Function at 0x1002e540
Capabilities:
Access peb ldr_data
Enumerate files on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, str.kernel32.dll
xor ebx, ebx
push esi
test eax, eax
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0x1002e596
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push eax
push ebx
push ebx
call edi
mov esi, eax
test esi, esi
je 0x1002e596
lea ecx, [esi + esi + 2]
push ecx
call fcn.10030d66
add esp, 4
mov ebx, eax
mov dword [ebp - 4], ebx
push esi
push ebx
push 0xffffffffffffffff
push str.kernel32.dll
push 0
push 0
call edi
mov word [ebx + esi*2], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
test ebx, ebx
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], eax
jne 0x1002e5bd
mov esi, dword [ecx + 0x18]
mov dword [ebp - 0x10], esi
jmp 0x1002e7c9
mov edx, ecx
cmp ecx, eax
mov dword [ebp - 0x10], edx
je 0x1002e7b8
jmp 0x1002e5cf
mov ebx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
cmp word [ebx], 0
mov dword [ebp - 0xc], eax
mov eax, ebx
je 0x1002e5e6
add eax, 2
cmp word [eax], 0
jne 0x1002e5dd
mov edi, dword [ebp - 4]
sub eax, edi
sar eax, 1
lea esi, [eax + eax + 2]
push esi
call fcn.10030d66
mov ebx, eax
add esp, 4
test ebx, ebx
mov dword [ebp - 0x18], ebx
mov ecx, esi
je 0x1002e640
test ecx, ecx
je 0x1002e61a
dec ecx
mov edx, edi
sub edx, ebx
lea esi, [ecx + 1]
mov cl, byte [edx + eax]
mov byte [eax], cl
inc eax
dec esi
jne 0x1002e611
cmp word [ebx], 0
mov eax, ebx
je 0x1002e640
mov cx, word [eax]
cmp cx, 0x61
jb 0x1002e637
cmp cx, 0x7a
ja 0x1002e637
add ecx, 0xffffffe0
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x1002e622
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x1002e64b
xor eax, eax
jmp 0x1002e660
cmp word [ecx], 0
mov eax, ecx
je 0x1002e65c
add eax, 2
cmp word [eax], 0
jne 0x1002e653
sub eax, ecx
sar eax, 1
lea esi, [eax + eax + 2]
push esi
call fcn.10030d66
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebp - 0x14], edi
mov ecx, esi
je 0x1002e6bd
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x1002e697
test ecx, ecx
je 0x1002e697
mov edx, dword [ebp - 0xc]
dec ecx
mov eax, edi
sub edx, edi
lea esi, [ecx + 1]
mov cl, byte [eax + edx]
mov byte [eax], cl
inc eax
dec esi
jne 0x1002e68e
cmp word [edi], 0
mov eax, edi
je 0x1002e6bd
mov cx, word [eax]
cmp cx, 0x61
jb 0x1002e6b4
cmp cx, 0x7a
ja 0x1002e6b4
add ecx, 0xffffffe0
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x1002e69f
test ebx, ebx
jne 0x1002e6c5
xor ecx, ecx
jmp 0x1002e6dc
cmp word [ebx], 0
mov eax, ebx
je 0x1002e6d6
add eax, 2
cmp word [eax], 0
jne 0x1002e6cd
sub eax, ebx
sar eax, 1
mov ecx, eax
test edi, edi
jne 0x1002e6e4
xor eax, eax
jmp 0x1002e6f9
cmp word [edi], 0
mov eax, edi
je 0x1002e6f5
add eax, 2
cmp word [eax], 0
jne 0x1002e6ec
sub eax, edi
sar eax, 1
cmp ecx, eax
jle 0x1002e705
xor esi, esi
mov si, word [ebx + eax*2]
jmp 0x1002e77b
jge 0x1002e711
xor esi, esi
mov si, word [edi + ecx*2]
neg esi
jmp 0x1002e77b
test ebx, ebx
je 0x1002e7af
test edi, edi
je 0x1002e7af
lea edx, [ecx + ecx]
push 4
push edx
call fcn.1003114a
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov ebx, edx
add esp, 8
xor edx, edx
test eax, eax
jle 0x1002e750
mov ecx, dword [esi]
add esi, 4
sub ecx, dword [edi]
add edi, 4
test ecx, ecx
jne 0x1002e7a3
inc edx
cmp edx, eax
jl 0x1002e73d
test ebx, ebx
je 0x1002e771
xor edx, edx
mov ecx, esi
test ebx, ebx
jle 0x1002e771
sub edi, esi
movsx esi, byte [ecx + edi]
movsx eax, byte [ecx]
sub eax, esi
inc ecx
test eax, eax
jne 0x1002e773
inc edx
cmp edx, ebx
jl 0x1002e75e
xor eax, eax
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov esi, eax
push ebx
call fcn.10030d5b
push edi
call fcn.10030d5b
add esp, 8
test esi, esi
je 0x1002e7a7
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov dword [ebp - 0x10], edx
jne 0x1002e5cc
jmp 0x1002e7b8
mov eax, ecx
jmp 0x1002e773
mov ecx, dword [ebp - 0x10]
mov esi, dword [ecx + 0x18]
jmp 0x1002e7ba
push 0
push 0
call fcn.1003116f
xor esi, esi
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], esi
push edx
call fcn.10030d5b
add esp, 4
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x7c]
lea eax, [eax + esi + 0x78]
test ecx, ecx
je 0x1002e964
mov eax, dword [eax]
test eax, eax
je 0x1002e964
mov ecx, dword [eax + esi + 0x20]
mov edx, dword [eax + esi + 0x24]
mov ebx, dword [eax + esi + 0x1c]
mov edi, dword [eax + esi + 0x14]
lea eax, [eax + esi + 0x14]
add ecx, esi
add edx, esi
add ebx, esi
test edi, edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], eax
jbe 0x1002e964
mov eax, str.IsWow64Process
mov dword [ebp - 4], ecx
and eax, 0xffff0000
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
test eax, eax
mov dx, word [ecx]
mov dword [ebp - 0x20], edx
jne 0x1002e84f
mov eax, edx
and eax, 0xffff
cmp eax, str.IsWow64Process
je 0x1002e94d
jmp 0x1002e919
mov ecx, dword [ebp - 4]
mov eax, str.IsWow64Process
mov edi, dword [ecx]
add edi, esi
test eax, eax
je 0x1002e87b
mov cl, byte [str.IsWow64Process]
mov eax, str.IsWow64Process
test cl, cl
je 0x1002e876
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1002e86e
sub eax, str.IsWow64Process
test edi, edi
jne 0x1002e883
xor ecx, ecx
jmp 0x1002e892
cmp byte [edi], 0
mov ecx, edi
je 0x1002e890
inc ecx
cmp byte [ecx], 0
jne 0x1002e88a
sub ecx, edi
cmp eax, ecx
jle 0x1002e89f
movsx eax, byte [ecx + str.IsWow64Process]
jmp 0x1002e915
jge 0x1002e8a9
movsx eax, byte [eax + edi]
neg eax
jmp 0x1002e915
mov ecx, str.IsWow64Process
test ecx, ecx
je 0x1002e96e
test edi, edi
je 0x1002e96e
push 4
push eax
call fcn.1003114a
mov ebx, edx
add esp, 8
xor edx, edx
mov esi, str.IsWow64Process
test eax, eax
jle 0x1002e8e9
mov ecx, dword [esi]
add esi, 4
sub ecx, dword [edi]
add edi, 4
test ecx, ecx
jne 0x1002e949
inc edx
cmp edx, eax
jl 0x1002e8d6
test ebx, ebx
je 0x1002e90a
xor edx, edx
mov ecx, esi
test ebx, ebx
jle 0x1002e90a
sub edi, esi
movsx esi, byte [ecx + edi]
movsx eax, byte [ecx]
sub eax, esi
inc ecx
test eax, eax
jne 0x1002e90c
inc edx
cmp edx, ebx
jl 0x1002e8f7
xor eax, eax
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
test eax, eax
je 0x1002e94d
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0xc]
add edx, 4
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0x24]
inc eax
add edi, 2
mov ecx, dword [edx]
mov dword [ebp - 0x18], eax
cmp eax, ecx
mov dword [ebp - 0xc], edi
jb 0x1002e828
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ecx
jmp 0x1002e90c
and edx, 0xffff
mov eax, dword [ebx + edx*4]
add eax, esi
test eax, eax
je 0x1002e964
lea ecx, [ebp - 8]
push ecx
push 0xffffffffffffffff
call eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
call fcn.1003116f
nop
nop
nop
nop
nop
nop
nop
nop
nop