Function at 0x10002180
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x5c
mov eax, dword [0x1002d00c]
xor eax, esp
mov dword [esp + 0x58], eax
push ebp
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebp, eax
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x100025b8
push ebx
mov ebx, dword [ebp + 0x3c]
add ebx, ebp
cmp dword [ebx], 0x4550
jne 0x100025b7
push esi
movzx esi, word [ebx + 0x14]
xor eax, eax
add esi, 0x18
push edi
add esi, ebx
xor edi, edi
cmp ax, word [ebx + 6]
jae 0x100021f9
push str..text
push esi
call fcn.1000c19f
add esp, 8
test eax, eax
jne 0x100021ed
test dword [esi + 0x24], 0x20000000
jne 0x100021f9
movzx eax, word [ebx + 6]
inc edi
add esi, 0x28
cmp edi, eax
jl 0x100021d2
mov ebx, dword [esi + 0xc]
mov eax, dword [0x1002eb80]
add ebx, ebp
mov ebp, dword [esi + 0x10]
cmp eax, 6
jne 0x10002357
mov eax, dword [0x1002eb8c]
cmp eax, 1
jne 0x100022ce
push 4
push ebx
mov dword [esp + 0x18], 0x89044889
mov dword [esp + 0x1c], 0x9090a301
mov dword [esp + 0x20], 0x76ff9090
mov byte [esp + 0x24], 0x20
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x100025b5
lea edi, [ebp - 0xd]
xor esi, esi
test edi, edi
js 0x100025b5
mov edx, ebx
nop dword [eax + eax]
cmp byte [edx], 0x89
jne 0x10002280
xor eax, eax
mov cl, byte [esp + eax + 0x11]
inc eax
cmp cl, 0x90
je 0x10002276
cmp byte [edx + eax], cl
jne 0x1000227b
cmp eax, 0xd
jl 0x10002267
cmp eax, 0xd
je 0x10002299
inc esi
inc edx
cmp esi, edi
jle 0x10002260
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.10005a76
add esp, 0x5c
ret
cmp esi, 0xffffffff
je 0x100025b5
mov eax, dword [esi + ebx + 0x11]
mov dword [0x1002eb90], eax
mov eax, dword [esi + ebx + 0x16]
add eax, 0x1a
pop edi
add eax, esi
pop esi
add eax, ebx
pop ebx
mov dword [0x1002eb88], eax
pop ebp
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.10005a76
add esp, 0x5c
ret
cmp eax, 3
jne 0x100025b5
push 4
push ebx
mov dword [esp + 0x18], 0x568bff33
mov dword [esp + 0x1c], 0xe8cb8b20
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x100025b5
lea edi, [ebp - 8]
xor esi, esi
test edi, edi
js 0x100025b5
mov edx, ebx
cmp byte [edx], 0x33
jne 0x10002329
xor eax, eax
nop
mov cl, byte [esp + eax + 0x11]
inc eax
cmp cl, 0x90
je 0x1000231f
cmp byte [edx + eax], cl
jne 0x10002324
cmp eax, 8
jl 0x10002310
cmp eax, 8
je 0x10002342
inc esi
inc edx
cmp esi, edi
jle 0x10002308
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.10005a76
add esp, 0x5c
ret
cmp esi, 0xffffffff
je 0x100025b5
mov eax, dword [esi + ebx + 8]
add eax, 0xc
jmp 0x100025ac
cmp eax, 0xa
jne 0x100025b5
cmp dword [0x1002eb8c], 0
jne 0x100025b5
push 4
push ebx
mov dword [esp + 0x28], 0xfed4858b
mov dword [esp + 0x2c], 0x708bffff
mov dword [esp + 0x30], 0x8bd68b50
mov word [esp + 0x34], 0xe8cb
mov dword [esp + 0x38], 0x8bf8458b
mov dword [esp + 0x3c], 0x50408bce
mov dword [esp + 0x40], 0x4589d08b
mov word [esp + 0x44], 0xe8f0
mov dword [esp + 0x48], 0xff90858b
mov dword [esp + 0x4c], 0x708bffff
mov dword [esp + 0x50], 0x8bd68b50
mov dword [esp + 0x54], 0xffff908d
mov word [esp + 0x58], 0xe8ff
mov dword [esp + 0x18], 0x8bfc458b
mov dword [esp + 0x1c], 0x50708bcf
mov word [esp + 0x20], 0xd68b
mov byte [esp + 0x22], 0xe8
mov dword [esp + 0x5c], 0xff14858b
mov dword [esp + 0x60], 0x708bffff
mov dword [esp + 0x64], 0x8bd68b50
mov dword [esp + 0x68], 0xfffef88d
mov word [esp + 0x6c], 0xe8ff
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x10002456
lea edi, [ebp - 0xe]
xor esi, esi
test edi, edi
js 0x10002456
mov edx, ebx
nop
cmp byte [edx], 0x8b
jne 0x10002450
xor eax, eax
mov cl, byte [esp + eax + 0x21]
inc eax
cmp cl, 0x90
je 0x10002446
cmp byte [edx + eax], cl
jne 0x1000244b
cmp eax, 0xe
jl 0x10002437
cmp eax, 0xe
je 0x10002498
inc esi
inc edx
cmp esi, edi
jle 0x10002430
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x100024ae
lea edi, [ebp - 0xe]
xor esi, esi
test edi, edi
js 0x100024ae
mov edx, ebx
nop
cmp byte [edx], 0x8b
jne 0x10002490
xor eax, eax
mov cl, byte [esp + eax + 0x31]
inc eax
cmp cl, 0x90
je 0x10002486
cmp byte [edx + eax], cl
jne 0x1000248b
cmp eax, 0xe
jl 0x10002477
cmp eax, 0xe
je 0x100024a9
inc esi
inc edx
cmp esi, edi
jle 0x10002470
jmp 0x100024ae
cmp esi, 0xffffffff
je 0x10002456
mov eax, dword [esi + ebx + 0xe]
add eax, 0x12
jmp 0x100025ac
cmp esi, 0xffffffff
jne 0x1000249d
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x100024fa
lea edi, [ebp - 0x12]
xor esi, esi
test edi, edi
js 0x100024fa
mov edx, ebx
cmp byte [edx], 0x8b
jne 0x100024e9
xor eax, eax
nop
mov cl, byte [esp + eax + 0x41]
inc eax
cmp cl, 0x90
je 0x100024df
cmp byte [edx + eax], cl
jne 0x100024e4
cmp eax, 0x12
jl 0x100024d0
cmp eax, 0x12
je 0x100024f1
inc esi
inc edx
cmp esi, edi
jle 0x100024c7
jmp 0x100024fa
cmp esi, 0xffffffff
jne 0x100025a5
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x1000253f
lea edi, [ebp - 0xb]
xor esi, esi
test edi, edi
js 0x1000253f
mov edx, ebx
cmp byte [edx], 0x8b
jne 0x10002539
xor eax, eax
nop word [eax + eax]
mov cl, byte [esp + eax + 0x11]
inc eax
cmp cl, 0x90
je 0x1000252f
cmp byte [edx + eax], cl
jne 0x10002534
cmp eax, 0xb
jl 0x10002520
cmp eax, 0xb
je 0x10002592
inc esi
inc edx
cmp esi, edi
jle 0x10002513
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x100025b5
lea edi, [ebp - 0x12]
xor esi, esi
test edi, edi
js 0x100025b5
mov edx, ebx
cmp byte [edx], 0x8b
jne 0x10002579
xor eax, eax
nop
mov cl, byte [esp + eax + 0x55]
inc eax
cmp cl, 0x90
je 0x1000256f
cmp byte [edx + eax], cl
jne 0x10002574
cmp eax, 0x12
jl 0x10002560
cmp eax, 0x12
je 0x100025a0
inc esi
inc edx
cmp esi, edi
jle 0x10002558
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.10005a76
add esp, 0x5c
ret
cmp esi, 0xffffffff
je 0x1000253f
mov eax, dword [esi + ebx + 0xb]
add eax, 0xf
jmp 0x100025ac
cmp esi, 0xffffffff
je 0x100025b5
mov eax, dword [esi + ebx + 0x12]
add eax, 0x16
add eax, esi
add eax, ebx
mov dword [0x1002eb84], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5c]
pop ebp
xor ecx, esp
call fcn.10005a76
add esp, 0x5c
ret