Function at 0x47f7b8
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4f
push 0
push 0
dec ecx
jne 0x47f7c0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x480053
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x150]
xor eax, eax
call fcn.00458368
push dword [ebp - 0x150]
lea edx, [ebp - 0x154]
xor eax, eax
call fcn.00458188
push dword [ebp - 0x154]
lea edx, [ebp - 0x158]
xor eax, eax
call fcn.00458228
push dword [ebp - 0x158]
lea edx, [ebp - 0x15c]
xor eax, eax
call fcn.004580e8
push dword [ebp - 0x15c]
lea edx, [ebp - 0x160]
xor eax, eax
call fcn.00458188
push dword [ebp - 0x160]
lea edx, [ebp - 0x164]
xor eax, eax
call fcn.004582a8
push dword [ebp - 0x164]
lea eax, [ebp - 0x14c]
mov edx, 6
call fcn.00404ef0
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00482a28
push dword [ebp - 0x148]
lea edx, [ebp - 0x168]
xor eax, eax
call fcn.00458468
push dword [ebp - 0x168]
lea edx, [ebp - 0x16c]
xor eax, eax
call fcn.004582c8
push dword [ebp - 0x16c]
lea edx, [ebp - 0x170]
xor eax, eax
call fcn.00458388
push dword [ebp - 0x170]
lea edx, [ebp - 0x174]
xor eax, eax
call fcn.004582c8
push dword [ebp - 0x174]
lea edx, [ebp - 0x178]
xor eax, eax
call fcn.004582e8
push dword [ebp - 0x178]
lea edx, [ebp - 0x17c]
xor eax, eax
call fcn.00458108
push dword [ebp - 0x17c]
lea edx, [ebp - 0x180]
xor eax, eax
call fcn.00458208
push dword [ebp - 0x180]
lea edx, [ebp - 0x184]
xor eax, eax
call fcn.00458508
push dword [ebp - 0x184]
lea edx, [ebp - 0x188]
xor eax, eax
call fcn.004584e8
push dword [ebp - 0x188]
lea edx, [ebp - 0x18c]
xor eax, eax
call fcn.00458468
push dword [ebp - 0x18c]
lea edx, [ebp - 0x190]
xor eax, eax
call fcn.00458228
push dword [ebp - 0x190]
lea edx, [ebp - 0x194]
xor eax, eax
call fcn.00458248
push dword [ebp - 0x194]
lea edx, [ebp - 0x198]
xor eax, eax
call fcn.004582e8
push dword [ebp - 0x198]
lea edx, [ebp - 0x19c]
xor eax, eax
call fcn.00458108
push dword [ebp - 0x19c]
lea edx, [ebp - 0x1a0]
xor eax, eax
call fcn.00458268
push dword [ebp - 0x1a0]
lea edx, [ebp - 0x1a4]
xor eax, eax
call fcn.00458088
push dword [ebp - 0x1a4]
lea edx, [ebp - 0x1a8]
xor eax, eax
call fcn.004580e8
push dword [ebp - 0x1a8]
lea edx, [ebp - 0x1ac]
xor eax, eax
call fcn.004583a8
push dword [ebp - 0x1ac]
lea edx, [ebp - 0x1b0]
xor eax, eax
call fcn.00458108
push dword [ebp - 0x1b0]
lea edx, [ebp - 0x1b4]
xor eax, eax
call fcn.00458348
push dword [ebp - 0x1b4]
lea edx, [ebp - 0x1b8]
xor eax, eax
call fcn.00458108
push dword [ebp - 0x1b8]
lea eax, [ebp - 0x144]
mov edx, 0x16
call fcn.00404ef0
mov eax, dword [ebp - 0x144]
call fcn.004095e8
test al, al
je 0x47fc61
lea edx, [ebp - 0x1c4]
xor eax, eax
call fcn.00458368
push dword [ebp - 0x1c4]
lea edx, [ebp - 0x1c8]
xor eax, eax
call fcn.00458188
push dword [ebp - 0x1c8]
lea edx, [ebp - 0x1cc]
xor eax, eax
call fcn.00458228
push dword [ebp - 0x1cc]
lea edx, [ebp - 0x1d0]
xor eax, eax
call fcn.004580e8
push dword [ebp - 0x1d0]
lea edx, [ebp - 0x1d4]
xor eax, eax
call fcn.00458188
push dword [ebp - 0x1d4]
lea edx, [ebp - 0x1d8]
xor eax, eax
call fcn.004582a8
push dword [ebp - 0x1d8]
lea eax, [ebp - 0x1c0]
mov edx, 6
call fcn.00404ef0
mov eax, dword [ebp - 0x1c0]
lea edx, [ebp - 0x1bc]
call fcn.00482a28
push dword [ebp - 0x1bc]
lea edx, [ebp - 0x1dc]
