Function at 0x4016a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows
Inspect section memory permissions
Parse pe header

Disassembly:
mov eax, 0x103c
call fcn.00403820
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1050]
test edi, edi
je 0x401974
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0x40
push edi
call esi
cmp eax, 1
je 0x401974
cmp word [edi], 0x5a4d
jne 0x401974
mov ebx, dword [edi + 0x3c]
push 0xf8
add ebx, edi
push ebx
call esi
cmp eax, 1
je 0x401974
cmp dword [ebx], 0x4550
jne 0x401974
cmp word [ebx + 0x14], 0xe0
jne 0x401974
cmp word [ebx + 0x18], 0x10b
jne 0x401974
mov cx, word [ebx + 6]
cmp cx, 1
jb 0x401974
mov eax, ecx
lea edx, [ebx + 0xf8]
and eax, 0xffff
xor esi, esi
mov dword [esp + 0x18], esi
lea ebp, [eax + eax*4]
shl ebp, 3
sub ebp, edi
add ebp, edx
cmp cx, si
mov dword [esp + 0x24], ebp
mov dword [esp + 0x10], ebp
jbe 0x4017c0
mov dword [esp + 0x1c], esi
lea edi, [edx + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 4]
mov ecx, dword [edi]
add ecx, eax
mov eax, dword [esp + 0x10]
cmp eax, ecx
jae 0x40176c
mov dword [esp + 0x10], ecx
mov esi, str..rsrc
lea ecx, [edi - 0xc]
mov al, byte [ecx]
mov dl, al
cmp al, byte [esi]
jne 0x401798
test dl, dl
je 0x401794
mov al, byte [ecx + 1]
mov dl, al
cmp al, byte [esi + 1]
jne 0x401798
add ecx, 2
add esi, 2
test dl, dl
jne 0x401774
xor ecx, ecx
jmp 0x40179d
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x4017a9
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
inc edx
add edi, 0x28
dec eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
jne 0x401759
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
mov eax, edi
xor edx, edx
div ecx
xor edx, edx
mov esi, eax
mov eax, edi
div ecx
mov dword [esp + 0x14], esi
test edx, edx
je 0x4017ee
inc esi
mov dword [esp + 0x14], esi
imul ecx, esi
push 0x40
push 0x1000
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
mov dword [esp + 0x1054], edi
je 0x401974
mov eax, dword [esp + 0x1050]
push ebp
push eax
push edi
call fcn.004034e0
xor esi, esi
add esp, 0xc
cmp word [ebx + 6], si
jbe 0x401866
mov ebp, dword [esp + 0x1050]
mov eax, esi
and eax, 0xffff
lea ecx, [eax + eax*4]
lea eax, [ebx + 0xf8]
mov edx, dword [eax + ecx*8 + 0x10]
lea eax, [eax + ecx*8]
push edx
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
add ecx, ebp
add edx, edi
push ecx
push edx
call fcn.004034e0
add esp, 0xc
inc esi
cmp si, word [ebx + 6]
jb 0x401833
mov ebx, dword [edi + 0x3c]
mov esi, dword [esp + 0x18]
add ebx, edi
mov dword [0x40b1b8], edi
test esi, esi
mov dword [esp + 0x10], ebx
je 0x4018ac
call fcn.00401b80
cmp eax, 1
jne 0x4018ac
mov ecx, dword [esp + 0x1050]
lea eax, [esi + esi*4]
mov esi, dword [ebx + eax*8 + 0x104]
lea eax, [ebx + eax*8 + 0xf8]
add esi, ecx
mov dword [eax + 0xc], esi
mov edx, dword [eax + 0x14]
add edx, ecx
mov dword [eax + 0x14], edx
mov ebp, dword [ebx + 0x80]
test ebp, ebp
je 0x401966
add ebp, edi
mov eax, dword [ebp + 4]
test eax, eax
jne 0x4018ce
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4019a3
mov esi, dword [ebp + 0xc]
mov edx, dword [0x40b1b8]
add esi, edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x4018f3
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x401952
mov edi, dword [ebp]
mov eax, dword [esp + 0x1054]
mov esi, dword [ebp + 0x10]
add edi, eax
add esi, eax
mov eax, dword [edi]
test eax, eax
je 0x40193f
test eax, 0x80000000
je 0x401919
and eax, 0xffff
push eax
jmp 0x401925
mov ecx, dword [esp + 0x1054]
lea edx, [eax + ecx + 2]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test esi, esi
mov dword [esi], eax
je 0x401981
mov eax, dword [edi + 4]
add edi, 4
add esi, 4
test eax, eax
jne 0x40190a
mov edi, dword [esp + 0x1054]
mov ebx, dword [esp + 0x10]
add ebp, 0x14
jmp 0x4018bc
push 0
push str.Error_in_LoadPbDllFromMemory__
push str.Cant_find_required_Dll
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x103c
ret
mov eax, dword [esp + 0x1054]
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x103c
ret
mov edx, dword [ebx + 0xa0]
test edx, edx
je 0x401a09
mov eax, dword [edx + edi]
add edx, edi
test eax, eax
je 0x401a09
mov ecx, dword [edx + 4]
lea esi, [edx + 8]
add ecx, edx
cmp esi, ecx
jae 0x401a01
xor eax, eax
mov ax, word [esi]
mov ecx, eax
and ecx, 0xf000
cmp ecx, 0x3000
jne 0x4019ed
mov ebp, dword [edx]
and eax, 0xfff
add eax, ebp
mov ebp, dword [ebx + 0x34]
add eax, edi
mov ecx, edi
sub ecx, ebp
add dword [eax], ecx
jmp 0x4019f5
test ecx, ecx
jne 0x401966
mov eax, dword [edx + 4]
add esi, 2
add eax, edx
cmp esi, eax
jb 0x4019c2
add edx, dword [edx + 4]
cmp dword [edx], 0
jne 0x4019b6
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x4c]
mov ebp, dword [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dx, word [eax + 6]
lea ebx, [eax + 0x108]
mov dword [esp + 0x1c], edx
cmp cx, dx
jne 0x401a44
mov eax, dword [esp + 0x24]
xor esi, esi
mov ecx, 0x60000000
jmp 0x401a4c
mov esi, dword [ebx - 4]
mov eax, dword [ebx]
mov ecx, dword [ebx + 0x14]
lea eax, [eax + esi - 1]
xor edx, edx
div ebp
xor edx, edx
mov edi, eax
mov eax, esi
div ebp
cmp eax, edi
ja 0x401a96
mov edx, ecx
mov esi, ecx
and edx, 0x20000000
and esi, 0x40000000
and ecx, 0x80000000
test edx, edx
je 0x401a7f
or byte [esp + eax + 0x4c], 1
test esi, esi
je 0x401a88
or byte [esp + eax + 0x4c], 2
test ecx, ecx
je 0x401a91
or byte [esp + eax + 0x4c], 4
inc eax
cmp eax, edi
jbe 0x401a76
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
inc ecx
add ebx, 0x28
cmp cx, dx
mov dword [esp + 0x18], ecx
jbe 0x401a35
mov ebx, dword [esp + 0x1054]
mov ebp, dword [esp + 0x14]
mov edi, ebx
xor esi, esi
xor eax, eax
mov al, byte [esp + esi + 0x4c]
sub eax, 2
je 0x401ae5
dec eax
je 0x401ade
sub eax, 3
je 0x401ad7
mov dword [esp + 0x20], 0x40
jmp 0x401b04
mov eax, 4
jmp 0x401aea
mov eax, 0x20
jmp 0x401aea
mov eax, 2
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x20]
push ecx
push eax
push edx
push edi
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401b31
mov edx, dword [esp + 0x2c]
add edi, edx
inc esi
cmp esi, ebp
jbe 0x401aba
mov eax, dword [esp + 0x10]
push 0
push 1
push ebx
mov eax, dword [eax + 0x28]
add eax, ebx
mov dword [0x40b1b0], eax
call eax
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x103c
ret
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x103c
ret