Function at 0x405a31
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
xor esi, esi
push str.NTDLL.DLL
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.ZwWow64QueryInformationProcess64
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x30
mov edi, eax
lea eax, [ebp - 0x58]
push esi
push eax
call sub.ntdll.dll_memset
add esp, 0xc
cmp edi, esi
jne 0x405aa1
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.PsSupWow64QueyProcessModules64:_API_function_not_found
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x405cfb
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x30
lea eax, [ebp - 0x58]
push eax
push esi
push ebx
call edi
test eax, eax
jge 0x405ade
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x58]
push eax
push 0
push ebx
call edi
test eax, eax
jge 0x405ade
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.PsSupWow64QueyProcessModules64:_Failed_querying_process_info
jmp 0x405a83
push 0x200
call fcn.004013ab
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x405b1f
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.PsSupWow64QueyProcessModules64:_Insufficient_resources_1
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x405ce3
push pe_nt_image_headers32
call fcn.004013ab
mov esi, eax
test esi, esi
jne 0x405b43
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.PsSupWow64QueyProcessModules64:_Insufficient_resources_2
jmp 0x405b01
push 0x28
push esi
push ebx
lea eax, [ebp - 0x50]
call fcn.0040594d
test eax, eax
mov dword [ebp - 4], eax
jne 0x405b77
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
push str.PsSupWow64QueyProcessModules64:_Failed_reading_target_PEB__hProcess_x
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x405b0c
push 0x40
lea eax, [esi + 0x28]
push eax
lea edi, [esi + 0x18]
push ebx
mov eax, edi
call fcn.0040594d
test eax, eax
mov dword [ebp - 4], eax
jne 0x405ba4
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
push str.PsSupWow64QueyProcessModules64:_Failed_reading_PEB_loader_data__hProcess_x
jmp 0x405b69
mov ebx, dword [edi]
mov edx, dword [esi + 0x3c]
mov eax, dword [edi + 4]
mov ecx, dword [esi + 0x38]
add ebx, 0x10
adc eax, 0
cmp ecx, ebx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], 4
lea edi, [edx + 8]
jne 0x405bdb
cmp dword [ebp - 0x1c], eax
je 0x405cda
push 0x98
lea eax, [esi + 0x68]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x20]
call fcn.0040594d
test eax, eax
mov dword [ebp - 4], eax
je 0x405cd7
mov eax, dword [esi + 0x68]
add dword [ebp - 8], 0x120
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x6c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
ja 0x405cc2
movzx ebx, word [esi + 0xb0]
mov ax, word [ebp - 0xc]
mov word [edi + 0x18], ax
mov eax, dword [esi + 0xd0]
mov dword [edi + 0x14], eax
mov ax, word [esi + 0xd4]
mov word [edi + 0x1c], ax
mov eax, dword [esi + 0xa8]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x98]
shr ebx, 1
cmp ebx, 0x100
mov dword [edi + 8], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0xc], eax
jae 0x405cb6
movzx eax, word [esi + 0xb0]
push eax
push dword [ebp - 0x10]
lea eax, [esi + 0xb8]
push dword [ebp + 8]
call fcn.0040594d
test eax, eax
mov dword [ebp - 4], eax
je 0x405cb6
xor eax, eax
test ebx, ebx
jbe 0x405c96
mov ecx, dword [ebp - 0x10]
mov cl, byte [ecx + eax*2]
mov byte [edi + eax + 0x20], cl
inc eax
cmp eax, ebx
jb 0x405c87
push 0x5c
push 0
lea eax, [edi + 0x20]
push eax
mov byte [ebx + edi + 0x20], 0
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
mov ecx, 0xffe1
sub ecx, edi
add eax, ecx
mov word [edi + 0x1e], ax
mov ebx, dword [ebp - 0x28]
add edi, 0x120
inc dword [ebp - 0xc]
cmp dword [ebp - 0x20], ebx
jne 0x405bdb
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jne 0x405bdb
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x405ce3
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
cmp dword [ebp - 0x10], 0
je 0x405cf1
push dword [ebp - 0x10]
call fcn.004013c0
test esi, esi
je 0x405cfb
push esi
call fcn.004013c0
mov eax, dword [ebp + 0x14]
test eax, eax
mov ecx, dword [ebp - 8]
je 0x405d07
mov dword [eax], ecx
cmp ecx, dword [ebp + 0x10]
ja 0x405d17
test ecx, ecx
je 0x405d17
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10