Function at 0x410640
Capabilities:
Inspect section memory permissions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov esi, eax
mov eax, dword [ebx + 0x2e8]
mov eax, dword [eax + 8]
push 0
lea ecx, [esi + 0x3618]
push 0x1000
push ecx
mov ecx, dword [eax + 4]
push eax
call ecx
add esp, 0x14
test eax, eax
jns 0x410692
mov edx, dword [ebx + 8]
push eax
push edx
push str._s:_Error_reading_image_header:__Rrc
mov edi, 0xffffea09
call fcn.0040e840
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
xor edi, edi
cmp word [esi + 0x3618], ax
jne 0x4106d3
mov edi, dword [esi + 0x3654]
cmp edi, 0x200
ja 0x4106b5
cmp edi, 0x40
jae 0x4106d3
mov ecx, dword [ebx + 8]
push edi
push ecx
push str._s:_Unexpected_e_lfanew_value:__x
mov edi, 0xffffea18
call fcn.0040e840
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + esi + 0x3618]
cmp eax, 0x4550
je 0x410700
mov edx, dword [ebx + 8]
push eax
push edi
push edx
push str._s:_No_PE_signature_at__x:__x
mov edi, 0xffffea1a
call fcn.0040e840
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [edi + esi + 0x361c]
mov ecx, 0x14c
cmp ax, cx
je 0x410730
push eax
mov eax, dword [ebx + 8]
push eax
push str._s:_Unexpected_machine:__x
mov edi, 0xffffe9f1
call fcn.0040e840
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [edi + esi + 0x362c]
cmp eax, 0xe0
je 0x41075d
mov ecx, dword [ebx + 8]
push eax
push ecx
push str._s:_Unexpected_optional_header_size:__x
mov edi, 0xffffea17
call fcn.0040e840
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [edi + esi + 0x3630]
cmp eax, 0x10b
je 0x41078a
mov edx, dword [ebx + 8]
push eax
push edx
push str._s:_Unexpected_optional_header_magic:__x
mov edi, 0xffffea17
call fcn.0040e840
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + esi + 0x368c]
cmp eax, 0x10
je 0x4107b4
push eax
mov eax, dword [ebx + 8]
push eax
push str._s:_Unexpected_data_dirs:__x
mov edi, 0xffffea17
call fcn.0040e840
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [edi + esi + 0x361e]
mov dword [ebp - 0x18], eax
cmp eax, 0x10
jbe 0x4107e4
mov edx, dword [ebx + 8]
mov ecx, eax
push ecx
push edx
push str._s:_Too_many_section_headers:__x
mov edi, 0xffffe9f2
call fcn.0040e840
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
lea ecx, [edi + esi + 0x3710]
mov dword [ebp + 8], eax
push ecx
lea eax, [esi + 0x4618]
push eax
call fcn.004023a0
mov eax, dword [edi + esi + 0x364c]
add esp, 0xc
test eax, 0xfff
je 0x410837
mov ecx, dword [ebx + 8]
push eax
push ecx
push str._s:_Invalid_image_base:__p
mov edi, 0xffffea1b
call fcn.0040e840
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + esi + 0x3668]
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], ecx
add ecx, 0xfff
lea edx, [eax + 0xfff]
xor ecx, edx
test ecx, 0xfffff000
je 0x410885
cmp byte [ebx + 0x2e6], 0
jne 0x410885
mov ecx, dword [ebx + 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ecx
push str._s:_SizeOfImage___x__isnt_close_enough_to_the_mapping_size___x_
mov edi, 0xffffea19
call fcn.0040e840
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x2e8]
mov eax, dword [edx + 4]
push eax
call fcn.00415390
add esp, 4
cmp dword [ebp - 0x14], eax
je 0x4108cd
mov ecx, dword [ebx + 0x2e8]
mov edx, dword [ecx + 4]
push edx
call fcn.00415390
mov ecx, dword [ebx + 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ecx
push str._s:_SizeOfImage___x__differs_from_what_RTLdrSize_returns___zx_
mov edi, 0xffffea19
call fcn.0040e840
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + esi + 0x3650]
lea ecx, [eax - 1]
mov dword [ebp - 0x20], eax
test eax, ecx
jne 0x410f6a
cmp eax, 0x1000
jb 0x410f6a
movzx edx, byte [ebx + 0x2e6]
neg edx
sbb edx, edx
and edx, 0xf000
add edx, 0x1000
cmp eax, edx
ja 0x410f6a
mov ecx, dword [edi + esi + 0x3654]
lea edx, [ecx - 1]
mov dword [ebp - 0x34], ecx
test ecx, edx
jne 0x410f45
lea edx, [ecx - 0x200]
cmp edx, 0xe00
ja 0x410f45
cmp ecx, eax
ja 0x410f45
mov edx, dword [ebp + 8]
mov eax, dword [edi + esi + 0x366c]
lea edx, [edx + edi + 0xf8]
cmp eax, edx
jae 0x410973
mov ecx, dword [ebp - 0x18]
push ecx
push edx
mov edx, dword [ebx + 8]
push eax
push edx
push str._s:_Headers_are_too_small:__x____x__cSections_x_
mov edi, 0xffffea12
call fcn.0040e840
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ecx - 1]
not edx
lea ecx, [eax + ecx - 1]
and ecx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp + 8], ecx
cmp ecx, 0x1000
jbe 0x4109b0
mov edx, dword [ebx + 8]
push 0x1000
push ecx
push eax
push edx
push str._s:_Headers_are_larger_than_expected:__x__x__expected_max__zx_
mov edi, 0xffffea12
call fcn.0040e840
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebx + 0x2e6], 0
mov ax, word [edi + esi + 0x362e]
mov word [ebx + 0x2e0], ax
movzx eax, word [edi + esi + 0x3676]
mov word [ebx + 0x2e2], ax
je 0x4109f4
mov ecx, dword [esi + 0x4624]
sub dword [ebx], ecx
mov edx, dword [esi + 0x4624]
add dword [ebx + 4], edx
mov eax, dword [esi + 0x4624]
mov dword [ebx + 0x220], eax
cmp dword [esi], 2
jne 0x410a15
mov ecx, dword [esi + 0x4898]
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x2e8]
push esi
push 0
push 0
push edx
lea eax, [ebp - 8]
push eax
push ecx
jmp 0x410a32
mov edx, dword [esi + 0x4898]
mov eax, dword [ebx]
push edx
mov edx, dword [ebx + 0x2e8]
push esi
push 0x40eea0
push 0
push eax
lea ecx, [ebp - 8]
push ecx
push edx
call fcn.004100c0
add esp, 0x1c
test eax, eax
js 0x410f84
cmp dword [0x4a8790], 0x60000000
jb 0x410a57
mov eax, dword [ebx]
mov ecx, dword [ebp - 8]
mov dword [ecx + edi + 0x34], eax
xor edi, edi
cmp byte [ebx + 0x2e5], 0
mov dword [ebp - 0x24], edi
je 0x410bb5
cmp dword [esi], 1
jne 0x410b14
mov eax, dword [ebx + 0x2e8]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x30]
push edx
push str.NtCreateSection
push 0xffffffffffffffff
push edi
push edi
mov edi, dword [ebp - 8]
push edi
push ecx
call fcn.00415440
add esp, 0x1c
test eax, eax
jns 0x410ab4
mov edx, dword [ebx + 8]
push eax
push edx
push str._s:_Failed_to_find_NtCreateSection:__Rrc
mov edi, eax
call fcn.0040e840
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov edx, dword [ebx + 0x2e8]
lea ecx, [ebp - 0x30]
push ecx
push str.LdrLoadDll
push 0xffffffffffffffff
push 0
push 0
mov dword [ebp - 0x60], eax
mov eax, dword [edx + 4]
push edi
push eax
mov dword [ebp - 0x5c], 5
call fcn.00415440
add esp, 0x1c
test eax, eax
jns 0x410b02
mov ecx, dword [ebx + 8]
push eax
push ecx
push str._s:_Failed_to_find_LdrLoadDll:__Rrc
mov edi, eax
call fcn.0040e840
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], 5
mov edi, 2
mov ecx, dword [ebp - 8]
mov edx, dword [ebx + 0x2e8]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [edx + 4]
push str.LdrInitializeThunk
push 0xffffffffffffffff
push 0
push 0
push ecx
push eax
call fcn.00415440
add esp, 0x1c
test eax, eax
jns 0x410b58
mov ecx, dword [ebx + 8]
push eax
push ecx
push str._s:_Failed_to_find_LdrInitializeThunk:__Rrc
mov edi, eax
call fcn.0040e840
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x30]
push eax
push str.LdrSystemDllInitBlock
push 0xffffffffffffffff
push 0
mov dword [ebp + edi*8 - 0x60], edx
mov edx, dword [ebx + 0x2e8]
mov eax, dword [edx + 4]
push 0
push ecx
mov dword [ebp + edi*8 - 0x5c], 0xe
inc edi
push eax
mov dword [ebp - 0x24], edi
call fcn.00415440
add esp, 0x1c
test eax, eax
js 0x410bb5
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 8]
mov dword [ebp + edi*8 - 0x60], eax
mov al, byte [eax + ecx]
cmp al, 0x50
movzx eax, al
jae 0x410bad
mov eax, 0x50
mov dword [ebp + edi*8 - 0x5c], eax
inc edi
mov dword [ebp - 0x24], edi
cmp byte [ebx + 0x2e6], 0
mov edi, dword [ebp + 8]
jne 0x410bf9
mov edx, dword [ebp - 8]
push 2
push 0
push 0
push 0xffffffffffffffff
push edx
push edi
push ebx
push esi
xor eax, eax
call fcn.0040e8c0
add esp, 0x20
test eax, eax
js 0x410f84
push 2
push edi
push 0
push ebx
push esi
call fcn.0040ec40
add esp, 0x14
test eax, eax
js 0x410f84
cmp dword [ebp - 0x18], 0
mov dword [ebp - 0x28], 2
mov ecx, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp + 8], 0
jbe 0x410eb0
lea eax, [esi + 0x463c]
mov dword [ebp - 0xc], eax
nop
mov edx, dword [ebp - 0xc]
mov edx, dword [edx - 0x18]
mov dword [ebp - 4], edx
cmp edx, ecx
jb 0x410f14
cmp edx, dword [ebp - 0x14]
ja 0x410f14
mov edi, dword [ebp - 0x20]
lea eax, [edi - 1]
not eax
lea edi, [edx + edi - 1]
and edi, eax
mov dword [ebp - 0x2c], eax
cmp edi, edx
jne 0x410f14
mov eax, dword [ebp - 0xc]
mov eax, dword [eax - 0x1c]
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
cmp eax, edi
ja 0x410ee3
add ecx, eax
cmp ecx, edi
ja 0x410ee3
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx - 0x14]
mov edi, dword [ebp - 0x34]
lea edi, [ecx + edi - 1]
and edi, dword [ebp - 0x38]
cmp ecx, edi
jne 0x410eb9
mov edi, dword [ebp - 0x20]
lea eax, [eax + edi - 1]
and eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
cmp ecx, eax
ja 0x410eb9
cmp byte [ebx + 0x2e6], 0
je 0x410cb1
cmp dword [ebp + 8], 0
jne 0x410e96
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
and eax, 0xe0000000
cmp eax, 0x60000000
ja 0x410d18
je 0x410d11
cmp eax, 0x20000000
je 0x410d0a
cmp eax, 0x40000000
je 0x410d6b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
push ecx
push edx
lea ecx, [eax + eax*4]
mov edx, dword [esi + ecx*8 + 0x463c]
push edx
push eax
mov eax, dword [ebx + 8]
push eax
push str._s:_Section__u:_Unexpected_characteristics:__x__uSectRva_x__cbMap_x_
mov edi, 0xffffe9f0
call fcn.0040e840
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0x10
jmp 0x410d70
mov edi, 0x20
jmp 0x410d70
cmp eax, 0xc0000000
je 0x410d40
cmp eax, 0xe0000000
jne 0x410cd6
cmp byte [ebx + 0x2e4], 0
jne 0x410cd6
mov edi, dword [esi]
sub edi, 2
neg edi
sbb edi, edi
and edi, 0xffffffe0
add edi, 0x40
jmp 0x410d70
mov eax, dword [esi]
mov edi, 4
cmp eax, 1
je 0x410d70
cmp eax, 2
je 0x410d70
mov eax, dword [ebp - 0xc]
push 8
add eax, 0xffffffdc
push str..mrdata
push eax
call fcn.00402350
add esp, 0xc
test eax, eax
jne 0x410d70
mov edi, 2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx]
test eax, 0x20000020
je 0x410d80
test eax, eax
jns 0x410da5
and eax, 0xc0000000
cmp eax, 0x40000000
je 0x410da5
mov eax, dword [esi]
cmp eax, 1
jne 0x410d9c
cmp byte [ebx + 0x2e4], 0
jne 0x410da5
cmp eax, 2
jne 0x410e66
mov edx, dword [ebp - 4]
cmp dword [ebp - 0x1c], edx
jae 0x410de5
cmp byte [ebx + 0x2e6], 0
jne 0x410de5
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x1c]
push 0
push 0
dec ecx
push ecx
lea ecx, [eax + edx]
mov edx, dword [ebp - 4]
push ecx
sub edx, eax
push edx
push ebx
push esi
call fcn.0040e8c0
add esp, 0x20
test eax, eax
js 0x410f84
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
push edi
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 8]
push edx
lea edx, [eax + ecx]
mov ecx, dword [ebp - 0x10]
push edx
push ecx
push ebx
push esi
call fcn.0040e8c0
add esp, 0x20
test eax, eax
js 0x410f84
mov edx, dword [ebp + 8]
inc edx
cmp edx, dword [ebp - 0x18]
jae 0x410e29
cmp byte [ebx + 0x2e6], 0
jne 0x410e29
mov ecx, dword [ebp - 0x2c]
jmp 0x410e38
mov ecx, dword [ebp - 0x10]
add ecx, 0xfff
and ecx, 0xfffff000
cmp ecx, dword [ebp - 0x10]
jbe 0x410e5e
mov eax, dword [ebp + 8]
push edi
push 0
push 0
push eax
mov eax, dword [ebp - 0x10]
push sym.VBoxSDL.exe_g_abRTZero16K
sub ecx, eax
add eax, dword [ebp - 4]
push ecx
push ebx
push esi
call fcn.0040e8c0
add esp, 0x20
test eax, eax
js 0x410f84
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push edi
add edx, 0xfff
and edx, 0xfffff000
push edx
push eax
push ebx
push esi
call fcn.0040ec40
add esp, 0x14
test eax, eax
js 0x410f84
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edi
add dword [ebp - 0xc], 0x28
lea ecx, [eax + edx]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 0x18]
jb 0x410c20
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push edx
mov edx, dword [ebx + 8]
push eax
push ecx
mov ecx, dword [ebp + 8]
push ecx
push edx
push str._s:_Section__u:_Invalid_file_size:__x__cbMap_x__uSectRva_x_
mov edi, 0xffffea15
call fcn.0040e840
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebx + 8]
push eax
push ecx
push edx
push str._s:_Section__u:_Invalid_virtual_size:__x__uSectRva_x__uRva_x__cbImage_x_
mov edi, 0xffffea13
call fcn.0040e840
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebx + 8]
push eax
push ecx
push edx
push str._s:_Section__u:_Invalid_virtual_address:__x__uRva_x__cbImage_x__cbSectAlign_x_
mov edi, 0xffffea14
call fcn.0040e840
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebx + 8]
push eax
push ecx
push edx
push str._s:_Unexpected_FileAlignment_value:__x__cbSectAlign_x_
mov edi, 0xffffea1c
call fcn.0040e840
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebx + 8]
push eax
push ecx
push str._s:_Unexpected_SectionAlignment_value:__x
mov edi, 0xffffea16
call fcn.0040e840
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret