Function at 0x4573a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc848
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x520078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
lea edi, [esi + 1]
cmp dword [0x527484], esi
jne 0x4573eb
mov ecx, edi
call fcn.004572c0
mov esi, eax
test esi, esi
jne 0x45792c
mov eax, dword [0x527484]
test eax, eax
je 0x4573fb
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x527488]
mov ecx, eax
inc eax
mov dword [0x527488], eax
test ecx, ecx
jne 0x457911
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x45756f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.IsWow64Process2
push esi
mov dword [ebp - 0x58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x14], ax
test edi, edi
je 0x4574d9
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x58]
call dword [0x4e3310]
call edi
test eax, eax
je 0x4574d9
mov cx, word [ebp - 0x14]
cmp word [ebp - 0x18], 0
movzx edx, word [0x527710]
movzx eax, cx
cmovne edx, eax
movzx eax, cx
mov word [0x527710], dx
cmp eax, 0x8664
ja 0x4574c5
je 0x4574b8
cmp eax, 0x200
je 0x4574ab
cmp eax, 0x284
jne 0x45751d
mov eax, 7
mov word [0x52770c], ax
jmp 0x45751d
mov eax, 6
mov word [0x52770c], ax
jmp 0x45751d
mov eax, 9
mov word [0x52770c], ax
jmp 0x45751d
cmp eax, 0xaa64
jne 0x45751d
mov eax, 0xc
mov word [0x52770c], ax
jmp 0x45751d
push str.IsWow64Process
push esi
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x457503
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
push dword [ebp - 0x58]
call dword [0x4e3310]
call edi
cmp dword [ebp - 0x1c], 0
je 0x457516
mov eax, 0x8664
mov word [0x527710], ax
jmp 0x457522
mov dx, word [0x527710]
test dx, dx
je 0x457533
push str.Wow64EnableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x527728], eax
push 0x4fb308
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetTickCount64
push esi
mov dword [0x527718], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x527734], 0xf
jl 0x45756a
push str.PrefetchVirtualMemory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x527714], eax
mov edi, 1
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x527708], eax
test eax, eax
je 0x457695
push str.RtlNtStatusToDosError
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlInitUnicodeString
push dword [0x527708]
mov dword [0x52747c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtOpenFile
push dword [0x527708]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateFile
push dword [0x527708]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtReadFile
push dword [0x527708]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtWriteFile
push dword [0x527708]
mov dword [0x527724], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationFile
push dword [0x527708]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationFile
push dword [0x527708]
mov dword [0x527720], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryVirtualMemory
push dword [0x527708]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryObject
push dword [0x527708]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryVolumeInformationFile
push dword [0x527708]
mov dword [0x52771c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push dword [0x527708]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQuerySystemInformation
push dword [0x527708]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryDirectoryFile
push dword [0x527708]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtClose
push dword [0x527708]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x524808
push 8
call fcn.00493ea0
mov esi, eax
add esp, 8
test esi, esi
je 0x4576ce
mov dword [ebp - 4], 0xffffffff
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00457ac0
mov dword [esi], eax
jmp 0x4576d0
xor esi, esi
mov dword [0x526be4], esi
test esi, esi
jne 0x4576e4
mov esi, 8
jmp 0x457915
push 0x524808
push 8
call fcn.00493ea0
mov esi, eax
add esp, 8
test esi, esi
je 0x45771d
mov dword [ebp - 4], 0xffffffff
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00457a90
mov dword [esi], eax
jmp 0x45771f
xor esi, esi
mov dword [0x526be0], esi
test esi, esi
jne 0x457733
mov esi, 8
jmp 0x457915
cmp dword [0x527708], 0
je 0x45788e
push ecx
push 0x5276f0
push ecx
mov edx, str.RtlSetThreadErrorMode
call fcn.0045ad10
add esp, 0xc
cmp dword [0x5276ec], 0
jne 0x457771
push ecx
push 0x5276ec
push ecx
mov edx, str.RtlGetVersion
call fcn.0045ad10
add esp, 0xc
cmp dword [0x5276e8], 0
jne 0x45778e
push ecx
push 0x5276e8
push ecx
mov edx, str.RtlPcToFileHeader
call fcn.0045ad10
add esp, 0xc
push ecx
push 0x5276e4
push ecx
mov edx, str.LdrLockLoaderLock
call fcn.0045ad10
add esp, 8
mov edx, str.LdrUnlockLoaderLock
push 0x5276e0
push ecx
call fcn.0045ad10
add esp, 8
mov edx, str.NtQueryDirectoryFileEx
push 0x5276f4
push ecx
call fcn.0045ad10
add esp, 8
mov edx, str.NtWow64QueryInformationProcess64
push 0x527470
push ecx
call fcn.0045ad10
add esp, 8
mov edx, str.NtWow64GetNativeSystemInformation
push 0x527700
push ecx
call fcn.0045ad10
add esp, 8
mov edx, str.NtWow64QueryVirtualMemory64
push 0x5276fc
push ecx
call fcn.0045ad10
add esp, 8
mov edx, str.NtWow64ReadVirtualMemory64
push 0x5276f8
push ecx
call fcn.0045ad10
mov esi, dword [0x527700]
add esp, 0xc
test esi, esi
je 0x45788e
cmp word [0x52770c], 0
jne 0x457859
push 0
push 0xc
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push 1
call dword [0x4e3310]
call esi
movzx edx, word [0x52770c]
test eax, eax
movzx ecx, word [ebp - 0x28]
mov esi, dword [0x527700]
cmove edx, ecx
mov word [0x52770c], dx
push 0
push 0x2c
lea eax, [ebp - 0x54]
mov ecx, esi
push eax
push 0
call dword [0x4e3310]
call esi
test eax, eax
jne 0x45788e
mov eax, dword [ebp - 0x34]
mov dword [0x520a98], eax
movzx eax, byte [ebp - 0x2c]
mov dword [0x520a9c], 0
mov dword [0x520aa8], eax
jmp 0x457893
mov eax, dword [0x520aa8]
and ebx, 1
jne 0x4578c2
sub esp, 0xc
lea edx, [ebx + 0x10]
lea ecx, [ebp - 0x48]
push str.aswSP
call fcn.0045ba30
add esp, 8
mov edx, eax
mov ecx, 0x527704
call fcn.0045b450
mov eax, dword [0x520aa8]
add esp, 8
test eax, eax
cmove eax, edi
sub esp, 8
mov dword [0x520aa8], eax
call fcn.0045bd50
add esp, 8
call fcn.0045d2c0
call fcn.00457c50
call fcn.00457ca0
or dword [0x52748c], 2
mov ecx, 0x52772c
call fcn.0045b570
mov esi, eax
test esi, esi
jne 0x457915
test ebx, ebx
jne 0x45791a
push 0x4f594d
push ebx
call fcn.004c1cba
add esp, 8
jmp 0x45791a
test esi, esi
je 0x45791a
call fcn.00457950
mov eax, dword [0x527484]
test eax, eax
je 0x45792a
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049384c
mov esp, ebp
pop ebp
ret