Function at 0x4072a0
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x15c
mov edx, dword [0x41d008]
mov ebx, dword [ebp + 8]
test edx, edx
je 0x40750d
mov dword [ebp - 0xcc], edx
mov esi, dword [sym.imp.ucrtbase.dll_strcmp]
mov edi, edx
jmp 0x4072d7
mov edi, dword [edi + 0x44]
test edi, edi
je 0x4072f8
mov eax, dword [edi + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call esi
test eax, eax
jne 0x4072d0
add dword [edi + 0x48], 1
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
mov eax, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp], ebx
mov dword [ebp - 0xd0], eax
call eax
mov dword [esp], 1
mov esi, eax
lea eax, [eax + 0xad]
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_calloc]
mov edi, eax
test eax, eax
je 0x407412
mov edx, dword [ebp - 0xcc]
lea eax, [eax + 0xac]
add esi, 1
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 8], eax
mov dword [edi + 0x44], edx
mov dword [edi + 0x48], 1
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
mov edx, dword [ebp - 0xcc]
mov dword [0x41d008], edi
mov dword [edx + 0x40], edi
lea eax, [ebp - 0xa0]
mov dword [esp], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_OpenFile]
sub esp, 0xc
mov ebx, eax
cmp eax, 0xffffffff
je 0x407405
lea eax, [ebp - 0xb0]
mov dword [esp + 8], 0x10
mov esi, dword [sym.imp.kernel32.dll__hread]
mov dword [esp + 4], eax
mov dword [esp], ebx
call esi
sub esp, 0xc
cmp eax, 0x10
jne 0x407420
movzx eax, byte [ebp - 0xad]
movzx edx, byte [ebp - 0xae]
movzx ecx, byte [ebp - 0xb0]
shl eax, 8
add eax, edx
movzx edx, byte [ebp - 0xaf]
shl eax, 0x10
shl edx, 8
add edx, ecx
movzx edx, dx
add eax, edx
cmp eax, 0x35f3f
je 0x40744f
test byte [0x415010], 4
jne 0x407de0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll__lclose]
sub esp, 4
sub dword [edi + 0x48], 1
jne 0x407412
mov eax, edi
call fcn.00401cf0
xor edi, edi
jmp 0x4072eb
test byte [0x415010], 4
je 0x4073f9
mov dword [esp + 0xc], str.header_n
mov dword [esp + 8], str.HLPFILE_ReadFileToBuffer
mov dword [esp + 4], 0x415010
mov dword [esp], 2
call fcn.004021c0
jmp 0x4073f9
movzx edx, byte [ebp - 0xa1]
movzx eax, byte [ebp - 0xa2]
movzx ecx, byte [ebp - 0xa4]
shl edx, 8
add edx, eax
movzx eax, byte [ebp - 0xa3]
shl edx, 0x10
shl eax, 8
add eax, ecx
movzx eax, ax
add edx, eax
lea eax, [edx + 1]
mov dword [edi + 4], edx
mov dword [ebp - 0xcc], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0xd8], eax
call eax
mov edx, dword [ebp - 0xcc]
test eax, eax
mov dword [edi], eax
je 0x4073f9
mov ecx, dword [ebp - 0xb0]
sub edx, 0x10
add eax, 0x10
mov dword [eax - 0x10], ecx
mov ecx, dword [ebp - 0xac]
mov dword [eax - 0xc], ecx
mov ecx, dword [ebp - 0xa8]
mov dword [eax - 8], ecx
mov ecx, dword [ebp - 0xa4]
mov dword [eax - 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call esi
mov edx, eax
mov eax, dword [edi + 4]
sub esp, 0xc
sub eax, 0x10
cmp edx, eax
je 0x40757c
test byte [0x415010], 4
je 0x4073f9
mov dword [esp + 0xc], str.filesize1_n
jmp 0x407431
mov eax, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp], ebx
mov dword [ebp - 0xd0], eax
call eax
mov dword [esp], 1
mov esi, eax
lea eax, [eax + 0xad]
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_calloc]
mov edi, eax
test eax, eax
je 0x407412
lea eax, [edi + 0xac]
add esi, 1
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 8], eax
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 1
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
mov dword [0x41d008], edi
jmp 0x40736d
lea eax, [ebp - 0xb4]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], ebx
call esi
sub esp, 0xc
test eax, eax
je 0x4075a7
test byte [0x415010], 4
jne 0x409d5f
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov byte [edx + eax], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll__lclose]
lea eax, [ebp - 0xb0]
lea ecx, [ebp - 0xb4]
mov dword [edi + 0xc], 0
sub esp, 4
mov edx, str.SYSTEM
mov dword [esp], eax
mov eax, edi
call fcn.00402f30
test eax, eax
je 0x407405
mov ebx, dword [ebp - 0xb4]
movzx esi, byte [ebx + 0xa]
movzx eax, byte [ebx + 9]
movzx edx, byte [ebx + 0xb]
shl esi, 8
add esi, eax
movzx eax, byte [ebx + 0xc]
shl eax, 8
lea ecx, [eax + edx]
movzx eax, byte [ebx + 0xe]
shl eax, 8
mov edx, eax
movzx eax, byte [ebx + 0xd]
add eax, edx
movzx edx, byte [ebx + 0x13]
mov word [ebp - 0xcc], ax
movzx eax, byte [ebx + 0x14]
shl eax, 8
add edx, eax
test byte [0x415010], 8
jne 0x4081bb
cmp si, 0x36c
jne 0x407daa
cmp word [ebp - 0xcc], 1
jne 0x407daa
cmp cx, 0x10
ja 0x407ded
mov eax, 0x7f4
invalid