Function at 0x4061ec
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffa84
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1578], ebx
mov dword [ebp - 0x157c], ebx
mov esi, ecx
lea edi, [ebp - 0x1074]
mov ecx, 0x416
rep movsd dword es:[edi], dword [esi]
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004026ec
xor eax, eax
push ebp
push 0x40647a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
call fcn.00403b40
test al, al
jne 0x406295
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1474]
push eax
push 0x400
push 0
mov eax, dword [ebp - 4]
call fcn.004026fc
push eax
push 0
call sub.kernel32.dll_SearchPathA
test eax, eax
je 0x406295
cmp eax, 0x400
jae 0x406295
mov byte [ebp + eax - 0x1474], 0
lea eax, [ebp - 4]
lea edx, [ebp - 0x1474]
mov ecx, 0x400
call fcn.004024c0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004026fc
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x406454
xor edx, edx
push ebp
push 0x40644d
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4062e9
call fcn.00401d84
jmp 0x406454
cmp ebx, 0x800
jae 0x4062fb
call fcn.00401d84
jmp 0x406454
mov edi, esi
and edi, 2
test edi, edi
je 0x406317
mov eax, ebx
and eax, 7
test eax, eax
je 0x406317
call fcn.00401d84
jmp 0x406454
test edi, edi
je 0x40634a
push 0
lea eax, [ebp - 0x10]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x1574]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x406344
call fcn.00401d84
jmp 0x406454
sub ebx, 0x100
push 0x40
push 0x3000
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40636c
call fcn.00401d84
jmp 0x406454
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x40638e
call fcn.00401d84
jmp 0x406454
test edi, edi
je 0x4063d4
lea eax, [ebp - 0x1074]
call fcn.004048a4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x1074]
mov ecx, ebx
call fcn.004048bc
xor eax, eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.00404d48
mov eax, dword [ebp - 0x1574]
cmp eax, dword [ebp - 0x1c]
je 0x4063d4
call fcn.00401d84
jmp 0x406454
lea edx, [ebp - 0x157c]
mov eax, dword [ebp - 4]
call fcn.00403aa0
mov eax, dword [ebp - 0x157c]
lea edx, [ebp - 0x1578]
call fcn.00403a64
mov eax, dword [ebp - 0x1578]
mov edx, dword [0x4097ec]
call fcn.00402648
je 0x406411
test esi, 8
jne 0x406411
or esi, 4
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.00405e3c
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406454
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 0x18], 0
je 0x40644c
push 0x8000
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406481
lea eax, [ebp - 0x157c]
mov edx, 2
call fcn.0040235c
lea eax, [ebp - 4]
call fcn.00402338
ret