Function at 0x415670
Capabilities:
Enumerate pe sections
Inspect section memory permissions
Link function at runtime on windows
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x134
mov eax, dword [0x4231f0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebp
mov ebp, dword [esp + 0x13c]
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov dword [esp + 8], ebp
call edx
mov eax, dword [esp + 0x144]
cmp eax, 0x40
ja 0x4156ad
xor al, al
jmp 0x416113
mov ecx, 0x5a4d
cmp word [ebp], cx
jne 0x4156a6
push ebx
mov ebx, dword [ebp + 0x3c]
lea edx, [ebx + 0xf8]
cmp eax, edx
jbe 0x416139
add ebx, ebp
cmp dword [ebx], 0x4550
mov dword [esp + 0x14], ebx
jne 0x416139
mov eax, 0x14c
cmp word [ebx + 4], ax
jne 0x416139
cmp word [ebx + 6], 0
je 0x416139
mov eax, dword [ebx + 0x50]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 1
push 0x2000
push eax
push 0
mov dword [esi + 0x10c], eax
call edi
push 4
mov dword [esi + 0x108], eax
mov ecx, dword [ebx + 0x54]
push 0x1000
push ecx
push eax
mov dword [esi + 0x114], ecx
call edi
mov ecx, dword [esi + 0x114]
push ecx
push ebp
push eax
mov dword [esi + 0x110], eax
call fcn.004054b0
mov eax, dword [esi + 0x114]
mov ecx, dword [esi + 0x110]
add esp, 0xc
lea edx, [esp + 0x38]
push edx
push 2
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, word [ebx + 6]
lea edx, [eax*4]
push edx
mov dword [esi + 0x120], eax
call fcn.0040c5b4
mov dword [esi + 0x118], eax
mov eax, dword [esi + 0x120]
add eax, eax
add eax, eax
push eax
call fcn.0040c5b4
xor edi, edi
add esp, 8
mov dword [esi + 0x11c], eax
cmp dword [esi + 0x120], edi
jbe 0x41581d
lea ebp, [ebx + 0x100]
mov ecx, dword [esi + 0x11c]
mov edx, dword [ebp + 8]
mov dword [ecx + edi*4], edx
mov eax, dword [esi + 0x11c]
mov ecx, dword [ebp]
cmp dword [eax + edi*4], ecx
lea eax, [eax + edi*4]
jae 0x4157c3
mov dword [eax], ecx
mov ecx, dword [esi + 0x11c]
mov eax, dword [ebp + 4]
mov edx, dword [ecx + edi*4]
add eax, dword [esi + 0x108]
push 4
push 0x1000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esi + 0x118]
mov dword [ecx + edi*4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x415811
mov edx, dword [ebp + 8]
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esi + 0x118]
add ecx, eax
mov eax, dword [edx + edi*4]
push ecx
push eax
call fcn.004054b0
add esp, 0xc
inc edi
add ebp, 0x28
cmp edi, dword [esi + 0x120]
jb 0x4157a4
cmp dword [ebx + 0xa0], 0
je 0x4158f2
xor ebp, ebp
xor eax, eax
mov dword [esp + 0x20], ebp
cmp dword [esi + 0x120], eax
jbe 0x415898
mov ecx, dword [esi + 0x11c]
lea edx, [ebx + 0x104]
mov dword [esp + 0x14], edx
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
mov edi, dword [ecx]
add edi, edx
mov edx, dword [ebx + 0xa0]
cmp edx, edi
jae 0x41586c
mov edi, dword [esp + 0x14]
cmp edx, dword [edi]
jae 0x41587f
add dword [esp + 0x14], 0x28
inc eax
add ecx, 4
cmp eax, dword [esi + 0x120]
jb 0x415850
jmp 0x415898
mov edi, dword [esi + 0x118]
mov ebp, dword [edi + eax*4]
lea ecx, [eax + eax*4]
sub ebp, dword [ebx + ecx*8 + 0x104]
add ebp, edx
mov dword [esp + 0x20], ebp
mov eax, dword [esi + 0x108]
sub eax, dword [ebx + 0x34]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x4158f2
nop
cmp eax, dword [ebx + 0xa4]
jae 0x4158f2
xor eax, eax
cmp dword [esi + 0x120], eax
jbe 0x4158f2
mov ebp, dword [ebp]
mov ecx, dword [esi + 0x11c]
lea edx, [ebx + 0x104]
mov edi, dword [edx]
mov ebx, dword [ecx]
add ebx, edi
cmp ebp, ebx
jae 0x4158df
cmp ebp, edi
jae 0x415950
inc eax
add ecx, 4
add edx, 0x28
cmp eax, dword [esi + 0x120]
jb 0x4158d1
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x415c38
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
cmp dword [esi + 0x120], eax
jbe 0x415a0c
mov ecx, dword [esi + 0x11c]
lea edx, [ebx + 0x104]
mov edi, dword [edx]
mov ebp, dword [ecx]
add ebp, edi
mov edi, dword [ebx + 0x80]
cmp edi, ebp
jae 0x415938
cmp edi, dword [edx]
jae 0x4159f7
inc eax
add ecx, 4
add edx, 0x28
cmp eax, dword [esi + 0x120]
jb 0x415920
mov ecx, dword [esp + 0x10]
jmp 0x415a0c
mov edx, dword [esi + 0x118]
mov edx, dword [edx + eax*4]
mov ebx, dword [esp + 0x18]
lea ecx, [eax + eax*4]
sub edx, dword [ebx + ecx*8 + 0x104]
add edx, ebp
je 0x4158f2
mov ebp, dword [esp + 0x20]
mov eax, dword [ebp + 4]
lea ecx, [ebp + 4]
sub eax, 8
shr eax, 1
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], eax
mov edi, 0
je 0x4159da
lea esp, [esp]
movzx ecx, word [ebp + edi*2 + 8]
mov eax, ecx
and eax, 0xfff
shr ecx, 0xc
add eax, edx
sub ecx, 1
je 0x4159c2
sub ecx, 1
je 0x4159b8
sub ecx, 1
jne 0x4159cf
mov ecx, dword [esp + 0x1c]
add dword [eax], ecx
jmp 0x4159cf
mov cx, word [esp + 0x1c]
add word [eax], cx
jmp 0x4159cf
movzx ecx, word [eax]
add ecx, dword [esp + 0x1c]
shr ecx, 0x10
mov word [eax], cx
inc edi
cmp edi, dword [esp + 0x10]
jb 0x415990
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
add ebp, dword [ecx]
add eax, dword [ecx]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], eax
test ebp, ebp
jne 0x4158b0
jmp 0x4158f2
mov ecx, dword [esi + 0x118]
mov ecx, dword [ecx + eax*4]
lea edx, [eax + eax*4]
sub ecx, dword [ebx + edx*8 + 0x104]
add ecx, edi
test ecx, ecx
je 0x415c38
add ecx, 0xc
cmp dword [ecx], 0
je 0x415c38
mov edx, ecx
mov dword [esp + 0x20], ecx
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
cmp dword [esi + 0x120], eax
jbe 0x415a84
mov ebp, dword [edx]
mov ecx, dword [esi + 0x11c]
lea edx, [ebx + 0x104]
mov edi, dword [edx]
mov ebx, dword [ecx]
add ebx, edi
cmp ebp, ebx
jae 0x415a52
cmp ebp, edi
jae 0x415a6b
inc eax
add ecx, 4
add edx, 0x28
cmp eax, dword [esi + 0x120]
jb 0x415a44
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
jmp 0x415a84
mov ecx, dword [esi + 0x118]
mov ecx, dword [ecx + eax*4]
mov ebx, dword [esp + 0x18]
lea edx, [eax + eax*4]
sub ecx, dword [ebx + edx*8 + 0x104]
add ecx, ebp
push ecx
mov ecx, esi
call fcn.004154a0
mov dword [esp + 0x1c], eax
test eax, eax
je 0x41612c
mov edx, dword [esp + 0x20]
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], ecx
cmp dword [edx - 8], eax
jne 0x415b11
cmp dword [esi + 0x120], ecx
jbe 0x415b09
mov ebp, dword [edx + 4]
mov ecx, dword [esi + 0x11c]
lea edx, [ebx + 0x104]
mov edi, dword [edx]
mov ebx, dword [ecx]
add ebx, edi
cmp ebp, ebx
jae 0x415ace
cmp ebp, edi
jae 0x415af0
inc eax
add ecx, 4
add edx, 0x28
cmp eax, dword [esi + 0x120]
jb 0x415ac0
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov ebp, ecx
mov dword [esp + 0x14], ebp
jmp 0x415b6e
mov ecx, dword [esi + 0x118]
mov ecx, dword [ecx + eax*4]
mov ebx, dword [esp + 0x18]
lea edx, [eax + eax*4]
sub ecx, dword [ebx + edx*8 + 0x104]
add ecx, ebp
mov ebp, ecx
mov dword [esp + 0x14], ebp
jmp 0x415b6e
cmp dword [esi + 0x120], ecx
jbe 0x415b68
mov ebp, dword [edx - 0xc]
mov ecx, dword [esi + 0x11c]
lea edx, [ebx + 0x104]
mov edi, dword [edx]
mov ebx, dword [ecx]
add ebx, edi
cmp ebp, ebx
jae 0x415b36
cmp ebp, edi
jae 0x415b4f
inc eax
add ecx, 4
add edx, 0x28
cmp eax, dword [esi + 0x120]
jb 0x415b28
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
jmp 0x415b68
mov ecx, dword [esi + 0x118]
mov ecx, dword [ecx + eax*4]
mov ebx, dword [esp + 0x18]
lea edx, [eax + eax*4]
sub ecx, dword [ebx + edx*8 + 0x104]
add ecx, ebp
mov ebp, ecx
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x415c24
jmp 0x415b80
mov eax, dword [ebp]
test eax, eax
je 0x415c24
jns 0x415b9a
mov edx, dword [esp + 0x1c]
and eax, 0xffff
push eax
push edx
jmp 0x415c0e
add eax, 2
mov dword [esp + 0x10], eax
xor eax, eax
xor edi, edi
cmp dword [esi + 0x120], eax
jbe 0x415c08
mov ecx, dword [esi + 0x11c]
lea edx, [ebx + 0x104]
lea esp, [esp]
mov ebx, dword [edx]
mov ebp, dword [ecx]
add ebp, ebx
mov ebx, ebp
mov ebp, dword [esp + 0x10]
cmp ebp, ebx
jae 0x415bd4
cmp ebp, dword [edx]
jae 0x415be9
inc eax
add ecx, 4
add edx, 0x28
cmp eax, dword [esi + 0x120]
jb 0x415bc0
mov ebx, dword [esp + 0x18]
jmp 0x415c04
mov edx, dword [esi + 0x118]
mov edi, dword [edx + eax*4]
lea ecx, [eax + eax*4]
mov eax, dword [esp + 0x18]
sub edi, dword [eax + ecx*8 + 0x104]
mov ebx, eax
add edi, ebp
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp], eax
add ebp, 4
mov dword [esp + 0x14], ebp
jne 0x415b80
mov edx, dword [esp + 0x20]
add edx, 0x14
cmp dword [edx], 0
mov dword [esp + 0x20], edx
jne 0x415a26
xor edi, edi
cmp dword [esi + 0x120], edi
jbe 0x415cdb
lea ebp, [ebx + 0x11c]
lea esp, [esp]
mov ecx, dword [ebp]
mov eax, ecx
and eax, 0x80000000
test ecx, 0x20000000
je 0x415c82
test ecx, 0x40000000
je 0x415c76
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
jmp 0x415c9e
neg eax
sbb eax, eax
and eax, 0x70
add eax, 0x10
jmp 0x415c9e
test ecx, 0x40000000
je 0x415c96
neg eax
sbb eax, eax
and eax, 2
add eax, 2
jmp 0x415c9e
neg eax
sbb eax, eax
and eax, 7
inc eax
test ecx, 0x4000000
je 0x415cab
or eax, 0x200
mov edx, dword [esi + 0x11c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esi + 0x118]
push eax
mov eax, dword [edx + edi*4]
mov edx, dword [ecx + edi*4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc edi
add ebp, 0x28
cmp edi, dword [esi + 0x120]
jb 0x415c50
xor eax, eax
mov dword [esi + 0x124], eax
cmp dword [esi + 0x120], eax
jbe 0x415d34
mov ecx, dword [esi + 0x11c]
lea edx, [ebx + 0x104]
mov edi, dword [edx]
mov ebp, dword [ecx]
add ebp, edi
mov edi, dword [ebx + 0x28]
cmp edi, ebp
jae 0x415d08
cmp edi, dword [edx]
jae 0x415d19
inc eax
add ecx, 4
add edx, 0x28
cmp eax, dword [esi + 0x120]
jb 0x415cf7
jmp 0x415d34
mov edx, dword [esi + 0x118]
lea ecx, [eax + eax*4]
mov eax, dword [edx + eax*4]
sub eax, dword [ebx + ecx*8 + 0x104]
add eax, edi
mov dword [esi + 0x124], eax
mov eax, dword [esi + 0x124]
test eax, eax
je 0x41612c
mov ecx, dword [esi + 0x108]
push 0
push 1
push ecx
call eax
test eax, eax
je 0x41612c
cmp dword [ebx + 0x78], 0
je 0x41610f
xor eax, eax
cmp dword [esi + 0x120], eax
jbe 0x41610f
mov ecx, dword [esi + 0x11c]
lea edx, [ebx + 0x104]
jmp 0x415d80
mov edi, dword [edx]
mov ebp, dword [ecx]
add ebp, edi
mov edi, dword [ebx + 0x78]
cmp edi, ebp
jae 0x415d91
cmp edi, dword [edx]
jae 0x415da5
inc eax
add ecx, 4
add edx, 0x28
cmp eax, dword [esi + 0x120]
jb 0x415d80
jmp 0x41610f
mov ecx, dword [esi + 0x118]
mov ecx, dword [ecx + eax*4]
lea edx, [eax + eax*4]
sub ecx, dword [ebx + edx*8 + 0x104]
add ecx, edi
mov dword [esp + 0x14], ecx
je 0x41610f
mov edx, dword [esi + 0x11c]
xor eax, eax
lea edi, [ebx + 0x104]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edi
lea ebx, [ebx]
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
mov ebp, dword [edx]
add ebp, edi
mov edi, dword [ecx + 0x20]
cmp edi, ebp
jae 0x415dfa
mov ebp, dword [esp + 0x1c]
cmp edi, dword [ebp]
jae 0x415e0d
add dword [esp + 0x1c], 0x28
inc eax
add edx, 4
cmp eax, dword [esi + 0x120]
jb 0x415de0
jmp 0x415e26
mov edx, dword [esi + 0x118]
lea ebp, [eax + eax*4]
mov eax, dword [edx + eax*4]
sub eax, dword [ebx + ebp*8 + 0x104]
add eax, edi
mov dword [esp + 0x20], eax
mov ecx, dword [ecx + 0x24]
mov edx, dword [esi + 0x11c]
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x10], ecx
lea edi, [ebx + 0x104]
nop
mov ecx, dword [edi]
mov ebp, dword [edx]
add ebp, ecx
mov ecx, dword [esp + 0x10]
cmp ecx, ebp
jae 0x415e52
cmp ecx, dword [edi]
jae 0x415e63
inc eax
add edx, 4
add edi, 0x28
cmp eax, dword [esi + 0x120]
jb 0x415e40
jmp 0x415e7c
mov edx, dword [esi + 0x118]
lea edi, [eax + eax*4]
mov eax, dword [edx + eax*4]
sub eax, dword [ebx + edi*8 + 0x104]
add eax, ecx
mov dword [esp + 0x34], eax
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 0x1c]
xor eax, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x11c]
mov dword [esp + 0x2c], eax
lea edx, [ebx + 0x104]
lea esp, [esp]
mov edi, dword [edx]
mov ebp, dword [ecx]
add ebp, edi
mov edi, dword [esp + 0x10]
cmp edi, ebp
jae 0x415eb2
cmp edi, dword [edx]
jae 0x415ec3
inc eax
add ecx, 4
add edx, 0x28
cmp eax, dword [esi + 0x120]
jb 0x415ea0
jmp 0x415edc
mov ecx, dword [esi + 0x118]
lea edx, [eax + eax*4]
mov eax, dword [ecx + eax*4]
sub eax, dword [ebx + edx*8 + 0x104]
add eax, edi
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x18], 0
mov eax, dword [ebx + 0x7c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], 0
jbe 0x41610f
lea esp, [esp]
xor eax, eax
mov dword [esp + 0x10], eax
cmp dword [esi + 0x120], eax
jbe 0x415f6c
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [edx + ecx*4]
mov edx, dword [esp + 0x18]
mov ecx, dword [esi + 0x11c]
add edx, 0x104
lea esp, [esp]
mov edi, dword [edx]
mov ebp, dword [ecx]
add ebp, edi
cmp ebx, ebp
jae 0x415f3e
cmp ebx, edi
jae 0x415f4f
inc eax
add ecx, 4
add edx, 0x28
cmp eax, dword [esi + 0x120]
jb 0x415f30
jmp 0x415f6c
mov ecx, dword [esi + 0x118]
lea edx, [eax + eax*4]
mov eax, dword [ecx + eax*4]
mov ecx, dword [esp + 0x18]
sub eax, dword [ecx + edx*8 + 0x104]
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x34]
movzx ecx, word [edx + eax*2]
xor eax, eax
xor edi, edi
mov dword [esp + 0x24], ecx
cmp dword [esi + 0x120], eax
jbe 0x4160d0
mov edx, dword [esp + 0x2c]
mov edx, dword [edx + ecx*4]
mov ecx, dword [esi + 0x11c]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x18]
add edx, 0x104
mov ebx, dword [edx]
mov ebp, dword [ecx]
add ebp, ebx
mov ebx, dword [esp + 0x28]
cmp ebx, ebp
jae 0x415fb9
cmp ebx, dword [edx]
jae 0x415fcd
inc eax
add ecx, 4
add edx, 0x28
cmp eax, dword [esi + 0x120]
jb 0x415fa7
jmp 0x4160d0
mov edx, dword [esi + 0x118]
mov edi, dword [edx + eax*4]
lea ecx, [eax + eax*4]
mov eax, dword [esp + 0x18]
sub edi, dword [eax + ecx*8 + 0x104]
add edi, ebx
cmp dword [esp + 0x14], edi
jae 0x4160d0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x14]
add ecx, edx
cmp edi, ecx
jae 0x4160d0
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416007
sub eax, edx
cmp byte [eax + edi - 1], 0x2e
lea ebp, [eax + edi - 1]
je 0x416027
jmp 0x416020
dec ebp
cmp byte [ebp], 0x2e
jne 0x416020
mov ebx, edi
sub ebx, ebp
push ebx
lea eax, [esp + 0x40]
push edi
push eax
call fcn.00405140
add esp, 0xc
lea ecx, [esp + 0x3c]
push ecx
mov ecx, esi
mov byte [esp + ebx + 0x40], 0
inc ebp
call fcn.004154a0
test eax, eax
je 0x41612c
cmp byte [ebp], 0x23
jne 0x4160c6
push 0xa
push 0
inc ebp
push ebp
call fcn.0040a047
xor ecx, ecx
add esp, 0xc
xor edi, edi
mov dword [esp + 0x28], eax
cmp dword [esi + 0x120], ecx
jbe 0x4160d0
mov ebx, dword [esp + 0x18]
mov edx, dword [esi + 0x11c]
add ebx, 0x104
mov eax, dword [ebx]
mov ebp, dword [edx]
add ebp, eax
mov eax, dword [esp + 0x28]
cmp eax, ebp
jae 0x41609a
cmp eax, dword [ebx]
jae 0x4160ab
inc ecx
add edx, 4
add ebx, 0x28
cmp ecx, dword [esi + 0x120]
jb 0x416088
jmp 0x4160d0
mov edi, dword [esi + 0x118]
mov edi, dword [edi + ecx*4]
lea edx, [ecx + ecx*4]
mov ecx, dword [esp + 0x18]
sub edi, dword [ecx + edx*8 + 0x104]
add edi, eax
jmp 0x4160d0
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x10
call fcn.004061a2
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], edx
mov dword [eax], edi
mov edx, dword [esi + 0x12c]
mov dword [eax + 0xc], edx
mov dword [esi + 0x12c], eax
mov eax, dword [esp + 0x20]
inc eax
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, dword [ecx + 0x18]
jb 0x415f00
mov al, 1
pop edi
pop ebx
mov ecx, dword [esp + 0x138]
pop esi
pop ebp
xor ecx, esp
call fcn.00405815
add esp, 0x134
ret 8
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
xor al, al
jmp 0x416111
xor al, al
jmp 0x416112