Function at 0x4641e0
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
pop esi
push 0x18
pop ecx
push 0
push 0
dec ecx
jne 0x4641e8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
sub eax, eax
push ebp
push 0x4648d3
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x464209
jmp 0x46420c
push ebx
pop ebx
nop
jmp 0x464212
nop
mov byte [ebp - 9], 0
mov eax, 0x105
call fcn.00402ce4
mov dword [ebp - 0x10], eax
push 0x105
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
xor eax, eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x48], eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
push eax
pop esi
push esi
pop eax
call fcn.00402ce4
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x20]
push eax
push esi
mov edi, dword [ebp - 0x14]
push edi
push ebx
call sub.kernel32.dll_ReadFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
push 1
push 0x2000
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x50]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [ebp - 0x18], ebx
push 4
push 0x1000
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x54]
push eax
push ebx
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x54]
mov edx, dword [ebp - 0x3c]
mov eax, edi
call fcn.00402ee0
mov eax, dword [ebp - 0x24]
add eax, 0x18
mov edx, dword [ebp - 0x24]
movzx edx, word [edx + 0x14]
add eax, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
movzx esi, word [eax + 6]
dec esi
or esi, esi
jl 0x464395
inc esi
xor edi, edi
nop
nop
nop
nop
push ecx
pop ecx
nop
lea eax, [edi + edi*4]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + eax*8 + 8]
mov dword [ebp - 0x40], eax
lea eax, [edi + edi*4]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + eax*8 + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x44]
jae 0x464338
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x40]
push eax
lea eax, [edi + edi*4]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + eax*8 + 0xc]
add eax, ebx
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
sub ecx, ecx
mov edx, dword [ebp - 0x40]
call fcn.00403720
lea eax, [edi + edi*4]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + eax*8 + 0x14]
add eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
call fcn.00402ee0
push 0x8000
push 0
mov eax, dword [ebp - 0x3c]
push eax
call sub.kernel32.dll_VirtualFree_1
inc edi
dec esi
jne 0x464309
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x78]
push ebx
pop edx
add eax, edx
mov edi, dword [eax + 0x20]
add edi, edx
mov ecx, dword [eax + 0x1c]
add ecx, edx
mov dword [ebp - 0x34], ecx
mov esi, dword [eax + 0x18]
dec esi
test esi, esi
jl 0x4643fe
inc esi
nop
nop
nop
jmp 0x4643bb
jmp 0x4643be
push edi
pop edi
nop
mov edx, dword [edi]
push ebx
pop eax
add edx, eax
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x34]
mov edx, dword [edx]
add edx, eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x4643f4
jmp 0x4643e8
nop
pushal
popal
nop
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
jmp 0x4643fe
add edi, 4
add dword [ebp - 0x34], 4
dec esi
jne 0x4643b5
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetModuleHandleA_2
push eax
pop ebx
mov eax, ebx
mov eax, dword [eax + 0x3c]
mov edx, ebx
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x78]
add eax, edx
mov edi, dword [eax + 0x20]
add edi, edx
mov ecx, dword [eax + 0x1c]
add ecx, edx
mov dword [ebp - 0x34], ecx
mov esi, dword [eax + 0x18]
dec esi
or esi, esi
jl 0x464480
inc esi
pushal
popal
push ebx
pop ebx
nop
nop
nop
jmp 0x46443d
pushal
popal
nop
nop
push edi
pop edi
mov edx, dword [edi]
push ebx
pop eax
add edx, eax
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x34]
mov edx, dword [edx]
add edx, eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x464476
push edi
pop edi
nop
jmp 0x46446d
nop
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
jmp 0x464480
add edi, 4
add dword [ebp - 0x34], 4
dec esi
jne 0x464433
cmp dword [ebp - 0x48], 0
je 0x464885
cmp dword [ebp - 0x4c], 0
je 0x464885
nop
mov eax, dword [ebp - 0x4c]
cmp byte [eax], 0
je 0x464885
mov eax, dword [ebp - 0x48]
cmp byte [eax], 0
je 0x464885
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
mov edx, dword [ebp - 0x48]
cmp al, byte [edx]
je 0x464885
jmp 0x4644c1
nop
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x48]
call fcn.004641b4
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x58]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x58]
mov edx, 0x4648f0
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x5c]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x5c]
mov edx, 0x464904
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x60]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x60]
mov edx, 0x464918
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x64]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x64]
mov edx, 0x464930
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x68]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x68]
mov edx, 0x464948
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x6c]
mov edx, 0x46495c
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x70]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x70]
mov edx, 0x464978
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x74]
mov edx, 0x464994
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x78]
mov edx, 0x4649b4
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x7c]
mov edx, 0x4649d0
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x80]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x80]
mov edx, 0x4649e8
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x84]
mov edx, 0x464a00
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x88]
mov edx, 0x464a14
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x8c]
mov edx, 0x464a2c
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x90]
mov edx, 0x464a44
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x94]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x94]
mov edx, 0x464a60
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x98]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x98]
mov edx, 0x464a80
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0x9c]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0x9c]
mov edx, 0x464a44
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0xa0]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0xa0]
mov edx, 0x464aa0
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0xa4]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0xa4]
mov edx, 0x464ab4
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0xa8]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0xa8]
mov edx, 0x464ac4
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0xac]
mov edx, 0x464adc
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0xb0]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0xb0]
mov edx, 0x464af4
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0xb4]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0xb4]
mov edx, 0x464b0c
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0xb8]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0xb8]
mov edx, 0x464b24
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0xbc]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0xbc]
mov edx, 0x464b3c
call fcn.004051b0
je 0x46484b
lea eax, [ebp - 0xc0]
mov edx, dword [ebp - 8]
call fcn.00404f98
mov eax, dword [ebp - 0xc0]
mov edx, 0x464b54
call fcn.004051b0
jne 0x464885
jmp 0x46484e
nop
lea eax, [ebp - 0x50]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.kernel32.dll_VirtualProtect
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
call fcn.0040774c
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp - 0x10]
call fcn.00402d00
mov eax, dword [ebp - 0x14]
call fcn.00402d00
push 0x8000
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualFree_1
push 0x8000
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_VirtualFree_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4648da
lea eax, [ebp - 0xc0]
push 0x1b
pop edx
pushal
popal
call fcn.00404dc4
ret