Function at 0x401640
Capabilities:
Execute command
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4035e5
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x406008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
mov dword [ebp - 4], 0
mov edx, str.Enter_the_target_process_name__e.g.__example.exe_:
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00401e70
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea edx, [ebp - 0x58]
call fcn.004023e0
lea ecx, [ebp - 0x58]
call fcn.00401240
mov esi, eax
mov dword [ebp - 0x90], esi
test esi, esi
jne 0x4016fd
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Process_not_found:
call fcn.00401e70
cmp dword [ebp - 0x44], 0x10
lea edx, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae edx, dword [ebp - 0x58]
mov ecx, eax
call fcn.004025e0
add esp, 4
mov edx, 0x404260
mov ecx, eax
call fcn.00401e70
mov esi, 1
jmp 0x401a64
push esi
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
push 0x410
movq qword [ebp - 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, eax
mov dword [ebp - 0x80], ecx
test ecx, ecx
jne 0x401761
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_open_process_with_ID:
push esi
call fcn.00401e70
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov edx, 0x404260
mov ecx, eax
call fcn.00401e70
xor ecx, ecx
xor eax, eax
xor edi, edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x84], ecx
xor esi, esi
mov dword [ebp - 0x24], ecx
jmp 0x40181b
xor esi, esi
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
xor edi, edi
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], edi
mov eax, 0x400000
mov byte [ebp - 4], 1
mov dword [ebp - 0x84], eax
push 0x1c
lea edx, [ebp - 0x78]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x4017f9
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x2c], eax
cmp esi, edi
je 0x4017cd
movups xmm0, xmmword [ebp - 0x38]
movups xmmword [esi], xmm0
add esi, 0x10
mov dword [ebp - 0x18], esi
jmp 0x4017e0
lea eax, [ebp - 0x38]
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.004020b0
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x84], eax
cmp eax, 0x1000000
jb 0x401790
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movq xmm0, qword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
movq qword [ebp - 0x28], xmm0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 2
cmp ecx, esi
jne 0x401849
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.No_memory_regions_found._n
call fcn.00401e70
mov esi, 1
jmp 0x401a31
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Summarized_Memory_Regions:_n
call fcn.00401e70
mov ecx, dword [ebp - 0x7c]
xor edx, edx
sub esi, ecx
mov dword [ebp - 0x80], edx
sar esi, 4
test esi, esi
mov esi, dword [ebp - 0x88]
je 0x4019c6
add ecx, 4
mov dword [ebp - 0x7c], ecx
nop word [eax + eax]
mov eax, dword [ecx + 4]
cmp eax, 0x1000
jne 0x401891
mov edx, str.COMMITTED
jmp 0x4018b1
cmp eax, 0x10000
jne 0x40189f
mov edx, str.FREE
jmp 0x4018b1
cmp eax, 0x2000
mov edx, str.RESERVED
mov eax, str.UNKNOWN
cmovne edx, eax
mov eax, edx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
lea ecx, [eax + 1]
mov dword [ebp - 0x8c], ecx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4018d5
sub eax, dword [ebp - 0x8c]
lea ecx, [ebp - 0x40]
push eax
push edx
call fcn.00401be0
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x80]
mov byte [ebp - 4], 3
inc ecx
mov dword [ebp - 0x80], ecx
push dword [eax]
push dword [eax - 4]
push 0x401220
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
mov edx, str.:_Base_Address:_0x
mov ecx, eax
call fcn.00401e70
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
mov edx, str.__Size:_0x
mov ecx, eax
call fcn.00401e70
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
mov edx, str.__State:
mov ecx, eax
call fcn.00401e70
cmp dword [ebp - 0x2c], 0x10
lea edx, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae edx, dword [ebp - 0x40]
mov ecx, eax
call fcn.004025e0
add esp, 4
mov edx, 0x404260
mov ecx, eax
call fcn.00401e70
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x4019a9
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40199f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401a8a
push edx
push ecx
call fcn.004028c4
add esp, 8
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x7c]
sub eax, esi
add ecx, 0x10
sar eax, 4
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0x80], eax
jb 0x401880
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._nEnter_the_number_of_the_region_to_analyze_in_detail:
call fcn.00401e70
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_int__]
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x401a11
mov eax, dword [ebp - 0x84]
sub eax, esi
sar eax, 4
cmp ecx, eax
ja 0x401a11
shl ecx, 4
lea edx, [ecx - 0x10]
mov ecx, dword [ebp - 0x90]
add edx, esi
call fcn.00401500
jmp 0x401a21
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Invalid_choice._n
call fcn.00401e70
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor esi, esi
mov ecx, dword [ebp - 0x88]
test ecx, ecx
je 0x401a64
sub edi, ecx
mov eax, ecx
and edi, 0xfffffff0
cmp edi, 0x1000
jb 0x401a5a
mov ecx, dword [ecx - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401a8a
push edi
push ecx
call fcn.004028c4
add esp, 8
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x401a9a
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401a90
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401a90
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004028c4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402886
mov esp, ebp
pop ebp
ret