Function at 0x3000a5c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x301884e0
mov eax, dword fs:[0]
push eax
sub esp, 0x38c
mov eax, dword [0x3021be88]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x2a0], edi
mov esi, ecx
xor ebx, ebx
mov word [ebp - 0x2d8], 0x100
mov dword [ebp - 0x2b8], ebx
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2d4], ebx
mov dword [ebp - 0x2cc], ebx
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2c4], ebx
mov dword [ebp - 0x2c0], ebx
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x284], ebx
call fcn.30011600
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x27c], ebx
call fcn.30011600
mov edx, dword [0x302455dc]
push ecx
mov ecx, dword [0x302455d8]
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x274], ebx
call fcn.3000b5f0
mov eax, dword [0x302455d8]
add esp, 4
mov dword [0x302455dc], eax
call fcn.30012740
test esi, esi
je 0x3000a6b6
mov dword [0x30242390], esi
mov edx, 0x302455e4
mov ecx, esi
jmp 0x3000a6cc
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov dword [0x30242390], eax
call esi
mov edx, 0x302455d8
mov ecx, eax
call fcn.300155c0
push edi
push str.DumpProcess:_Instantiating_PeParser_with_address:_0x_p._n
call fcn.30009b40
push 0x50
call fcn.3015f9ad
add esp, 8
mov ecx, eax
push edi
call fcn.30012950
mov esi, eax
mov dword [ebp - 0x290], esi
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x3000a7ec
call fcn.30003fc0
cmp eax, 1
jne 0x3000a7ec
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x3000a722
test edi, edi
je 0x3000a72b
cmp ebx, edi
jbe 0x3000a72b
sub ebx, edi
jmp 0x3000a72b
mov ecx, esi
call fcn.30012c40
mov ebx, eax
mov ecx, esi
call fcn.30013480
push ebx
cmp ebx, eax
jb 0x3000a748
push str.DumpProcess:_Error___entry_point_too_big:_0x_x__ignoring._n
call fcn.30009b40
add esp, 8
xor ebx, ebx
jmp 0x3000a757
push str.DumpProcess:_Module_entry_point_VA_is_0x_p._n
call fcn.30009b40
add esp, 8
add ebx, edi
cmp dword [ebp + 0xc], 0
mov ecx, esi
je 0x3000a7ca
push str.CapeOutput.bin
push ebx
push edi
call fcn.300145b0
test al, al
je 0x3000a7b7
push dword [esi + 0xc]
push 0x30239778
push str.DumpProcess:_Module_image_dump_success__s___dump_size_0x_x._n
call fcn.30009b40
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x3000aca9
xor edi, edi
lea ecx, [ebp - 0x398]
push ebx
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x290], edi
call fcn.3000fac0
test eax, eax
jne 0x3000aa7e
xor al, al
jmp 0x3000aa98
push edi
push str.DumpProcess:_Failed_to_dump_image_at_0x_p._n
call fcn.30009b40
add esp, 8
jmp 0x3000accf
push 0
push ebx
push edi
call fcn.300145b0
test al, al
je 0x3000a7b7
push dword [esi + 0xc]
push str.DumpProcess:_Module_image_dump_success___dump_size_0x_x._n
call fcn.30009b40
add esp, 8
jmp 0x3000aca9
mov ecx, edi
call fcn.30003fc0
test eax, eax
je 0x3000a801
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x3000a811
mov eax, dword [edi + 0x3c]
cmp dword [edi + eax], 0x4550
je 0x3000acc2
push edi
push str.DumpProcess:_Disguised_PE_image__bad_MZ_and_or_PE_headers__at_0x_p._n
call fcn.30009b40
add esp, 8
lea eax, [ebp - 0x38c]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x3000a846
push edi
push str.DumpProcess:_unable_to_query_memory_address_0x_p
call fcn.30009b60
add esp, 8
jmp 0x3000accf
push 1
push dword [ebp - 0x380]
call fcn.30169fc8
add esp, 8
mov dword [ebp - 0x294], eax
test eax, eax
je 0x3000accf
push dword [ebp - 0x380]
push dword [ebp - 0x38c]
push eax
call fcn.301619b0
lea eax, [edi + 0x3c]
mov dword [ebp - 0x29c], 0x8664
add esp, 0xc
mov edx, 0x14c
mov dword [ebp - 0x28c], edx
cmp dword [eax], ebx
jne 0x3000a9ae
lea edx, [edi + 0x1c4]
mov ecx, eax
cmp ecx, edx
jae 0x3000a8fb
xor esi, esi
jmp 0x3000a8b0
movzx eax, word [ecx]
cmp ax, word [ebp - 0x28c]
je 0x3000a8c5
cmp ax, word [ebp - 0x29c]
jne 0x3000a8cf
lea eax, [edi + 3]
cmp ecx, eax
jbe 0x3000a8cf
lea esi, [ecx - 4]
add ecx, 4
cmp ecx, edx
jb 0x3000a8b0
mov dword [ebp - 0x28c], esi
test esi, esi
mov esi, dword [ebp - 0x290]
mov edx, 0x14c
je 0x3000a8f6
mov eax, dword [ebp - 0x28c]
sub eax, edi
mov dword [edi + 0x3c], eax
lea eax, [edi + 0x3c]
jmp 0x3000a900
mov edx, 0x14c
cmp dword [eax], ebx
jne 0x3000a9ae
lea eax, [edi + 0x1c4]
xor esi, esi
mov ecx, edi
cmp edi, eax
jae 0x3000a9a8
mov ebx, dword [ebp - 0x294]
movzx eax, word [ecx]
cmp ax, dx
je 0x3000a931
cmp ax, word [ebp - 0x29c]
jne 0x3000a93b
lea eax, [edi + 4]
cmp ecx, eax
jb 0x3000a93b
lea esi, [ecx - 4]
add ecx, 4
mov dword [ebp - 0x298], ecx
test esi, esi
je 0x3000a996
cmp esi, edi
jne 0x3000a996
mov eax, dword [esi + 0x54]
test eax, eax
je 0x3000a996
add eax, 0xffffffc0
lea esi, [ebx + 0x40]
push eax
push ebx
push esi
call fcn.30161f30
add esp, 0xc
push 0x40
push 0
push ebx
call fcn.30162560
add esp, 0xc
mov dword [ebx + 0x3c], 0x40
mov edi, ebx
push 0x40
push esi
push ebx
push str.DumpProcess:_pNtHeader_moved_from_0x_x_to_0x_x__e_lfanew_0x_x_n
call fcn.30009b40
mov ecx, dword [ebp - 0x298]
add esp, 0x10
mov edx, 0x14c
lea eax, [edi + 0x1c4]
cmp ecx, eax
jb 0x3000a920
mov edi, dword [ebp - 0x2a0]
xor ebx, ebx
mov esi, dword [ebp - 0x290]
mov ecx, esi
call fcn.30012a70
push 0x50
push esi
call fcn.3015f781
push 0x50
call fcn.3015f9ad
add esp, 8
mov ecx, eax
push dword [ebp - 0x294]
call fcn.300128c0
mov esi, eax
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x3000a784
call fcn.30003fc0
cmp eax, 1
jne 0x3000a784
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x3000a9ff
mov ecx, esi
call fcn.30012c40
mov ebx, eax
mov ecx, esi
call fcn.30013480
push ebx
cmp ebx, eax
jb 0x3000aa1c
push str.DumpProcess:_Error___entry_point_too_big:_0x_x__ignoring._n
call fcn.30009b40
add esp, 8
xor ebx, ebx
jmp 0x3000aa2b
push str.DumpProcess:_Module_entry_point_VA_is_0x_p._n
call fcn.30009b40
add esp, 8
add ebx, edi
cmp dword [ebp + 0xc], 0
mov ecx, esi
je 0x3000aa5a
push str.CapeOutput.bin
push ebx
push edi
call fcn.300145b0
test al, al
jne 0x3000a76f
push edi
push str.DumpProcess:_Failed_to_dump_image_at_0x_p._n
call fcn.30009b40
add esp, 8
jmp 0x3000a784
push 0
push ebx
push edi
call fcn.300145b0
test al, al
jne 0x3000a7d7
push edi
push str.DumpProcess:_Failed_to_dump_image_at_0x_p._n
call fcn.30009b40
add esp, 8
jmp 0x3000aca9
lea ecx, [ebp - 0x290]
push ecx
lea ecx, [ebp - 0x28c]
push ecx
push eax
call fcn.3000fdc0
mov edi, dword [ebp - 0x28c]
test al, al
jne 0x3000aaca
lea eax, [ebp - 0x290]
mov dword [ebp - 0x28c], 0
push eax
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x290], 0
push eax
push ebx
call fcn.3000f760
mov edi, dword [ebp - 0x28c]
test edi, edi
je 0x3000ac9c
mov ebx, dword [ebp - 0x290]
test ebx, ebx
je 0x3000ac9c
push ebx
push edi
push str.DumpProcess:_Found_IAT___0x_x__size:_0x_x
call fcn.30009b40
add esp, 0xc
lea eax, [ebp - 0x288]
mov dword [0x30239760], eax
push ebx
call fcn.3015f9e2
add esp, 4
mov dword [ebp - 0x294], eax
mov edx, ebx
mov ecx, edi
push eax
call fcn.30015420
add esp, 4
test al, al
je 0x3000ab2a
push ebx
mov ebx, dword [ebp - 0x294]
push ebx
push edi
call fcn.3000c4f0
jmp 0x3000ab30
mov ebx, dword [ebp - 0x294]
push ebx
call fcn.3015f9dd
add esp, 4
lea ecx, [ebp - 0x288]
call fcn.300119f0
mov eax, dword [0x3024239c]
test eax, eax
je 0x3000ab5b
mov ecx, dword [eax + 0x104]
mov eax, dword [eax + 0x108]
jmp 0x3000ab66
mov ecx, dword [0x30242398]
mov eax, dword [0x30242394]
add eax, ecx
cmp edi, ecx
jbe 0x3000ab70
cmp edi, eax
jb 0x3000ab7d
push str.DumpProcess:_Warning___IAT_is_not_inside_the_PE_image__requires_rebasing._n
call fcn.30009b40
add esp, 4
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x36c], 0
mov dword [ebp - 0x368], 0
call fcn.30012b60
push ecx
mov dword [ebp - 0x360], 0x30239778
call fcn.30012c90
mov ecx, dword [ebp - 0x358]
test ecx, ecx
je 0x3000abd5
call fcn.30003fc0
cmp eax, 1
jne 0x3000abd5
lea ecx, [ebp - 0x370]
call fcn.30013070
lea eax, [ebp - 0x288]
mov dword [ebp - 0x318], 0
push eax
push ecx
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x314], 0
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x304], 0
mov dword [ebp - 0x300], 0
mov word [ebp - 0x2f8], 0
mov dword [ebp - 0x2fc], 0
mov byte [ebp - 0x31c], 0
mov dword [ebp - 0x2ec], 0
call fcn.30010550
test al, al
je 0x3000ac79
push str.DumpProcess:_Import_table_rebuild_success._n
call fcn.30009b40
mov ecx, esi
call fcn.3000a480
lea ecx, [ebp - 0x370]
call fcn.30012a70
mov edi, 1
jmp 0x3000ace3
push str.DumpProcess:_Import_table_rebuild_failed__falling_back_to_unfixed_dump._n
call fcn.30009b40
add esp, 4
mov ecx, esi
push 0
call fcn.30013740
lea ecx, [ebp - 0x370]
call fcn.30012a70
jmp 0x3000aca9
push str.DumpProcess:_Warning:_Unable_to_find_IAT_in_scan._n
call fcn.30009b40
add esp, 4
mov ecx, esi
call fcn.30012a70
push 0x50
push esi
call fcn.3015f781
add esp, 8
mov edi, 1
jmp 0x3000ace3
push str.DumpProcess:_Invalid_PE_file_or_invalid_PE_header._n
call fcn.30009b40
add esp, 4
mov ecx, esi
call fcn.30012a70
push 0x50
push esi
call fcn.3015f781
add esp, 8
xor edi, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x280]
mov esi, dword [ebp - 0x280]
push dword [esi + 4]
call fcn.3000ce90
mov eax, dword [ebp - 0x280]
push pe_nt_image_headers32
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x280]
mov dword [eax], esi
mov eax, dword [ebp - 0x280]
mov dword [eax + 8], esi
push dword [ebp - 0x280]
mov dword [ebp - 0x27c], 0
call fcn.3015f781
add esp, 8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x288]
mov esi, dword [ebp - 0x288]
push dword [esi + 4]
call fcn.3000ce90
mov eax, dword [ebp - 0x288]
push pe_nt_image_headers32
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x288]
mov dword [eax], esi
mov ecx, dword [ebp - 0x288]
mov dword [ecx + 8], esi
push dword [ebp - 0x288]
mov dword [ebp - 0x284], 0
call fcn.3015f781
add esp, 8
lea ecx, [ebp - 0x2d8]
call fcn.3000a390
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret