Function at 0x10001ac4
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 0x1000c140
push 0x1000c14c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
nop
nop
nop
nop
nop
nop
nop
mov byte [ebp - 0x20], 0x56
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x63
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0
push str.VirtualProtect
push 0x1000c16c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
inc eax
inc ebx
sub ebx, 2
dec eax
inc ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
xor edx, edx
mov dx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 8], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], 0
jmp 0x10001b89
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
xor edx, edx
mov dx, word [ecx + 6]
cmp dword [ebp - 0xc], edx
jge 0x10001ce1
inc eax
inc ebx
sub ebx, 2
dec eax
inc ebx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x20000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
and eax, 0x40000000
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0x80000000
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x24], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x2000000
test ecx, ecx
je 0x10001c21
inc eax
inc ebx
sub ebx, 2
dec eax
inc ebx
push 0x4000
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10001b77
nop
nop
nop
nop
mov eax, dword [ebp - 0x28]
shl eax, 4
mov ecx, dword [ebp - 0x38]
lea edx, [eax + ecx*8 + 0x1000c040]
mov eax, dword [ebp - 0x24]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
and eax, 0x4000000
test eax, eax
je 0x10001c56
mov ecx, dword [ebp - 0x30]
or ch, 2
mov dword [ebp - 0x30], ecx
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x10001ca0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0x40
test edx, edx
je 0x10001c85
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x2c], edx
jmp 0x10001ca0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x80
test ecx, ecx
je 0x10001ca0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x2c], ecx
inc eax
inc ebx
sub ebx, 2
dec eax
inc ebx
cmp dword [ebp - 0x2c], 0
jbe 0x10001cdc
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [ebp - 0x10]
test eax, eax
jne 0x10001cdc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x10001b77
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret