Function at 0x4c0dc0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [edx + 0x80]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x18], esi
push edi
test eax, eax
je 0x4c107c
cmp dword [edx + 0x84], 0
je 0x4c107c
lea edi, [eax + esi]
lea eax, [esp + 0x24]
mov dword [esp + 0x18], edi
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.004c0870
test eax, eax
js 0x4c1081
lea eax, [esp + 0x20]
push eax
push 4
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x34]
push eax
push 0xffffffffffffffff
lfence
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
js 0x4c1081
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x4c105a
lea esp, [esp]
lea ebx, [ecx + esi]
mov dword [esp + 0x34], edi
mov ecx, dword [edi + 0x10]
mov dword [esp + 0x2c], ebx
lea eax, [ecx + esi]
mov dword [esp + 0x30], eax
mov eax, dword [edi]
test eax, eax
cmovne ecx, eax
mov eax, ebx
lea edi, [ecx + esi]
mov ecx, 0x598874
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c0e9a
lea esp, [esp]
test dl, dl
je 0x4c0e96
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c0e9a
add eax, 2
add ecx, 2
test dl, dl
jne 0x4c0e76
xor eax, eax
jmp 0x4c0e9f
sbb eax, eax
or eax, 1
nop
test eax, eax
jne 0x4c0eb3
mov esi, dword [0x5cd528]
mov dword [esp + 0x10], eax
jmp 0x4c0f79
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4c0eb6
push dword [0x5cd4f8]
sub ebx, ecx
lea esi, [ebx + ebx]
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov dword [esp + 0x14], eax
lea ecx, [eax + 8]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov word [ecx + esi], dx
push dword [eax + 4]
push ebx
push dword [esp + 0x34]
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov ebx, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
call fcn.004c05e0
mov esi, eax
test esi, esi
jne 0x4c0f56
mov ebx, dword [ebx + 4]
push 0x800
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4c0f2d
push 0xa00
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x4c0f35
xor ebx, ebx
mov dword [esp + 0x10], ebx
jmp 0x4c0f5a
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jle 0x4c0f5a
movzx ebx, bx
or ebx, 0xc0070000
mov dword [esp + 0x10], ebx
jmp 0x4c0f5a
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
or eax, 0xffffffff
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4c0f71
call fcn.004c1f60
test ebx, ebx
js 0x4c1051
lea esp, [esp]
test esi, esi
je 0x4c1045
mov ecx, dword [edi]
test ecx, ecx
je 0x4c101a
mov ebx, dword [esp + 0x30]
sub ebx, edi
test ecx, ecx
jns 0x4c0ff5
movzx ecx, word [edi]
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4c0fe9
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4c0fe9
cmp eax, 0x7fffffff
jae 0x4c0fe9
cmp dword ds:[eax + esi], 0x4550
jne 0x4c0fe9
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x4c0fe9
cmp dword [edx + 4], 0
je 0x4c0fe9
push ecx
add eax, esi
mov ecx, esi
push 0
push eax
call fcn.004c0900
test eax, eax
jne 0x4c100e
mov eax, 0xc0000138
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x1c]
movzx eax, word [ecx + edx]
add edx, 2
add edx, ecx
mov ecx, esi
push eax
call fcn.004c0b40
test eax, eax
je 0x4c1039
mov dword [ebx + edi], eax
add edi, 4
mov ecx, dword [edi]
test ecx, ecx
jne 0x4c0f9a
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x18]
add edi, 0x14
mov dword [esp + 0x18], edi
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x4c105a
mov esi, dword [esp + 0x1c]
jmp 0x4c0e50
mov eax, 0xc000007a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x24]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x34]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xc0000020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret