Function at 0x10001086
Capabilities:
Enumerate pe sections
Extract resource via kernel32 functions
Get system information on windows
Map section object
Resolve function by parsing pe exports

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xf0
push esi
push edi
and dword [ebp + 0x70], 0
and dword [ebp + 0xc], 0
push str.Binary
push 0x66
push dword [0x10008064]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push dword [0x10008064]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 0xc], eax
push dword [ebp - 0x30]
push dword [0x10008064]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x74], eax
push 0x40
push 0x3000
push dword [ebp + 0xc]
call fcn.10005858
add esp, 0xc
mov dword [ebp + 0x70], eax
mov edi, dword [ebp + 0x70]
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 0x70]
mov dword [ebp - 0x10], eax
and dword [ebp + 8], 0
jmp 0x1000111f
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jae 0x1000117d
mov eax, dword [ebp + 0x70]
add eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp + 4], eax
mov eax, dword [ebp + 4]
and eax, 0xf
shl eax, 4
mov ecx, dword [ebp + 4]
and ecx, 0xf00
shr ecx, 8
or eax, ecx
mov ecx, dword [ebp + 4]
and ecx, 0xf0000
shr ecx, 4
or eax, ecx
mov ecx, dword [ebp + 4]
and ecx, 0xf000000
shr ecx, 0x10
or eax, ecx
mov word [ebp - 4], ax
mov eax, dword [ebp - 0x10]
mov cx, word [ebp - 4]
mov word [eax], cx
mov eax, dword [ebp - 0x10]
inc eax
inc eax
mov dword [ebp - 0x10], eax
jmp 0x10001116
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x70]
add ecx, dword [eax + 0x3c]
mov dword [ebp + 0x64], ecx
mov eax, dword [ebp + 0x64]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp + 0x64]
lea eax, [ecx + eax + 0x18]
mov dword [ebp + 0x40], eax
mov eax, dword [0x10008040]
add eax, 0x364
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [0x10008040]
mov eax, dword [eax + 0x380]
mov dword [ebp - 0x48], eax
and dword [ebp - 0x1c], 0
and dword [ebp + 0x50], 0
and dword [ebp + 0x4c], 0
jmp 0x100011d7
mov eax, dword [ebp + 0x4c]
inc eax
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x40]
add eax, 0x28
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x64]
movzx eax, word [eax + 6]
cmp dword [ebp + 0x4c], eax
jge 0x10001497
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
cmp dword [ebp + 0x4c], 0
jne 0x100011fc
mov eax, dword [ebp + 0x40]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x48]
push dword [ebp - 0x34]
call fcn.10001000
pop ecx
pop ecx
mov dword [ebp + 0x24], eax
mov eax, dword [ebp + 0x40]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x24]
sub eax, dword [ebp - 0x5c]
mov dword [ebp + 0x50], eax
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x24]
mov dword [eax + 0xc], ecx
cmp dword [ebp + 0x4c], 0
jne 0x1000126a
mov eax, dword [ebp + 0x64]
mov dword [eax + 0x34], 0x400000
mov eax, dword [ebp + 0x64]
mov dword [eax + 0x38], 0x10000
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x24]
mov dword [eax + 0x2c], ecx
mov eax, dword [ebp + 0x64]
mov eax, dword [eax + 0x28]
add eax, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x64]
mov dword [ecx + 0x28], eax
mov eax, 0x8000
mov ecx, dword [ebp + 0x64]
mov word [ecx + 0x5e], ax
jmp 0x10001465
cmp dword [ebp + 0x4c], 1
jne 0x1000133b
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x24]
mov dword [eax + 0x30], ecx
push 8
pop eax
shl eax, 0
mov ecx, dword [ebp + 0x64]
lea eax, [ecx + eax + 0x78]
mov dword [ebp], eax
mov eax, dword [ebp]
cmp dword [eax + 4], 0
je 0x10001336
mov eax, dword [ebp]
mov eax, dword [eax]
add eax, dword [ebp + 0x50]
mov ecx, dword [ebp]
mov dword [ecx], eax
mov eax, dword [ebp]
push dword [eax]
push dword [ebp + 0x70]
call fcn.100020b4
pop ecx
pop ecx
