Function at 0x3000a580
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x30186e80
mov eax, dword fs:[0]
push eax
sub esp, 0x38c
mov eax, dword [0x3021ae88]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x2a0], edi
mov esi, ecx
xor ebx, ebx
mov word [ebp - 0x2d8], 0x100
mov dword [ebp - 0x2b8], ebx
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2d4], ebx
mov dword [ebp - 0x2cc], ebx
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2c4], ebx
mov dword [ebp - 0x2c0], ebx
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x284], ebx
call fcn.300115d0
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x27c], ebx
call fcn.300115d0
mov edx, dword [0x3024453c]
push ecx
mov ecx, dword [0x30244538]
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x274], ebx
call fcn.3000b5c0
mov eax, dword [0x30244538]
add esp, 4
mov dword [0x3024453c], eax
call fcn.30012710
test esi, esi
je 0x3000a676
mov dword [0x302412f0], esi
mov edx, 0x30244544
mov ecx, esi
jmp 0x3000a68c
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov dword [0x302412f0], eax
call esi
mov edx, 0x30244538
mov ecx, eax
call fcn.30015590
push edi
push str.DumpProcess:_Instantiating_PeParser_with_address:_0x_p._n
call fcn.30009b00
push 0x50
call fcn.3015e35d
add esp, 8
mov ecx, eax
push edi
call fcn.30012920
mov esi, eax
mov dword [ebp - 0x290], esi
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x3000a7ac
call fcn.30003f40
cmp eax, 1
jne 0x3000a7ac
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x3000a6e2
test edi, edi
je 0x3000a6eb
cmp ebx, edi
jbe 0x3000a6eb
sub ebx, edi
jmp 0x3000a6eb
mov ecx, esi
call fcn.30012c10
mov ebx, eax
mov ecx, esi
call fcn.30013450
push ebx
cmp ebx, eax
jb 0x3000a708
push str.DumpProcess:_Error___entry_point_too_big:_0x_x__ignoring._n
call fcn.30009b00
add esp, 8
xor ebx, ebx
jmp 0x3000a717
push str.DumpProcess:_Module_entry_point_VA_is_0x_p._n
call fcn.30009b00
add esp, 8
add ebx, edi
cmp dword [ebp + 0xc], 0
mov ecx, esi
je 0x3000a78a
push str.CapeOutput.bin
push ebx
push edi
call fcn.30014580
test al, al
je 0x3000a777
push dword [esi + 0xc]
push 0x302386d8
push str.DumpProcess:_Module_image_dump_success__s___dump_size_0x_x._n
call fcn.30009b00
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x3000ac69
xor edi, edi
lea ecx, [ebp - 0x398]
push ebx
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x290], edi
call fcn.3000fa90
test eax, eax
jne 0x3000aa3e
xor al, al
jmp 0x3000aa58
push edi
push str.DumpProcess:_Failed_to_dump_image_at_0x_p._n
call fcn.30009b00
add esp, 8
jmp 0x3000ac8f
push 0
push ebx
push edi
call fcn.30014580
test al, al
je 0x3000a777
push dword [esi + 0xc]
push str.DumpProcess:_Module_image_dump_success___dump_size_0x_x._n
call fcn.30009b00
add esp, 8
jmp 0x3000ac69
mov ecx, edi
call fcn.30003f40
test eax, eax
je 0x3000a7c1
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x3000a7d1
mov eax, dword [edi + 0x3c]
cmp dword [edi + eax], 0x4550
je 0x3000ac82
push edi
push str.DumpProcess:_Disguised_PE_image__bad_MZ_and_or_PE_headers__at_0x_p._n
call fcn.30009b00
add esp, 8
lea eax, [ebp - 0x38c]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x3000a806
push edi
push str.DumpProcess:_unable_to_query_memory_address_0x_p
call fcn.30009b20
add esp, 8
jmp 0x3000ac8f
push 1
push dword [ebp - 0x380]
call fcn.30168968
add esp, 8
mov dword [ebp - 0x294], eax
test eax, eax
je 0x3000ac8f
push dword [ebp - 0x380]
push dword [ebp - 0x38c]
push eax
call fcn.30160350
lea eax, [edi + 0x3c]
mov dword [ebp - 0x29c], 0x8664
add esp, 0xc
mov edx, 0x14c
mov dword [ebp - 0x28c], edx
cmp dword [eax], ebx
jne 0x3000a96e
lea edx, [edi + 0x1c4]
mov ecx, eax
cmp ecx, edx
jae 0x3000a8bb
xor esi, esi
jmp 0x3000a870
movzx eax, word [ecx]
cmp ax, word [ebp - 0x28c]
je 0x3000a885
cmp ax, word [ebp - 0x29c]
jne 0x3000a88f
lea eax, [edi + 3]
cmp ecx, eax
jbe 0x3000a88f
lea esi, [ecx - 4]
add ecx, 4
cmp ecx, edx
jb 0x3000a870
mov dword [ebp - 0x28c], esi
test esi, esi
mov esi, dword [ebp - 0x290]
mov edx, 0x14c
je 0x3000a8b6
mov eax, dword [ebp - 0x28c]
sub eax, edi
mov dword [edi + 0x3c], eax
lea eax, [edi + 0x3c]
jmp 0x3000a8c0
mov edx, 0x14c
cmp dword [eax], ebx
jne 0x3000a96e
lea eax, [edi + 0x1c4]
xor esi, esi
mov ecx, edi
cmp edi, eax
jae 0x3000a968
mov ebx, dword [ebp - 0x294]
movzx eax, word [ecx]
cmp ax, dx
je 0x3000a8f1
cmp ax, word [ebp - 0x29c]
jne 0x3000a8fb
lea eax, [edi + 4]
cmp ecx, eax
jb 0x3000a8fb
lea esi, [ecx - 4]
add ecx, 4
mov dword [ebp - 0x298], ecx
test esi, esi
je 0x3000a956
cmp esi, edi
jne 0x3000a956
mov eax, dword [esi + 0x54]
test eax, eax
je 0x3000a956
add eax, 0xffffffc0
lea esi, [ebx + 0x40]
push eax
push ebx
push esi
call fcn.301608d0
add esp, 0xc
push 0x40
push 0
push ebx
call fcn.30160f00
add esp, 0xc
mov dword [ebx + 0x3c], 0x40
mov edi, ebx
push 0x40
push esi
push ebx
push str.DumpProcess:_pNtHeader_moved_from_0x_x_to_0x_x__e_lfanew_0x_x_n
call fcn.30009b00
mov ecx, dword [ebp - 0x298]
add esp, 0x10
mov edx, 0x14c
lea eax, [edi + 0x1c4]
cmp ecx, eax
jb 0x3000a8e0
mov edi, dword [ebp - 0x2a0]
xor ebx, ebx
mov esi, dword [ebp - 0x290]
mov ecx, esi
call fcn.30012a40
push 0x50
push esi
call fcn.3015e131
push 0x50
call fcn.3015e35d
add esp, 8
mov ecx, eax
push dword [ebp - 0x294]
call fcn.30012890
mov esi, eax
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x3000a744
call fcn.30003f40
cmp eax, 1
jne 0x3000a744
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x3000a9bf
mov ecx, esi
call fcn.30012c10
mov ebx, eax
mov ecx, esi
call fcn.30013450
push ebx
cmp ebx, eax
jb 0x3000a9dc
push str.DumpProcess:_Error___entry_point_too_big:_0x_x__ignoring._n
call fcn.30009b00
add esp, 8
xor ebx, ebx
jmp 0x3000a9eb
push str.DumpProcess:_Module_entry_point_VA_is_0x_p._n
call fcn.30009b00
add esp, 8
add ebx, edi
cmp dword [ebp + 0xc], 0
mov ecx, esi
je 0x3000aa1a
push str.CapeOutput.bin
push ebx
push edi
call fcn.30014580
test al, al
jne 0x3000a72f
push edi
push str.DumpProcess:_Failed_to_dump_image_at_0x_p._n
call fcn.30009b00
add esp, 8
jmp 0x3000a744
push 0
push ebx
push edi
call fcn.30014580
test al, al
jne 0x3000a797
push edi
push str.DumpProcess:_Failed_to_dump_image_at_0x_p._n
call fcn.30009b00
add esp, 8
jmp 0x3000ac69
lea ecx, [ebp - 0x290]
push ecx
lea ecx, [ebp - 0x28c]
push ecx
push eax
call fcn.3000fd90
mov edi, dword [ebp - 0x28c]
test al, al
jne 0x3000aa8a
lea eax, [ebp - 0x290]
mov dword [ebp - 0x28c], 0
push eax
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x290], 0
push eax
push ebx
call fcn.3000f730
mov edi, dword [ebp - 0x28c]
test edi, edi
je 0x3000ac5c
mov ebx, dword [ebp - 0x290]
test ebx, ebx
je 0x3000ac5c
push ebx
push edi
push str.DumpProcess:_Found_IAT___0x_x__size:_0x_x
call fcn.30009b00
add esp, 0xc
lea eax, [ebp - 0x288]
mov dword [0x302386c0], eax
push ebx
call fcn.3015e392
add esp, 4
mov dword [ebp - 0x294], eax
mov edx, ebx
mov ecx, edi
push eax
call fcn.300153f0
add esp, 4
test al, al
je 0x3000aaea
push ebx
mov ebx, dword [ebp - 0x294]
push ebx
push edi
call fcn.3000c4c0
jmp 0x3000aaf0
mov ebx, dword [ebp - 0x294]
push ebx
call fcn.3015e38d
add esp, 4
lea ecx, [ebp - 0x288]
call fcn.300119c0
mov eax, dword [0x302412fc]
test eax, eax
je 0x3000ab1b
mov ecx, dword [eax + 0x104]
mov eax, dword [eax + 0x108]
jmp 0x3000ab26
mov ecx, dword [0x302412f8]
mov eax, dword [0x302412f4]
add eax, ecx
cmp edi, ecx
jbe 0x3000ab30
cmp edi, eax
jb 0x3000ab3d
push str.DumpProcess:_Warning___IAT_is_not_inside_the_PE_image__requires_rebasing._n
call fcn.30009b00
add esp, 4
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x36c], 0
mov dword [ebp - 0x368], 0
call fcn.30012b30
push ecx
mov dword [ebp - 0x360], 0x302386d8
call fcn.30012c60
mov ecx, dword [ebp - 0x358]
test ecx, ecx
je 0x3000ab95
call fcn.30003f40
cmp eax, 1
jne 0x3000ab95
lea ecx, [ebp - 0x370]
call fcn.30013040
lea eax, [ebp - 0x288]
mov dword [ebp - 0x318], 0
push eax
push ecx
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x314], 0
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x304], 0
mov dword [ebp - 0x300], 0
mov word [ebp - 0x2f8], 0
mov dword [ebp - 0x2fc], 0
mov byte [ebp - 0x31c], 0
mov dword [ebp - 0x2ec], 0
call fcn.30010520
test al, al
je 0x3000ac39
push str.DumpProcess:_Import_table_rebuild_success._n
call fcn.30009b00
mov ecx, esi
call fcn.3000a440
lea ecx, [ebp - 0x370]
call fcn.30012a40
mov edi, 1
jmp 0x3000aca3
push str.DumpProcess:_Import_table_rebuild_failed__falling_back_to_unfixed_dump._n
call fcn.30009b00
add esp, 4
mov ecx, esi
push 0
call fcn.30013710
lea ecx, [ebp - 0x370]
call fcn.30012a40
jmp 0x3000ac69
push str.DumpProcess:_Warning:_Unable_to_find_IAT_in_scan._n
call fcn.30009b00
add esp, 4
mov ecx, esi
call fcn.30012a40
push 0x50
push esi
call fcn.3015e131
add esp, 8
mov edi, 1
jmp 0x3000aca3
push str.DumpProcess:_Invalid_PE_file_or_invalid_PE_header._n
call fcn.30009b00
add esp, 4
mov ecx, esi
call fcn.30012a40
push 0x50
push esi
call fcn.3015e131
add esp, 8
xor edi, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x280]
mov esi, dword [ebp - 0x280]
push dword [esi + 4]
call fcn.3000ce60
mov eax, dword [ebp - 0x280]
push 0x128
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x280]
mov dword [eax], esi
mov eax, dword [ebp - 0x280]
mov dword [eax + 8], esi
push dword [ebp - 0x280]
mov dword [ebp - 0x27c], 0
call fcn.3015e131
add esp, 8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x288]
mov esi, dword [ebp - 0x288]
push dword [esi + 4]
call fcn.3000ce60
mov eax, dword [ebp - 0x288]
push 0x128
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x288]
mov dword [eax], esi
mov ecx, dword [ebp - 0x288]
mov dword [ecx + 8], esi
push dword [ebp - 0x288]
mov dword [ebp - 0x284], 0
call fcn.3015e131
add esp, 8
lea ecx, [ebp - 0x2d8]
call fcn.3000a350
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret