Function at 0x489ac0
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x34
push ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x489ae1
pop esi
lea eax, [ebp + 1]
pop ebp
add esp, 0x34
ret
cmp esi, 0x4f000000
jae 0x489af4
pop esi
mov eax, 0xb
pop ebp
add esp, 0x34
ret
mov ecx, 0x5a4d
cmp word [esi], cx
je 0x489b09
pop esi
mov eax, 2
pop ebp
add esp, 0x34
ret
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
je 0x489b21
pop esi
mov eax, 3
pop ebp
add esp, 0x34
ret
mov edx, 0x14c
cmp word [eax + 4], dx
je 0x489b42
mov ecx, 0x100
test word [eax + 0x16], cx
jne 0x489b42
pop esi
mov eax, 0x21
pop ebp
add esp, 0x34
ret
movzx edx, word [eax + 0x14]
cmp byte [edx + eax + 0x18], 0x2e
lea edx, [edx + eax + 0x18]
mov dword [esp + 0x34], edx
je 0x489b60
pop esi
mov eax, 4
pop ebp
add esp, 0x34
ret
mov ecx, dword [eax + 0xd8]
mov eax, dword [eax + 0xdc]
push ebx
mov ebx, dword [edx + 8]
add ecx, esi
push edi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], 0x10000
cmp dword [esp + 0x50], ebp
je 0x489ba1
mov dword [esp + 0x24], 0x1000
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004b97b1
add esp, 4
mov edi, eax
cmp ebx, ebp
je 0x48a109
mov ebp, dword [esp + 0x48]
jmp 0x489bc4
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
cmp ebx, eax
jbe 0x489bd4
mov ebx, eax
mov dword [esp + 0x18], ebx
jmp 0x489bd8
mov dword [esp + 0x18], ebx
sub dword [esp + 0x1c], ebx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x537c84], 0
je 0x489bf2
call fcn.00492260
lea edx, [esp + 0x10]
push edx
push ebx
push edi
push esi
push ebp
call dword [0x5385e0]
mov ebx, eax
test ebx, ebx
je 0x48a0d0
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x18]
jne 0x48a0d0
mov bl, byte [edi]
xor edx, edx
mov dword [esp + 0x2c], eax
mov ecx, esi
mov dword [esp + 0x14], edx
cmp bl, byte [esi]
jne 0x489c50
mov ebx, edi
sub ebx, esi
mov dword [esp + 0x14], ebx
inc edx
sub dword [esp + 0x2c], 1
je 0x48a028
mov ebx, dword [esp + 0x14]
mov bl, byte [ebx + ecx + 1]
inc ecx
cmp bl, byte [ecx]
je 0x489c33
mov dword [esp + 0x14], edx
cmp dword [0x53ceac], 0
mov ecx, dword [edx + esi]
lea ebx, [edx + esi]
mov dword [esp + 0x2c], ecx
je 0x489cb8
mov ecx, dword [esp + 0x30]
cmp ecx, ebx
jae 0x489cb8
mov edx, dword [esp + 0x34]
add edx, ecx
cmp ebx, edx
jae 0x489cb4
mov eax, dword [esp + 0x2c]
push eax
push ebx
push 0x51e028
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
mov eax, dword [0x53ceac]
mov ecx, dword [esp + 0x3c]
add esp, 0x10
cmp eax, ecx
jae 0x489cb0
add eax, 0x9d000
cmp ecx, eax
jb 0x48a028
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
cmp byte [0x54a135], 0
jne 0x489d05
movzx ecx, byte [edx + edi]
lea eax, [edx + edi]
movzx edx, byte [ebx]
push ecx
push edx
push ebx
push 0x51e00c
mov dword [esp + 0x3c], eax
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x10
push ebx
call fcn.00489860
mov eax, dword [esp + 0x48]
push 0x10
push eax
call fcn.00489860
mov eax, dword [esp + 0x34]
add esp, 0x24
cmp byte [0x52b490], 0
je 0x48a028
cmp dword [esp + 0x50], 0
jne 0x489fd1
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 1
push ebp
push edi
push eax
push esi
push ecx
push str.VirtualProtectEx
call fcn.004899d0
mov edx, dword [esp + 0x2c]
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 1
push ebp
push edi
push edx
push esi
push eax
push 0x51dfe8
call fcn.004899d0
mov ecx, dword [esp + 0x48]
mov edx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 1
push ebp
push edi
push ecx
push esi
push edx
push 0x51dfd4
call fcn.004899d0
mov eax, dword [esp + 0x64]
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x54
push 1
push ebp
push edi
push eax
push esi
push ecx
push 0x51dfc4
call fcn.004899d0
mov edx, dword [esp + 0x2c]
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
push 1
push ebp
push edi
push edx
push esi
push eax
push str.OpenProcess
call fcn.004899d0
mov ecx, dword [esp + 0x48]
mov edx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 1
push ebp
push edi
push ecx
push esi
push edx
push str.CreateFileA
call fcn.004899d0
mov eax, dword [esp + 0x64]
mov ecx, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0x54
push 1
push ebp
push edi
push eax
push esi
push ecx
push str.CreateFileW
call fcn.004899d0
mov edx, dword [esp + 0x2c]
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 1
push ebp
push edi
push edx
push esi
push eax
push 0x51df94
call fcn.004899d0
mov ecx, dword [esp + 0x48]
