Function at 0x506f8fe7
Capabilities:
Parse pe header

Disassembly:
push 0x118
push 0x506f92d8
call fcn.506f2e44
mov eax, dword [0x506fb050]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x506fb924]
xor ecx, ecx
cmp eax, ecx
je 0x506f9028
mov dword [ebp - 4], ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x506f9127
mov eax, dword [ebp + 8]
dec eax
je 0x506f9044
mov edi, 0x506f92b4
mov dword [ebp - 0x128], 0x506f9200
mov esi, 0xd4
jmp 0x506f9058
mov edi, 0x506f91e0
mov dword [ebp - 0x128], 0x506f9140
mov esi, 0xb9
mov byte [ebp - 0x20], cl
push 0x104
lea eax, [ebp - 0x124]
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x506f9085
push 0x506f4d00
lea eax, [ebp - 0x124]
push eax
call fcn.506f16e4
pop ecx
pop ecx
lea ebx, [ebp - 0x124]
mov eax, ebx
push eax
call fcn.506f17c8
pop ecx
add eax, 0xb
cmp eax, 0x3c
jbe 0x506f90c1
mov eax, ebx
push eax
call fcn.506f17c8
mov ebx, eax
lea eax, [ebp - 0x124]
sub eax, 0x31
add ebx, eax
push 3
push 0x506f4cfc
push ebx
call fcn.506f39e1
add esp, 0x10
push ebx
call fcn.506f17c8
pop ecx
lea eax, [eax + esi + 0xc]
add eax, 3
and eax, 0xfffffffc
call fcn.506f19f4
mov dword [ebp - 0x18], esp
mov esi, esp
push edi
push esi
call fcn.506f16e4
mov edi, 0x506f4cf8
push edi
push esi
call fcn.506f3970
push 0x506f9130
push esi
call fcn.506f3970
push ebx
push esi
call fcn.506f3970
push edi
push esi
call fcn.506f3970
push dword [ebp - 0x128]
push esi
call fcn.506f3970
push 0x12010
push 0x506f4cd0
push esi
call fcn.506f6c53
add esp, 0x3c
push 3
call fcn.506f8bf1
nop
nop
push eax
jb 0x506f91a2
jb 0x506f9197
insd dword es:[edi], dx
cmp ah, byte [eax]
add byte [eax - 0x6f6f6f70], dl
nop
inc ecx
and byte [edx + 0x75], ah
jb 0x506f9169
outsd dx, dword [esi]
jbe 0x506f91b1
jb 0x506f91c0
jne 0x506f91be
and byte [eax + 0x61], ch
jae 0x506f9175
bound esp, qword [ebp + 0x65]
outsb dx, byte [esi]
and byte [ebp + 0x74], ah
arpl word gs:[ebp + 0x64], si
and byte [edi + 0x68], dh
imul esp, dword [ebx + 0x68], 0x73616820
and byte [ebx + 0x6f], ah
push 0x63207361
outsd dx, dword [esi]
jb 0x506f91e3
jne 0x506f91e3
je 0x506f91da
and byte fs:[eax + ebp*2 + 0x65], dh
and byte [eax + 0x72], dh
outsd dx, dword [esi]
jb 0x506f91e2
insd dword es:[edi], dx
daa
jae 0x506f918f
imul ebp, dword [esi + 0x74], 0x616e7265
insb byte es:[edi], dx
and byte [ebx + 0x74], dh
popal
je 0x506f91f2
je 0x506f91f8
and byte cs:[eax], ah
push esp
push 0x72702065
outsd dx, dword [esi]
jb 0x506f9201
insd dword es:[edi], dx
and byte [ebx + 0x61], ah
outsb dx, byte [esi]
arpl word [ecx + 0x6e], sp
outsb dx, byte [esi]
outsd dx, dword [esi]
je 0x506f91c9
jae 0x506f920c
insb byte es:[edi], dx
jns 0x506f91d0
arpl word [edi + 0x6e], bp
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x506f921e
outsb dx, byte [esi]
jne 0x506f921d
and byte [ebp + 0x78], ah
arpl word gs:[ebp + 0x74], si
imul ebp, dword [edi + 0x6e], 0x646e6120
and byte [ebp + 0x75], ch
je 0x506f9229
outsd dx, dword [esi]
outsb dx, byte [esi]
and byte [ecx + 0x6e], ah
and byte fs:[ebp + 0x75], ch
jae 0x506f923f
or ch, byte [esi + 0x6f]
ja 0x506f91f0
bound esp, qword [ebp + 0x20]
je 0x506f923a
jb 0x506f9244
imul ebp, dword [esi + 0x61], 0x2e646574
or al, byte [eax]
je 0x506f9241
or al, byte cs:[eax]
inc edx
jne 0x506f9249
jb 0x506f9207
jb 0x506f9207
outsd dx, dword [esi]
jbe 0x506f924f
jb 0x506f925e
jne 0x506f925c
and byte [ebp + 0x74], ah
je 0x506f9258
arpl word gs:[ebp + 0x64], si
arpl word [ebp + 0x64], si
and dword [eax], eax
nop
nop
nop
nop
nop
add byte [eax - 0x6f6f6f70], dl
nop
nop
inc ecx
and byte [ebx + 0x65], dh
arpl word [ebp + 0x72], si
imul esi, dword [ecx + edi*2 + 0x20], 0x6f727265
jb 0x506f9280
outsd dx, dword [esi]
jb 0x506f9231
outsd dx, dword [esi]
and byte [ebp + 0x6e], dh
imul ebp, dword [esi + 0x6f], 0x77
outsb dx, byte [esi]
and byte [ebx + 0x61], ah
popal
jne 0x506f9293
and byte gs:[eax + 0x61], ch
jae 0x506f9246
bound esp, qword [ebp + 0x65]
outsb dx, byte [esi]
and byte [ebp + 0x74], ah
arpl word gs:[ebp + 0x64], si
and byte [edi + 0x68], dh
and byte fs:[edi + 0x68], dh
imul esp, dword [ebx + 0x68], 0x73616820
or ah, byte [ebx + 0x6f]
push 0x630a7361
outsd dx, dword [esi]
jb 0x506f92b4
jb 0x506f92b8
jne 0x506f92b4
jo 0x506f92b9
je 0x506f92ab
and byte fs:[eax + ebp*2 + 0x65], dh
and byte fs:[eax + ebp*2 + 0x65], dh
push 0x72702065
and byte [eax + 0x72], dh
outsd dx, dword [esi]
jb 0x506f92b3
insd dword es:[edi], dx
daa
jae 0x506f9276
imul ebp, dword [esi + 0x74], 0x616e7265
je 0x506f92bf
jb 0x506f92ca
popal
insb byte es:[edi], dx
and byte [ebx + 0x74], dh
popal
je 0x506f92c9
and byte cs:[eax], ah
push esp
push 0x72702065
outsd dx, dword [esi]
jb 0x506f92d2
insd dword es:[edi], dx
and byte [ebx + 0x61], ah
outsb dx, byte [esi]
outsb dx, byte [esi]
outsd dx, dword [esi]
je 0x506f929a
jae 0x506f92dd
insb byte es:[edi], dx
jns 0x506f928b
or ah, byte [ebx + 0x6f]
outsb dx, byte [esi]
arpl word [edi + 0x6e], bp
je 0x506f92ef
outsb dx, byte [esi]
jne 0x506f92ee
and byte [ebp + 0x78], ah
arpl word gs:[ebp + 0x74], si
js 0x506f92f2
arpl word [ebp + 0x74], si
imul ebp, dword [edi + 0x6e], 0x646e6120
and byte [ebp + 0x75], ch
and byte [ecx + 0x6e], ah
and byte fs:[ebp + 0x75], ch
jae 0x506f9310
and byte [esi + 0x6f], ch
ja 0x506f92c1
bound esp, qword [ebp + 0x20]
je 0x506f930b
jb 0x506f9315
imul ebp, dword [esi + 0x61], 0x2e646574
or al, byte [eax]
je 0x506f9312
or al, byte cs:[eax]
nop
nop
nop
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x6f], 0x77
outsb dx, byte [esi]
outsd dx, dword [esi]
ja 0x506f9329
and byte [ebx + 0x65], dh
arpl word [ebp + 0x72], si
jne 0x506f9333
imul esi, dword [ecx + edi*2 + 0x20], 0x6c696166
jne 0x506f933d
jb 0x506f9331
and byte gs:[ebp + 0x74], ah
and byte [ebp + 0x74], ah
arpl word gs:[ebp + 0x64], si
and dword [eax], eax
je 0x506f9339
and dword fs:[eax], eax
nop
nop
outsd dx, dword [esi]
push eax
and edx, dword [eax - 0x74aaaf91]
in al, dx
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
or byte [ebx - 0x3c09f7a2], cl
add esi, dword [ebp + 0x1b]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x506f9312
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x506f9319
cmp ebx, dword [eax + 4]
jae 0x506f9319
xor eax, eax
jmp 0x506f9509
lock add dword [eax], eax
add byte [edi - 0x75], dl
jle 0x506f9329
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x506f932a
xor eax, eax
inc eax
jmp 0x506f9508
add byte [ebx], dh
ror byte [ecx - 0x3c74f7ab], cl
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x506f9340
cmp ecx, edx
jae 0x506f9485
retf 0x830f
add dword [eax], eax
add byte [ebx + 0x74000478], al
add edi, edi
inc ebp
or byte [edx - 0x7d], al
ror byte [ebx + edi], 0xd7
cmp dword [eax + 4], 0
je 0x506f9349
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x506f9331
cmp dword [ebp + 8], 0
je 0x506f936b
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x506f9485
cmp eax, esi
jae 0x506f9485
mov eax, dword [0x506fb928]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x506f9390
cmp dword [esi*4 + 0x506fb930], edi
je 0x506f9489
inc esi
cmp esi, eax
jl 0x506f937e
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x506f9505
cmp dword [ebp - 8], 0x1000000
jne 0x506f9505
test byte [ebp - 0xc], 0xcc
je 0x506f940e
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x506f9505
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x506f9505
cmp word [eax + 0x18], 0x10b
jne 0x506f9505
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x506f9505
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x506f940e
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x506f940e
test byte [ecx + 0x27], 0x80
jne 0x506f9485
push 1
push 0x506fb970
call dword [sym.imp.kernel32.dll_InterlockedExchange]
test eax, eax
jne 0x506f9322
mov ecx, dword [0x506fb928]
test ecx, ecx
mov edx, ecx
jle 0x506f9442
lea eax, [ecx*4 + 0x506fb92c]
cmp dword [eax], edi
je 0x506f9442
dec edx
sub eax, 4
test edx, edx
jg 0x506f9436
test edx, edx
jne 0x506f9473
push 0xf
pop ebx
cmp ecx, ebx
jg 0x506f944f
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x506f9467
lea eax, [edx*4 + 0x506fb930]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x506f9455
cmp ecx, 0x10
jge 0x506f9473
inc ecx
mov dword [0x506fb928], ecx
push 0
push 0x506fb970
call dword [sym.imp.kernel32.dll_InterlockedExchange]
jmp 0x506f9322
xor eax, eax
jmp 0x506f9508
test esi, esi
jle 0x506f9322
mov ebx, dword [sym.imp.kernel32.dll_InterlockedExchange]
push 1
push 0x506fb970
call ebx
test eax, eax
jne 0x506f9322
cmp dword [esi*4 + 0x506fb930], edi
je 0x506f94df
mov eax, dword [0x506fb928]
lea esi, [eax - 1]
test esi, esi
jl 0x506f94cd
cmp dword [esi*4 + 0x506fb930], edi
je 0x506f94c9
dec esi
jns 0x506f94bd
test esi, esi
jge 0x506f94dd
cmp eax, 0x10
jge 0x506f94d8
inc eax
mov dword [0x506fb928], eax
lea esi, [eax - 1]
jmp 0x506f94df
je 0x506f94f7
xor ecx, ecx
test esi, esi
jl 0x506f94f7
lea eax, [ecx*4 + 0x506fb930]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x506f94e5
push 0
push 0x506fb970
call ebx
jmp 0x506f9322
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret