Function at 0x10002600
Capabilities:
Enumerate pe sections
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x68
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sym._MapSL_4
test eax, eax
push ebx
je 0x100027f8
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x64], 0x4c
mov ax, word [ebx + 4]
mov dword [ebp - 0x60], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym._MapSL_4
mov dword [ebp - 0x58], eax
push ecx
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sym._MapSL_4
mov dword [ebp - 0x54], eax
push edi
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call sym._MapSL_4
mov dword [ebp - 0x48], eax
push edx
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call sym._MapSL_4
mov dword [ebp - 0x40], eax
push ecx
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sym._MapSL_4
mov dword [ebp - 0x38], eax
push edi
xor edi, edi
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sym._MapSL_4
mov dword [ebp - 0x34], eax
push edx
mov eax, dword [ebx + 0x30]
and eax, 0xffffff9f
or eax, 0x20
mov dword [ebp - 0x30], eax
mov ax, word [ebx + 0x34]
mov word [ebp - 0x2c], ax
mov ax, word [ebx + 0x36]
mov word [ebp - 0x2a], ax
mov eax, dword [ebx + 0x38]
mov dword [esp], eax
call sym._MapSL_4
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], dbg.dummy_hook
push ecx
mov eax, dword [ebx + 0x30]
test al, 0x40
jne 0x10002750
test al, 0x20
jne 0x10002740
lea eax, [ebp - 0x64]
mov dword [esp], eax
call dword [sym.imp.comdlg32.dll_GetSaveFileNameA]
mov esi, eax
test eax, eax
push edx
jne 0x10002728
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [ebp - 0x4c]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov word [ebx + 0x34], ax
mov ax, word [ebp - 0x2a]
mov word [ebx + 0x36], ax
jmp 0x100026f6
mov eax, dword [ebx + 0x40]
call sym._alloc_hook
mov dword [ebp - 0x20], eax
jmp 0x100026e3
mov eax, dword [ebx + 0x44]
xor edi, edi
mov dword [esp], eax
call sym._MapSL_4
push edx
mov dword [esp + 4], eax
mov dword [esp + 8], 5
xor eax, eax
mov ax, word [ebx + 6]
mov dword [esp], eax
call sym._FindResource16_12
sub esp, 0xc
mov di, ax
xor eax, eax
mov dword [esp + 4], edi
mov ax, word [ebx + 6]
mov dword [esp], eax
call sym._LoadResource16_8
mov esi, eax
xor eax, eax
push ecx
and esi, 0xffff
push ecx
mov dword [esp + 4], edi
mov ax, word [ebx + 6]
mov dword [esp], eax
call sym._SizeofResource16_8
mov dword [ebp - 0x68], eax
push edi
push edi
mov dword [esp], esi
call sym._LockResource16_4
mov edi, eax
test eax, eax
push edx
je 0x100027d9
mov edx, dword [ebp - 0x68]
call dbg.convert_dialog
mov edi, eax
test eax, eax
je 0x100027d9
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x30]
or al, 0x80
mov dword [ebp - 0x30], eax
mov dword [esp], esi
call sym._FreeResource16_4
push ecx
mov eax, dword [ebx + 0x30]
test al, 0x20
je 0x100026e3
jmp 0x10002740
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 4