Function at 0x401000
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x158
mov edi, dword [esp + 0x16c]
mov eax, dword [0x4e6c40]
xor eax, esp
mov dword [esp + 0x154], eax
mov esi, dword [edi + 0x3c]
lea eax, [esi + edi]
mov dword [esp + 4], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x28], xmm0
movups xmmword [esp + 0x18], xmm0
movzx eax, word [esi + edi + 0x14]
lea ecx, [esp + 0x18]
push eax
push 0x45ff2a
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ebp, dword [esi + edi + 0x34]
lea eax, [esp + 0x44]
push 0x110
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x38], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x45b030]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call ebx
push 3
push 1
push edx
push eax
call ebx
push 3
push 0x20
push edx
push eax
call ebx
mov ebx, edi
mov dword [esp + 0x3c], 0xa
mov dword [esp + 0x40], 0
mov word [esp + 0x14c], 0
lea ecx, [esp + 0x38]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov esi, dword [esi + edi + 0x50]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x40
push 0x3000
push esi
mov dword [esp + 0x18], ebp
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test eax, eax
jne 0x401104
mov eax, dword [esp + 4]
mov esi, dword [eax + 0x50]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x40
push 0x3000
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov edi, dword [esp + 4]
mov dword [edi + 0x34], esi
push dword [edi + 0x54]
push ebx
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp word [edi + 6], 0
mov edi, esi
je 0x401166
mov ebp, ebx
mov ecx, dword [esp + 4]
movzx eax, word [ecx + 0x14]
lea esi, [ecx + eax]
add esi, 0x18
add esi, 0x14
xor ebx, ebx
nop word cs:[eax + eax]
mov eax, dword [esi - 8]
add eax, edi
mov ecx, dword [esi]
add ecx, ebp
push dword [esi - 4]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
inc ebx
mov eax, dword [esp + 4]
movzx eax, word [eax + 6]
add esi, 0x28
cmp ebx, eax
jb 0x401140
mov ebp, dword [esp + 4]
mov ebp, dword [ebp + 0x80]
mov eax, dword [ebp + edi + 0xc]
test eax, eax
mov esi, edi
mov dword [esp], edi
je 0x401247
add ebp, esi
jmp 0x4011a1
mov eax, dword [ebp + 0x20]
add ebp, 0x14
test eax, eax
mov esi, dword [esp]
je 0x401247
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x40129c
mov edi, eax
mov ebx, dword [ebp + 0x10]
cmp dword [ebp + 4], 0xffffffff
jne 0x4011ed
mov eax, dword [ebp]
mov ecx, dword [eax + esi]
cmp ecx, 0x10000000
jae 0x4011d4
lea eax, [ecx + esi]
add eax, 2
push eax
jmp 0x4011db
movzx ecx, cx
mov dword [esi + eax], ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [esi + ebx], eax
je 0x401190
mov ebx, dword [ebp]
mov esi, dword [esp]
mov eax, dword [ebx + esi]
test eax, eax
je 0x401190
mov ecx, dword [esp]
lea esi, [ebx + ecx]
mov ecx, ebx
mov ebx, esi
sub ebx, ecx
jmp 0x401239
mov ecx, dword [esp]
add eax, ecx
add eax, 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebx + ecx], eax
mov eax, dword [esi + 4]
add esi, 4
add ebx, 4
test eax, eax
je 0x401190
cmp eax, 0x10000000
jb 0x401210
movzx eax, ax
mov dword [esi], eax
jmp 0x401218
mov eax, esi
sub eax, dword [esp + 0xc]
je 0x401338
mov edx, dword [esp]
mov ecx, dword [edx + 0x3c]
mov edx, dword [ecx + edx + 0xa0]
mov dword [esp + 8], edx
test edx, edx
je 0x401338
mov edx, dword [esp]
mov ecx, dword [edx + ecx + 0xa4]
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x401338
mov ecx, dword [esp + 4]
mov ecx, dword [ecx + 0x50]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 8]
add ecx, dword [esp]
mov dword [esp + 8], ecx
xor ebx, ebx
jmp 0x4012cf
push 0x4000
mov eax, dword [esp + 8]
push dword [eax + 0x50]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor edi, edi
jmp 0x401359
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 4]
add ebx, ecx
cmp ebx, dword [esp + 0x14]
jae 0x401338
mov ecx, dword [esp + 8]
mov esi, dword [ecx + ebx]
test esi, esi
je 0x401338
mov ecx, dword [esp + 8]
add ecx, ebx
mov dword [esp + 0x10], ecx
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x401338
lea edx, [ecx - 8]
cmp edx, 2
jb 0x4012c7
mov ecx, dword [esp + 0x10]
add ecx, 8
shr edx, 1
nop dword [eax]
movzx ebp, word [ecx]
cmp ebp, 0x1000
jb 0x4012c0
mov edi, ebp
and edi, 0xf000
cmp edi, 0x3000
jne 0x401338
and ebp, 0xfff
add ebp, esi
cmp ebp, dword [esp + 0xc]
jae 0x401338
mov edi, dword [esp]
add dword [ebp + edi], eax
add ecx, 2
dec edx
jne 0x401300
jmp 0x4012c0
push 0xc
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov edx, dword [esp]
mov dword [eax], edx
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
add edx, dword [ecx + 0x28]
mov dword [edi + 8], edx
mov ecx, dword [esp + 0x154]
xor ecx, esp
call fcn.00401ebc
mov eax, edi
add esp, 0x158
pop esi
pop edi
pop ebx
pop ebp
ret