Function at 0x4012f0
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x417ab4]
mov ecx, dword [eax + 0x3c]
lea ebx, [ecx + eax]
mov edx, dword [ecx + eax + 0x34]
push 0x40
push 0x3000
push dword [ecx + eax + 0x50]
mov dword [esp + 0x14], edx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebp, eax
test eax, eax
jne 0x401336
push 0x40
push 0x3000
push dword [ebx + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebp, eax
mov dword [ebx + 0x34], ebp
push dword [ebx + 0x54]
push dword [0x417ab4]
push ebp
call fcn.00403100
add esp, 0xc
cmp word [ebx + 6], 0
je 0x401396
movzx eax, word [ebx + 0x14]
lea esi, [ebx + eax]
add esi, 0x18
add esi, 0x14
xor edi, edi
nop word cs:[eax + eax]
mov eax, dword [esi - 8]
add eax, ebp
mov ecx, dword [esi]
add ecx, dword [0x417ab4]
push dword [esi - 4]
push ecx
push eax
call fcn.00403100
add esp, 0xc
inc edi
movzx eax, word [ebx + 6]
add esi, 0x28
cmp edi, eax
jb 0x401370
mov dword [0x416aa8], 0
mov dword [esp + 4], ebx
mov eax, ebp
mov ebp, dword [ebx + 0x80]
mov dword [esp], eax
mov eax, dword [ebp + eax + 0xc]
test eax, eax
je 0x401477
add ebp, dword [esp]
jmp 0x4013ce
mov eax, dword [ebp + 0x20]
add ebp, 0x14
test eax, eax
je 0x401477
add eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x401533
mov edi, eax
mov ebx, dword [ebp + 0x10]
cmp dword [ebp + 4], 0xffffffff
jne 0x40141b
mov eax, dword [ebp]
mov esi, dword [esp]
mov ecx, dword [eax + esi]
cmp ecx, 0x10000000
jae 0x401405
lea eax, [ecx + esi]
add eax, 2
push eax
jmp 0x40140c
movzx ecx, cx
mov dword [esi + eax], ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [esi + ebx], eax
je 0x4013c0
mov ebx, dword [ebp]
mov eax, dword [esp]
mov eax, dword [ebx + eax]
test eax, eax
je 0x4013c0
mov ecx, dword [esp]
lea esi, [ebx + ecx]
mov ecx, ebx
mov ebx, esi
sub ebx, ecx
jmp 0x401469
mov ecx, dword [esp]
add eax, ecx
add eax, 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebx + ecx], eax
mov eax, dword [esi + 4]
add esi, 4
add ebx, 4
test eax, eax
je 0x4013c0
cmp eax, 0x10000000
jb 0x401440
movzx eax, ax
mov dword [esi], eax
jmp 0x401448
mov edx, dword [esp + 4]
cmp dword [edx + 0x8c], 0
je 0x4014a8
jmp 0x401496
jmp 0x4014a8
mov esi, dword [esp]
mov ecx, esi
sub ecx, dword [esp + 8]
je 0x401605
jmp 0x4014c9
mov edx, dword [esi + 0x3c]
cmp dword [edx + esi + 0xa0], 0
je 0x4015ec
jmp 0x4014ec
mov eax, dword [esp]
mov esi, dword [eax + edx + 0xa4]
jmp 0x401508
mov dword [esp + 0x14], esi
test esi, esi
je 0x4015ec
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp]
mov edx, dword [eax + edx + 0xa0]
add edx, eax
mov dword [esp + 0x10], edx
xor ebp, ebp
jmp 0x401563
push 0x4000
mov eax, dword [esp + 8]
push dword [eax + 0x50]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor esi, esi
jmp 0x401608
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 4]
add ebp, eax
cmp ebp, dword [esp + 0x14]
jae 0x4015ec
mov eax, dword [esp + 0x10]
mov edx, dword [eax + ebp]
test edx, edx
je 0x4015ec
mov eax, dword [esp + 0x10]
add eax, ebp
mov dword [esp + 0xc], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x4015ec
lea ebx, [eax - 8]
cmp ebx, 2
jb 0x401557
mov eax, dword [esp + 0xc]
lea edi, [eax + 8]
shr ebx, 1
movzx esi, word [edi]
cmp esi, 0x1000
jb 0x401550
mov eax, esi
and eax, 0xf000
cmp eax, 0x3000
jne 0x4015ec
and esi, 0xfff
add esi, edx
cmp esi, dword [esp + 8]
jae 0x4015ec
mov eax, dword [esp]
add dword [esi + eax], ecx
jmp 0x4015cf
add edi, 2
jmp 0x4015e4
dec ebx
jne 0x401590
jmp 0x401550
jmp 0x4015fe
mov edx, dword [esp + 4]
mov esi, dword [esp]
add esi, dword [edx + 0x28]
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret