Function at 0x10001535
Capabilities:
Enumerate pe sections
Get system information on windows
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0x60]
cmp edx, dword [ebp - 0x50]
jbe 0x1000156b
xor eax, eax
jmp 0x100017ee
mov eax, dword [ebp - 0x60]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp - 0x60]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x60]
xor eax, eax
mov ax, word [edx + 6]
imul eax, eax, 0x28
add ecx, eax
mov dword [ebp - 0x68], ecx
lea ecx, [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x100015c2
xor eax, eax
jmp 0x100017ee
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp - 0x5c]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov word [ebp - 0x44], 0
jmp 0x100015e8
mov ax, word [ebp - 0x44]
add ax, 1
mov word [ebp - 0x44], ax
mov ecx, dword [ebp - 0x44]
and ecx, 0xffff
mov edx, dword [ebp - 0x60]
xor eax, eax
mov ax, word [edx + 6]
cmp ecx, eax
jg 0x10001726
mov ecx, dword [ebp - 0x44]
and ecx, 0xffff
mov edx, dword [ebp - 0x60]
xor eax, eax
mov ax, word [edx + 6]
cmp ecx, eax
jne 0x1000162e
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x48], 0x60000000
jmp 0x10001670
mov edx, dword [ebp - 0x44]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + edx + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x44]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + edx + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x44]
and edx, 0xffff
imul edx, edx, 0x28
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + edx + 0x24]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
lea ecx, [eax + edx - 1]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
push str._x__x
call fcn.10001000
add esp, 0xc
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
div dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x58], ecx
jmp 0x100016b9
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x54]
ja 0x10001721
mov ecx, dword [ebp - 0x48]
and ecx, 0x20000000
test ecx, ecx
je 0x100016e0
mov edx, dword [ebp - 0x5c]
add edx, dword [ebp - 0x58]
mov al, byte [edx]
or al, 1
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x58]
mov byte [ecx], al
mov edx, dword [ebp - 0x48]
and edx, 0x40000000
test edx, edx
je 0x10001700
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x58]
mov cl, byte [eax]
or cl, 2
mov edx, dword [ebp - 0x5c]
add edx, dword [ebp - 0x58]
mov byte [edx], cl
mov eax, dword [ebp - 0x48]
and eax, 0x80000000
test eax, eax
je 0x1000171f
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x58]
mov dl, byte [ecx]
or dl, 4
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x58]
mov byte [eax], dl
jmp 0x100016b0
jmp 0x100015dc
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x58], 0
jmp 0x1000173e
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp + 0x10]
ja 0x100017cf
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x58]
mov dl, byte [ecx]
mov byte [ebp - 0x70], dl
cmp byte [ebp - 0x70], 2
je 0x10001769
cmp byte [ebp - 0x70], 4
je 0x10001772
cmp byte [ebp - 0x70], 6
je 0x1000177b
jmp 0x10001784
mov dword [ebp - 8], 2
jmp 0x1000178b
mov dword [ebp - 8], 0x20
jmp 0x1000178b
mov dword [ebp - 8], 4
jmp 0x1000178b
mov dword [ebp - 8], 0x40
cmp dword [ebp - 8], 0x40
je 0x100017c1
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jne 0x100017c1
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
jmp 0x100017ee
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
jmp 0x10001735
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push str.Set_VirtualMeomory_Pages_Protection_over
call fcn.10001000
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc