Function at 0x102a765
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x340
mov eax, dword [0x10413a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, word [esi + 6]
push edi
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x340]
push eax
xor edi, edi
xor ebx, ebx
inc edi
push edi
push 0xb1c
push ebx
mov dword [ebp - 0x320], ebx
mov dword [ebp - 0x334], ebx
mov dword [ebp - 0x338], ebx
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x340], edi
call sub.ntdll.dll_WinSqmAddToStream
movzx eax, word [esi + 6]
cmp ax, 2
je 0x102b4c9
cmp ax, 6
je 0x102b4c9
cmp dword [0x10418bc], 3
jle 0x102a7ee
xor eax, eax
jmp 0x102b4f4
call fcn.010284ad
push 0x1004f58
push 9
lea eax, [ebp - 0x10]
push eax
call fcn.0100e041
movzx eax, word [esi + 6]
mov dword [0x1043650], eax
movzx eax, word [esi + 6]
mov ecx, 0x102
cmp ax, cx
jne 0x102a828
movzx ecx, word [esi + 0x10]
cmp byte [ecx + esi + 4], bl
je 0x102a97d
mov ecx, 0x203
cmp ax, cx
je 0x102a97d
inc ecx
cmp ax, cx
je 0x102a97d
mov ecx, 0x106
cmp ax, cx
je 0x102a97d
inc ecx
cmp ax, cx
je 0x102a97d
movzx eax, word [esi + 0x10]
cmp ax, bx
jbe 0x102a97d
movzx eax, ax
mov edi, 0x1005054
push edi
lea ebx, [eax + esi + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push ebx
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x114]
jne 0x102a8b8
push 0x1005068
push 0x104
push eax
call fcn.0100e041
and dword [ebp - 0x32c], 0
lea eax, [ebp - 0x114]
mov dword [ebp - 0x324], eax
mov edi, 0x104
jmp 0x102a8fa
push ebx
mov edi, 0x104
push edi
push eax
call fcn.0100e041
lea eax, [ebp - 0x114]
push 0x3e
push eax
mov dword [ebp - 0x324], eax
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
mov dword [ebp - 0x32c], eax
test eax, eax
je 0x102a8fa
mov ebx, eax
lea eax, [ebx + 1]
push eax
push 9
lea eax, [ebp - 0x10]
push eax
call fcn.0100e041
mov byte [ebx], 0
push 3
lea eax, [ebp - 0x113]
push 0x1005804
push eax
call dword [sym.imp.msvcrt.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x102a929
lea eax, [ebp - 0x112]
push eax
push edi
lea eax, [ebp - 0x114]
push eax
call fcn.0100e041
cmp byte [ebp - 0x114], 0
je 0x102aa1a
push 0x2e
lea eax, [ebp - 0x114]
push eax
call fcn.0100bd56
test eax, eax
jne 0x102aa1a
lea eax, [ebp - 0x114]
push eax
push edi
push eax
call fcn.0100e041
push 0x1005044
push edi
lea eax, [ebp - 0x114]
push eax
call fcn.0103210b
lea eax, [ebp - 0x114]
mov dword [ebp - 0x324], eax
jmp 0x102aa1a
movzx eax, word [esi + 6]
inc dword [0x10418bc]
cmp eax, 0x96
mov edx, 0x108
jg 0x102aec1
cmp eax, 0x95
jge 0x102b399
cmp eax, 8
jg 0x102ad2c
jne 0x102ab8a
xor ebx, ebx
push ebx
push dword [ebp - 0x320]
push dword [esi + 8]
push 0x10057f0
call fcn.010296c3
xor edi, edi
inc edi
mov dword [0x1043888], edi
cmp dword [0x10438a0], ebx
jne 0x102ad21
push edi
push dword [esi + 8]
push ebx
push dword [ebp - 0x320]
call fcn.01023145
test eax, eax
jne 0x102ad21
push ebx
call fcn.01031099
mov eax, 0x6f19
cmp dword [esi + 8], eax
je 0x102ad05
mov dword [ebp - 0x324], 0x100539c
mov dword [esi + 8], eax
mov edi, 0x104
and dword [ebp - 0x320], 0
call fcn.01011d7f
mov ebx, eax
mov dword [ebp - 0x330], ebx
test ebx, ebx
je 0x102aa5c
mov eax, dword [ebp - 0x324]
cmp byte [eax], 0
jne 0x102aa4a
mov eax, dword [ebx + 0xc]
push dword [eax + 8]
call fcn.01012e56
jmp 0x102aa56
push eax
mov eax, dword [ebx + 0xc]
push dword [eax + 8]
call fcn.010133d8
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
je 0x102aa74
push dword [ebp - 0x320]
call fcn.01012f0b
test eax, eax
jne 0x102aa95
push dword [ebp - 0x320]
call fcn.01007110
push 0xb1
push dword [ebp - 0x324]
call fcn.01013dc4
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
je 0x102aaad
push dword [ebp - 0x320]
call fcn.01012f0b
test eax, eax
jne 0x102ab15
cmp dword [esi], 0
je 0x102ab15
push dword [ebp - 0x320]
call fcn.01007110
push edi
lea eax, [ebp - 0x218]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x102ab15
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.01013892
push 0xc
mov ebx, eax
push edi
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x324]
call fcn.0101354d
lea eax, [ebp - 0x31c]
push eax
push ebx
call fcn.010133d8
push ebx
mov dword [ebp - 0x320], eax
call fcn.01007110
mov ebx, dword [ebp - 0x330]
cmp dword [ebp - 0x320], 0
je 0x102ab31
push dword [ebp - 0x320]
call fcn.01012f0b
test eax, eax
jne 0x102a97d
mov edi, dword [ebp - 0x324]
cmp byte [edi], 0
je 0x102a97d
push dword [ebp - 0x320]
call fcn.01007110
push 1
push edi
call fcn.01013abe
mov dword [ebp - 0x320], eax
test eax, eax
je 0x102ab6b
push eax
call fcn.01012f0b
test eax, eax
jne 0x102a97d
push edi
push 1
push 0x80
call fcn.0102b7c6
test ebx, ebx
jne 0x102a7e7
call fcn.01020814
jmp 0x102a7e7
dec eax
je 0x102aca6
dec eax
dec eax
je 0x102ac52
dec eax
je 0x102ac2a
dec eax
je 0x102abc6
dec eax
dec eax
jne 0x102b4b3
mov eax, dword [0x10437b8]
imul eax, eax, 0x50
push 1
push dword [eax + 0x10438c0]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x102b4b3
push 0
push dword [ebp - 0x320]
push dword [esi + 8]
push 0x10057dc
call fcn.010296c3
call fcn.01011d7f
mov edi, eax
test edi, edi
je 0x102ac04
push dword [ebp - 0x320]
push edi
call fcn.0102c7a9
test eax, eax
je 0x102ac04
push dword [esi + 8]
push edi
call fcn.0101e3c4
jmp 0x102b4b3
mov eax, dword [0x10437b8]
imul eax, eax, 0x50
push dword [eax + 0x10438c0]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x102b4b3
call fcn.0102b535
jmp 0x102b4b3
push 0x10057c8
call fcn.0102965e
mov eax, dword [0x10437b8]
imul eax, eax, 0x50
push dword [eax + 0x10438c4]
call fcn.01011d99
push eax
call fcn.01027e5a
jmp 0x102b4b3
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x320]
push 0x10057b8
call fcn.0102976b
push 1
push 0
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.01028b88
test eax, eax
je 0x102b4b3
and dword [ebp - 0x330], 0
lea eax, [ebp - 0x330]
push eax
push 2
call fcn.0102a310
push 0x400
call fcn.01031099
jmp 0x102b4b3
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x320]
add esi, 8
push dword [esi]
push 0x10057a8
call fcn.010296c3
push 1
push 0
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.01028b88
test eax, eax
je 0x102b4b3
xor eax, eax
inc eax
push esi
push eax
mov dword [0x104386c], eax
call fcn.0102a310
test eax, eax
