Function at 0x10003170
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov eax, dword [0x10037600]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1003898c]
mov eax, dword [0x10038988]
mov edx, ecx
sub edx, 0x3d6bdaa0
sub edx, 1
add edx, 0x3d6bdaa0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x52], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x51], al
mov dword [ebp - 0x58], 0x501cc3cc
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x68], eax
sub eax, 0x933ee3df
je 0x10003ced
jmp 0x100031eb
mov eax, dword [ebp - 0x68]
sub eax, 0x93a3744f
je 0x10003c38
jmp 0x100031fe
mov eax, dword [ebp - 0x68]
sub eax, 0x94435175
je 0x10003c73
jmp 0x10003211
mov eax, dword [ebp - 0x68]
sub eax, 0x95bc827f
je 0x100036f1
jmp 0x10003224
mov eax, dword [ebp - 0x68]
sub eax, 0xa5c6f5ca
je 0x1000384d
jmp 0x10003237
mov eax, dword [ebp - 0x68]
sub eax, 0xb22d7854
je 0x10003ae0
jmp 0x1000324a
mov eax, dword [ebp - 0x68]
sub eax, 0xc4a2db9a
je 0x1000388b
jmp 0x1000325d
mov eax, dword [ebp - 0x68]
sub eax, 0xc6069872
je 0x10003b47
jmp 0x10003270
mov eax, dword [ebp - 0x68]
sub eax, 0xcfcd4206
je 0x10003d20
jmp 0x10003283
mov eax, dword [ebp - 0x68]
sub eax, 0xdc653edc
je 0x100037b6
jmp 0x10003296
mov eax, dword [ebp - 0x68]
sub eax, 0xdf011e70
je 0x10003a3c
jmp 0x100032a9
mov eax, dword [ebp - 0x68]
sub eax, 0xeeca5496
je 0x10003c58
jmp 0x100032bc
mov eax, dword [ebp - 0x68]
sub eax, 0xfd2bfcae
je 0x100038d1
jmp 0x100032cf
mov eax, dword [ebp - 0x68]
sub eax, 0xfdc60f4e
je 0x100039c0
jmp 0x100032e2
mov eax, dword [ebp - 0x68]
sub eax, 0x62e3844
je 0x100034fa
jmp 0x100032f5
mov eax, dword [ebp - 0x68]
sub eax, 0x7861a02
je 0x1000360d
jmp 0x10003308
mov eax, dword [ebp - 0x68]
sub eax, 0xaba34a7
je 0x10003d14
jmp 0x1000331b
mov eax, dword [ebp - 0x68]
sub eax, 0xcbc402c
je 0x10003ad4
jmp 0x1000332e
mov eax, dword [ebp - 0x68]
sub eax, 0x10d8ad48
je 0x1000386e
jmp 0x10003341
mov eax, dword [ebp - 0x68]
sub eax, 0x145666a6
je 0x10003770
jmp 0x10003354
mov eax, dword [ebp - 0x68]
sub eax, 0x16ce970e
je 0x10003957
jmp 0x10003367
mov eax, dword [ebp - 0x68]
sub eax, 0x19ea47a9
je 0x10003a8e
jmp 0x1000337a
mov eax, dword [ebp - 0x68]
sub eax, 0x20b824bc
je 0x10003862
jmp 0x1000338d
mov eax, dword [ebp - 0x68]
sub eax, 0x358e3a3c
je 0x10003972
jmp 0x100033a0
mov eax, dword [ebp - 0x68]
sub eax, 0x38f80fe5
je 0x10003a48
jmp 0x100033b3
mov eax, dword [ebp - 0x68]
sub eax, 0x3b088c3f
je 0x1000367d
jmp 0x100033c6
mov eax, dword [ebp - 0x68]
sub eax, 0x3b7e1b2e
je 0x100036fd
jmp 0x100033d9
mov eax, dword [ebp - 0x68]
sub eax, 0x3f3a51a0
je 0x100035c7
jmp 0x100033ec
mov eax, dword [ebp - 0x68]
sub eax, 0x439de56f
je 0x100037f9
jmp 0x100033ff
mov eax, dword [ebp - 0x68]
sub eax, 0x448cfee8
je 0x1000362f
jmp 0x10003412
mov eax, dword [ebp - 0x68]
sub eax, 0x495680d3
je 0x10003ce1
jmp 0x10003425
mov eax, dword [ebp - 0x68]
sub eax, 0x501cc3cc
je 0x100034af
jmp 0x10003438
mov eax, dword [ebp - 0x68]
sub eax, 0x5bed55d0
je 0x10003cff
jmp 0x1000344b
mov eax, dword [ebp - 0x68]
sub eax, 0x5c4c8281
je 0x10003c44
jmp 0x1000345e
mov eax, dword [ebp - 0x68]
sub eax, 0x6d8fdae9
je 0x100037c2
jmp 0x10003471
mov eax, dword [ebp - 0x68]
sub eax, 0x76ac0a0f
je 0x100035bb
jmp 0x10003484
mov eax, dword [ebp - 0x68]
sub eax, 0x798fea40
je 0x10003ccc
jmp 0x10003497
mov eax, dword [ebp - 0x68]
sub eax, 0x7f0c2593
je 0x10003b8d
jmp 0x100034aa
jmp 0x10003d5f
mov bl, byte [ebp - 0x52]
mov dh, byte [ebp - 0x51]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x94435175
mov ecx, 0x62e3844
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x60]
mov esi, dword [ebp - 0x64]
push eax
mov eax, esp
