Function at 0x4b2b40
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [edx + 0x80]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x18], esi
push edi
test eax, eax
je 0x4b2e16
cmp dword [edx + 0x84], 0
je 0x4b2e16
lea edi, [eax + esi]
lea eax, [esp + 0x24]
mov dword [esp + 0x18], edi
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.004b28a0
test eax, eax
js 0x4b2e1b
lea eax, [esp + 0x20]
push eax
push 4
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x34]
push eax
push 0xffffffffffffffff
lfence
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov dword [esp + 0x10], eax
test eax, eax
js 0x4b2e1b
mov ecx, dword ds:[edi + 0xc]
test ecx, ecx
je 0x4b2df4
jmp 0x4b2bd0
lea ebx, [ecx + esi]
mov dword [esp + 0x34], edi
mov ecx, dword [edi + 0x10]
mov dword [esp + 0x2c], ebx
lea eax, [ecx + esi]
mov dword [esp + 0x14], eax
mov eax, dword [edi]
test eax, eax
cmovne ecx, eax
mov eax, ebx
lea edi, [ecx + esi]
mov ecx, 0x57e8ac
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4b2c1a
lea esp, [esp]
test dl, dl
je 0x4b2c16
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4b2c1a
add eax, 2
add ecx, 2
test dl, dl
jne 0x4b2bf6
xor eax, eax
jmp 0x4b2c1f
sbb eax, eax
or eax, 1
nop
test eax, eax
jne 0x4b2c33
mov esi, dword [0x5b1d78]
mov dword [esp + 0x10], eax
jmp 0x4b2cdc
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4b2c36
push dword [0x5b1d70]
sub ebx, ecx
lea esi, [ebx + ebx]
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov dword [esp + 0x30], eax
lea ecx, [eax + 8]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov word [ecx + esi], dx
push dword [eax + 4]
push ebx
push dword [esp + 0x34]
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Buffer
mov ebx, dword [esp + 0x30]
mov ecx, dword [ebx + 4]
call fcn.004b2780
mov esi, eax
test esi, esi
jne 0x4b2cbd
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4b2c9b
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4b2cbd
jmp 0x4b2ca0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
jle 0x4b2cbd
movzx edx, dx
or edx, 0xc0070000
mov dword [esp + 0x10], edx
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4b2cd0
call fcn.004b3960
mov eax, dword [esp + 0x10]
test eax, eax
js 0x4b2e1b
lea esp, [esp]
test esi, esi
je 0x4b2de8
mov eax, dword [edi]
test eax, eax
je 0x4b2dbd
sub dword [esp + 0x14], edi
test eax, eax
jns 0x4b2d50
movzx edx, word [edi]
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4b2d44
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4b2d44
cmp eax, 0x7fffffff
jae 0x4b2d44
cmp dword [eax + esi], 0x4550
jne 0x4b2d44
lea ecx, [eax + 0x78]
mov eax, dword [ecx + esi]
add ecx, esi
test eax, eax
je 0x4b2d44
cmp dword [ecx + 4], 0
je 0x4b2d44
push edx
push 0
add eax, esi
push eax
push ecx
mov ecx, esi
call fcn.004b2920
mov edi, edi
test eax, eax
jne 0x4b2da9
mov eax, 0xc0000138
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword ds:[esp + 0x1c]
add ebx, eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4b2ddc
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4b2ddc
cmp eax, 0x7fffffff
jae 0x4b2ddc
cmp dword [eax + esi], 0x4550
jne 0x4b2ddc
lea edx, [eax + 0x78]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x4b2ddc
cmp dword [edx + 4], 0
je 0x4b2ddc
lea ecx, ds:[eax + esi]
push 0
lea eax, [ebx + 2]
push eax
push ecx
push edx
mov ecx, esi
call fcn.004b2920
test eax, eax
je 0x4b2ddc
mov ecx, dword [esp + 0x14]
mov dword [edi + ecx], eax
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x4b2cf8
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x18]
add edi, 0x14
mov dword [esp + 0x18], edi
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x4b2df4
mov esi, dword [esp + 0x1c]
jmp 0x4b2bd0
mov eax, 0xc000007a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x24]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x34]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xc0000020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret