Function at 0x4470f4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x447403
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xf], 1
mov byte [ebp - 0x11], 0x4d
mov byte [ebp - 0x10], 0x5a
push 0
call sub.kernel32.dll_GetModuleHandleW_2
mov ebx, eax
lea eax, [ebp - 8]
call fcn.00446fcc
mov dword [ebp - 0x18], ebx
jmp 0x4473cf
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x1c
call fcn.00404870
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov edi, ebx
push edi
call sub.kernel32.dll_VirtualQuery_1
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 0xe]
push eax
push edi
push 0xffffffffffffffff
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4473cc
cmp word [ebp - 0xe], 0x5a4d
jne 0x447281
push 0x3e8
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4470bc]
call fcn.004084c4
add esp, 4
lea eax, [ebp - 0xc]
push eax
push 0x3e8
mov eax, dword [ebp - 4]
push eax
push edi
push 0xffffffffffffffff
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4473cc
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 4]
mov ecx, 0x40
call fcn.004043a0
cmp dword [ebp - 0x38], 0
jle 0x4473cc
mov eax, dword [ebp - 0x38]
cdq
push edx
push eax
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4471ee
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4473cc
jmp 0x4471f6
pop edx
pop eax
jle 0x4473cc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x38]
add eax, edx
lea edx, [ebp - 0x16c]
mov ecx, 0xf8
call fcn.004043a0
cmp dword [ebp - 0x16c], 0x4550
jne 0x4473cc
cmp dword [ebp - 0x84], 0
jbe 0x44725c
lea eax, [ebp - 0xc]
push eax
push 8
push 0x456300
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x38]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 0xf8
adc edx, 0
sub eax, 0x10
sbb edx, 0
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_WriteProcessMemory
cmp ebx, dword [ebp - 0x18]
jbe 0x447273
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00447050
test al, al
je 0x447273
mov byte [ebp - 0xf], 0
add ebx, dword [ebp - 0x11c]
sub ebx, dword [ebp - 0x28]
jmp 0x4473cc
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4470bc]
call fcn.004084c4
add esp, 4
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x28]
call fcn.00404870
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004082fc
push eax
mov eax, dword [ebp - 4]
push eax
push edi
push 0xffffffffffffffff
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4473cc
xor esi, esi
mov eax, dword [ebp - 4]
cmp byte [eax + esi], 0x4d
jne 0x4473c1
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 4]
add eax, esi
mov ecx, 0x40
call fcn.004043a0
cmp word [ebp - 0x74], 0x5a4d
jne 0x4473be
cmp dword [ebp - 0x38], 0
jle 0x4473be
mov eax, dword [ebp - 0x38]
cdq
push edx
push eax
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x44731e
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4473be
jmp 0x447326
pop edx
pop eax
jle 0x4473be
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x38]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [ebp - 4]
lea eax, [edx + eax]
lea edx, [ebp - 0x16c]
mov ecx, 0xf8
call fcn.004043a0
cmp dword [ebp - 0x16c], 0x4550
jne 0x4473be
cmp dword [ebp - 0x84], 0
jbe 0x44739d
lea eax, [ebp - 0xc]
push eax
push 8
push 0x456300
mov eax, dword [ebp - 0x34]
add eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x38]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 0xf8
adc edx, 0
sub eax, 0x10
sbb edx, 0
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_WriteProcessMemory
lea eax, [ebp - 0xc]
push eax
push 2
push 0x4562fc
add esi, dword [ebp - 0x34]
push esi
push 0xffffffffffffffff
call sub.kernel32.dll_WriteProcessMemory
add ebx, dword [ebp - 0x11c]
sub ebx, dword [ebp - 0x28]
jmp 0x4473cc
add esi, 0x40
cmp esi, dword [ebp - 0x28]
jae 0x4473cc
inc esi
jmp 0x4472cb
add ebx, dword [ebp - 0x28]
cmp byte [ebp - 0xf], 0
jne 0x44713b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44740a
lea eax, [ebp - 8]
mov edx, dword [0x446f94]
call fcn.004085e4
lea eax, [ebp - 4]
mov edx, dword [0x4470bc]
call fcn.004085e4
ret