Function at 0x428550
Capabilities:
Create thread
Get system information on windows
Inspect section memory permissions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x43a064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x50], eax
mov eax, 0x5a4d
push esi
push edi
mov dword [ebp - 0x44], ecx
movlpd qword [ebp - 0x34], xmm0
cmp word [ecx], ax
jne 0x4289ee
mov edi, dword [ecx + 0x3c]
add edi, ecx
mov dword [ebp - 0x3c], edi
je 0x4289ee
cmp dword [edi], 0x4550
jne 0x4289ee
mov eax, 0x14c
cmp word [edi + 4], ax
jne 0x4289ee
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x38], eax
test al, 1
jne 0x4289ee
movzx ecx, word [edi + 0x14]
xor esi, esi
movzx ebx, word [edi + 6]
add ecx, 0x24
movzx eax, word [edi + 0x16]
mov dword [ebp - 0x4c], eax
test ebx, ebx
je 0x428602
add ecx, edi
mov edi, dword [ebp - 0x38]
nop
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
test eax, eax
jne 0x4285ee
lea eax, [edi + edx]
jmp 0x4285f0
add eax, edx
cmp eax, esi
cmovbe eax, esi
add ecx, 0x28
mov esi, eax
sub ebx, 1
jne 0x4285e0
mov edi, dword [ebp - 0x3c]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov ecx, dword [ebp - 0x28]
lea edx, [ecx - 1]
lea ebx, [ecx - 1]
not edx
add ebx, dword [edi + 0x50]
lea eax, [ecx - 1]
add eax, esi
and ebx, edx
and eax, edx
mov dword [ebp - 0x38], ebx
cmp ebx, eax
jne 0x4289ee
mov esi, dword [sym.imp.kernel32.dll_VirtualAlloc]
push 4
push 0x3000
push ebx
push dword [edi + 0x34]
call esi
mov ebx, eax
mov dword [ebp - 0x40], ebx
test ebx, ebx
jne 0x42865c
push 4
push 0x3000
push dword [ebp - 0x38]
push eax
call esi
mov ebx, eax
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x44]
mov ecx, dword [edx + 0x3c]
mov dword [ebx + 0x3c], ecx
mov eax, dword [edi + 0x54]
sub eax, dword [edx + 0x3c]
push eax
lea eax, [ecx + edx]
push eax
lea eax, [ecx + ebx]
push eax
call fcn.00429620
mov ecx, dword [ebx + 0x3c]
xor eax, eax
add ecx, ebx
add esp, 0xc
xor edi, edi
mov dword [ebp - 0x3c], ecx
movzx esi, word [ecx + 0x14]
add esi, 0x2c
cmp ax, word [ecx + 6]
jae 0x4286bd
add esi, ecx
push dword [esi - 4]
mov eax, dword [esi]
add eax, dword [ebp - 0x44]
push eax
mov eax, dword [esi - 8]
add eax, ebx
push eax
call fcn.00429620
mov ecx, dword [ebp - 0x3c]
lea esi, [esi + 0x28]
inc edi
add esp, 0xc
movzx eax, word [ecx + 6]
cmp edi, eax
jb 0x428697
mov eax, ebx
sub eax, dword [ecx + 0x34]
mov dword [ebp - 0x38], eax
je 0x42878d
cmp dword [ecx + 0xa4], 0
je 0x42878d
mov esi, dword [ecx + 0xa0]
add esi, ebx
cmp dword [esi], 0
je 0x42878d
nop dword [eax]
mov eax, dword [esi + 4]
lea edi, [esi + 8]
add eax, esi
cmp edi, eax
je 0x42877f
movzx edx, word [edi]
mov cx, dx
mov eax, edx
shr cx, 0xc
movzx ebx, cx
cmp cx, 0xa
jne 0x428728
mov ebx, dword [ebp - 0x40]
and edx, 0xfff
add edx, dword [esi]
mov eax, dword [ebp - 0x38]
add dword [edx + ebx], eax
jmp 0x428773
cmp ebx, 3
jne 0x42873f
mov ebx, dword [ebp - 0x40]
and eax, 0xfff
add eax, dword [esi]
mov ecx, dword [ebp - 0x38]
add dword [eax + ebx], ecx
jmp 0x428773
cmp ebx, 1
jne 0x428759
mov ebx, dword [ebp - 0x40]
and eax, 0xfff
add eax, dword [esi]
lea ecx, [eax + ebx]
mov eax, dword [ebp - 0x38]
shr eax, 0x10
jmp 0x428771
cmp ebx, 2
mov ebx, dword [ebp - 0x40]
jne 0x428773
and eax, 0xfff
add eax, dword [esi]
lea ecx, [eax + ebx]
mov eax, dword [ebp - 0x38]
movzx eax, ax
add dword [ecx], eax
mov eax, dword [esi + 4]
add edi, 2
add eax, esi
cmp edi, eax
jne 0x428700
cmp dword [edi], 0
mov esi, edi
jne 0x4286f0
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx + 0x84], 0
je 0x428829
mov esi, dword [ecx + 0x80]
add esi, ebx
mov dword [ebp - 0x38], esi
cmp dword [esi + 0xc], 0
je 0x428829
nop
mov eax, dword [esi + 0xc]
add eax, ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, dword [esi + 0x10]
mov esi, dword [esi]
add edi, ebx
add esi, ebx
mov dword [ebp - 0x40], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x428817
jns 0x4287d7
movzx ecx, word [esi]
xor eax, eax
jmp 0x4287ff
mov edx, dword [esi]
xor ecx, ecx
add edx, 2
add edx, ebx
cmp byte [edx], cl
je 0x4287ef
mov eax, edx
lea eax, [eax + 1]
inc ecx
cmp byte [eax], 0
jne 0x4287e6
mov word [ebp - 0x34], cx
lea eax, [ebp - 0x34]
mov word [ebp - 0x32], cx
xor ecx, ecx
mov dword [ebp - 0x30], edx
push edi
push ecx
push eax
push dword [ebp - 0x40]
call sub.ntdll.dll_LdrGetProcedureAddress
mov ecx, dword [esi + 4]
add esi, 4
add edi, 4
test ecx, ecx
jne 0x4287ce
mov esi, dword [ebp - 0x38]
add esi, 0x14
mov dword [ebp - 0x38], esi
cmp dword [esi + 0xc], 0
jne 0x4287b0
mov ecx, dword [ebp - 0x3c]
movzx esi, word [ecx + 0x14]
xor eax, eax
add esi, 0x28
xor edi, edi
cmp ax, word [ecx + 6]
jae 0x4288dc
add esi, ecx
lea edx, [edi + 1]
cmp dword [esi], 0
je 0x4288cc
mov ecx, dword [esi + 0x14]
mov eax, ecx
and eax, 0x40000000
test ecx, 0x20000000
jne 0x42887e
test eax, eax
jne 0x42886e
test ecx, ecx
mov eax, 8
cmovns eax, edx
jmp 0x42889d
xor eax, eax
test ecx, ecx
sets al
lea eax, [eax*2 + 2]
jmp 0x42889d
test eax, eax
jne 0x42888e
mov eax, 0x80
test ecx, ecx
lea ecx, [eax - 0x70]
jmp 0x42889a
test ecx, ecx
mov eax, 0x40
mov ecx, 0x20
cmovns eax, ecx
mov dword [ebp - 8], eax
test dword [esi + 0x14], 0x4000000
je 0x4288b1
or eax, 0x200
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
push ecx
push eax
mov eax, dword [esi - 4]
push dword [esi]
add eax, ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x3c]
mov edx, 1
movzx eax, word [ecx + 6]
inc edi
add esi, 0x28
cmp edi, eax
jb 0x428843
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_FlushInstructionCache]
mov esi, dword [ebp - 0x3c]
push 0
mov eax, dword [esi + 0x28]
add eax, ebx
test dword [ebp - 0x4c], 0x2000
jne 0x428904
push 0
push 0
jmp 0x42899e
push 1
push ebx
call eax
mov edx, dword [ebp - 0x48]
test edx, edx
je 0x4289bf
cmp dword [esi + 0x7c], 0
je 0x4289bf
mov eax, dword [esi + 0x78]
add eax, ebx
mov dword [ebp - 0x3c], eax
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x4289bf
cmp dword [eax + 0x14], 0
je 0x4289bf
mov edi, dword [eax + 0x20]
mov esi, dword [eax + 0x24]
add edi, ebx
add esi, ebx
mov dword [ebp - 0x38], 0
test ecx, ecx
je 0x4289bf
mov eax, dword [edi]
add eax, ebx
je 0x4289bf
push eax
push edx
call fcn.0042d106
add esp, 8
test eax, eax
jne 0x42896c
test esi, esi
jne 0x428986
mov ecx, dword [ebp - 0x38]
add edi, 4
mov eax, dword [ebp - 0x3c]
inc ecx
add esi, 2
mov dword [ebp - 0x38], ecx
cmp ecx, dword [eax + 0x18]
jae 0x4289bf
mov edx, dword [ebp - 0x48]
jmp 0x428954
mov eax, dword [ebp - 0x3c]
movzx ecx, word [esi]
push 0
push 0
mov eax, dword [eax + 0x1c]
push dword [ebp - 0x50]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
push eax
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x4289ee
push 0xffffffffffffffff
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [ebp - 0x44]
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
test eax, eax
jne 0x4289db
push esi
call dword [sym.imp.kernel32.dll_LocalFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428d1b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d1b
mov esp, ebp
pop ebp
ret