Function at 0x457710
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcb98
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x520078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
lea edi, [esi + 1]
cmp dword [0x527a74], esi
jne 0x45775b
mov ecx, edi
call fcn.00457630
mov esi, eax
test esi, esi
jne 0x457c9c
mov eax, dword [0x527a74]
test eax, eax
je 0x45776b
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x527a78]
mov ecx, eax
inc eax
mov dword [0x527a78], eax
test ecx, ecx
jne 0x457c81
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4578df
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.IsWow64Process2
push esi
mov dword [ebp - 0x58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x14], ax
test edi, edi
je 0x457849
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x58]
call dword [0x4e3310]
call edi
test eax, eax
je 0x457849
mov cx, word [ebp - 0x14]
cmp word [ebp - 0x18], 0
movzx edx, word [0x527d00]
movzx eax, cx
cmovne edx, eax
movzx eax, cx
mov word [0x527d00], dx
cmp eax, 0x8664
ja 0x457835
je 0x457828
cmp eax, 0x200
je 0x45781b
cmp eax, 0x284
jne 0x45788d
mov eax, 7
mov word [0x527cfc], ax
jmp 0x45788d
mov eax, 6
mov word [0x527cfc], ax
jmp 0x45788d
mov eax, 9
mov word [0x527cfc], ax
jmp 0x45788d
cmp eax, 0xaa64
jne 0x45788d
mov eax, 0xc
mov word [0x527cfc], ax
jmp 0x45788d
push str.IsWow64Process
push esi
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x457873
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
push dword [ebp - 0x58]
call dword [0x4e3310]
call edi
cmp dword [ebp - 0x1c], 0
je 0x457886
mov eax, 0x8664
mov word [0x527d00], ax
jmp 0x457892
mov dx, word [0x527d00]
test dx, dx
je 0x4578a3
push str.Wow64EnableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x527d18], eax
push 0x4fb2e0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetTickCount64
push esi
mov dword [0x527d08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x527d24], 0xf
jl 0x4578da
push str.PrefetchVirtualMemory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x527d04], eax
mov edi, 1
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x527cf8], eax
test eax, eax
je 0x457a05
push str.RtlNtStatusToDosError
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlInitUnicodeString
push dword [0x527cf8]
mov dword [0x527a6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtOpenFile
push dword [0x527cf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateFile
push dword [0x527cf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtReadFile
push dword [0x527cf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtWriteFile
push dword [0x527cf8]
mov dword [0x527d14], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationFile
push dword [0x527cf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationFile
push dword [0x527cf8]
mov dword [0x527d10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryVirtualMemory
push dword [0x527cf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryObject
push dword [0x527cf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryVolumeInformationFile
push dword [0x527cf8]
mov dword [0x527d0c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push dword [0x527cf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQuerySystemInformation
push dword [0x527cf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryDirectoryFile
push dword [0x527cf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtClose
push dword [0x527cf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x524df8
push 8
call fcn.00494260
mov esi, eax
add esp, 8
test esi, esi
je 0x457a3e
mov dword [ebp - 4], 0xffffffff
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00457e30
mov dword [esi], eax
jmp 0x457a40
xor esi, esi
mov dword [0x5271d0], esi
test esi, esi
jne 0x457a54
mov esi, 8
jmp 0x457c85
push 0x524df8
push 8
call fcn.00494260
mov esi, eax
add esp, 8
test esi, esi
je 0x457a8d
mov dword [ebp - 4], 0xffffffff
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00457e00
mov dword [esi], eax
jmp 0x457a8f
xor esi, esi
mov dword [0x5271d4], esi
test esi, esi
jne 0x457aa3
mov esi, 8
jmp 0x457c85
cmp dword [0x527cf8], 0
je 0x457bfe
push ecx
push 0x527ce0
push ecx
mov edx, str.RtlSetThreadErrorMode
call fcn.0045b090
add esp, 0xc
cmp dword [0x527cdc], 0
jne 0x457ae1
push ecx
push 0x527cdc
push ecx
mov edx, str.RtlGetVersion
call fcn.0045b090
add esp, 0xc
cmp dword [0x527cd8], 0
jne 0x457afe
push ecx
push 0x527cd8
push ecx
mov edx, str.RtlPcToFileHeader
call fcn.0045b090
add esp, 0xc
push ecx
push 0x527cd4
push ecx
mov edx, str.LdrLockLoaderLock
call fcn.0045b090
add esp, 8
mov edx, str.LdrUnlockLoaderLock
push 0x527cd0
push ecx
call fcn.0045b090
add esp, 8
mov edx, str.NtQueryDirectoryFileEx
push 0x527ce4
push ecx
call fcn.0045b090
add esp, 8
mov edx, str.NtWow64QueryInformationProcess64
push 0x527a60
push ecx
call fcn.0045b090
add esp, 8
mov edx, str.NtWow64GetNativeSystemInformation
push 0x527cf0
push ecx
call fcn.0045b090
add esp, 8
mov edx, str.NtWow64QueryVirtualMemory64
push 0x527cec
push ecx
call fcn.0045b090
add esp, 8
mov edx, str.NtWow64ReadVirtualMemory64
push 0x527ce8
push ecx
call fcn.0045b090
mov esi, dword [0x527cf0]
add esp, 0xc
test esi, esi
je 0x457bfe
cmp word [0x527cfc], 0
jne 0x457bc9
push 0
push 0xc
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push 1
call dword [0x4e3310]
call esi
movzx edx, word [0x527cfc]
test eax, eax
movzx ecx, word [ebp - 0x28]
mov esi, dword [0x527cf0]
cmove edx, ecx
mov word [0x527cfc], dx
push 0
push 0x2c
lea eax, [ebp - 0x54]
mov ecx, esi
push eax
push 0
call dword [0x4e3310]
call esi
test eax, eax
jne 0x457bfe
mov eax, dword [ebp - 0x34]
mov dword [0x520a98], eax
movzx eax, byte [ebp - 0x2c]
mov dword [0x520a9c], 0
mov dword [0x520aa8], eax
jmp 0x457c03
mov eax, dword [0x520aa8]
and ebx, 1
jne 0x457c32
sub esp, 0xc
lea edx, [ebx + 0x10]
lea ecx, [ebp - 0x48]
push str.aswSP
call fcn.0045bda0
add esp, 8
mov edx, eax
mov ecx, 0x527cf4
call fcn.0045b7c0
mov eax, dword [0x520aa8]
add esp, 8
test eax, eax
cmove eax, edi
sub esp, 8
mov dword [0x520aa8], eax
call fcn.0045c0c0
add esp, 8
call fcn.0045d630
call fcn.00457fd0
call fcn.00458020
or dword [0x527a7c], 2
mov ecx, 0x527d1c
call fcn.0045b8e0
mov esi, eax
test esi, esi
jne 0x457c85
test ebx, ebx
jne 0x457c8a
push 0x4f594d
push ebx
call fcn.004c210a
add esp, 8
jmp 0x457c8a
test esi, esi
je 0x457c8a
call fcn.00457cc0
mov eax, dword [0x527a74]
test eax, eax
je 0x457c9a
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00493bec
mov esp, ebp
pop ebp
ret