Function at 0x1000b9a0
Capabilities:
Enumerate pe sections
Parse pe header
Read file on windows

Disassembly:
mov eax, 0x1810
call fcn.100089d0
mov eax, dword [0x1001a1a0]
xor eax, esp
mov dword [esp + 0x180c], eax
mov eax, dword [esp + 0x1814]
mov ecx, dword [esp + 0x1824]
push 0x400
lea edx, [esp + 0x1010]
push edx
push eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1000b9ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [esp + 0x180c]
xor ecx, esp
call fcn.10001f35
add esp, 0x1810
ret
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x1028]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000ba55
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IOjuHZcS0kMr576WR16MoDKdhzlpK6zQZ3N6vgdd59gwtvxtoz3XRmHtfvNrHzRf1a_rDf4
push 0
call fcn.1000b050
add esp, 0xc
xor eax, eax
pop edi
mov ecx, dword [esp + 0x180c]
xor ecx, esp
call fcn.10001f35
add esp, 0x1810
ret
push 0x1000
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.10002160
add esp, 0xc
push 0
lea edx, [esp + 8]
push edx
push 0x1000
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000baba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Hbga0VEX5KyjUEWngDyHkTlqDpCERVw_jRZZxfc1v85toz3XRmHtfvNyEmQDoJ2FxWMc
push 0
call fcn.1000b050
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
mov ecx, dword [esp + 0x180c]
xor ecx, esp
call fcn.10001f35
add esp, 0x1810
ret
cmp dword [esp + 4], 0x1000
je 0x1000bacb
push str.GQPFr6R6V4eBNp6FKnIno5FTRX6rEmWB1T2nymXmeMJUKPVz9i0adR3VrtlCg
jmp 0x1000baf5
mov ecx, 0x5a4d
cmp word [esp + 0x10], cx
je 0x1000bade
push str.GQPFr6R6V4eBNp6FKnIno5FTRX6rEmWB3zOniwHFTpFPbeB_8jFmL3ZXtQ
jmp 0x1000baf5
mov ecx, dword [esp + 0x4c]
cmp dword [esp + ecx + 0x10], 0x4550
lea ecx, [esp + ecx + 0x10]
je 0x1000bb1e
push str.FotyVJW9NYywPWkMg59JU36oN1nV0AHzxSrPf9zKOl9idfMyrnwWmR
push 0
call fcn.1000b050
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
mov ecx, dword [esp + 0x180c]
xor ecx, esp
call fcn.10001f35
add esp, 0x1810
ret
push ebx
mov ebx, dword [ecx + 0x78]
test ebx, ebx
jne 0x1000bb54
push str.FotyVJW9NYywPWkMg59JU36oN1nV0AHz2TPrPdhUKLE3ty1VYRD8r4ixE1SvEJ2DP7RSnHSZXAZBg8
push ebx
call fcn.1000b050
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop edi
mov ecx, dword [esp + 0x180c]
xor ecx, esp
call fcn.10001f35
add esp, 0x1810
ret
mov edx, dword [ecx + 0x7c]
movzx eax, word [ecx + 0x14]
push ebp
push esi
movzx esi, word [ecx + 6]
mov dword [esp + 0x14], edx
xor edx, edx
lea eax, [eax + ecx + 0x18]
test esi, esi
jle 0x1000bb88
nop
mov ecx, dword [eax + 0xc]
cmp ebx, ecx
jb 0x1000bb80
mov ebp, dword [eax + 8]
add ebp, ecx
cmp ebx, ebp
jbe 0x1000bb8f
inc edx
add eax, 0x28
cmp edx, esi
jl 0x1000bb70
push str.E7q1Np6MPns5lIRic3CyIVnW9T2nyhiqeMlXZ_NvtzBfIgLgroXlFFS1EJ6UOr6HYnq2tOI
jmp 0x1000bbbb
mov ecx, dword [eax + 0x14]
sub ecx, dword [eax + 0xc]
push 0
push 0
add ecx, ebx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [esp + 0x14]
push ebp
call fcn.100022ab
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000bbd3
push str.LpM6IuW7R1ecutd6RtY04cgPpzzARAWip7VYEYCeP4WgeHsrmJxBZR9UVw
push 0
call fcn.1000b050
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1000bcf1
push ebp
push 0
push esi
call fcn.10002160
add esp, 0xc
push 0
lea edx, [esp + 0x14]
push edx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000bc1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.D5gfeD6lkJyeqs1Ss7cDrLcAetp0Hoo0372J3woGuzpwuUcWqhcnZ99MZLPepXHlbQ
push 0
call fcn.1000b050
push esi
call fcn.10001f2a
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1000bcf1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, dword [esp + 0x10]
je 0x1000bc46
push str.DBG2lVBOebkAXdX3LrzGFtq9UZ84Ea3J1s1F6mtjrYJG7VYmZVvooZPYdNKanwctjO1HL8
push 0
call fcn.1000b050
push esi
call fcn.10001f2a
add esp, 0xc
xor eax, eax
jmp 0x1000bcf1
mov edi, dword [esi + 0x1c]
mov eax, dword [esp + 0x1828]
sub edi, ebx
add edi, esi
cmp dword [esp + 0x1830], 0
mov ebx, dword [edi + eax*4]
mov dword [esp + 0x14], ebx
jne 0x1000bc6f
push esi
call fcn.10001f2a
mov eax, ebx
jmp 0x1000bcee
mov ebp, dword [esp + 0x182c]
push 4
add ebp, ebp
push 0x1000
add ebp, ebp
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1000bcb3
push esi
call fcn.10001f2a
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.pfh7wc0W1X4LhinyVzfvmLZCeICGMreLENIxVJp7Vr7L1UkW6ylfe1LVth49BiHmtcSJBYI
push ebx
call fcn.1000b050
add esp, 0x10
xor eax, eax
jmp 0x1000bcf1
push ebp
push 0
push ebx
call fcn.10002160
xor ecx, ecx
add esp, 0xc
cmp dword [esi + 0x14], ecx
jbe 0x1000bcde
mov eax, ebx
sub edi, ebx
lea ebx, [ebx]
mov edx, dword [edi + eax]
mov dword [eax], edx
inc ecx
add eax, 4
cmp ecx, dword [esi + 0x14]
jb 0x1000bcd0
push esi
call fcn.10001f2a
mov eax, dword [esp + 0x1c]
mov dword [eax], ebx
mov eax, dword [esp + 0x18]
add esp, 4
mov ecx, dword [esp + 0x181c]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
call fcn.10001f35
add esp, 0x1810
ret