add eax, dword [ebp + 0x70]
mov dword [ebp + 0x54], eax
jmp 0x100012c7
mov eax, dword [ebp + 0x54]
add eax, 0x14
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x54]
cmp dword [eax + 0xc], 0
je 0x10001336
mov eax, dword [ebp + 0x54]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x54]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 0x54]
mov eax, dword [eax + 0x10]
add eax, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x54]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 0x54]
push dword [eax + 0x10]
push dword [ebp + 0x70]
call fcn.100020b4
pop ecx
pop ecx
add eax, dword [ebp + 0x70]
mov dword [ebp + 0x48], eax
jmp 0x1000130f
mov eax, dword [ebp + 0x48]
add eax, 4
mov dword [ebp + 0x48], eax
mov eax, dword [ebp + 0x48]
cmp dword [eax], 0
je 0x10001334
mov eax, dword [ebp + 0x48]
mov eax, dword [eax]
and eax, 0x80000000
je 0x10001325
jmp 0x10001332
mov eax, dword [ebp + 0x48]
mov eax, dword [eax]
add eax, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x48]
mov dword [ecx], eax
jmp 0x10001306
jmp 0x100012be
jmp 0x10001465
cmp dword [ebp + 0x4c], 3
jne 0x10001465
push 8
pop eax
shl eax, 1
mov ecx, dword [ebp + 0x64]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
add eax, dword [ebp + 0x50]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
push dword [eax]
push dword [ebp + 0x70]
call fcn.100020b4
pop ecx
pop ecx
add eax, dword [ebp + 0x70]
mov dword [ebp + 0x44], eax
mov eax, dword [ebp + 0x44]
add eax, 0x10
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x44]
movzx eax, word [eax + 0xe]
mov ecx, dword [ebp + 0x44]
movzx ecx, word [ecx + 0xc]
add eax, ecx
mov dword [ebp - 0x60], eax
and dword [ebp + 0x1c], 0
jmp 0x1000139f
mov eax, dword [ebp + 0x1c]
inc eax
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x1c]
cmp eax, dword [ebp - 0x60]
jae 0x10001465
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx + eax*8 + 4]
shr eax, 0x1f
and eax, 1
je 0x10001460
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx + eax*8 + 4]
and eax, 0x7fffffff
add eax, dword [ebp + 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0xe]
mov ecx, dword [ebp - 0x18]
movzx ecx, word [ecx + 0xc]
add eax, ecx
mov dword [ebp - 0x70], eax
and dword [ebp + 0x18], 0
jmp 0x100013ff
mov eax, dword [ebp + 0x18]
inc eax
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp - 0x70]
jae 0x10001460
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ecx + eax*8 + 4]
shr eax, 0x1f
and eax, 1
je 0x1000145e
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ecx + eax*8 + 4]
and eax, 0x7fffffff
add eax, dword [ebp + 0x44]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
add eax, 0x10
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 4]
shr eax, 0x1f
and eax, 1
jne 0x1000145e
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp + 0x44]
add ecx, dword [eax + 4]
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
add eax, dword [ebp + 0x50]
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
jmp 0x100013f8
jmp 0x10001398
push dword [ebp - 0x48]
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x24]
add ecx, dword [eax + 8]
push ecx
call fcn.10001000
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x64]
movzx eax, word [eax + 6]
dec eax
cmp dword [ebp + 0x4c], eax
jne 0x10001492
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x50], ecx
jmp 0x100011c7
and dword [ebp + 0x5c], 0
and dword [ebp + 0x68], 0
and dword [ebp + 0x14], 0
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x70]
add ecx, dword [eax + 0x3c]
mov dword [ebp + 0x68], ecx
mov eax, dword [ebp + 0x68]
mov eax, dword [eax + 0x50]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
and dword [ebp + 0x58], 0
push 0
push 0x8000000
push 0x40
lea eax, [ebp - 0x2c]
push eax
push 0
push 0xf001f
lea eax, [ebp + 0x58]
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov dword [ebp + 0x60], eax
cmp dword [ebp + 0x60], 0
jl 0x10001965
and dword [ebp + 0x38], 0
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
and dword [ebp - 0x20], 0
push 4
push 0
push 2
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp + 0x68]
push dword [eax + 0x50]
push 0
lea eax, [ebp + 0x38]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x58]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov dword [ebp + 0x60], eax
cmp dword [ebp + 0x60], 0
jl 0x10001965
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x5c], eax
push dword [ebp + 0x58]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp + 0x58], 0
and dword [ebp + 0x38], 0
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
and dword [ebp - 0x20], 0
push dword [ebp + 0x70]
push dword [ebp + 0x5c]
push dword [ebp + 0x68]
call fcn.10002274
add esp, 0xc
push dword [ebp + 0x70]
call fcn.1000589d
pop ecx
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x5c]
add ecx, dword [eax + 0x3c]
mov dword [ebp + 0x68], ecx
push dword [ebp + 0x68]
call fcn.100023c2
pop ecx
test eax, eax
je 0x10001965
push 0x40
push 0x3000
mov eax, dword [ebp + 0x68]
push dword [eax + 0x50]
call fcn.10005858
add esp, 0xc
mov dword [ebp + 0x14], eax
push dword [ebp + 0x5c]
push dword [ebp + 0x14]
push dword [ebp + 0x68]
call fcn.100021dd
add esp, 0xc
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
add ecx, dword [eax + 0x3c]
mov dword [ebp + 0x68], ecx
mov eax, dword [ebp + 0x68]
mov eax, dword [eax + 0x50]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
push 0
push 0x8400000
push 0x40
lea eax, [ebp - 0x2c]
push eax
push 0
push 0xf001f
lea eax, [ebp + 0x58]
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov dword [ebp + 0x60], eax
cmp dword [ebp + 0x60], 0
jl 0x10001965
push 4
push 0
push 2
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp + 0x68]
push dword [eax + 0x50]
push 0
lea eax, [ebp + 0x38]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x58]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov dword [ebp + 0x60], eax
cmp dword [ebp + 0x60], 0
jl 0x10001965
mov dword [ebp - 0x24], 0x9dfff
mov eax, dword [ebp - 0x24]
add eax, 0x400000
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x5c]
add eax, 0x10000
mov dword [ebp + 0x74], eax
mov eax, dword [ebp + 0x74]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x5c]
sub eax, 0x3f1000
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp + 0x3c]
add eax, 0x4276f3
mov dword [ebp - 0x4c], eax
push 0
push 0x40
push dword [ebp - 0x24]
push dword [ebp + 0x74]
call fcn.100058bf
add esp, 0x10
mov eax, dword [ebp + 0x74]
cmp eax, dword [ebp - 0x68]
jae 0x1000184a
mov eax, dword [ebp - 0x4c]
sub eax, 5
cmp dword [ebp + 0x74], eax
jne 0x100016a1
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x74], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x74]
inc eax
mov dword [ebp + 0x74], eax
xor eax, eax
je 0x100016b9
mov eax, dword [ebp + 0x74]
and dword [eax - 1], 0
xor eax, eax
inc eax
imul eax, eax, 0
mov ecx, dword [ebp + 0x20]
movzx eax, byte [ecx + eax]
cmp eax, 0xff
jne 0x10001726
xor eax, eax
inc eax
shl eax, 0
mov ecx, dword [ebp + 0x20]
movzx eax, byte [ecx + eax]
cmp eax, 0x24
jne 0x10001726
xor eax, eax
inc eax
shl eax, 1
mov ecx, dword [ebp + 0x20]
movzx eax, byte [ecx + eax]
shl eax, 5
movzx eax, al
cmp eax, 0xa0
jne 0x10001726
xor eax, eax
inc eax
imul eax, eax, 6
mov ecx, dword [ebp + 0x20]
movzx eax, byte [ecx + eax]
test eax, eax
jne 0x10001726
mov eax, dword [ebp + 0x74]
mov eax, dword [eax + 2]
add eax, dword [ebp + 0x3c]
mov ecx, dword [ebp + 0x74]
mov dword [ecx + 2], eax
mov eax, dword [ebp + 0x74]
add eax, 7
mov dword [ebp + 0x74], eax
jmp 0x10001845
xor eax, eax
inc eax
imul eax, eax, 0
mov ecx, dword [ebp + 0x20]
movzx eax, byte [ecx + eax]
cmp eax, 0x68
je 0x10001845
mov eax, dword [ebp + 0x74]
and eax, 3
jne 0x10001845
mov eax, dword [ebp - 0x4c]
sub eax, 3
cmp dword [ebp + 0x74], eax
je 0x10001845
mov eax, dword [ebp + 0x74]
movzx eax, word [eax + 2]
sub eax, 0x40
mov word [ebp + 0x34], ax
mov eax, dword [ebp + 0x74]
mov ax, word [eax + 1]
mov word [ebp - 8], ax
movzx eax, word [ebp + 0x34]
shr eax, 8
and eax, 0xff
movzx eax, al
test eax, eax
jne 0x10001845
movzx eax, word [ebp + 0x34]
and eax, 0xf0
jne 0x10001845
movzx eax, word [ebp - 8]
cmp eax, 0x49f0
jg 0x10001845
mov eax, dword [ebp + 0x74]
movzx eax, word [eax + 6]
sub eax, 0x40
mov word [ebp + 0x30], ax
mov eax, dword [ebp + 0x74]
movzx eax, word [eax - 2]
sub eax, 0x40
mov word [ebp + 0x2c], ax
movzx eax, word [ebp + 0x30]
shr eax, 8
and eax, 0xff
movzx eax, al
test eax, eax
jne 0x100017df
movzx eax, word [ebp + 0x30]
and eax, 0xf0
je 0x100017fd
movzx eax, word [ebp + 0x2c]
shr eax, 8
and eax, 0xff
movzx eax, al
test eax, eax
jne 0x10001845
movzx eax, word [ebp + 0x2c]
and eax, 0xf0
jne 0x10001845
mov eax, dword [ebp + 0x74]
mov eax, dword [eax]
add eax, dword [ebp + 0x3c]
mov ecx, dword [ebp + 0x74]
mov dword [ecx], eax
mov eax, dword [ebp + 0x74]
movzx eax, word [eax + 0xa]
sub eax, 0x40
mov word [ebp + 0x28], ax
movzx eax, word [ebp + 0x28]
shr eax, 8
and eax, 0xff
movzx eax, al
test eax, eax
jne 0x10001836
movzx eax, word [ebp + 0x28]
and eax, 0xf0
je 0x10001845
mov eax, dword [ebp + 0x74]
mov eax, dword [eax + 4]
add eax, dword [ebp + 0x3c]
mov ecx, dword [ebp + 0x74]
mov dword [ecx + 4], eax
jmp 0x10001684
mov eax, dword [0x10008040]
mov ecx, dword [ebp + 0x5c]
mov dword [eax + 0x58c], ecx
mov eax, dword [0x10008040]
mov ecx, dword [ebp + 0x3c]
mov dword [eax + 0x590], ecx
push dword [ebp + 0x3c]
call fcn.1000359b
pop ecx
push dword [ebp + 0x5c]
push dword [ebp + 0x38]
push dword [ebp + 0x68]
call fcn.100021dd
add esp, 0xc
push dword [ebp + 0x38]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov dword [ebp + 0x60], eax
cmp dword [ebp + 0x60], 0
jl 0x10001965
push dword [ebp + 0x5c]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov dword [ebp + 0x60], eax
cmp dword [ebp + 0x60], 0
jl 0x10001965
mov eax, dword [ebp + 0x68]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp + 0x68]
lea eax, [ecx + eax + 0x18]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x5c]
mov dword [ebp - 0x50], eax
xor eax, eax
mov word [ebp + 0x6c], ax
jmp 0x100018db
mov ax, word [ebp + 0x6c]
add ax, 1
mov word [ebp + 0x6c], ax
movzx eax, word [ebp + 0x6c]
mov ecx, dword [ebp + 0x68]
movzx ecx, word [ecx + 6]
cmp eax, ecx
jge 0x10001945
movzx eax, word [ebp + 0x6c]
imul eax, eax, 0x28
mov ecx, dword [ebp + 0x10]
push dword [ecx + eax + 0x24]
call fcn.10002161
pop ecx
mov dword [ebp - 0x6c], eax
push dword [ebp - 0x6c]
movzx eax, word [ebp + 0x6c]
imul eax, eax, 0x28
mov ecx, dword [ebp + 0x10]
push dword [ecx + eax + 0xc]
movzx eax, word [ebp + 0x6c]
imul eax, eax, 0x28
mov ecx, dword [ebp + 0x10]
push dword [ecx + eax + 8]
movzx eax, word [ebp + 0x6c]
imul eax, eax, 0x28
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x50]
add edx, dword [ecx + eax + 0xc]
push edx
push dword [ebp + 0x58]
call fcn.1000230b
add esp, 0x14
test eax, eax
jne 0x10001943
jmp 0x10001945
jmp 0x100018cf
push 2
push 0
push 0x1000
push dword [ebp - 0x50]
push dword [ebp + 0x58]
call fcn.1000230b
add esp, 0x14
push dword [ebp + 0x58]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
add ebp, 0x78
leave
ret