jne 0x102acf9
push eax
call fcn.01031099
jmp 0x102ab80
and dword [0x104386c], 0
jmp 0x102b4b3
push edi
push 0x81
mov dword [0x1043888], ebx
call fcn.0102b944
mov dword [0x1043888], edi
jmp 0x102ab80
mov dword [0x1043888], ebx
jmp 0x102b4b3
sub eax, 9
je 0x102ae72
dec eax
dec eax
je 0x102ae5a
dec eax
dec eax
je 0x102ae1b
dec eax
je 0x102adf1
dec eax
jne 0x102b4b3
xor edi, edi
mov dword [0x10437b8], edi
call fcn.0102e30e
mov eax, dword [0x10438c0]
cmp eax, edi
je 0x102ad71
push edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor ebx, ebx
inc ebx
push 0x104367c
mov dword [0x1043768], ebx
call fcn.01012ee8
push dword [ebp - 0x320]
call fcn.010134ed
push ebx
mov dword [0x104367c], eax
push edi
lea eax, [ebp - 0x320]
push eax
push 0x1004f54
call fcn.01028b88
test eax, eax
je 0x102afaa
cmp dword [0x1043624], edi
jne 0x102adcf
push edi
push edi
push dword [0x104367c]
call fcn.01035155
push dword [0x10438c4]
call fcn.01011d48
mov dword [0x1043768], edi
cmp word [esi + 6], 0xf
jne 0x102ade7
mov eax, dword [esi + 8]
add eax, 3
mov dword [0x1043790], eax
call fcn.0100d918
jmp 0x102b4b3
call fcn.01032364
xor esi, esi
push esi
push esi
push dword [ebp - 0x320]
call fcn.01035155
cmp dword [0x1043624], esi
jne 0x102aeb1
call fcn.01020814
jmp 0x102aeb1
movsx eax, word [esi + 8]
mov dword [0x1043698], eax
movsx ecx, word [esi + 0xa]
push ecx
push eax
push 0x100578c
lea eax, [ebp - 0x1dc]
push 0xc8
push eax
mov dword [0x104369c], ecx
call fcn.01007bcb
add esp, 0x14
lea eax, [ebp - 0x1dc]
push eax
call fcn.0102965e
jmp 0x102b4b3
xor edi, edi
push edi
push dword [ebp - 0x320]
push 0x1005780
call fcn.0102976b
jmp 0x102ad55
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x320]
push 0x1005770
call fcn.0102976b
lea eax, [ebp - 0x10]
push eax
call fcn.0102e491
push eax
call fcn.01011d99
test eax, eax
je 0x102ac66
push dword [ebp - 0x320]
push eax
call fcn.0102c7a9
test eax, eax
je 0x102ac66
push dword [ebp - 0x320]
call fcn.01007110
jmp 0x102b4b3
cmp eax, 0x107
jg 0x102b034
cmp eax, 0x106
jge 0x102aff0
cmp eax, 0x101
je 0x102afdc
mov ecx, 0x102
cmp eax, ecx
je 0x102af1b
jle 0x102b4b3
cmp eax, 0x104
jle 0x102b399
cmp eax, 0x105
jne 0x102b4b3
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x320]
push 0x1005760
jmp 0x102b181
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x320]
push 0x1005750
call fcn.0102976b
push 0x100574c
call fcn.0102965e
movzx eax, word [esi + 0x12]
lea eax, [eax + esi + 4]
push eax
call fcn.0102965e
push 0x1005084
call fcn.0102965e
xor edi, edi
mov dword [0x1043858], 1
cmp dword [0x1043624], edi
jne 0x102af72
push edi
push edi
push dword [ebp - 0x320]
call fcn.01035155
movzx eax, word [esi + 0x12]
push 4
lea eax, [eax + esi + 4]
push eax
push 0x1005744
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x102afb4
movzx eax, word [esi + 0x12]
movzx eax, byte [eax + esi + 8]
sub eax, 0x31
push 0xf
mov dword [esi + 8], eax
pop eax
mov word [esi + 6], ax
jmp 0x102ad55
call fcn.01020814
jmp 0x102b4b3
push 0x104367c
call fcn.01012ee8
mov eax, dword [ebp - 0x320]
mov dword [0x104367c], eax
movzx eax, word [esi + 0x12]
lea eax, [eax + esi + 4]
push eax
call fcn.0100916e
jmp 0x102b4b3
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x320]
push 0x1005738
jmp 0x102b181
movzx eax, word [esi + 0x12]
lea edi, [eax + esi + 4]
movsx eax, word [edi]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x102b4b3
push edi
push 2
lea eax, [ebx + 0xc]
push eax
call fcn.0100e041
mov eax, 0x107
push ebx
cmp word [esi + 6], ax
jne 0x102b02d
push 1
jmp 0x102b13c
push 2
jmp 0x102b13c
cmp eax, edx
je 0x102b399
cmp eax, 0x201
je 0x102b172
cmp eax, 0x202
je 0x102b146
add eax, 0xfffffdfd
cmp eax, 1
ja 0x102b4b3
push 0x1005724
call fcn.0102965e
movzx eax, word [esi + 0x12]
lea edi, [eax + esi + 4]
xor ebx, ebx
lea eax, [edi + 0x18]
cmp word [edi + 2], bx
je 0x102b080
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0xe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
jne 0x102b0af
push dword [0x10413bc]
push 1
push 0x10056d8
call fcn.0103d72e
jmp 0x102a7e7
cmp word [edi + 2], bx
je 0x102b0c5
movsx eax, word [edi]
push eax
push edi
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x102b0fc
mov ax, word [edi + 4]
mov word [esi + 2], ax
mov ax, word [edi + 8]
mov word [esi + 4], ax
mov ax, word [edi + 0xc]
mov word [esi + 6], ax
mov ax, word [edi + 0x10]
mov word [esi + 8], ax
mov ax, word [edi + 0x14]
add edi, 0x18
push edi
mov word [esi + 0xa], ax
push 2
lea eax, [esi + 0xc]
push eax
call fcn.0100e041
movsx eax, word [esi + 8]
push eax
movsx eax, word [esi + 6]
push eax
movsx eax, word [esi + 4]
push eax
movsx eax, word [esi + 2]
push eax
lea eax, [esi + 0xc]
push eax
push 0x10056c0
lea eax, [ebp - 0x1dc]
push 0xc8
push eax
call fcn.01007bcb
add esp, 0x20
lea eax, [ebp - 0x1dc]
push eax
call fcn.0102965e
push esi
push 3
call fcn.0102e532
jmp 0x102b4b3
push 1
push 0
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.01028b88
test eax, eax
je 0x102b4ac
movzx eax, word [esi + 0x12]
lea eax, [eax + esi + 6]
push eax
push 3
jmp 0x102b4a7
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x320]
push 0x10056b0
call fcn.0102976b
xor ebx, ebx
cmp dword [ebp - 0x320], ebx
jne 0x102b1be
cmp dword [ebp - 0x324], ebx
je 0x102b1af
push dword [ebp - 0x324]
push 1
push 0x80
call fcn.0102b7c6
jmp 0x102b4b3
push 0x8a
call fcn.01022b3c
jmp 0x102b4b3
push dword [ebp - 0x320]
call fcn.010134ed
push 0x104367c
mov dword [ebp - 0x334], eax
call fcn.01012ee8
push dword [ebp - 0x334]
call fcn.010134ed
push dword [0x10438c0]
mov dword [0x104367c], eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x102b22a
push 0x1004f58
call fcn.0102e491
push eax
call fcn.01011d99
cmp eax, ebx
je 0x102b22a
push dword [ebp - 0x320]
push eax
call fcn.0102c7a9
test eax, eax
jne 0x102b22a
push ebx
push dword [0x10438c0]
call dword [sym.imp.USER32.dll_ShowWindow]
xor edi, edi
inc edi
mov dword [0x1043768], edi
call fcn.01011d7f
cmp dword [0x1043624], ebx
je 0x102b25e
cmp eax, ebx
je 0x102b254
push dword [ebp - 0x320]
push eax
call fcn.0102c7a9
test eax, eax
jne 0x102b25e
call fcn.01020a58
call fcn.01032364
push edi
push ebx
lea eax, [ebp - 0x320]
push eax
push 0x1004f58
call fcn.01028b88
mov dword [0x1043768], ebx
cmp dword [0x1043624], ebx
jne 0x102b28c
push ebx
push edi
push dword [ebp - 0x320]
call fcn.01035155
lea eax, [ebp - 0x320]
push eax
call fcn.01012ee8
movzx eax, word [esi + 0x12]
lea edi, [eax + esi + 4]
mov eax, 0x201
cmp word [esi + 6], ax
jne 0x102b2d1
cmp word [edi + 2], bx
je 0x102b2b9
mov al, byte [edi + 2]
add edi, 3
jmp 0x102b2bf
mov al, byte [edi + 4]
add edi, 5
movzx eax, al
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov byte [ebp - 0x324], al
jmp 0x102b2f8
push edi
push 0x100
mov ebx, 0x1041b88
push ebx
mov byte [ebp - 0x324], 0x4b
call fcn.0100e041
push 0x3b
push ebx
call fcn.0100bd56
test eax, eax
je 0x102b2f8
mov byte [eax], 0
push 0x10056ac
call fcn.0102965e
push edi
call fcn.0102965e
push 0x10056a8
call fcn.0102965e
cmp byte [edi], 0
je 0x102b356
movzx eax, word [esi + 6]
mov ecx, 0x105
cmp ax, cx
je 0x102b333
mov ecx, 0x201
cmp ax, cx
je 0x102b333
xor eax, eax
jmp 0x102b336
push 0x10
pop eax
push dword [ebp - 0x32c]
or eax, 9
push dword [ebp - 0x324]
push 0
push eax
push edi
call fcn.010397d1
test eax, eax
jne 0x102b4b3
mov eax, 0x201
cmp word [esi + 6], ax
jne 0x102b36b
push 0x41d
jmp 0x102b1b4
xor esi, esi
inc esi
mov dword [0x1043790], esi
call fcn.0103668a
xor ecx, ecx
cmp dword [0x1043624], ecx
je 0x102b38b
cmp dword [0x104379c], ecx
jne 0x102b38d
mov ecx, esi
push ecx
push eax
call fcn.0102508f
jmp 0x102b4b3
movzx eax, word [esi + 6]
mov edi, 0x103
mov ecx, edi
cmp ax, cx
je 0x102b3c5
inc ecx
cmp ax, cx
je 0x102b3c5
cmp ax, dx
je 0x102b3c5
mov eax, dword [esi + 8]
mov ebx, dword [ebp - 0x338]
mov dword [ebp - 0x328], eax
jmp 0x102b3ec
movzx eax, word [esi + 0x12]
lea ebx, [eax + esi + 4]
push ebx
call fcn.0100d44a
test eax, eax
je 0x102b3e5
push ebx
call fcn.0100d46c
mov dword [ebp - 0x328], eax
jmp 0x102b3ec
and dword [ebp - 0x328], 0
movzx eax, word [esi + 6]
cmp ax, di
je 0x102b421
mov ecx, 0x95
cmp ax, cx
je 0x102b421
add ecx, 0x73
cmp ax, cx
je 0x102b421
push 5
push dword [ebp - 0x328]
push 0
push dword [ebp - 0x320]
call fcn.01023145
jmp 0x102b4ac
cmp dword [0x1041760], 2
jne 0x102b486
mov ecx, 0x95
cmp ax, cx
jne 0x102b43a
mov ebx, dword [ebp - 0x328]
cmp dword [0x10436a8], 1
je 0x102b45e
mov eax, dword [0x10436c0]
test eax, eax
je 0x102b45e
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x102b45e
mov eax, dword [0x10436c0]
jmp 0x102b460
xor eax, eax
movzx ecx, word [esi + 6]
push ebx
push ecx
push dword [ebp - 0x320]
push eax
call dword [sym.imp.USER32.dll_WinHelpA]
lea eax, [ebp - 0x320]
push eax
call fcn.01012ee8
call fcn.01020814
jmp 0x102b4ac
push 1
push 0
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.01028b88
test eax, eax
je 0x102b4ac
lea eax, [ebp - 0x328]
push eax
push 5
call fcn.0102a310
and dword [0x1041c98], 0
push dword [ebp - 0x334]
dec dword [0x10418bc]
call fcn.01007110
xor eax, eax
inc eax
jmp 0x102b4f4
push 0x100569c
call fcn.0102965e
cmp dword [0x1043894], ebx
jne 0x102b4f2
push ebx
call fcn.010242e2
test eax, eax
jge 0x102b4ed
cmp dword [0x10438c0], ebx
je 0x102b4f2
call fcn.01020814
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0103d1ec
leave
ret 4