Function at 0x10177dd0
Capabilities:
Check processdebugport

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
mov ebx, ecx
lea edi, [ebp - 0x4c]
pop ecx
xor eax, eax
xor edx, edx
push 7
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x28]
mov dword [ebp - 0x2c], edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], edx
push eax
push 0x18
lea eax, [ebp - 0x4c]
mov dword [ebp - 0xc], edx
push eax
push edx
push ebx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x50], edx
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov esi, eax
test esi, esi
jns 0x10177e38
or esi, 0x10000000
push 0x100777c8
push 1
push esi
jmp 0x10177fb9
cmp dword [ebp - 8], 0x18
je 0x10177e48
push 0x10077798
jmp 0x10177faf
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x48]
add eax, 0x10
push eax
push ebx
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_ReadProcessMemory]
test eax, eax
jne 0x10177e89
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10177e7b
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10177e82
mov esi, 0x80004005
push 0x10077820
jmp 0x10177e30
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x2c]
add eax, 0x40
push eax
push ebx
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_ReadProcessMemory]
test eax, eax
jne 0x10177ecd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10177ebc
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10177ec3
mov esi, 0x80004005
push 0x100777fc
jmp 0x10177e30
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x30]
push ebx
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualQueryEx]
test eax, eax
jne 0x10177f09
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10177ef8
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10177eff
mov esi, 0x80004005
push 0x10077870
jmp 0x10177e30
cmp dword [ebp - 0x10], 0x20000
jne 0x10177faa
cmp dword [ebp - 0x14], 4
jne 0x10177faa
push dword [ebp + 0xc]
lea eax, [ebp - 0x50]
push dword [ebp + 8]
push 0x10050fe8
push eax
call fcn.100a6b40
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x10177f47
push 0x100778b8
jmp 0x10177e30
mov ecx, dword [ebp - 0x50]
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10177f4f
movzx eax, word [ebp - 0x34]
sub ecx, edx
sar ecx, 1
add ecx, ecx
cmp eax, ecx
jae 0x10177f6f
push 0x10077898
jmp 0x10177faf
push edi
push ecx
push dword [ebp - 0x50]
push dword [ebp - 0x30]
push ebx
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_WriteProcessMemory]
test eax, eax
jne 0x10177fc6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10177f99
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10177fa0
mov esi, 0x80004005
push 0x100778ec
jmp 0x10177e30
push 0x10077840
mov eax, 0x8000ffff
push 1
mov esi, eax
push eax
push 0x4000000
call fcn.100e8059
add esp, 0x10
lea ecx, [ebp - 0x50]
call fcn.100b61be
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 8