Function at 0x10002de0
Capabilities:
64-bit execution via heavens gate
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12a4
call fcn.100137d0
mov eax, dword [0x1001d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.GetNativeSystemInfo
push str.kernel32
push eax
call 0x100cabf5
mov ebx, dword [0x10015014]
push eax
call ebx
test eax, eax
je 0x10002e22
lea ecx, [ebp - 0x12a4]
push ecx
call eax
jmp 0x10002e2f
lea eax, [ebp - 0x12a4]
push eax
push edi
call 0x1007aabc
mov ax, word [ebp - 0x12a4]
cmp ax, 9
je 0x10002e42
cmp ax, 6
jne 0x10002e64
push 0x1001e290
mov dword [0x1001e2c8], 1
push edx
call 0x1013adbd
push eax
call 0x100947a5
cmp dword [0x1001e2c8], 0
mov esi, dword [0x10015018]
je 0x10002ea8
call fcn.100025b0
push edx
push eax
mov ecx, str.ZwSetInformationThread
call fcn.10002d10
add esp, 8
mov dword [0x1001e2c0], eax
mov dword [0x1001e2c4], edx
call fcn.100025b0
mov ecx, dword [0x1001e2c0]
sub ecx, eax
mov eax, dword [0x1001e2c4]
sbb eax, edx
jmp 0x10002edd
push str.ZwSetInformationThread
push str.ntdll.dll
call esi
push eax
call ebx
push str.ntdll.dll
mov dword [0x1001e2c0], eax
mov dword [0x1001e2c4], 0
call esi
mov ecx, dword [0x1001e2c0]
sub ecx, eax
mov eax, dword [0x1001e2c4]
sbb eax, 0
mov dword [0x1001e2c0], ecx
or ecx, eax
mov dword [0x1001e2c4], eax
jne 0x10002f00
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003cf6
mov esp, ebp
pop ebp
ret
cmp dword [0x1001e2c8], 0
je 0x10003035
call fcn.100025b0
lea ecx, [ebp - 0x1250]
mov dword [ebp - 0x1254], ecx
test eax, eax
jne 0x10002f26
test edx, edx
je 0x10002f81
mov dword [ebp - 0x1268], eax
mov dword [ebp - 0x1264], edx
push 0x33
call 0x10002f39
add dword [esp], 5
retf
mov eax, 0x5a4d
cmp word [ebp - 0x1250], ax
je 0x10002fa5
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003cf6
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1250]
add ecx, dword [ebp - 0x1214]
cmp dword [ecx], 0x4550
jne 0x10002f8f
movzx eax, word [ecx + 0x14]
xor edx, edx
movzx ebx, word [ecx + 6]
add eax, 0x18
mov edi, dword [0x1001e2c0]
add eax, ecx
mov dword [ebp - 0x1254], ebx
test ebx, ebx
je 0x100030c8
mov ebx, dword [0x1001e2c4]
mov ecx, dword [ebp - 0x1254]
nop dword [eax + eax]
mov esi, dword [eax + 0xc]
mov dword [ebp - 0x1264], 0
cmp dword [ebp - 0x1264], ebx
ja 0x10003028
jb 0x1000300b
cmp esi, edi
ja 0x10003028
mov ecx, dword [eax + 8]
add ecx, esi
test ebx, ebx
jb 0x100030c8
ja 0x10003022
cmp edi, ecx
jbe 0x100030c8
mov ecx, dword [ebp - 0x1254]
inc edx
add eax, 0x28
cmp edx, ecx
jl 0x10002ff0
jmp 0x100030c8
push str.ntdll.dll
call esi
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10002f8f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10002f8f
movzx eax, word [ecx + 0x14]
xor edx, edx
movzx ebx, word [ecx + 6]
add eax, 0x18
mov edi, dword [0x1001e2c0]
add eax, ecx
mov dword [ebp - 0x1254], ebx
test ebx, ebx
je 0x100030c8
mov ebx, dword [0x1001e2c4]
mov ecx, dword [ebp - 0x1254]
nop word [eax + eax]
mov esi, dword [eax + 0xc]
mov dword [ebp - 0x1264], 0
cmp dword [ebp - 0x1264], ebx
ja 0x100030c0
jb 0x100030ab
cmp esi, edi
ja 0x100030c0
mov ecx, dword [eax + 8]
add ecx, esi
test ebx, ebx
jb 0x100030c8
ja 0x100030ba
cmp edi, ecx
jbe 0x100030c8
mov ecx, dword [ebp - 0x1254]
inc edx
add eax, 0x28
cmp edx, ecx
jl 0x10003090
mov esi, dword [eax + 0x14]
sub esi, dword [eax + 0xc]
add esi, edi
test esi, esi
je 0x10002f8f
push 0x208
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.10006160
add esp, 0xc
lea eax, [ebp - 0x250]
push 0x104
push eax
call 0x101758f0