Function at 0x467b70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8f8
mov eax, dword [0x58e5a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push esi
mov dword [ebp - 0x8dc], eax
xor eax, eax
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x8d0], eax
mov dword [ebp - 0x8d8], eax
mov dword [ebp - 0x8cc], eax
nop
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
push eax
add esi, 0x10000
xorps xmm0, xmm0
push esi
push edi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call ebx
test eax, eax
je 0x467c3c
nop word [eax + eax]
mov ecx, dword [ebp - 0x14]
mov eax, ecx
and eax, 0xfff
cmp eax, 0xfff
je 0x467c3c
mov edx, dword [ebp - 0x20]
lea eax, [ecx + edx]
cmp eax, esi
jb 0x467c3c
cmp dword [ebp - 0x10], 0x1000
jne 0x467c2b
cmp byte [ebp - 0xc], 1
je 0x467c2b
test dword [ebp - 0xc], 0x100
jne 0x467c2b
lea eax, [ebp - 0x118]
push eax
push esi
push edi
call fcn.00466530
test eax, eax
jne 0x467c5a
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
push 0x1c
lea eax, [ebp - 0x20]
push eax
lea esi, [ecx + edx]
push esi
push edi
call ebx
test eax, eax
jne 0x467be0
mov esi, dword [ebp - 0x8cc]
test esi, esi
jne 0x467cce
push 0x10dd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x468004
test esi, esi
je 0x467c3c
test dword [ebp - 0x102], 0x2000
jne 0x467c9f
mov eax, 0x10b
mov dword [ebp - 0x8cc], esi
cmp word [ebp - 0x100], ax
jne 0x467bb0
cmp word [ebp - 0x114], 0
je 0x467bb0
mov dword [ebp - 0x8d8], 1
jmp 0x467bb0
mov eax, 0x20b
cmp word [ebp - 0x100], ax
jne 0x467bb0
cmp word [ebp - 0x114], 0
je 0x467bb0
mov dword [ebp - 0x8d0], 1
jmp 0x467bb0
cmp dword [ebp - 0x8d8], 0
jne 0x467ce1
xor ebx, ebx
mov dword [ebp - 0x8d4], ebx
jmp 0x467d13
cmp dword [ebp - 0x8d0], 0
jne 0x467cf7
mov ebx, 1
mov dword [ebp - 0x8d4], ebx
jmp 0x467d13
lea eax, [ebp - 0x8d4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x468004
mov ebx, dword [ebp - 0x8d4]
push 0x1c
lea eax, [ebp - 0x8f8]
mov dword [ebp - 0x8e0], 0
push eax
xorps xmm0, xmm0
push esi
push edi
movups xmmword [ebp - 0x8f8], xmm0
movq qword [ebp - 0x8e8], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
test eax, eax
je 0x467ffd
push 0
push 0x40
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 0x8cc]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x467ffd
mov eax, 0x5a4d
cmp word [ebp - 0x250], ax
jne 0x467ff6
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x8ec]
ja 0x467ff6
cmp eax, 0x40
jb 0x467ff6
add eax, dword [ebp - 0x8cc]
lea ecx, [ebp - 0x210]
push 0
push 0xf8
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x467ffd
cmp dword [ebp - 0x210], 0x4550
jne 0x467ff6
push 0x678
lea eax, [ebp - 0x8c8]
push 0
push eax
call fcn.004d52d0
mov eax, dword [ebp - 0x8cc]
lea ecx, [ebp - 0x8ac]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 0xc
mov dword [ebp - 0x8c8], 0x678
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x8c4], 0x40
push 0
push 0x40
push ecx
push eax
push edi
call esi
test eax, eax
je 0x468004
mov eax, dword [ebp - 0x870]
lea ecx, [ebp - 0x86c]
add eax, dword [ebp - 0x8b8]
push 0
push 0x18
push ecx
push eax
push edi
mov dword [ebp - 0x8b4], eax
mov dword [ebp - 0x8c0], 0x18
call esi
test eax, eax
je 0x468004
movzx eax, word [ebp - 0x866]
lea ecx, [eax + eax*4]
movzx eax, word [ebp - 0x858]
lea eax, [eax + ecx*8]
add eax, 0x18
mov dword [ebp - 0x8c0], eax
cmp eax, 0x608
ja 0x468004
push 0
push eax
lea eax, [ebp - 0x86c]
push eax
push dword [ebp - 0x8b4]
push edi
call esi
test eax, eax
je 0x468004
mov ax, word [ebp - 0x854]
mov ecx, 0x10b
cmp ax, cx
jne 0x467eca
mov eax, dword [ebp - 0x784]
test eax, eax
je 0x467ef5
cmp dword [ebp - 0x780], 0
je 0x467ef5
add eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x8b0], eax
jmp 0x467efb
mov ecx, 0x20b
cmp ax, cx
jne 0x467ef5
mov eax, dword [ebp - 0x774]
test eax, eax
je 0x467ef5
cmp dword [ebp - 0x770], 0
je 0x467ef5
add eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x8b0], eax
jmp 0x467efb
mov eax, dword [ebp - 0x8b0]
test eax, eax
je 0x467f20
push 0
push 0x14
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x8bc], 0x14
push ecx
push eax
push edi
call esi
test eax, eax
je 0x468004
test ebx, ebx
je 0x467fec
push dword [ebp + 0x10]
push dword [ebp - 0x8dc]
push dword [ebp - 0x8cc]
push edi
call fcn.004666f0
add esp, 0x10
test eax, eax
je 0x468004
mov ecx, dword [ebp - 0x8b0]
test ecx, ecx
je 0x467fbc
mov eax, dword [ebp - 0x254]
movups xmm0, xmmword [ebp - 0x264]
and eax, 0xfffffffe
mov dword [ebp - 8], eax
lea eax, [ebp - 0x8d0]
push eax
push 4
push 0x14
push ecx
push edi
movups xmmword [ebp - 0x18], xmm0
call fcn.004696d0
test eax, eax
je 0x468004
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x8b0]
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x468004
lea eax, [ebp - 0x8d0]
push eax
push dword [ebp - 0x8d0]
push 0x14
push dword [ebp - 0x8b0]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x468004
push 0x678
lea eax, [ebp - 0x8c8]
push eax
push 0x54286c
push edi
call fcn.00466d80
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d2a60
mov esp, ebp
pop ebp
ret 0xc
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x468004
push 0xc1
call esi
push 0x10dd
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d2a60
mov esp, ebp
pop ebp
ret 0xc