Function at 0x3000ab60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x30182d20
mov eax, dword fs:[0]
push eax
sub esp, 0x38c
mov eax, dword [0x30215e88]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x2a0], edi
mov esi, ecx
xor ebx, ebx
mov word [ebp - 0x2d8], 0x100
mov dword [ebp - 0x2b8], ebx
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2d4], ebx
mov dword [ebp - 0x2cc], ebx
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2c4], ebx
mov dword [ebp - 0x2c0], ebx
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x284], ebx
call fcn.30011ba0
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x27c], ebx
call fcn.30011ba0
mov edx, dword [0x3023f99c]
push ecx
mov ecx, dword [0x3023f998]
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x274], ebx
call fcn.3000bb90
mov eax, dword [0x3023f998]
add esp, 4
mov dword [0x3023f99c], eax
call fcn.30012ce0
test esi, esi
je 0x3000ac56
mov dword [0x3023c750], esi
mov edx, 0x3023f9a4
mov ecx, esi
jmp 0x3000ac6c
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov dword [0x3023c750], eax
call esi
mov edx, 0x3023f998
mov ecx, eax
call fcn.30015b60
push edi
push str.DumpProcess:_Instantiating_PeParser_with_address:_0x_p._n
call fcn.3000a0d0
push 0x50
call fcn.3015a21d
add esp, 8
mov ecx, eax
push edi
call fcn.30012ef0
mov esi, eax
mov dword [ebp - 0x290], esi
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x3000ad8c
call fcn.300042b0
cmp eax, 1
jne 0x3000ad8c
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x3000acc2
test edi, edi
je 0x3000accb
cmp ebx, edi
jbe 0x3000accb
sub ebx, edi
jmp 0x3000accb
mov ecx, esi
call fcn.300131e0
mov ebx, eax
mov ecx, esi
call fcn.30013a20
push ebx
cmp ebx, eax
jb 0x3000ace8
push str.DumpProcess:_Error___entry_point_too_big:_0x_x__ignoring._n
call fcn.3000a0d0
add esp, 8
xor ebx, ebx
jmp 0x3000acf7
push str.DumpProcess:_Module_entry_point_VA_is_0x_p._n
call fcn.3000a0d0
add esp, 8
add ebx, edi
cmp dword [ebp + 0xc], 0
mov ecx, esi
je 0x3000ad6a
push str.CapeOutput.bin
push ebx
push edi
call fcn.30014b50
test al, al
je 0x3000ad57
push dword [esi + 0xc]
push 0x30233b38
push str.DumpProcess:_Module_image_dump_success__s___dump_size_0x_x._n
call fcn.3000a0d0
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x3000b249
xor edi, edi
lea ecx, [ebp - 0x398]
push ebx
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x290], edi
call fcn.30010060
test eax, eax
jne 0x3000b01e
xor al, al
jmp 0x3000b038
push edi
push str.DumpProcess:_Failed_to_dump_image_at_0x_p._n
call fcn.3000a0d0
add esp, 8
jmp 0x3000b26f
push 0
push ebx
push edi
call fcn.30014b50
test al, al
je 0x3000ad57
push dword [esi + 0xc]
push str.DumpProcess:_Module_image_dump_success___dump_size_0x_x._n
call fcn.3000a0d0
add esp, 8
jmp 0x3000b249
mov ecx, edi
call fcn.300042b0
test eax, eax
je 0x3000ada1
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x3000adb1
mov eax, dword [edi + 0x3c]
cmp dword [edi + eax], 0x4550
je 0x3000b262
push edi
push str.DumpProcess:_Disguised_PE_image__bad_MZ_and_or_PE_headers__at_0x_p._n
call fcn.3000a0d0
add esp, 8
lea eax, [ebp - 0x38c]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x3000ade6
push edi
push str.DumpProcess:_unable_to_query_memory_address_0x_p
call fcn.3000a0f0
add esp, 8
jmp 0x3000b26f
push 1
push dword [ebp - 0x380]
call fcn.30164988
add esp, 8
mov dword [ebp - 0x294], eax
test eax, eax
je 0x3000b26f
push dword [ebp - 0x380]
push dword [ebp - 0x38c]
push eax
call fcn.3015c210
lea eax, [edi + 0x3c]
mov dword [ebp - 0x29c], 0x8664
add esp, 0xc
mov edx, 0x14c
mov dword [ebp - 0x28c], edx
cmp dword [eax], ebx
jne 0x3000af4e
lea edx, [edi + 0x1c4]
mov ecx, eax
cmp ecx, edx
jae 0x3000ae9b
xor esi, esi
jmp 0x3000ae50
movzx eax, word [ecx]
cmp ax, word [ebp - 0x28c]
je 0x3000ae65
cmp ax, word [ebp - 0x29c]
jne 0x3000ae6f
lea eax, [edi + 3]
cmp ecx, eax
jbe 0x3000ae6f
lea esi, [ecx - 4]
add ecx, 4
cmp ecx, edx
jb 0x3000ae50
mov dword [ebp - 0x28c], esi
test esi, esi
mov esi, dword [ebp - 0x290]
mov edx, 0x14c
je 0x3000ae96
mov eax, dword [ebp - 0x28c]
sub eax, edi
mov dword [edi + 0x3c], eax
lea eax, [edi + 0x3c]
jmp 0x3000aea0
mov edx, 0x14c
cmp dword [eax], ebx
jne 0x3000af4e
lea eax, [edi + 0x1c4]
xor esi, esi
mov ecx, edi
cmp edi, eax
jae 0x3000af48
mov ebx, dword [ebp - 0x294]
movzx eax, word [ecx]
cmp ax, dx
je 0x3000aed1
cmp ax, word [ebp - 0x29c]
jne 0x3000aedb
lea eax, [edi + 4]
cmp ecx, eax
jb 0x3000aedb
lea esi, [ecx - 4]
add ecx, 4
mov dword [ebp - 0x298], ecx
test esi, esi
je 0x3000af36
cmp esi, edi
jne 0x3000af36
mov eax, dword [esi + 0x54]
test eax, eax
je 0x3000af36
add eax, 0xffffffc0
lea esi, [ebx + 0x40]
push eax
push ebx
push esi
call fcn.3015c790
add esp, 0xc
push 0x40
push 0
push ebx
call fcn.3015cdc0
add esp, 0xc
mov dword [ebx + 0x3c], 0x40
mov edi, ebx
push 0x40
push esi
push ebx
push str.DumpProcess:_pNtHeader_moved_from_0x_x_to_0x_x__e_lfanew_0x_x_n
call fcn.3000a0d0
mov ecx, dword [ebp - 0x298]
add esp, 0x10
mov edx, 0x14c
lea eax, [edi + 0x1c4]
cmp ecx, eax
jb 0x3000aec0
mov edi, dword [ebp - 0x2a0]
xor ebx, ebx
mov esi, dword [ebp - 0x290]
mov ecx, esi
call fcn.30013010
push 0x50
push esi
call fcn.30159ff1
push 0x50
call fcn.3015a21d
add esp, 8
mov ecx, eax
push dword [ebp - 0x294]
call fcn.30012e60
mov esi, eax
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x3000ad24
call fcn.300042b0
cmp eax, 1
jne 0x3000ad24
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x3000af9f
mov ecx, esi
call fcn.300131e0
mov ebx, eax
mov ecx, esi
call fcn.30013a20
push ebx
cmp ebx, eax
jb 0x3000afbc
push str.DumpProcess:_Error___entry_point_too_big:_0x_x__ignoring._n
call fcn.3000a0d0
add esp, 8
xor ebx, ebx
jmp 0x3000afcb
push str.DumpProcess:_Module_entry_point_VA_is_0x_p._n
call fcn.3000a0d0
add esp, 8
add ebx, edi
cmp dword [ebp + 0xc], 0
mov ecx, esi
je 0x3000affa
push str.CapeOutput.bin
push ebx
push edi
call fcn.30014b50
test al, al
jne 0x3000ad0f
push edi
push str.DumpProcess:_Failed_to_dump_image_at_0x_p._n
call fcn.3000a0d0
add esp, 8
jmp 0x3000ad24
push 0
push ebx
push edi
call fcn.30014b50
test al, al
jne 0x3000ad77
push edi
push str.DumpProcess:_Failed_to_dump_image_at_0x_p._n
call fcn.3000a0d0
add esp, 8
jmp 0x3000b249
lea ecx, [ebp - 0x290]
push ecx
lea ecx, [ebp - 0x28c]
push ecx
push eax
call fcn.30010360
mov edi, dword [ebp - 0x28c]
test al, al
jne 0x3000b06a
lea eax, [ebp - 0x290]
mov dword [ebp - 0x28c], 0
push eax
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x290], 0
push eax
push ebx
call fcn.3000fd00
mov edi, dword [ebp - 0x28c]
test edi, edi
je 0x3000b23c
mov ebx, dword [ebp - 0x290]
test ebx, ebx
je 0x3000b23c
push ebx
push edi
push str.DumpProcess:_Found_IAT___0x_x__size:_0x_x
call fcn.3000a0d0
add esp, 0xc
lea eax, [ebp - 0x288]
mov dword [0x30233b20], eax
push ebx
call fcn.3015a252
add esp, 4
mov dword [ebp - 0x294], eax
mov edx, ebx
mov ecx, edi
push eax
call fcn.300159c0
add esp, 4
test al, al
je 0x3000b0ca
push ebx
mov ebx, dword [ebp - 0x294]
push ebx
push edi
call fcn.3000ca90
jmp 0x3000b0d0
mov ebx, dword [ebp - 0x294]
push ebx
call fcn.3015a24d
add esp, 4
lea ecx, [ebp - 0x288]
call fcn.30011f90
mov eax, dword [0x3023c75c]
test eax, eax
je 0x3000b0fb
mov ecx, dword [eax + 0x104]
mov eax, dword [eax + 0x108]
jmp 0x3000b106
mov ecx, dword [0x3023c758]
mov eax, dword [0x3023c754]
add eax, ecx
cmp edi, ecx
jbe 0x3000b110
cmp edi, eax
jb 0x3000b11d
push str.DumpProcess:_Warning___IAT_is_not_inside_the_PE_image__requires_rebasing._n
call fcn.3000a0d0
add esp, 4
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x36c], 0
mov dword [ebp - 0x368], 0
call fcn.30013100
push ecx
mov dword [ebp - 0x360], 0x30233b38
call fcn.30013230
mov ecx, dword [ebp - 0x358]
test ecx, ecx
je 0x3000b175
call fcn.300042b0
cmp eax, 1
jne 0x3000b175
lea ecx, [ebp - 0x370]
call fcn.30013610
lea eax, [ebp - 0x288]
mov dword [ebp - 0x318], 0
push eax
push ecx
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x314], 0
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x304], 0
mov dword [ebp - 0x300], 0
mov word [ebp - 0x2f8], 0
mov dword [ebp - 0x2fc], 0
mov byte [ebp - 0x31c], 0
mov dword [ebp - 0x2ec], 0
call fcn.30010af0
test al, al
je 0x3000b219
push str.DumpProcess:_Import_table_rebuild_success._n
call fcn.3000a0d0
mov ecx, esi
call fcn.3000aa10
lea ecx, [ebp - 0x370]
call fcn.30013010
mov edi, 1
jmp 0x3000b283
push str.DumpProcess:_Import_table_rebuild_failed__falling_back_to_unfixed_dump._n
call fcn.3000a0d0
add esp, 4
mov ecx, esi
push 0
call fcn.30013ce0
lea ecx, [ebp - 0x370]
call fcn.30013010
jmp 0x3000b249
push str.DumpProcess:_Warning:_Unable_to_find_IAT_in_scan._n
call fcn.3000a0d0
add esp, 4
mov ecx, esi
call fcn.30013010
push 0x50
push esi
call fcn.30159ff1
add esp, 8
mov edi, 1
jmp 0x3000b283
push str.DumpProcess:_Invalid_PE_file_or_invalid_PE_header._n
call fcn.3000a0d0
add esp, 4
mov ecx, esi
call fcn.30013010
push 0x50
push esi
call fcn.30159ff1
add esp, 8
xor edi, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x280]
mov esi, dword [ebp - 0x280]
push dword [esi + 4]
call fcn.3000d430
mov eax, dword [ebp - 0x280]
push pe_nt_image_headers32
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x280]
mov dword [eax], esi
mov eax, dword [ebp - 0x280]
mov dword [eax + 8], esi
push dword [ebp - 0x280]
mov dword [ebp - 0x27c], 0
call fcn.30159ff1
add esp, 8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x288]
mov esi, dword [ebp - 0x288]
push dword [esi + 4]
call fcn.3000d430
mov eax, dword [ebp - 0x288]
push pe_nt_image_headers32
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x288]
mov dword [eax], esi
mov ecx, dword [ebp - 0x288]
mov dword [ecx + 8], esi
push dword [ebp - 0x288]
mov dword [ebp - 0x284], 0
call fcn.30159ff1
add esp, 8
lea ecx, [ebp - 0x2d8]
call fcn.3000a920
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret