Function at 0x529e60
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
sub esp, 0x1c
mov edx, ecx
mov eax, 0x5a4d
push ebx
mov dword [esp + 4], edx
cmp word [edx], ax
je 0x529e81
mov eax, 0xc000012f
lfence
pop ebx
add esp, 0x1c
ret
mov eax, dword [edx + 0x3c]
test eax, eax
je 0x52a0c4
cmp eax, 0x7fffffff
jae 0x52a0c4
cmp dword [eax + edx], 0x4550
lea ebx, [eax + edx]
mov dword [esp + 0xc], ebx
jne 0x52a0c4
mov ecx, dword ds:[ebx + 0xa0]
lea eax, [ebx + 0xa0]
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x52a0b7
cmp dword [eax + 4], 0
je 0x52a0b7
test byte [ebx + 0x16], 1
push ebp
lea ebp, [ecx + edx]
mov dword [esp + 0xc], 0
je 0x529eec
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
push esi
push edi
lea ecx, [ebx + 6]
xor edi, edi
xor esi, esi
mov dword [esp + 0x1c], ecx
cmp di, word [ecx]
jae 0x529f6a
nop
movzx ecx, word [ebx + 0x14]
add ecx, edi
mov dword [esp + 0x14], 0
mov eax, dword [ecx + ebx + 0x24]
add eax, edx
mov dword [esp + 0x24], eax
mov eax, dword [ecx + ebx + 0x28]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov ecx, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
js 0x529f5d
mov eax, dword [esp + 0x1c]
inc esi
mov edx, dword [esp + 0x10]
add edi, 0x28
movzx eax, word [eax]
cmp esi, eax
jb 0x529f00
mov eax, dword [esp + 0x28]
jmp 0x529f6e
pop edi
pop esi
pop ebp
lfence
mov eax, ecx
pop ebx
add esp, 0x1c
ret
mov dword [esp + 0x18], ebx
lfence
mov eax, dword [eax + 4]
mov edi, edx
sub edi, dword [ebx + 0x34]
add eax, ebp
mov dword [esp + 0x24], eax
cmp ebp, eax
jae 0x529ff3
mov ebx, dword [ebp + 4]
lea eax, [ebp + 4]
mov esi, dword [ebp]
sub ebx, 8
add esi, edx
mov dword [esp + 0x28], eax
xor edx, edx
shr ebx, 1
je 0x529fe3
nop dword [eax]
movzx eax, word [ebp + edx*2 + 8]
mov ecx, eax
shr ecx, 0xc
sub ecx, 2
je 0x529fd1
sub ecx, 1
je 0x529fc7
sub ecx, 7
jne 0x529fda
and eax, 0xfff
add dword [eax + esi], edi
adc dword [eax + esi + 4], ecx
jmp 0x529fda
and eax, 0xfff
add dword [eax + esi], edi
jmp 0x529fda
and eax, 0xfff
add word [eax + esi], di
inc edx
cmp edx, ebx
jb 0x529fa0
mov eax, dword [esp + 0x28]
add ebp, dword [eax]
mov edx, dword [esp + 0x10]
cmp ebp, dword [esp + 0x24]
jb 0x529f84
mov ebx, dword [esp + 0x18]
mov eax, dword ds:[esp + 0x1c]
xor ecx, ecx
xor esi, esi
cmp cx, word [eax]
jae 0x52a0ab
xor edi, edi
lea ebp, [esi + 8]
nop
movzx ecx, word [ebx + 0x14]
add ecx, edi
mov dword [esp + 0x28], 0
mov eax, dword [ecx + ebx + 0x24]
add eax, edx
mov dword [esp + 0x20], eax
mov eax, dword [ecx + ebx + 0x28]
mov dword [esp + 0x24], eax
mov eax, 0x10
mov ecx, dword [ecx + ebx + 0x3c]
mov edx, ecx
shr edx, 0x1d
and edx, 2
test ecx, ecx
cmovs edx, ebp
test ecx, 0x20000000
cmovne edx, eax
mov eax, ecx
and eax, 0x60000000
cmp eax, 0x60000000
mov eax, 0x20
cmove edx, eax
and ecx, 0xa0000000
cmp ecx, 0xa0000000
mov eax, 0x40
cmove edx, eax
lea eax, [esp + 0x28]
push eax
push edx
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x2c]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov dword [esp + 0x14], eax
test eax, eax
js 0x52a0ab
movzx eax, word [ebx + 6]
inc esi
mov edx, dword [esp + 0x10]
add edi, 0x28
cmp esi, eax
jb 0x52a010
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lfence
mov eax, 0xc0000020
pop ebx
add esp, 0x1c
ret
mov eax, 0xc000007b
lfence
pop ebx
add esp, 0x1c
ret