Function at 0x413eb0
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
push edi
push str.loadSection_start_n
mov edi, ecx
mov dword [esp + 0x28], edx
xorps xmm0, xmm0
mov dword [esp + 0x30], edi
push 0x100000
xor esi, esi
movlpd qword [esp + 0x38], xmm0
push 0x420410
mov dword [esp + 0x20], esi
call fcn.00401010
mov ebp, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov edi, dword [edi + 0x3c]
add edi, dword [esp + 0x2c]
movzx eax, word [edi + 0x14]
add eax, 0x18
add eax, edi
mov dword [esp + 0x3c], eax
movzx eax, word [edi + 6]
push eax
push str.section_number:__d_n
push 0x100000
push 0x420410
mov dword [esp + 0x2c], eax
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov eax, dword [edi + 0x38]
push eax
push str.sectionAlignment:__x_n
push 0x100000
push 0x420410
mov dword [esp + 0x38], eax
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov eax, dword [edi + 0x54]
push eax
push str.sizeOfHeaders:__x_n
push 0x100000
push 0x420410
mov dword [esp + 0x48], eax
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
movzx eax, word [edi + 0x14]
mov ecx, 0xe0
cmp ax, cx
jne 0x414028
mov eax, dword [edi + 0x34]
push eax
push str.1imageBase:__ux_n
push 0x100000
push 0x420410
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 0
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
jmp 0x414087
mov ecx, 0xf0
cmp ax, cx
jne 0x414077
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x30]
push ecx
push eax
push str.2imageBase:__llx_n
push 0x100000
push 0x420410
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], ecx
call fcn.00401010
add esp, 0x14
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
jmp 0x414087
mov eax, dword [esp + 0x34]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov edi, eax
push eax
push str.sectionHeadersCopy_name:__s_n
push 0x100000
push 0x420410
mov dword [esp + 0x28], edi
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
xor eax, eax
mov dword [esp + 0x30], eax
cmp dword [esp + 0x1c], eax
jbe 0x4141ad
push edi
push eax
push str._i.__s_t
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x14
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov edi, dword [edi + 8]
push edi
push str.tmp:__x__t
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov ecx, dword [esp + 0x28]
mov eax, edi
xor edx, edx
div ecx
sub ecx, edx
add edi, ecx
push edi
push str.__x__n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
add ecx, edi
mov edi, dword [esp + 0x18]
inc eax
add edi, 0x28
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], eax
cmp eax, dword [esp + 0x1c]
jl 0x4140d5
jmp 0x4141af
xor ecx, ecx
mov edi, dword [esp + 0x38]
xor edx, edx
mov eax, edi
div dword [esp + 0x28]
sub edi, edx
add edi, dword [esp + 0x28]
add ecx, edi
mov dword [esp + 0x18], edi
push ecx
push str.amountVirtualMemory:__x_n
push 0x100000
push 0x420410
mov dword [esp + 0x24], ecx
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x14]
push 4
push 0x2000
mov eax, dword [eax + 0x20]
push esi
push dword [esp + 0x1c]
call eax
mov dword [esp + 0x14], eax
test eax, eax
jne 0x414353
mov eax, dword [esp + 0x44]
push 4
push 0x2000
push esi
mov eax, dword [eax + 0x20]
push 0
call eax
mov dword [esp + 0x14], eax
test eax, eax
jne 0x41427c
push str.VirtualAlloc_failed
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
cdq
mov ebx, eax
mov edi, edx
mov eax, dword [esp + 0x24]
mov esi, ebx
sub esi, dword [esp + 0x10]
mov ecx, edi
mov edx, dword [esp + 0x20]
push edx
mov dword [eax], esi
sbb ecx, edx
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
push str.imageBase:__llx_n
push 0x100000
push 0x420410
mov dword [esi + 4], ecx
call fcn.00401010
add esp, 0x14
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
push edi
push ebx
push str._u64_allocatedMemory:__llx_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x14
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov eax, dword [esp + 0x24]
push dword [eax + 4]
push dword [eax]
push str.baseDif:__llx_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x14
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x44]
push 4
push 0x1000
push edi
push dword [esp + 0x20]
mov eax, dword [eax + 0x20]
call eax
test eax, eax
jne 0x4143a9
push str.VirtualAlloc_for_section_failed
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x4143e1
cmp edi, ecx
jb 0x4143c5
push ecx
push dword [esp + 0x30]
push eax
call fcn.00402b20
add esp, 0xc
jmp 0x4143e1
push edi
push 0
push eax
call fcn.004020a0
add esp, 0xc
call fcn.004045b0
mov dword [eax], 0x22
call fcn.00404455
mov edi, dword [esp + 0x3c]
push edi
push str.sectionHeadersCopy_name:__s_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
cmp dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
jbe 0x41460b
lea ecx, [edi + 0xc]
mov dword [esp + 0x30], ecx
mov ebp, dword [ecx - 4]
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ebx, dword [ecx + 0x18]
push ebp
push str.virtualSize:__x__t
mov dword [esp + 0x40], eax
mov eax, dword [ecx + 8]
push 0x100000
push 0x420410
mov dword [esp + 0x4c], eax
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
push dword [esp + 0x38]
push str.rawSize:__x__t
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esp + 0x3c]
push str.fileOffset:__x__t
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push str.rva:__x__t
push 0x100000
push 0x420410
call fcn.00401010
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 0x10
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call edi
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x28]
xor edx, edx
mov eax, ebp
div ecx
test edx, edx
je 0x414556
mov eax, ecx
sub eax, edx
add ebp, eax
mov eax, dword [esp + 0x44]
and ebx, 0x20000000
neg ebx
sbb ebx, ebx
mov ecx, dword [eax + 0x20]
and ebx, 0x3c
mov eax, dword [esp + 0x18]
add ebx, 4
add eax, dword [esp + 0x14]
push ebx
push 0x1000
push ebp
push eax
call ecx
test eax, eax
je 0x41464a
mov esi, dword [esp + 0x3c]
add esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x38]
test ebx, ebx
je 0x4145dd
test esi, esi
je 0x4145ac
cmp ebp, ebx
jb 0x4145ac
push ebx
push esi
push eax
call fcn.00402b20
add esp, 0xc
jmp 0x4145dd
push ebp
push 0
push eax
call fcn.004020a0
add esp, 0xc
test esi, esi
jne 0x4145c9
call fcn.004045b0
mov dword [eax], 0x16
jmp 0x4145d8
cmp ebp, ebx
jae 0x4145dd
call fcn.004045b0
mov dword [eax], 0x22
call fcn.00404455
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
inc eax
add dword [esp + 0x18], ebp
add ecx, 0x28
mov dword [esp + 0x30], ecx
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x1c]
jl 0x414433
mov ebp, dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push str.loadSection_end_n
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call ebp
push 0
push 0x420408
push esi
push 0x420410
push eax
call ebx
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
push str.VirtualAlloc_for_section_failed
push 0x100000
push 0x420410
call fcn.00401010
add esp, 0xc
mov esi, eax
mov dword [0x42040c], esi
push 0xfffffffffffffff5
call edi
push 0
push 0x420408
push esi
push 0x420410
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x30
ret