Function at 0x401970
Capabilities:
Enumerate pe sections
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x40
mov edx, dword [ebp + 0x10]
push edx
push edi
call fcn.004013b4
test eax, eax
jne 0x401998
xor eax, eax
jmp 0x401c55
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
cmp word [ecx], 0x5a4d
je 0x4019b9
push 0xc1
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x401c55
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x3c]
add ecx, 0xf8
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
call fcn.004013b4
test eax, eax
jne 0x4019db
xor eax, eax
jmp 0x401c55
mov edx, dword [ebp - 4]
mov esi, dword [edx + 0x3c]
add esi, dword [ebp + 0xc]
cmp dword [esi], 0x4550
je 0x4019fd
push 0xc1
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x401c55
cmp word [esi + 4], 0x14c
je 0x401a16
push 0xc1
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x401c55
test byte [esi + 0x38], 1
je 0x401a2d
push 0xc1
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x401c55
movzx eax, word [esi + 0x14]
add eax, esi
mov edx, dword [esi + 0x38]
add eax, 0x18
xor ecx, ecx
mov dword [ebp - 0x10], edx
jmp 0x401a62
mov edx, dword [eax + 0x10]
test edx, edx
jne 0x401a4f
mov edx, dword [eax + 0xc]
add edx, dword [ebp - 0x10]
jmp 0x401a56
mov ebx, dword [eax + 0xc]
add ebx, edx
mov edx, ebx
cmp edx, dword [ebp - 0x14]
jbe 0x401a5e
mov dword [ebp - 0x14], edx
inc ecx
add eax, 0x28
movzx edx, word [esi + 6]
cmp ecx, edx
jb 0x401a40
lea eax, [ebp - 0x3c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x38]
mov ecx, dword [esi + 0x50]
mov edx, eax
add ecx, eax
dec edx
dec ecx
not edx
and ecx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov eax, dword [ebp - 0x38]
dec eax
dec ecx
not eax
and ecx, eax
cmp ecx, dword [ebp - 0x18]
je 0x401aaa
push 0xc1
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x401c55
push 4
push 0x3000
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [esi + 0x34]
push ecx
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401af0
push 4
push 0x3000
mov eax, dword [ebp - 0x18]
push eax
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401af0
push 0xe
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x401c55
push 0x34
push 8
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapAlloc
mov ebx, eax
test ebx, ebx
jne 0x401b23
push 0x8000
push 0
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_VirtualFree
push 0xe
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x401c55
mov edx, dword [ebp - 8]
mov dword [ebx + 4], edx
test byte [esi + 0x17], 0x20
setne cl
and ecx, 1
mov dword [ebx + 0x14], ecx
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x1c], eax
mov edx, dword [ebp + 0x18]
mov dword [ebx + 0x20], edx
mov ecx, dword [ebp + 0x1c]
mov dword [ebx + 0x24], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x28], eax
mov edx, dword [ebp - 0x38]
mov dword [ebx + 0x30], edx
mov ecx, dword [esi + 0x54]
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
call fcn.004013b4
test eax, eax
je 0x401c4c
push 4
push 0x1000
mov edx, dword [esi + 0x54]
push edx
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x54]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00403318
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov edx, dword [ebp - 8]
mov dword [eax + 0x34], edx
push ebx
push esi
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004013d4
test eax, eax
je 0x401c4c
mov edx, dword [ebx]
mov ecx, dword [edx + 0x34]
sub ecx, dword [esi + 0x34]
mov esi, ecx
test esi, esi
je 0x401bd9
push esi
push ebx
push edi
call fcn.00401738
mov dword [ebx + 0x18], eax
jmp 0x401be0
mov dword [ebx + 0x18], 1
push ebx
push edi
call fcn.004017c4
test eax, eax
je 0x401c4c
push ebx
push edi
call fcn.004015d4
test eax, eax
je 0x401c4c
push ebx
push edi
call fcn.004016f0
test eax, eax
je 0x401c4c
mov eax, dword [ebx]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x401c43
cmp dword [ebx + 0x14], 0
je 0x401c36
add eax, dword [ebp - 8]
push 0
push 1
mov edx, dword [ebp - 8]
push edx
call eax
test eax, eax
jne 0x401c2d
push 0x45a
call sub.KERNEL32.DLL_SetLastError
jmp 0x401c4c
mov dword [ebx + 0x10], 1
jmp 0x401c48
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
add eax, dword [ebp - 8]
mov dword [ebx + 0x2c], eax
jmp 0x401c48
xor edx, edx
mov dword [ebx + 0x2c], edx
mov eax, ebx
jmp 0x401c55
push ebx
push edi
call fcn.00401c8c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c