Function at 0x51d440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
push ebx
push esi
push edi
push 0
mov edi, ecx
mov dword [esp + 0x48], edx
mov esi, 0x400000
mov dword [esp + 0x34], edi
push esi
call dword [sym.imp.ntdll.dll_RtlCreateQueryDebugBuffer]
mov ebx, eax
test ebx, ebx
je 0x51d4b0
lea ecx, [ecx]
push ebx
push 0x80000014
push edi
call dword [sym.imp.ntdll.dll_RtlQueryProcessDebugInformation]
mov edi, eax
test edi, edi
jns 0x51d4cd
push ebx
call dword [sym.imp.ntdll.dll_RtlDestroyQueryDebugBuffer]
cmp edi, 0xc0000017
jne 0x51d4c1
lea eax, [esi + esi]
cmp eax, esi
jbe 0x51d4bc
mov esi, eax
push 0
push esi
call dword [sym.imp.ntdll.dll_RtlCreateQueryDebugBuffer]
mov edi, dword [esp + 0x30]
mov ebx, eax
test ebx, ebx
jne 0x51d470
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0xc0000001
lfence
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 0x38]
mov dword [esp + 0x1c], eax
mov eax, dword [eax]
test eax, eax
jne 0x51d4f2
push ebx
call dword [sym.imp.ntdll.dll_RtlDestroyQueryDebugBuffer]
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [eax]
lea ecx, [eax*8]
sub ecx, eax
cmp dword [0x62dbb0], 0x72
lea esi, [ecx*4 + 0x24]
push esi
push 4
push dword [0x6337d4]
jbe 0x51d537
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push esi
mov edi, eax
push 0
push edi
mov dword [esp + 0x48], edi
call fcn.00581cf0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [edi], ecx
jmp 0x51d556
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push esi
mov edi, eax
mov dword [esp + 0x40], eax
push 0
push edi
call fcn.00581cf0
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [edi], eax
mov eax, dword [ebx + 0x4c]
add esp, 0xc
cmp dword [edi], 0
mov dword [edi + 4], eax
mov dword [esp + 0x34], 0
jbe 0x51d7ad
xor ecx, ecx
mov dword [esp + 0x40], ebx
xor esi, esi
mov dword [esp + 0x20], ecx
lea eax, [edi + 0x14]
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x1c]
xor ebx, ebx
xor edx, edx
cmp dword [0x62dbb0], 0x72
mov eax, dword [eax]
jbe 0x51d5a8
add eax, 8
lea ecx, [ebx + 0x12]
add esi, eax
lea edi, [esp + 0x68]
jmp 0x51d5b6
lea esi, [eax + 4]
add esi, ecx
lea edi, [esp + 0x68]
mov ecx, 0x10
rep movsd dword es:[edi], dword ds:[esi]
mov esi, dword [esp + 0x78]
mov ecx, dword [esp + 0x80]
mov edi, dword [esp + 0x68]
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x18], esi
mov dword [esp + 0x28], ecx
test ecx, ecx
je 0x51d613
add eax, 8
mov esi, ecx
lea esp, [esp]
movzx ecx, word [eax - 4]
test cl, 1
je 0x51d5fc
add ebx, dword [eax - 8]
lea esp, [esp]
test cl, 2
je 0x51d607
add edx, dword [eax]
add eax, 0x10
sub esi, 1
jne 0x51d5f0
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x38]
cmp edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
cmovb edx, dword [esp + 0x2c]
mov dword [esi - 0xc], eax
cmp ebx, edx
mov eax, edx
mov dword [esi - 8], 0xffffffff
cmovbe eax, ebx
mov byte [esi - 4], 0xff
cmp dword [0x6355f0], 3
mov dword [esi + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x48]
mov dword [esi], ecx
mov dword [esi + 4], edi
mov dword [esi + 0xc], edx
mov dword [esp + 0x4c], 0
push eax
jl 0x51d672
mov edx, 0x1010
lea ecx, [esp + 0x18]
call fcn.00523a40
jmp 0x51d6cb
lea eax, [esp + 0x54]
mov dword [esp + 0x54], 0x18
push eax
push 0x1010
lea eax, [esp + 0x20]
mov dword [esp + 0x60], 0
push eax
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
call dword [sym.imp.ntdll.dll_NtOpenProcess]
jmp 0x51d6c0
cmp eax, 0xc0000022
je 0x51d77b
test eax, eax
js 0x51d77b
mov eax, dword [0x62dbb0]
mov dword [esp + 0x18], 0xffffffff
cmp eax, 0x3d
jb 0x51d710
push 0
push 4
lea eax, [esp + 0x20]
push eax
lea eax, [edi + 8]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
lea esp, [esp]
test eax, eax
js 0x51d70b
mov eax, dword [esp + 0x18]
mov dword [esi - 8], eax
mov eax, dword [0x62dbb0]
mov byte [esp + 0x13], 0xff
cmp eax, 0x64
jb 0x51d72b
push 0
lea eax, [esp + 0x17]
push 1
push eax
lea eax, [edi + 0xea]
jmp 0x51d756
cmp eax, 0x3f
jb 0x51d742
push 0
lea eax, [esp + 0x17]
push 1
push eax
lea eax, [edi + 0xd6]
jmp 0x51d756
cmp eax, 0x3d
jb 0x51d771
push 0
lea eax, [esp + 0x17]
push 1
push eax
lea eax, [edi + 0xda]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x51d771
mov al, byte [esp + 0x13]
mov byte [esi - 4], al
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x34]
add esi, 0x1c
mov edi, dword [esp + 0x3c]
inc ecx
add dword [esp + 0x24], 0x48
add dword [esp + 0x20], 0x40
mov dword [esp + 0x34], ecx
cmp ecx, dword [edi]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x38], esi
mov esi, dword [esp + 0x24]
jb 0x51d587
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
test eax, eax
je 0x51d7c7
push ebx
mov dword [eax], edi
call dword [sym.imp.ntdll.dll_RtlDestroyQueryDebugBuffer]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0
push dword [0x6337d4]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push ebx
call dword [sym.imp.ntdll.dll_RtlDestroyQueryDebugBuffer]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret