Function at 0x100244c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], str.x5QUjrDtEWiSDpSBeJtkodkEGaE5nSmZeHWp4cCwP7WPrgly
push 0x101c
call dword [sym.imp.GDI32.dll_RealizePalette]
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
call dword [ebp - 0x10]
cmp eax, 6
je 0x100244ef
xor eax, eax
jmp 0x10024b2d
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], ecx
mov edx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1003f718], edx
push 0
call dword [ebp - 0x18]
mov dword [0x1003f6c0], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x14], eax
mov ecx, 0x101
mov edx, dword [ebp - 8]
mov word [edx], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx], cx
mov eax, 0x126
mov ecx, dword [ebp - 8]
mov word [ecx + 2], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 2]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 2], ax
mov edx, 0x12c
mov eax, dword [ebp - 8]
mov word [eax + 4], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 4]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 4], dx
mov ecx, 0x11d
mov edx, dword [ebp - 8]
mov word [edx + 6], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 6]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 6], cx
mov eax, 0x12a
mov ecx, dword [ebp - 8]
mov word [ecx + 8], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 8]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 8], ax
mov edx, 0x11e
mov eax, dword [ebp - 8]
mov word [eax + 0xa], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0xa]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0xa], dx
mov ecx, 0x119
mov edx, dword [ebp - 8]
mov word [edx + 0xc], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0xc]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0xc], cx
mov eax, 0x11b
mov ecx, dword [ebp - 8]
mov word [ecx + 0xe], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0xe]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0xe], ax
mov edx, 0x11d
mov eax, dword [ebp - 8]
mov word [eax + 0x10], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x10]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x10], dx
mov ecx, 0x114
mov edx, dword [ebp - 8]
mov word [edx + 0x12], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x12]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x12], cx
mov eax, 0x133
mov ecx, dword [ebp - 8]
mov word [ecx + 0x14], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x14]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x14], ax
mov edx, 0x11a
mov eax, dword [ebp - 8]
mov word [eax + 0x16], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x16]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x16], dx
mov ecx, 0xe9
mov edx, dword [ebp - 8]
mov word [edx + 0x18], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x18]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x18], cx
mov eax, 0xf1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x1a], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x1a]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x1a], ax
mov edx, 0xee
mov eax, dword [ebp - 8]
mov word [eax + 0x1c], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x1c]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x1c], dx
mov ecx, 0x11a
mov edx, dword [ebp - 8]
mov word [edx + 0x1e], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x1e]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x1e], cx
mov eax, 0xea
mov ecx, dword [ebp - 8]
mov word [ecx + 0x20], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x20]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x20], ax
mov edx, 0xf0
mov eax, dword [ebp - 8]
mov word [eax + 0x22], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x22]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x22], dx
mov ecx, 0xef
mov edx, dword [ebp - 8]
mov word [edx + 0x24], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x24]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x24], cx
mov eax, 0xe5
mov ecx, dword [ebp - 8]
mov word [ecx + 0x26], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x26]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x26], ax
mov edx, 0x11a
mov eax, dword [ebp - 8]
mov word [eax + 0x28], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x28]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x28], dx
mov ecx, 0x119
mov edx, dword [ebp - 8]
mov word [edx + 0x2a], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x2a]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x2a], cx
mov eax, 0x11a
mov ecx, dword [ebp - 8]
mov word [ecx + 0x2c], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x2c]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x2c], ax
mov edx, 0xec
mov eax, dword [ebp - 8]
mov word [eax + 0x2e], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x2e]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x2e], dx
mov ecx, 0xe5
mov edx, dword [ebp - 8]
mov word [edx + 0x30], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x30]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x30], cx
mov eax, 0xe9
mov ecx, dword [ebp - 8]
mov word [ecx + 0x32], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x32]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x32], ax
mov edx, 0xe8
mov eax, dword [ebp - 8]
mov word [eax + 0x34], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x34]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x34], dx
mov ecx, 0xe9
mov edx, dword [ebp - 8]
mov word [edx + 0x36], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x36]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x36], cx
mov eax, 0x119
mov ecx, dword [ebp - 8]
mov word [ecx + 0x38], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x38]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x38], ax
mov edx, 0xe5
mov eax, dword [ebp - 8]
mov word [eax + 0x3a], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x3a]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x3a], dx
mov ecx, 0x11a
mov edx, dword [ebp - 8]
mov word [edx + 0x3c], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x3c]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x3c], cx
mov eax, 0xee
mov ecx, dword [ebp - 8]
mov word [ecx + 0x3e], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x3e]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x3e], ax
mov edx, 0xf1
mov eax, dword [ebp - 8]
mov word [eax + 0x40], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x40]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x40], dx
mov ecx, 0x11b
mov edx, dword [ebp - 8]
mov word [edx + 0x42], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x42]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x42], cx
mov eax, 0xe5
mov ecx, dword [ebp - 8]
mov word [ecx + 0x44], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x44]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x44], ax
mov edx, 0xe8
mov eax, dword [ebp - 8]
mov word [eax + 0x46], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x46]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x46], dx
mov ecx, 0xe8
mov edx, dword [ebp - 8]
mov word [edx + 0x48], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x48]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x48], cx
mov eax, 0x119
mov ecx, dword [ebp - 8]
mov word [ecx + 0x4a], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x4a]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x4a], ax
mov edx, 0x119
mov eax, dword [ebp - 8]
mov word [eax + 0x4c], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x4c]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x4c], dx
mov ecx, 0xe8
mov edx, dword [ebp - 8]
mov word [edx + 0x4e], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x4e]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x4e], cx
mov eax, 0xe8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x50], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x50]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x50], ax
mov edx, 0xeb
mov eax, dword [ebp - 8]
mov word [eax + 0x52], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x52]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x52], dx
mov ecx, 0xec
mov edx, dword [ebp - 8]
mov word [edx + 0x54], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x54]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x54], cx
mov eax, 0xe9
mov ecx, dword [ebp - 8]
mov word [ecx + 0x56], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x56]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x56], ax
mov edx, 0x11c
mov eax, dword [ebp - 8]
mov word [eax + 0x58], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x58]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x58], dx
mov ecx, 0xe8
mov edx, dword [ebp - 8]
mov word [edx + 0x5a], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x5a]
sub ecx, 0xb8
mov edx, dword [ebp - 8]
mov word [edx + 0x5a], cx
mov eax, 0xef
mov ecx, dword [ebp - 8]
mov word [ecx + 0x5c], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x5c]
sub eax, 0xb8
mov ecx, dword [ebp - 8]
mov word [ecx + 0x5c], ax
mov edx, 0x135
mov eax, dword [ebp - 8]
mov word [eax + 0x5e], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x5e]
sub edx, 0xb8
mov eax, dword [ebp - 8]
mov word [eax + 0x5e], dx
push 0x1003f71c
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [0x1003e6a0]
sub edx, 2
push edx
call dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10024b2d
mov eax, 1
test eax, eax
je 0x10024b2d
jmp 0x10024b22
mov esp, ebp
pop ebp
ret