Function at 0x10001780
Capabilities:
Get process heap flags
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x104]
push ebx
mov ebx, eax
sub esp, 0x134
mov dword [ebp - 0x110], edx
mov edi, dword [sym.imp.lz32.dll_LZSeek]
mov dword [ebp - 0x114], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
mov eax, dword [sym.imp.lz32.dll_LZRead]
sub esp, 0xc
mov dword [esp + 8], 0x40
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [ebp - 0x10c], eax
call eax
sub esp, 0xc
cmp eax, 0x40
jne 0x100017ed
cmp word [ebp - 0x104], 0x5a4d
je 0x10001800
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0xc8]
mov dword [esp + 8], 0
mov dword [esp], ebx
mov dword [esp + 4], eax
call edi
lea eax, [ebp - 0x107]
sub esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10c]
mov dword [esp + 8], 2
mov dword [esp], ebx
call eax
sub esp, 0xc
cmp eax, 2
jne 0x100017ed
mov eax, dword [ebp - 0xc8]
mov dword [esp + 8], 0
mov dword [esp], ebx
mov dword [esp + 4], eax
call edi
movzx eax, byte [ebp - 0x107]
sub esp, 0xc
cmp al, 0x4e
je 0x100018c0
cmp al, 0x50
jne 0x10001875
cmp byte [ebp - 0x106], 0x45
je 0x10001960
mov byte [ebp - 0x105], 0
test byte [0x10004330], 4
je 0x100017ed
lea eax, [ebp - 0x107]
mov dword [esp + 0xc], str.Cant_handle__s_files._n
xor esi, esi
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.read_xx_header
mov dword [esp + 4], global___dbch
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x100017ef
cmp byte [ebp - 0x106], 0x45
jne 0x10001875
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], ebx
call edi
sub esp, 0xc
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x10c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0xc
cmp eax, 0x40
jne 0x100017ed
movzx ecx, word [ebp - 0xde]
movzx eax, word [ebp - 0xe0]
sub ecx, eax
mov esi, ecx
jne 0x100019e8
test byte [0x10004330], 8
je 0x100017ed
mov dword [esp + 0xc], str.No_resources_in_NE_dll_n
mov dword [esp + 8], str.find_ne_resource
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x100017ef
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], ebx
call edi
sub esp, 0xc
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x10c]
mov dword [esp + 8], 0xf8
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0xc
cmp eax, 0xf8
jne 0x100017ed
mov esi, dword [ebp - 0x78]
test esi, esi
jne 0x10001be0
test byte [0x10004330], 8
je 0x100017ed
mov dword [esp + 0xc], str.No_resources_in_PE_dll_n
mov dword [esp + 8], str.find_pe_resource
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x100017ef
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x120], eax
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x11c], eax
sub esp, 0xc
test eax, eax
je 0x100017ed
movzx eax, word [ebp - 0xe0]
add eax, dword [ebp - 0x118]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call edi
mov eax, dword [ebp - 0x11c]
sub esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10c]
mov dword [esp + 8], esi
mov dword [esp], ebx
call eax
sub esp, 0xc
cmp esi, eax
jne 0x10001ec8
mov edx, dword [ebp - 0x110]
mov edi, dword [ebp - 0x11c]
mov eax, edx
lea ebx, [edi + 2]
shr eax, 0x10
je 0x10001d30
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, dword [ebp - 0x11c]
mov ecx, eax
movzx eax, word [edi + 2]
mov edx, ecx
movzx edi, cl
test ax, ax
jne 0x10001abf
jmp 0x10001d6c
movzx eax, word [ebx + 2]
lea eax, [eax + eax*2]
lea ebx, [ebx + eax*4 + 8]
movzx eax, word [ebx]
test ax, ax
je 0x10001d6c
test ax, ax
js 0x10001aa8
add eax, esi
cmp dl, byte [eax]
jne 0x10001aa8
mov ecx, dword [ebp - 0x110]
add eax, 1
mov byte [ebp - 0x10c], dl
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__strnicmp]
movzx edx, byte [ebp - 0x10c]
test eax, eax
jne 0x10001aa8
lea esi, [esi]
mov edi, dword [ebp - 0x114]
lea esi, [ebx + 8]
mov eax, edi
shr eax, 0x10
je 0x10001fa8
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_strlen]
movzx ebx, word [ebx + 2]
mov edx, eax
movzx edi, al
test ebx, ebx
je 0x10001fd2
mov dword [ebp - 0x118], edi
mov edi, dword [ebp - 0x11c]
jmp 0x10001b44
add esi, 0xc
sub ebx, 1
je 0x10001fd2
movzx eax, word [esi + 6]
test ax, ax
js 0x10001b38
add eax, edi
cmp dl, byte [eax]
jne 0x10001b38
mov byte [ebp - 0x10c], dl
mov edx, dword [ebp - 0x118]
add eax, 1
mov dword [esp], eax
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x114]
mov dword [esp + 4], edx
call dword [sym.imp.ucrtbase.dll__strnicmp]
movzx edx, byte [ebp - 0x10c]
test eax, eax
jne 0x10001b38
mov eax, dword [ebp - 0x11c]
mov edi, dword [ebp + 8]
movzx ecx, word [eax]
movzx eax, word [esi + 2]
shl eax, cl
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10001ba9
movzx eax, word [esi]
mov edi, dword [ebp + 0xc]
shl eax, cl
mov dword [edi], eax
mov edi, dword [ebp - 0x11c]
mov dword [esp + 4], 0
mov esi, 0x454e
mov eax, dword fs:[0x18]
mov dword [esp + 8], edi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x100017ef
movzx eax, word [ebp - 0xfe]
mov dword [esp + 4], 0
mov edx, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x120], eax
lea eax, [eax + eax*4]
lea esi, [eax*8]
mov dword [ebp - 0x124], edx
mov dword [esp + 8], esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edx
mov dword [ebp - 0x11c], eax
sub esp, 0xc
test eax, eax
je 0x100017ed
mov ecx, dword [ebp - 0x118]
movzx eax, word [ebp - 0xf0]
mov dword [esp + 8], 0
mov dword [esp], ebx
lea eax, [ecx + eax + 0x18]
mov dword [esp + 4], eax
call edi
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x10c]
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call ecx
sub esp, 0xc
cmp esi, eax
jne 0x10001da8
mov ecx, dword [ebp - 0x120]
test ecx, ecx
je 0x10001cc6
mov dword [ebp - 0x118], ebx
mov ecx, dword [ebp - 0x7c]
xor edx, edx
mov dword [ebp - 0x128], edi
mov esi, dword [ebp - 0x11c]
mov edi, dword [ebp - 0x120]
lea esi, [esi]
mov eax, dword [esi + 0xc]
cmp ecx, eax
jb 0x10001cbc
mov ebx, dword [esi + 0x10]
add eax, ebx
cmp ecx, eax
jb 0x10001de0
add edx, 1
add esi, 0x28
cmp edi, edx
jne 0x10001ca8
mov edi, dword [ebp - 0x11c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
test byte [0x10004330], 8
je 0x100017ed
mov dword [esp + 0xc], str.Couldnt_find_resource_section_n
xor esi, esi
mov dword [esp + 8], str.find_pe_resource
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x100017ef
mov eax, dword [ebp - 0x11c]
movzx ecx, word [ebp - 0x110]
movzx eax, word [eax + 2]
or cx, 0x8000
test ax, ax
je 0x10001d6c
lea esi, [esi]
nop
cmp cx, ax
je 0x10001af8
movzx eax, word [ebx + 2]
lea eax, [eax + eax*2]
lea ebx, [ebx + eax*4 + 8]
movzx eax, word [ebx]
test ax, ax
jne 0x10001d50
test byte [0x10004330], 8
je 0x10001da8
mov eax, dword [ebp - 0x110]
mov dword [esp + 0xc], str.No_typeid_entry_found_for__p_n
mov dword [esp + 8], str.find_ne_resource
mov dword [esp + 0x10], eax
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
lea esi, [esi]
nop
mov edi, dword [ebp - 0x11c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
mov dword [esp + 4], 0
mov edi, dword [ebp - 0x128]
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x12c], ebx
mov ebx, dword [ebp - 0x118]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x128], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x124]
call eax
mov edx, dword [ebp - 0x128]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x118], eax
je 0x1000211a
mov dword [esp + 8], 0
mov eax, dword [esi + 0x14]
mov dword [esp], ebx
mov dword [esp + 4], eax
call edi
mov eax, dword [ebp - 0x118]
mov edi, dword [ebp - 0x12c]
sub esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10c]
mov dword [esp + 8], edi
mov dword [esp], ebx
call eax
sub esp, 0xc
cmp edi, eax
je 0x10001ef0
mov eax, dword [ebp - 0x118]
mov dword [esp + 4], 0
mov esi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x11c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
jmp 0x100017ed
mov eax, dword [ebp - 0x11c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax + 0x30]
jmp 0x10001dc3
mov ebx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x110]
add ebx, dword [ebp - 0x7c]
sub ebx, dword [esi + 0xc]
mov ecx, ebx
mov eax, ebx
call dbg.find_entry_by_name
test eax, eax
je 0x1000209a
mov edx, dword [ebp - 0x114]
mov ecx, ebx
call dbg.find_entry_by_name
test eax, eax
je 0x100020da
mov eax, dword [eax + 0x14]
mov edi, dword [ebp - 0x120]
and eax, 0x7fffffff
lea esi, [ebx + eax]
test edi, edi
je 0x10001f6b
mov eax, dword [ebp - 0x11c]
mov ebx, dword [esi]
xor ecx, ecx
add eax, 0xc
lea esi, [esi]
mov edx, dword [eax]
cmp ebx, edx
jb 0x10001f61
add edx, dword [eax + 4]
cmp ebx, edx
jb 0x10002012
add ecx, 1
add eax, 0x28
cmp edi, ecx
jne 0x10001f50
test byte [0x10004330], 8
je 0x10001e72
mov dword [esp + 0xc], str.Couldnt_find_resource_data_section_n
mov dword [esp + 8], str.find_pe_resource
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001e72
movzx ecx, word [ebp - 0x114]
movzx eax, word [ebx + 2]
or cx, 0x8000
test eax, eax
je 0x10001fd2
lea esi, [esi]
cmp cx, word [esi + 6]
je 0x10001b84
add esi, 0xc
sub eax, 1
jne 0x10001fc0
test byte [0x10004330], 8
je 0x10001da8
mov eax, dword [ebp - 0x110]
mov dword [esp + 0xc], str.No_resid_entry_found_for__p_n
mov dword [esp + 8], str.find_ne_resource
mov dword [esp + 0x10], eax
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001da8
cmp dword [ebp - 0x120], ecx
je 0x10001f6b
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [edi], eax
test edx, edx
je 0x10002043
mov edi, dword [ebp - 0x11c]
lea eax, [ecx + ecx*4]
add ebx, dword [edi + eax*8 + 0x14]
sub ebx, dword [edi + eax*8 + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
mov eax, dword [ebp - 0x118]
mov dword [esp + 4], 0
mov esi, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x11c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov esi, 0x4550
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
jmp 0x100017ef
test byte [0x10004330], 8
je 0x10001e72
mov eax, dword [ebp - 0x110]
mov dword [esp + 0xc], str.No_typeid_entry_found_for__p_n
mov dword [esp + 8], str.find_pe_resource
mov dword [esp + 0x10], eax
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001e72
test byte [0x10004330], 8
je 0x10001e72
mov eax, dword [ebp - 0x114]
mov dword [esp + 0xc], str.No_resid_entry_found_for__p_n
mov dword [esp + 8], str.find_pe_resource
mov dword [esp + 0x10], eax
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001e72
mov eax, dword [ebp - 0x11c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
jmp 0x10001dc3