mov dword [ebp - 0x50], eax
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
push eax
mov eax, esp
mov dword [ebp - 0x48], eax
push eax
mov eax, esp
mov dword [ebp - 0x44], eax
sub esp, 0x40
mov eax, esp
mov dword [ebp - 0x40], eax
push eax
mov eax, esp
mov dword [ebp - 0x3c], eax
sub esp, 0xf8
mov eax, esp
mov dword [ebp - 0x38], eax
push eax
mov eax, esp
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], esi
mov eax, dword [ebp - 0x48]
mov dword [eax], edx
mov eax, dword [ebp - 0x44]
mov dword [eax], ecx
mov eax, dword [ebp - 0x40]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x40
call fcn.10009e70
add esp, 0xc
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0
mov eax, dword [0x1003898c]
mov ecx, dword [0x10038988]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x94435175
mov ecx, 0x76ac0a0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov dword [ebp - 0x58], 0x3f3a51a0
jmp 0x10003d5f
mov eax, dword [ebp - 0x48]
mov edx, dword [eax]
mov eax, dword [ebp - 0x44]
mov esi, dword [eax]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x40]
mov ax, word [eax]
mov word [ebp - 0x2e], ax
mov dword [ebp - 0x58], 0x7861a02
jmp 0x10003d5f
mov ax, word [ebp - 0x2e]
movzx edx, ax
mov eax, 0x6d8fdae9
mov ecx, 0x448cfee8
cmp edx, 0x5a4d
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov eax, dword [0x1003898c]
mov ecx, dword [0x10038988]
mov edx, eax
add edx, 0x4ced13e3
sub edx, 1
sub edx, 0x4ced13e3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x798fea40
mov ecx, 0x3b088c3f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov eax, dword [ebp - 0x50]
mov dword [eax], 0
mov ecx, dword [0x1003898c]
mov eax, dword [0x10038988]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x798fea40
mov ecx, 0x95bc827f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov dword [ebp - 0x58], 0x3b7e1b2e
jmp 0x10003d5f
mov ecx, dword [0x1003898c]
mov eax, dword [0x10038988]
mov edx, ecx
add edx, 0xc03deb40
sub edx, 1
sub edx, 0xc03deb40
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x495680d3
mov ecx, 0x145666a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov eax, dword [0x1003898c]
mov ecx, dword [0x10038988]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x495680d3
mov ecx, 0xdc653edc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov dword [ebp - 0x58], 0x5c4c8281
jmp 0x10003d5f
mov eax, dword [ebp - 0x38]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xf8
call fcn.10009e70
add esp, 0xc
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x58], 0x439de56f
jmp 0x10003d5f
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 0x2c]
add edx, eax
mov eax, dword [ebp - 0x44]
mov esi, dword [eax]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xf8
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x38]
mov eax, 0x10d8ad48
mov ecx, 0xa5c6f5ca
cmp dword [edx], 0x4550
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov eax, dword [ebp - 0x50]
mov dword [eax], 0
mov dword [ebp - 0x58], 0x20b824bc
jmp 0x10003d5f
mov dword [ebp - 0x58], 0x5c4c8281
jmp 0x10003d5f
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
add eax, 0x18
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x58], 0xc4a2db9a
jmp 0x10003d5f
mov eax, dword [0x1003898c]
mov ecx, dword [0x10038988]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x933ee3df
mov ecx, 0xfd2bfcae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x5c]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setae al
and al, 1
mov byte [ebp - 0x1d], al
mov ecx, dword [0x1003898c]
mov eax, dword [0x10038988]
mov edx, ecx
sub edx, 0xddfaaa2a
sub edx, 1
add edx, 0xddfaaa2a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x933ee3df
mov ecx, 0x16ce970e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov dl, byte [ebp - 0x1d]
mov eax, 0xb22d7854
mov ecx, 0x358e3a3c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov eax, dword [0x1003898c]
mov ecx, dword [0x10038988]
mov edx, eax
add edx, 0x27cdf7c8
sub edx, 1
sub edx, 0x27cdf7c8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5bed55d0
mov ecx, 0xfdc60f4e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov eax, dword [ebp - 0x50]
mov dword [eax], 0
mov ecx, dword [0x1003898c]
mov eax, dword [0x10038988]
mov edx, ecx
add edx, 0x2883ede2
sub edx, 1
sub edx, 0x2883ede2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5bed55d0
mov ecx, 0xdf011e70
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov dword [ebp - 0x58], 0x38f80fe5
jmp 0x10003d5f
mov eax, dword [0x1003898c]
mov ecx, dword [0x10038988]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaba34a7
mov ecx, 0x19ea47a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov eax, dword [0x1003898c]
mov ecx, dword [0x10038988]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaba34a7
mov ecx, 0xcbc402c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov dword [ebp - 0x58], 0x5c4c8281
jmp 0x10003d5f
sub esp, 4
mov dword [esp], 8
call fcn.100090fe
add esp, 4
mov dword [ebp - 0x6c], eax
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 8
call fcn.10009e70
mov ecx, dword [ebp - 0x6c]
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
add eax, 0x18
add eax, 0x60
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
shl ecx, 3
add eax, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x58], 0xc6069872
jmp 0x10003d5f
mov eax, dword [0x1003898c]
mov ecx, dword [0x10038988]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xcfcd4206
mov ecx, 0x7f0c2593
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov eax, dword [ebp - 0x44]
mov esi, dword [eax]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 8
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov ecx, dword [0x1003898c]
mov eax, dword [0x10038988]
mov edx, ecx
sub edx, 0x3520ef69
sub edx, 1
add edx, 0x3520ef69
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcfcd4206
mov ecx, 0x93a3744f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x58], eax
jmp 0x10003d5f
mov dword [ebp - 0x58], 0x5c4c8281
jmp 0x10003d5f
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x58], 0xeeca5496
jmp 0x10003d5f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100090f0
mov eax, dword [ebp - 0x70]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp - 0x60]
push eax
push eax
mov ebx, esp
push eax
mov esi, esp
push eax
mov ecx, esp
sub esp, 0x40
mov eax, esp
push eax
mov edx, esp
mov dword [ebp - 0x74], edx
mov edx, dword [ebp - 0x64]
mov dword [ebx], edx
mov edx, dword [ebp - 0x5c]
mov dword [esi], edi
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x40
call fcn.10009e70
mov eax, dword [ebp - 0x74]
add esp, 0xc
mov dword [eax], 0
mov dword [ebp - 0x58], 0x62e3844
jmp 0x10003d5f
mov eax, dword [ebp - 0x50]
mov dword [eax], 0
mov dword [ebp - 0x58], 0x3b088c3f
jmp 0x10003d5f
mov dword [ebp - 0x58], 0x145666a6
jmp 0x10003d5f
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x58], 0xfd2bfcae
jmp 0x10003d5f
mov eax, dword [ebp - 0x50]
mov dword [eax], 0
mov dword [ebp - 0x58], 0xfdc60f4e
jmp 0x10003d5f
mov dword [ebp - 0x58], 0x19ea47a9
jmp 0x10003d5f
mov eax, dword [ebp - 0x44]
mov esi, dword [eax]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 8
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov dword [ebp - 0x58], 0x7f0c2593
jmp 0x100031d5