Function at 0x1002d88d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081bae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002d8d7
push 0x20a3
push 0x870
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x1002dee7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x14], eax
push 2
lea ecx, [ebp - 0x48]
call fcn.1001610f
and dword [ebp - 4], 0
mov dword [ebp - 0x8c], 0xb3e7
push 3
lea ecx, [ebp - 0xe0]
call fcn.1001610f
mov byte [ebp - 4], 1
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x78], 0xffffffff
push 0x637f
push 0x233d
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10028d5a
add esp, 0x14
mov dword [ebp - 0x10], 0
jmp 0x1002d976
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002d98c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb0], 7
jmp 0x1002d96f
mov dword [ebp - 0x10], 0
jmp 0x1002d99c
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002d9b8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe0]
call fcn.100161ad
mov dword [eax], 0x50d8af87
jmp 0x1002d995
push 0
lea ecx, [ebp - 0x48]
call fcn.100161ad
cmp dword [eax], 0
je 0x1002da88
push 0
lea ecx, [ebp - 0x48]
call fcn.100161ad
mov esi, eax
push 0
lea ecx, [ebp - 0x48]
call fcn.100161ad
mov ecx, dword [esi]
imul ecx, dword [eax]
test ecx, ecx
je 0x1002da02
push 1
lea ecx, [ebp - 0x48]
call fcn.100161ad
cmp dword [eax], 0
je 0x1002da02
mov dword [ebp - 0x6c], 1
jmp 0x1002da06
and dword [ebp - 0x6c], 0
push 0
lea ecx, [ebp - 0x48]
call fcn.100161ad
mov ecx, dword [ebp - 0x6c]
add ecx, dword [eax]
jne 0x1002da21
push 0
lea ecx, [ebp - 0x48]
call fcn.100161ad
mov esi, dword [ebp - 0x8c]
push 1
lea ecx, [ebp - 0x48]
call fcn.100161ad
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x48]
call fcn.100161ad
cmp esi, dword [eax]
jne 0x1002da4a
mov dword [ebp - 0x58], 1
jmp 0x1002da4e
and dword [ebp - 0x58], 0
push 0
lea ecx, [ebp - 0x48]
call fcn.100161ad
mov eax, dword [eax]
sub eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x8c]
imul eax, eax, 6
mov dword [ebp - 0x80], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x80]
mov dword [ebp + eax - 0xb0], ecx
cmp dword [ebp - 0x80], 0
je 0x1002da88
mov dword [ebp - 0x60], 1
jmp 0x1002da8c
and dword [ebp - 0x60], 0
push 2
lea ecx, [ebp - 0xe0]
call fcn.100161ad
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe0]
call fcn.10016191
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10016191
and dword [ebp - 0x34], 0
jmp 0x1002dad6
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
add eax, 0x28
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x34], eax
jge 0x1002dee7
push 2
lea ecx, [ebp - 0xc0]
call fcn.1001610f
mov dword [ebp - 4], 2
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x2c], 0
jmp 0x1002db1d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002db39
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xc0]
call fcn.100161ad
mov dword [eax], 0xfffffffe
jmp 0x1002db16
mov dword [ebp - 0x1c], 1
jmp 0x1002db49
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1002db7f
push 0x1a16
push 0
push 0xbea
push 0x33d7
call fcn.10030978
add esp, 0x10
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xc0]
call fcn.100161ad
cmp dword [eax], 0
je 0x1002db7d
jmp 0x1002db42
jmp 0x1002db42
push 1
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x6c33
call fcn.10028e04
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.10016191
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x10], 0
jne 0x1002dbe9
push 1
push 0x1861
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0xa0]
push 0x4f25
push 0x1ab0
push dword [ebp - 0x84]
push dword [ebp - 0x14]
call fcn.10025a8d
add esp, 0x20
jmp 0x1002dac6
mov dword [ebp - 0x20], 0xd59e57ad
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x110], 9
mov dword [ebp - 0x7c], 0xfffffffb
or dword [ebp - 0xd4], 0xffffffff
or dword [ebp - 0xd0], 0xffffffff
or dword [ebp - 0xcc], 0xffffffff
or dword [ebp - 0xc8], 0xffffffff
lea ecx, [ebp - 0x49]
call fcn.10008f33
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0x118]
call fcn.100161bc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf8]
call fcn.1001616b
mov dword [ebp - 4], 3
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x30], 0
jmp 0x1002dc7e
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1002dc94
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x100], 0xe2db
jmp 0x1002dc77
mov dword [ebp - 0x20], 0
jmp 0x1002dca4
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x1002de5d
mov dword [ebp - 0xb4], 0xffffffff
mov dword [ebp - 0xa4], 0x22e974a5
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x88], 0xfffffffe
mov dword [ebp - 0x68], 0x1e01b17d
mov dword [ebp - 0x104], 0xfffffffb
push 1
lea ecx, [ebp - 0xec]
call fcn.1001610f
mov byte [ebp - 4], 4
mov dword [ebp - 0x94], 0x36a5b5cf
mov dword [ebp - 0x90], 0x83e7
mov dword [ebp - 0x28], 0
jmp 0x1002dd1c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1002dd38
push dword [ebp - 0x28]
lea ecx, [ebp - 0xec]
call fcn.100161ad
mov dword [eax], 0x42206dd2
jmp 0x1002dd15
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x15]
push eax
push 0
push 0x55ef
push 0x7b68
push 0x538
push 0x1bc9
push 0x77d1
call fcn.10028f3b
add esp, 0x1c
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x70], eax
push 1
lea ecx, [ebp - 0xf8]
call fcn.100161ad
mov ecx, dword [ebp - 0x70]
mov dword [eax], ecx
cmp dword [ebp - 0x70], 4
jne 0x1002dd9d
mov dword [ebp - 0x54], 1
jmp 0x1002dda1
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x54], eax
jle 0x1002ddb5
mov dword [ebp - 0x5c], 1
jmp 0x1002ddb9
and dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x38]
inc edx
mov dword [ebp - 0x38], edx
cmp eax, ecx
jg 0x1002dde3
cmp dword [ebp - 0xa4], 0
je 0x1002dde3
mov dword [ebp - 0x64], 1
jmp 0x1002dde7
and dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x1002de02
cmp dword [ebp - 0xb4], 0
jne 0x1002de02
and dword [ebp - 0x74], 0
jmp 0x1002de09
mov dword [ebp - 0x74], 1
cmp dword [ebp - 0x74], 0x576c
jge 0x1002de2d
push 0
lea ecx, [ebp - 0xec]
call fcn.100161ad
cmp dword [eax], 0
jne 0x1002de2d
and dword [ebp - 0xac], 0
jmp 0x1002de37
mov dword [ebp - 0xac], 1
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xec]
call fcn.10016191
jmp 0x1002dc9d
lea eax, [ebp - 0x20]
push eax
push 0
push 0x6b01
lea eax, [ebp - 0xf8]
push eax
push 0x1fa
call fcn.1002c7e5
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8]
call fcn.10016191
push 4
push 0x1000
mov eax, dword [ebp - 0x14]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x84]
add ecx, dword [eax + 0xc]
push ecx
push 0x5448
push 0x44fa
call fcn.10025006
pop ecx
pop ecx
call eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x98]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x3c]
call fcn.10025090
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 8], ecx
jmp 0x1002dac6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret