Function at 0x402310
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x402591
call fcn.00401e50
test eax, eax
je 0x402353
mov eax, 1
test eax, eax
je 0x402353
push 0x40e2d8
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x402365
push 0x40e304
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x402591
xor eax, eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
push 0xc
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_K32GetModuleInformation
test eax, eax
je 0x402584
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
je 0x402584
push 0
push 0
push 0
push 0x1000002
push 0
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x402577
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x40256a
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x220]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x22c], ecx
xor edx, edx
mov word [ebp - 0x224], dx
jmp 0x402481
mov ax, word [ebp - 0x224]
add ax, 1
mov word [ebp - 0x224], ax
movzx ecx, word [ebp - 0x224]
mov edx, dword [ebp - 0x22c]
movzx eax, word [edx + 6]
cmp ecx, eax
jge 0x40256a
mov ecx, dword [ebp - 0x22c]
movzx edx, word [ecx + 0x14]
mov eax, dword [ebp - 0x22c]
lea ecx, [eax + edx + 0x18]
movzx edx, word [ebp - 0x224]
imul eax, edx, 0x28
add ecx, eax
mov dword [ebp - 0x228], ecx
push 0x40e330
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402565
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0x220]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x234], eax
mov ecx, dword [ebp - 0x228]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x230], edx
lea eax, [ebp - 0x214]
push eax
push 0x40
mov ecx, dword [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp - 0x244]
add edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x234]
push eax
call fcn.00403450
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x214]
push edx
mov eax, dword [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x40256a
jmp 0x40246f
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004025ef
mov esp, ebp
pop ebp
ret