Function at 0x10002280
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov ecx, dword [ebp + 0x10]
movzx ebx, word [ebp + 0x18]
movsx esi, word [ebp + 0xc]
test ecx, ecx
je 0x100023e0
lea edi, [ebx*4]
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov dword [esp + 8], edi
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x14], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x10], eax
call eax
mov edx, dword [ebp + 0x14]
sub esp, 0xc
test edx, edx
je 0x10002420
mov edx, dword [ebp - 0x14]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [ebp - 0x18], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
call eax
mov ecx, dword [ebp - 0x18]
sub esp, 0xc
mov edi, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ecx
mov dword [ebp - 0x10], ecx
mov dword [esp + 4], esi
mov dword [esp + 0x10], ebx
mov dword [esp], eax
call dword [sym.imp.shell32.dll_ExtractIconExA]
mov ecx, dword [ebp - 0x10]
sub esp, 0x14
mov esi, eax
test ecx, ecx
je 0x10002381
xor ebx, ebx
test esi, esi
jle 0x1000235d
mov dword [ebp - 0x10], edi
mov edi, ecx
lea esi, [esi]
nop
mov edx, dword [edi + ebx*4]
xor eax, eax
call dbg.convert_icon_to_16
mov ecx, dword [ebp + 0x10]
mov word [ecx + ebx*2], ax
add ebx, 1
cmp ebx, esi
jne 0x10002340
mov ecx, edi
mov edi, dword [ebp - 0x10]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
test edi, edi
je 0x100023cc
xor ebx, ebx
test esi, esi
jle 0x100023a8
lea esi, [esi]
nop
mov edx, dword [edi + ebx*4]
xor eax, eax
call dbg.convert_icon_to_16
mov ecx, dword [ebp + 0x14]
mov word [ecx + ebx*2], ax
add ebx, 1
cmp ebx, esi
jne 0x10002390
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x10002460
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], ebx
mov dword [esp + 4], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.shell32.dll_ExtractIconExA]
mov esi, eax
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret 0x14
mov dword [esp + 8], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp], eax
call dword [sym.imp.shell32.dll_ExtractIconExA]
mov ecx, dword [ebp - 0x10]
sub esp, 0x14
mov esi, eax
test ecx, ecx
je 0x100023cc
xor edi, edi
jmp 0x1000232d
lea edx, [ebx*4]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.shell32.dll_ExtractIconExA]
sub esp, 0x14
mov esi, eax
jmp 0x10002381