xor eax, eax
call fcn.00458468
push dword [ebp - 0x1dc]
lea edx, [ebp - 0x1e0]
xor eax, eax
call fcn.004582c8
push dword [ebp - 0x1e0]
lea edx, [ebp - 0x1e4]
xor eax, eax
call fcn.00458388
push dword [ebp - 0x1e4]
lea edx, [ebp - 0x1e8]
xor eax, eax
call fcn.004582c8
push dword [ebp - 0x1e8]
lea edx, [ebp - 0x1ec]
xor eax, eax
call fcn.004582e8
push dword [ebp - 0x1ec]
lea edx, [ebp - 0x1f0]
xor eax, eax
call fcn.00458108
push dword [ebp - 0x1f0]
lea edx, [ebp - 0x1f4]
xor eax, eax
call fcn.00458208
push dword [ebp - 0x1f4]
lea edx, [ebp - 0x1f8]
xor eax, eax
call fcn.00458508
push dword [ebp - 0x1f8]
lea edx, [ebp - 0x1fc]
xor eax, eax
call fcn.004584e8
push dword [ebp - 0x1fc]
lea edx, [ebp - 0x200]
xor eax, eax
call fcn.00458468
push dword [ebp - 0x200]
lea edx, [ebp - 0x204]
xor eax, eax
call fcn.00458228
push dword [ebp - 0x204]
lea edx, [ebp - 0x208]
xor eax, eax
call fcn.00458248
push dword [ebp - 0x208]
lea edx, [ebp - 0x20c]
xor eax, eax
call fcn.004582e8
push dword [ebp - 0x20c]
lea edx, [ebp - 0x210]
xor eax, eax
call fcn.00458108
push dword [ebp - 0x210]
lea edx, [ebp - 0x214]
xor eax, eax
call fcn.00458268
push dword [ebp - 0x214]
lea edx, [ebp - 0x218]
xor eax, eax
call fcn.00458088
push dword [ebp - 0x218]
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.004580e8
push dword [ebp - 0x21c]
lea edx, [ebp - 0x220]
xor eax, eax
call fcn.004583a8
push dword [ebp - 0x220]
lea edx, [ebp - 0x224]
xor eax, eax
call fcn.00458108
push dword [ebp - 0x224]
lea edx, [ebp - 0x228]
xor eax, eax
call fcn.00458348
push dword [ebp - 0x228]
lea edx, [ebp - 0x22c]
xor eax, eax
call fcn.00458108
push dword [ebp - 0x22c]
lea eax, [ebp - 4]
mov edx, 0x16
call fcn.00404ef0
jmp 0x47fdeb
lea edx, [ebp - 0x238]
xor eax, eax
call fcn.00458368
push dword [ebp - 0x238]
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.00458188
push dword [ebp - 0x23c]
lea edx, [ebp - 0x240]
xor eax, eax
call fcn.00458228
push dword [ebp - 0x240]
lea edx, [ebp - 0x244]
xor eax, eax
call fcn.004580e8
push dword [ebp - 0x244]
lea edx, [ebp - 0x248]
xor eax, eax
call fcn.00458188
push dword [ebp - 0x248]
lea edx, [ebp - 0x24c]
xor eax, eax
call fcn.004582a8
push dword [ebp - 0x24c]
lea eax, [ebp - 0x234]
mov edx, 6
call fcn.00404ef0
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x230]
call fcn.00482a28
push dword [ebp - 0x230]
lea edx, [ebp - 0x250]
xor eax, eax
call fcn.00458468
push dword [ebp - 0x250]
lea edx, [ebp - 0x254]
xor eax, eax
call fcn.00458228
push dword [ebp - 0x254]
lea edx, [ebp - 0x258]
xor eax, eax
call fcn.00458248
push dword [ebp - 0x258]
lea edx, [ebp - 0x25c]
xor eax, eax
call fcn.004582e8
push dword [ebp - 0x25c]
lea edx, [ebp - 0x260]
xor eax, eax
call fcn.00458108
push dword [ebp - 0x260]
lea edx, [ebp - 0x264]
xor eax, eax
call fcn.00458268
push dword [ebp - 0x264]
lea edx, [ebp - 0x268]
xor eax, eax
call fcn.00458088
push dword [ebp - 0x268]
lea edx, [ebp - 0x26c]
xor eax, eax
call fcn.004580e8
push dword [ebp - 0x26c]
lea edx, [ebp - 0x270]
xor eax, eax
call fcn.004583a8
push dword [ebp - 0x270]
lea edx, [ebp - 0x274]
xor eax, eax
call fcn.00458108
push dword [ebp - 0x274]
lea edx, [ebp - 0x278]
xor eax, eax
call fcn.00458348
push dword [ebp - 0x278]
lea edx, [ebp - 0x27c]
xor eax, eax
call fcn.00458108
push dword [ebp - 0x27c]
lea eax, [ebp - 4]
mov edx, 0xd
call fcn.00404ef0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
call fcn.0047f744
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.00402e9c
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x480026
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x54]
mov edx, dword [ebp - 0x1c]
lea esi, [edx + 0x18]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx + 0x14]
add esi, edx
mov edx, dword [ebp - 0x1c]
movzx edi, word [edx + 6]
dec edi
test edi, edi
jb 0x47fe59
inc edi
xor ebx, ebx
lea edx, [ebx + ebx*4]
cmp eax, dword [esi + edx*8 + 0x14]
jbe 0x47fe55
lea eax, [ebx + ebx*4]
mov eax, dword [esi + eax*8 + 0x14]
inc ebx
dec edi
jne 0x47fe45
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call fcn.00407804
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x54]
call fcn.0047f6cc
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
movzx edi, word [eax + 6]
dec edi
test edi, edi
jb 0x47fefb
inc edi
xor ebx, ebx
lea eax, [ebx + ebx*4]
mov eax, dword [esi + eax*8 + 0x10]
test eax, eax
jbe 0x47fed5
lea edx, [ebx + ebx*4]
cmp eax, dword [esi + edx*8 + 8]
jbe 0x47fea7
lea eax, [ebx + ebx*4]
mov eax, dword [esi + eax*8 + 8]
lea edx, [ebx + ebx*4]
mov edx, dword [esi + edx*8 + 0x14]
add edx, dword [ebp - 8]
mov ecx, eax
mov eax, dword [ebp - 0x18]
call fcn.00407804
lea eax, [ebx + ebx*4]
mov eax, dword [esi + eax*8 + 8]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x38]
call fcn.0047f6cc
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
jmp 0x47fef7
lea eax, [ebx + ebx*4]
cmp dword [esi + eax*8 + 8], 0
je 0x47fef7
lea eax, [ebx + ebx*4]
mov eax, dword [esi + eax*8 + 8]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x38]
call fcn.0047f6cc
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
inc ebx
dec edi
jne 0x47fe8c
lea eax, [ebp - 0x140]
xor ecx, ecx
mov edx, 0x44
call fcn.00403594
lea eax, [ebp - 0xec]
xor ecx, ecx
mov edx, 0xcc
call fcn.00403594
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x140]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
push 0
call sub.KERNEL32.DLL_GetExitCodeThread
mov dword [ebp - 0xec], 0x10007
lea eax, [ebp - 0xec]
push eax
mov eax, dword [ebp - 0xf8]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x48]
add eax, 8
push eax
mov eax, dword [ebp - 0xfc]
push eax
call sub.KERNEL32.DLL_GetStartupInfoA
push pe_nt_image_headers32
push 0x3000
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x34]
push eax
mov eax, dword [ebp - 0xfc]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x34]
push eax
mov eax, dword [ebp - 0xfc]
push eax
call sub.KERNEL32.DLL_TlsGetValue
lea eax, [ebp - 0x10]
push eax
push 4
mov eax, dword [ebp - 0x1c]
add eax, 0x34
push eax
mov eax, dword [ebp - 0x48]
add eax, 8
push eax
mov eax, dword [ebp - 0xfc]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 0x1c]
add eax, dword [edx + 0x28]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0xec]
push eax
mov eax, dword [ebp - 0xf8]
push eax
call sub.KERNEL32.DLL_InterlockedIncrement
mov eax, dword [ebp - 0xf8]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48002d
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040675c
pop ecx
ret