Function at 0x100028f0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov edi, dword [0x1009a2c4]
xor ebp, ebp
push 0x10062440
mov esi, edi
mov ebx, eax
mov dword [esp + 0x30], ebp
call fcn.10002820
push 0x10062450
mov dword [esp + 0x2c], eax
call fcn.10002820
push 0x10062460
mov dword [esp + 0x34], eax
call fcn.10002820
push 0x10062470
mov dword [esp + 0x30], eax
call fcn.10002820
mov esi, dword [0x1009a2c8]
push str.NtFlushInstructionCache
mov dword [esp + 0x44], eax
call fcn.10002820
push str.GetNativeSystemInfo
mov esi, edi
mov dword [esp + 0x4c], eax
call fcn.10002820
mov edi, dword [ebx + 0x3c]
add edi, ebx
add esp, 0x18
cmp dword [edi], 0x4550
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
je 0x10002981
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret
cmp word [edi + 4], 0x14c
jne 0x10002977
mov eax, dword [edi + 0x38]
test al, 1
mov dword [esp + 0x18], eax
jne 0x10002977
movzx ecx, word [edi + 0x14]
lea edx, [ecx + edi + 0x18]
movzx ecx, word [edi + 6]
test ecx, ecx
jle 0x100029d7
add edx, 0xc
mov dword [esp + 0x10], ecx
jmp 0x100029b0
mov esi, dword [edx + 4]
test esi, esi
mov ecx, dword [edx]
jne 0x100029c5
mov edi, dword [esp + 0x14]
add ecx, eax
mov eax, dword [esp + 0x18]
jmp 0x100029c7
add ecx, esi
cmp ecx, ebp
jbe 0x100029cd
mov ebp, ecx
add edx, 0x28
sub dword [esp + 0x10], 1
jne 0x100029b0
lea edx, [esp + 0x38]
push edx
call dword [esp + 0x20]
mov edx, dword [esp + 0x3c]
mov ecx, dword [edi + 0x50]
lea eax, [edx - 1]
lea esi, [edx + ebp - 1]
not eax
lea edx, [ecx + edx - 1]
and esi, eax
and edx, eax
cmp edx, esi
jne 0x10002977
push 4
push 0x3000
push ecx
push 0
call dword [esp + 0x30]
mov ecx, dword [edi + 0x54]
test ecx, ecx
mov esi, eax
mov dword [esp + 0x10], esi
mov eax, ebx
je 0x10002a33
sub esi, ebx
nop
mov dl, byte [eax]
sub ecx, 1
mov byte [esi + eax], dl
add eax, 1
test ecx, ecx
jne 0x10002a20
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
movzx ebp, word [edx + 6]
test ebp, ebp
movzx eax, word [edi + 0x14]
lea edi, [eax + edi + 0x18]
je 0x10002a81
add edi, 0x14
lea ebx, [ebx]
mov eax, dword [edi - 8]
mov ecx, dword [edi]
mov esi, dword [edi - 4]
add eax, dword [esp + 0x10]
sub ebp, 1
add ecx, ebx
test esi, esi
je 0x10002a7a
mov dl, byte [ecx]
sub esi, 1
mov byte [eax], dl
add eax, 1
add ecx, 1
test esi, esi
jne 0x10002a65
mov edx, dword [esp + 0x14]
add edi, 0x28
test ebp, ebp
jne 0x10002a50
mov ebp, dword [edx + 0x80]
add ebp, dword [esp + 0x10]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10002b06
mov ecx, dword [esp + 0x10]
add eax, ecx
push eax
call dword [esp + 0x28]
mov edx, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp]
add esi, edx
add ebx, edx
cmp dword [esi], 0
mov edi, eax
je 0x10002af8
mov eax, dword [ebx]
test eax, eax
je 0x10002ada
jns 0x10002ada
mov ecx, dword [edi + 0x3c]
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
and eax, 0xffff
sub eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x1c]
lea eax, [ecx + eax*4]
mov ecx, dword [eax + edi]
add ecx, edi
mov dword [esi], ecx
jmp 0x10002aed
mov eax, dword [esi]
add eax, edx
add eax, 2
push eax
push edi
call dword [esp + 0x30]
mov edx, dword [esp + 0x10]
mov dword [esi], eax
add esi, 4
add ebx, 4
cmp dword [esi], 0
jne 0x10002ab2
mov eax, dword [ebp + 0x20]
add ebp, 0x14
test eax, eax
jne 0x10002a92
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, eax
sub esi, dword [edx + 0x34]
cmp dword [edx + 0xa4], 0
je 0x10002bac
mov ebp, dword [edx + 0xa0]
add ebp, eax
mov eax, dword [ebp + 4]
test eax, eax
je 0x10002bac
nop
mov edx, dword [ebp]
add edx, dword [esp + 0x10]
lea edi, [eax - 8]
shr edi, 1
lea ebx, [ebp + 8]
je 0x10002b9e
movzx eax, word [ebx]
mov cx, ax
shr cx, 0xc
sub edi, 1
cmp cx, 0xa
jne 0x10002b5f
and eax, 0xfff
add eax, edx
add dword [eax], esi
jmp 0x10002b97
cmp cx, 3
jne 0x10002b70
and eax, 0xfff
add eax, edx
add dword [eax], esi
jmp 0x10002b97
cmp cx, 1
jne 0x10002b87
and eax, 0xfff
mov ecx, esi
add eax, edx
shr ecx, 0x10
add word [eax], cx
jmp 0x10002b97
cmp cx, 2
jne 0x10002b97
and eax, 0xfff
add eax, edx
add word [eax], si
add ebx, 2
test edi, edi
jne 0x10002b41
add ebp, dword [ebp + 4]
mov eax, dword [ebp + 4]
test eax, eax
jne 0x10002b30
mov edx, dword [esp + 0x14]
movzx ecx, word [edx + 6]
test ecx, ecx
movzx eax, word [edx + 0x14]
lea eax, [eax + edx + 0x18]
je 0x10002c88
mov edi, dword [esp + 0x34]
lea ebp, [eax + 0x24]
mov ebx, dword [ebp - 0x14]
sub ecx, 1
test ebx, ebx
mov dword [esp + 0x28], ecx
jbe 0x10002c7d
mov esi, dword [ebp]
mov ecx, esi
shr ecx, 0x1d
mov edx, esi
shr edx, 0x1e
mov eax, esi
and ecx, 1
and edx, 1
shr eax, 0x1f
test ecx, ecx
jne 0x10002c16
test edx, edx
jne 0x10002c07
neg eax
sbb eax, eax
and eax, 7
add eax, 1
mov edi, eax
jmp 0x10002c4c
xor ecx, ecx
test eax, eax
setne cl
lea ecx, [ecx + ecx + 2]
mov edi, ecx
jmp 0x10002c4c
test edx, edx
jne 0x10002c34
test eax, eax
jne 0x10002c25
mov edi, 0x10
jmp 0x10002c4c
test edx, edx
jne 0x10002c34
test eax, eax
je 0x10002c3f
mov edi, 0x80
jmp 0x10002c4c
test eax, eax
jne 0x10002c3f
mov edi, 0x20
jmp 0x10002c4c
test edx, edx
je 0x10002c4c
test eax, eax
je 0x10002c4c
mov edi, 0x40
test esi, 0x4000000
je 0x10002c5a
or edi, 0x200
mov eax, dword [ebp - 0x18]
add eax, dword [esp + 0x10]
lea edx, [esp + 0x2c]
push edx
push edi
push ebx
push eax
call dword [esp + 0x40]
test eax, eax
je 0x10002977
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
add ebp, 0x28
test ecx, ecx
jne 0x10002bc7
mov esi, dword [edx + 0x28]
add esi, dword [esp + 0x10]
push 0
push 0
push 0xffffffffffffffff
call dword [esp + 0x40]
push 1
push 1
push 0x10000000
call esi
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret