Function at 0x520dc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a30c0
mov eax, dword fs:[0]
push eax
sub esp, 0x8c4
mov eax, dword [0x60ef40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 0x8b4], eax
mov dword [ebp - 0x898], 0x1438
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x420], 0
jne 0x520e1c
mov edx, dword [ebp - 0x898]
or edx, 2
mov dword [ebp - 0x898], edx
mov eax, dword [ebp - 0x898]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x418]
push edx
lea eax, [ebp - 0x8d0]
push eax
call fcn.0051e6a0
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x8d0]
call fcn.004f40e0
movzx ecx, al
test ecx, ecx
je 0x520e8f
push 0x14
push 1
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x8b4]
push eax
call fcn.005208b0
add esp, 0x10
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d0]
call fcn.0051f4c0
mov eax, dword [ebp - 0x8b8]
jmp 0x521359
push 0x430
push 0
lea ecx, [ebp - 0x87c]
push ecx
call fcn.00537090
add esp, 0xc
mov dword [ebp - 0x460], 1
mov dword [ebp - 0x45c], 0
push 0x208
lea edx, [ebp - 0x878]
push edx
call fcn.0052b380
add esp, 8
push 0x5d492c
push 0x410
lea eax, [ebp - 0x878]
push eax
call fcn.00521780
mov dword [ebp - 0x884], 0
mov dword [ebp - 0x880], 0
lea ecx, [ebp - 0x8d0]
mov dword [ebp - 0x8a4], ecx
mov ecx, dword [ebp - 0x8a4]
call fcn.0043d900
mov dword [ebp - 0x894], eax
mov ecx, dword [ebp - 0x8a4]
call fcn.00426d50
mov dword [ebp - 0x8bc], eax
jmp 0x520f36
mov edx, dword [ebp - 0x894]
add edx, 0xc
mov dword [ebp - 0x894], edx
mov eax, dword [ebp - 0x894]
cmp eax, dword [ebp - 0x8bc]
je 0x52131f
mov ecx, dword [ebp - 0x894]
mov edx, dword [ecx]
mov dword [ebp - 0x44c], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x448], eax
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x444], ecx
mov edx, dword [ebp - 0x44c]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 0
jne 0x520fa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ebp - 0x884], 0x12
jmp 0x520f27
mov edx, dword [ebp - 0x880]
push edx
call fcn.0052b580
add esp, 4
movzx eax, al
test eax, eax
je 0x520fce
mov ecx, dword [ebp - 0x880]
push ecx
call fcn.0052b4d0
add esp, 4
movzx edx, al
test edx, edx
jne 0x520ff5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ebp - 0x884], 0x15
mov edx, dword [ebp - 0x880]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x520f27
mov dword [ebp - 0x888], 0
push str.GH_Injector___x86.dll
mov eax, dword [ebp - 0x880]
push eax
call fcn.0051fbf0
add esp, 8
mov dword [ebp - 0x888], eax
cmp dword [ebp - 0x888], 0
jne 0x521085
mov ecx, dword [ebp - 0x44c]
mov dword [ebp - 0x464], ecx
lea edx, [ebp - 0x87c]
push edx
call sym.WhatsApp.exe_InjectW
mov dword [ebp - 0x8a8], eax
cmp dword [ebp - 0x8a8], 0
jne 0x521052
cmp dword [ebp - 0x450], 0
jne 0x521079
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x8a8]
mov dword [eax], ecx
mov dword [ebp - 0x884], 0x16
mov edx, dword [ebp - 0x880]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x520f27
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x888], eax
mov dword [ebp - 0x8ac], 0
lea ecx, [ebp - 0x8ac]
push ecx
push 0x5d4970
mov edx, dword [ebp - 0x888]
push edx
mov eax, dword [ebp - 0x880]
push eax
call fcn.0051fd40
add esp, 0x10
mov byte [ebp - 0x889], al
movzx ecx, byte [ebp - 0x889]
test ecx, ecx
jne 0x5210f4
mov dword [ebp - 0x884], 0x1a
mov edx, dword [ebp - 0x888]
push edx
mov eax, dword [ebp - 0x880]
push eax
call fcn.0051e630
add esp, 8
mov ecx, dword [ebp - 0x880]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x520f27
movzx edx, word [ebp - 0x448]
mov eax, dword [ebp + 8]
mov dword [eax + 0x428], edx
push 0x40
push 0x3000
push 0x430
push 0
mov ecx, dword [ebp - 0x880]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x890], eax
cmp dword [ebp - 0x890], 0
jne 0x52116b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov dword [ebp - 0x884], 0x17
mov eax, dword [ebp - 0x888]
push eax
mov ecx, dword [ebp - 0x880]
push ecx
call fcn.0051e630
add esp, 8
mov edx, dword [ebp - 0x880]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x520f27
push 0
push 0x430
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x890]
push ecx
mov edx, dword [ebp - 0x880]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x5211e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ebp - 0x884], 0x18
push 0x8000
push 0
mov edx, dword [ebp - 0x890]
push edx
mov eax, dword [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0x888]
push ecx
mov edx, dword [ebp - 0x880]
push edx
call fcn.0051e630
add esp, 8
mov eax, dword [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x520f27
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x428], 0
mov dword [ebp - 0x8b0], 0
mov dword [ebp - 0x8a0], 0
lea edx, [ebp - 0x8a0]
push edx
lea eax, [ebp - 0x8b0]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x890]
push ecx
mov edx, dword [ebp - 0x8ac]
push edx
mov eax, dword [ebp - 0x880]
push eax
call fcn.005241c0
add esp, 0x1c
mov dword [ebp - 0x89c], eax
push 0x430
push 0
lea ecx, [ebp - 0x440]
push ecx
call fcn.00537090
add esp, 0xc
push 0
push 0x430
lea edx, [ebp - 0x440]
push edx
mov eax, dword [ebp - 0x890]
push eax
mov ecx, dword [ebp - 0x880]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x8000
push 0
mov edx, dword [ebp - 0x890]
push edx
mov eax, dword [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0x888]
push ecx
mov edx, dword [ebp - 0x880]
push edx
call fcn.0051e630
add esp, 8
mov eax, dword [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x89c], 0
je 0x5212d9
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x8b0]
mov dword [ecx], edx
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x884], eax
jmp 0x520f27
cmp dword [ebp - 0x89c], 0
jne 0x521305
cmp dword [ebp - 0x8a0], 0
je 0x521305
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x8a0]
mov dword [ecx], edx
mov dword [ebp - 0x884], 0x1d
jmp 0x520f27
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [ebp - 0x884], 0
jmp 0x52131f
mov ecx, dword [ebp - 0x884]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x8b4]
push eax
call fcn.005208b0
add esp, 0x10
mov dword [ebp - 0x8c0], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d0]
call fcn.0051f4c0
mov eax, dword [ebp - 0x8c0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00534c20
mov esp, ebp
pop ebp
ret