mov edx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 1
push ebp
push edi
push ecx
push esi
push edx
push 0x51df84
call fcn.004899d0
mov eax, dword [esp + 0x64]
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x54
push 1
push ebp
push edi
push eax
push esi
push ecx
push str.LoadLibraryW
call fcn.004899d0
mov edx, dword [esp + 0x2c]
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 1
push ebp
push edi
push edx
push esi
push eax
push str.LoadLibraryExA
call fcn.004899d0
mov ecx, dword [esp + 0x48]
mov edx, dword [0x53cec8]
push 1
push ebp
push edi
push ecx
push esi
push edx
push str.pfnLoadLibraryExW
call fcn.004899d0
mov eax, dword [esp + 0x64]
mov ecx, dword [0x53cecc]
add esp, 0x54
push 1
push ebp
push edi
push eax
push esi
push ecx
push str.pfnsend
call fcn.004899d0
mov edx, dword [esp + 0x2c]
mov eax, dword [0x53ced4]
push 1
push ebp
push edi
push edx
push esi
push eax
push str.pfnZwDeviceIoControlFile
call fcn.004899d0
mov ecx, dword [esp + 0x48]
mov edx, dword [0x53ced8]
push 1
push ebp
push edi
push ecx
push esi
push edx
push str.pfnMapViewOfFileEx
call fcn.004899d0
mov eax, dword [esp + 0x64]
mov ecx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esp, 0x54
push 1
push ebp
push edi
push eax
push esi
push ecx
push str.FindNextFileW
call fcn.004899d0
mov edx, dword [esp + 0x2c]
mov eax, dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
push 1
push ebp
push edi
push edx
push esi
push eax
push str.FindFirstFileExW
call fcn.004899d0
mov ecx, dword [esp + 0x48]
mov edx, dword [0x53ceb0]
push 1
push ebp
push edi
push ecx
push esi
push edx
push str.LdrGetDllHandle
call fcn.004899d0
mov eax, dword [esp + 0x64]
mov ecx, dword [0x53ceb4]
add esp, 0x54
push 1
push ebp
push edi
push eax
push esi
push ecx
push 0x51dec8
call fcn.004899d0
mov edx, dword [esp + 0x2c]
mov eax, dword [0x53ceb8]
push 1
push ebp
push edi
push edx
push esi
push eax
push str.NtResumeThread
call fcn.004899d0
mov ecx, dword [esp + 0x48]
mov edx, dword [0x53cebc]
push 1
push ebp
push edi
push ecx
push esi
push edx
push str.NtProtectVirtualMemory
call fcn.004899d0
mov eax, dword [esp + 0x64]
mov ecx, dword [0x53cec0]
add esp, 0x54
push 1
push ebp
push edi
push eax
push esi
push ecx
push str.LdrLoadDll
call fcn.004899d0
mov edx, dword [esp + 0x2c]
mov eax, dword [0x53cec4]
push 1
push ebp
push edi
push edx
push esi
push eax
push str.NtOpenProcess
call fcn.004899d0
mov ecx, dword [esp + 0x48]
mov edx, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
push 1
push ebp
push edi
push ecx
push esi
push edx
push str.EnumServicesStatusA
call fcn.004899d0
mov eax, dword [esp + 0x64]
mov ecx, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
add esp, 0x54
push 1
push ebp
push edi
push eax
push esi
push ecx
push str.EnumServicesStatusW
call fcn.004899d0
add esp, 0x1c
jmp 0x48a028
cmp byte [0x54a135], 0
jne 0x48a028
lea edx, [esp + 0x38]
push edx
push 0x40
push eax
push esi
push ebp
call dword [0x5385e8]
test eax, eax
je 0x48a091
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push ecx
push esi
push esi
push ebp
call dword [0x5385e4]
mov ebx, eax
test ebx, ebx
je 0x48a04c
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x28], eax
jne 0x48a04c
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x40]
push edx
push ecx
push eax
push esi
push ebp
call dword [0x5385e8]
add esi, dword [esp + 0x18]
cmp dword [esp + 0x1c], 0
jne 0x489bc0
push edi
call fcn.004b97a6
mov eax, dword [esp + 0x24]
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x34
ret
mov dword [esp + 0x20], 0xb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x28]
push eax
push edx
push ebx
push 0x51de38
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x14
push edi
call fcn.004b97a6
mov eax, dword [esp + 0x24]
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x34
ret
mov dword [esp + 0x20], 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x51de24
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
push edi
call fcn.004b97a6
mov eax, dword [esp + 0x24]
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x34
ret
mov dword [esp + 0x20], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x3c]
mov edx, dword [ecx + 8]
push eax
mov eax, dword [esp + 0x14]
push eax
push ebx
push edx
push esi
push 0x51dde8
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x1c
push edi
call fcn.004b97a6
mov eax, dword [esp + 0x24]
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x34
ret