dword [esi + edi + 0x304]
test edx, edx
je 0x8181ab
mov eax, dword [esp + 0x10]
mov ecx, ebp
lea esi, [eax + edi + 0x304]
call fcn.007f7790
mov edx, dword [esi]
mov ecx, ebp
call fcn.007f75c0
mov edx, dword [esi]
mov esi, dword [esp + 0x10]
mov ecx, ebp
add edx, 0xfffffffe
call fcn.007f75c0
mov eax, dword [esi + edi + 0x320]
test eax, eax
je 0x8181d8
mov ecx, dword [esp + 0x10]
mov edx, 0x3b
mov esi, dword [ecx + edi + 0x31c]
mov ecx, ebp
shr esi, 1
push eax
push esi
mov esi, dword [esp + 0x18]
call fcn.007d10d0
add esp, 8
mov eax, dword [esp + 4]
mov eax, dword [eax]
test eax, eax
je 0x81828f
mov ecx, dword [esp + 0x14]
mov edx, 0x30
mov ebx, dword [ecx + 0x24]
mov ecx, ebp
push eax
call fcn.007f9600
add esp, 4
mov edi, eax
test bl, 0x40
jne 0x81821d
mov eax, dword [esp]
mov ecx, ebp
mov edx, pe_nt_image_headers32
push dword [esi + eax + 0x2f4]
call fcn.007f9600
add esp, 4
test ebx, 0x200
jne 0x81823a
test ebx, 0x2000
je 0x818253
mov eax, dword [esp]
cmp dword [esi + eax + 0x330], 0
je 0x818253
mov eax, dword [esp]
mov ecx, ebp
mov edx, pe_nt_image_headers32
push dword [esi + eax + 0x2f8]
call fcn.007f9600
add esp, 4
mov eax, dword [esp + 0xc]
mov ebx, dword [esp]
mov ecx, ebp
cmp byte [eax], 0x41
mov eax, dword [esi + ebx + 0x30c]
jne 0x81827f
mov edx, 0xc
push eax
push dword [esi + ebx + 0x328]
call fcn.007d10d0
add esp, 8
jmp 0x818286
mov edx, eax
call fcn.007f7790
mov ecx, ebp
mov edx, edi
call fcn.007f75c0
mov eax, dword [esp + 0x24]
test eax, eax
jg 0x817e93
mov edx, dword [esi + 0x20]
mov ecx, ebp
call fcn.007fbd70
cmp byte [esi + 0x2c], 0
mov edx, dword [esp + 8]
je 0x8182ee
lea ebx, [esi + 0x2f0]
xor ecx, ecx
movzx eax, byte [ebx + 0x34]
mov dword [esp + 4], ecx
lea eax, [eax + eax*8]
test byte [edx + eax*8 + 0x30], 0x10
je 0x81833a
mov edx, dword [ebx + 0x20]
mov ecx, dword [esp + 0x1c]
push 0
mov edi, dword [esp + 0xc]
push dword [edi + eax*8 + 0x28]
push dword [ebx + 4]
call fcn.00827d60
mov edx, dword [esp + 0x14]
add esp, 0xc
jmp 0x81842f
mov edx, dword [esi + 0x40]
mov ebx, dword [esp + 0x28]
test edx, edx
je 0x81831d
mov eax, dword [edx]
mov ecx, 0xd
mov dword [esi + 0x40], eax
lea esi, [edx + 8]
mov edi, dword [edx + 4]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov esi, dword [esp + 0x10]
call fcn.00780810
mov edx, dword [esi + 0x40]
test edx, edx
jne 0x8182f9
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, esi
mov dword [ecx + 0x84], eax
mov ecx, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00821960
mov eax, dword [edx + eax*8 + 0x18]
mov dword [esp], eax
mov eax, dword [ebx + 0x48]
mov ecx, dword [eax + 0x24]
test ecx, 0x240
je 0x818354
add eax, 0x20
jmp 0x818363
test ecx, 0x2000
je 0x81842f
lea eax, [ebx + 0x40]
mov ecx, dword [eax]
test ecx, ecx
je 0x81842f
cmp byte [esi + 0x2e], 0
je 0x818380
mov eax, dword [ecx + 0xc]
cmp byte [eax + 0x24], 0
jns 0x81842f
mov eax, dword [esp + 0x28]
cmp byte [eax + 0x51], 0
jne 0x81842f
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x18]
call fcn.007fdcb0
mov ebp, dword [ebx + 0x20]
mov edx, dword [esp + 8]
cmp ebp, eax
jge 0x81842f
mov dword [esp + 0xc], eax
mov edx, ebp
mov ecx, dword [esp + 0x18]
call fcn.007f77c0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, eax
mov eax, dword [edi + 4]
cmp eax, dword [ebx + 4]
jne 0x818427
movzx eax, byte [edi]
cmp al, 0x15
je 0x818421
cmp al, 0x7f
je 0x818448
cmp al, 0x59
jne 0x818427
mov ecx, dword [esp]
mov eax, dword [edi + 8]
cmp byte [ecx + 0x24], 0
jns 0x8183fc
mov dword [esp + 0x24], eax
call fcn.00792930
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x24]
movzx eax, word [eax + ecx*2]
jmp 0x818404
movsx edx, ax
call fcn.0082c560
mov ecx, dword [esp + 0x14]
movsx edx, ax
call fcn.007fc7b0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
test ax, ax
js 0x818427
cwde
mov dword [edi + 8], eax
mov eax, dword [ebx + 8]
mov dword [edi + 4], eax
inc ebp
add edi, 0x14
cmp ebp, ecx
jne 0x8183c3
mov ecx, dword [esp + 4]
movzx eax, byte [esi + 0x2c]
add ebx, 0x58
inc ecx
cmp ecx, eax
jb 0x8182b7
jmp 0x8182ee
mov eax, dword [ebx + 8]
mov dword [edi + 4], eax
mov byte [edi], 0x86
jmp 0x818427