Function at 0x42a210
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
push edi
lea edi, [ebp - 0x154]
mov ecx, 0x55
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4cede4]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
push str.VirtualFree
mov edi, esp
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.00427bea
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00427bea
mov dword [ebp - 0xc], eax
nop
nop
nop
nop
nop
nop
nop
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x50
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x6f
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x63
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0
mov esi, esp
push str.VirtualProtect
mov edi, esp
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.00427bea
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00427bea
mov dword [ebp - 0x30], eax
inc eax
inc ebx
sub ebx, 2
dec eax
inc ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 0x48], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x3c], 0
jmp 0x42a316
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x48]
add ecx, 0x28
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x3c], edx
jge 0x42a486
inc eax
inc ebx
sub ebx, 2
dec eax
inc ebx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x24]
and ecx, 0x20000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x78], ecx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x24]
and ecx, 0x40000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x84], ecx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x24]
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x90], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x24]
and ecx, 0x2000000
je 0x42a3ba
inc eax
inc ebx
sub ebx, 2
dec eax
inc ebx
mov esi, esp
push 0x4000
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x48]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp esi, esp
call fcn.00427bea
jmp 0x42a304
nop
nop
nop
nop
mov eax, dword [ebp - 0x78]
shl eax, 4
mov ecx, dword [ebp - 0x84]
lea edx, [eax + ecx*8 + 0x4c2b5c]
mov eax, dword [ebp - 0x90]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x24]
and ecx, 0x4000000
je 0x42a3f6
mov eax, dword [ebp - 0x54]
or eax, 0x200
mov dword [ebp - 0x54], eax
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x6c], ecx
cmp dword [ebp - 0x6c], 0
jne 0x42a43c
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x24]
and ecx, 0x40
je 0x42a423
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x6c], edx
jmp 0x42a43c
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x24]
and ecx, 0x80
je 0x42a43c
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x6c], edx
inc eax
inc ebx
sub ebx, 2
dec eax
inc ebx
cmp dword [ebp - 0x6c], 0
jbe 0x42a481
mov esi, esp
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
mov edx, dword [ebp - 0x48]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx + 8]
push edx
call dword [ebp - 0x30]
cmp esi, esp
call fcn.00427bea
test eax, eax
jne 0x42a481
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x42a304
push edx
mov ecx, ebp
push eax
lea edx, [0x42a4b8]
call fcn.0042751e
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427186
add esp, 0x154
cmp ebp, esp
call fcn.00427bea
mov esp, ebp
pop ebp
ret