Function at 0x421000
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [ebp - 0x20], eax
push 0x14
lea eax, [ebp - 0x3c]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.test.exe
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x421040
xor eax, eax
leave
ret
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 4]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
jne 0x421063
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
leave
ret
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 4
push dword [ebp - 8]
call sub.kernel32.dll_MapViewOfFile
or eax, eax
jne 0x42108e
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
xor eax, eax
leave
ret
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
add esi, dword [esi + 0x3c]
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x18], eax
movzx eax, word [esi + 6]
mov dword [ebp - 0x14], eax
movzx eax, word [esi + 0x14]
lea ebx, [esi + 0x18]
add eax, ebx
mov dword [ebp - 0x1c], eax
push dword [esi + 0x28]
pop dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x50], eax
lea eax, [esi + 0x80]
mov eax, dword [eax]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
push 0x40
push 0x20000
push dword [ebp - 0x20]
call sub.kernel32.dll_VirtualProtect
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x20]
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
xor ebx, ebx
jmp 0x421115
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx + 0x14]
add esi, dword [ebp - 0xc]
mov edi, dword [ecx + 0xc]
add edi, dword [ebp - 0x20]
push dword [ecx + 0x10]
push esi
push edi
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
add dword [ebp - 0x1c], 0x28
inc ebx
cmp ebx, dword [ebp - 0x14]
jb 0x4210f3
push 0x14
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.msvcrt.dll_memcmp]
add esp, 0xc
or eax, eax
jne 0x421135
jmp 0x4211d7
mov esi, dword [ebp - 0x28]
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_LoadLibraryA
or eax, eax
jne 0x42115d
push 0
push 0x423009
push 0x423009
push 0
call fcn.00421206
jmp 0x4211d7
mov dword [ebp - 0x40], eax
cmp dword [esi + 0x10], 0
jne 0x421168
jmp 0x4211d7
mov eax, dword [esi + 0x10]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [esi]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x421182
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x44]
jmp 0x4211c9
test dword [ebx], 0x8000000
je 0x4211a6
movzx eax, word [ebx]
push eax
push dword [ebp - 0x40]
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x48], eax
jmp 0x4211ba
mov eax, dword [ebx]
add eax, dword [ebp - 0x20]
add eax, 2
push eax
push dword [ebp - 0x40]
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x4c]
push dword [ebp - 0x48]
pop dword [eax]
add ebx, 4
add dword [ebp - 0x4c], 4
cmp dword [ebx], 0
jne 0x42118d
add dword [ebp - 0x28], 0x14
jmp 0x42111a
push dword [ebp - 0xc]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x50]
leave
ret