Function at 0x411830
Capabilities:
Inspect section memory permissions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov esi, eax
mov eax, dword [ebx + 0x2e8]
mov eax, dword [eax + 8]
push 0
lea ecx, [esi + 0x3618]
push 0x1000
push ecx
mov ecx, dword [eax + 4]
push eax
call ecx
add esp, 0x14
test eax, eax
jns 0x411882
mov edx, dword [ebx + 8]
push eax
push edx
push str._s:_Error_reading_image_header:__Rrc
mov edi, 0xffffea09
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
xor edi, edi
cmp word [esi + 0x3618], ax
jne 0x4118c3
mov edi, dword [esi + 0x3654]
cmp edi, 0x200
ja 0x4118a5
cmp edi, 0x40
jae 0x4118c3
mov ecx, dword [ebx + 8]
push edi
push ecx
push str._s:_Unexpected_e_lfanew_value:__x
mov edi, 0xffffea18
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + esi + 0x3618]
cmp eax, 0x4550
je 0x4118f0
mov edx, dword [ebx + 8]
push eax
push edi
push edx
push str._s:_No_PE_signature_at__x:__x
mov edi, 0xffffea1a
call fcn.0040f980
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [edi + esi + 0x361c]
mov ecx, 0x14c
cmp ax, cx
je 0x411920
push eax
mov eax, dword [ebx + 8]
push eax
push str._s:_Unexpected_machine:__x
mov edi, 0xffffe9f1
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [edi + esi + 0x362c]
cmp eax, 0xe0
je 0x41194d
mov ecx, dword [ebx + 8]
push eax
push ecx
push str._s:_Unexpected_optional_header_size:__x
mov edi, 0xffffea17
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [edi + esi + 0x3630]
cmp eax, 0x10b
je 0x41197a
mov edx, dword [ebx + 8]
push eax
push edx
push str._s:_Unexpected_optional_header_magic:__x
mov edi, 0xffffea17
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + esi + 0x368c]
cmp eax, 0x10
je 0x4119a4
push eax
mov eax, dword [ebx + 8]
push eax
push str._s:_Unexpected_data_dirs:__x
mov edi, 0xffffea17
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [edi + esi + 0x361e]
mov dword [ebp - 0x18], eax
cmp eax, 0x10
jbe 0x4119d4
mov edx, dword [ebx + 8]
mov ecx, eax
push ecx
push edx
push str._s:_Too_many_section_headers:__x
mov edi, 0xffffe9f2
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
lea ecx, [edi + esi + 0x3710]
mov dword [ebp + 8], eax
push ecx
lea eax, [esi + 0x4618]
push eax
call fcn.00402580
mov eax, dword [edi + esi + 0x364c]
add esp, 0xc
test eax, 0xfff
je 0x411a27
mov ecx, dword [ebx + 8]
push eax
push ecx
push str._s:_Invalid_image_base:__p
mov edi, 0xffffea1b
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + esi + 0x3668]
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], ecx
add ecx, 0xfff
lea edx, [eax + 0xfff]
xor edx, ecx
test edx, 0xfffff000
je 0x411a75
cmp byte [ebx + 0x2e6], 0
jne 0x411a75
mov ecx, dword [ebx + 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ecx
push str._s:_SizeOfImage___x__isnt_close_enough_to_the_mapping_size___x_
mov edi, 0xffffea19
call fcn.0040f980
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x2e8]
mov eax, dword [edx + 4]
push eax
call fcn.00416c30
add esp, 4
cmp dword [ebp - 0x14], eax
je 0x411abd
mov ecx, dword [ebx + 0x2e8]
mov edx, dword [ecx + 4]
push edx
call fcn.00416c30
mov ecx, dword [ebx + 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ecx
push str._s:_SizeOfImage___x__differs_from_what_RTLdrSize_returns___zx_
mov edi, 0xffffea19
call fcn.0040f980
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + esi + 0x3650]
lea ecx, [eax - 1]
mov dword [ebp - 0x20], eax
test eax, ecx
jne 0x4121ae
cmp eax, 0x1000
jb 0x4121ae
movzx edx, byte [ebx + 0x2e6]
neg edx
sbb edx, edx
and edx, 0xf000
add edx, 0x1000
cmp eax, edx
ja 0x4121ae
mov ecx, dword [edi + esi + 0x3654]
lea edx, [ecx - 1]
mov dword [ebp - 0x34], ecx
test ecx, edx
jne 0x412189
lea edx, [ecx - 0x200]
cmp edx, 0xe00
ja 0x412189
cmp ecx, eax
ja 0x412189
mov edx, dword [ebp + 8]
mov eax, dword [edi + esi + 0x366c]
lea edx, [edx + edi + 0xf8]
cmp eax, edx
jae 0x411b63
mov ecx, dword [ebp - 0x18]
push ecx
push edx
mov edx, dword [ebx + 8]
push eax
push edx
push str._s:_Headers_are_too_small:__x____x__cSections_x_
mov edi, 0xffffea12
call fcn.0040f980
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ecx - 1]
not edx
lea ecx, [eax + ecx - 1]
and ecx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp + 8], ecx
cmp ecx, 0x1000
jbe 0x411ba0
mov edx, dword [ebx + 8]
push 0x1000
push ecx
push eax
push edx
push str._s:_Headers_are_larger_than_expected:__x__x__expected_max__zx_
mov edi, 0xffffea12
call fcn.0040f980
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebx + 0x2e6], 0
mov ax, word [edi + esi + 0x362e]
mov word [ebx + 0x2e0], ax
movzx eax, word [edi + esi + 0x3676]
mov word [ebx + 0x2e2], ax
je 0x411be4
mov ecx, dword [esi + 0x4624]
sub dword [ebx], ecx
mov edx, dword [esi + 0x4624]
add dword [ebx + 4], edx
mov eax, dword [esi + 0x4624]
mov dword [ebx + 0x220], eax
cmp dword [esi], 2
jne 0x411c05
mov ecx, dword [esi + 0x4898]
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x2e8]
push esi
push 0
push 0
push edx
lea eax, [ebp - 4]
push eax
push ecx
jmp 0x411c22
mov edx, dword [esi + 0x4898]
mov eax, dword [ebx]
push edx
mov edx, dword [ebx + 0x2e8]
push esi
push 0x40ffe0
push 0
push eax
lea ecx, [ebp - 4]
push ecx
push edx
call fcn.004112b0
add esp, 0x1c
test eax, eax
js 0x4121c8
cmp dword [0x4ab7bc], 0x60000000
jb 0x411c47
mov eax, dword [ebx]
mov ecx, dword [ebp - 4]
mov dword [ecx + edi + 0x34], eax
xor edi, edi
cmp byte [ebx + 0x2e5], 0
mov dword [ebp - 0x24], edi
je 0x411dfa
cmp dword [esi], 1
jne 0x411d04
mov eax, dword [ebx + 0x2e8]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x30]
push edx
push str.NtCreateSection
push 0xffffffffffffffff
push edi
push edi
mov edi, dword [ebp - 4]
push edi
push ecx
call fcn.00416ce0
add esp, 0x1c
test eax, eax
jns 0x411ca4
mov edx, dword [ebx + 8]
push eax
push edx
push str._s:_Failed_to_find_NtCreateSection:__Rrc
mov edi, eax
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov edx, dword [ebx + 0x2e8]
lea ecx, [ebp - 0x30]
push ecx
push str.LdrLoadDll
push 0xffffffffffffffff
push 0
push 0
mov dword [ebp - 0x68], eax
mov eax, dword [edx + 4]
push edi
push eax
mov dword [ebp - 0x64], 5
call fcn.00416ce0
add esp, 0x1c
test eax, eax
jns 0x411cf2
mov ecx, dword [ebx + 8]
push eax
push ecx
push str._s:_Failed_to_find_LdrLoadDll:__Rrc
mov edi, eax
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], 5
mov edi, 2
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x2e8]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [edx + 4]
push str.LdrInitializeThunk
push 0xffffffffffffffff
push 0
push 0
push ecx
push eax
call fcn.00416ce0
add esp, 0x1c
test eax, eax
jns 0x411d48
mov ecx, dword [ebx + 8]
push eax
push ecx
push str._s:_Failed_to_find_LdrInitializeThunk:__Rrc
mov edi, eax
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x30]
push eax
push str.KiUserApcDispatcher
push 0xffffffffffffffff
push 0
mov dword [ebp + edi*8 - 0x68], edx
mov edx, dword [ebx + 0x2e8]
mov eax, dword [edx + 4]
push 0
push ecx
push eax
mov dword [ebp + edi*8 - 0x64], 0xe
call fcn.00416ce0
add esp, 0x1c
test eax, eax
jns 0x411d9b
mov ecx, dword [ebx + 8]
push eax
push ecx
push str._s:_Failed_to_find_KiUserApcDispatcher:__Rrc
mov edi, eax
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x30]
push eax
push str.LdrSystemDllInitBlock
push 0xffffffffffffffff
push 0
mov dword [ebp + edi*8 - 0x60], edx
mov edx, dword [ebx + 0x2e8]
mov eax, dword [edx + 4]
push 0
push ecx
mov dword [ebp + edi*8 - 0x5c], 0xe
add edi, 2
push eax
mov dword [ebp - 0x24], edi
call fcn.00416ce0
add esp, 0x1c
test eax, eax
js 0x411dfa
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
mov dword [ebp + edi*8 - 0x68], eax
mov al, byte [eax + ecx]
cmp al, 0x50
movzx eax, al
jae 0x411df2
mov eax, 0x50
mov dword [ebp + edi*8 - 0x64], eax
inc edi
mov dword [ebp - 0x24], edi
cmp byte [ebx + 0x2e6], 0
mov edi, dword [ebp + 8]
jne 0x411e3e
mov edx, dword [ebp - 4]
push 2
push 0
push 0
push 0xffffffffffffffff
push edx
push edi
push ebx
push esi
xor eax, eax
call fcn.0040fa00
add esp, 0x20
test eax, eax
js 0x4121c8
push 2
push edi
push 0
push ebx
push esi
call fcn.0040fd80
add esp, 0x14
test eax, eax
js 0x4121c8
cmp dword [ebp - 0x18], 0
mov dword [ebp - 0x28], 2
mov ecx, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp + 8], 0
jbe 0x4120f4
lea eax, [esi + 0x463c]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov edx, dword [edx - 0x18]
mov dword [ebp - 8], edx
cmp edx, ecx
jb 0x412158
cmp edx, dword [ebp - 0x14]
ja 0x412158
mov edi, dword [ebp - 0x20]
lea eax, [edi - 1]
not eax
lea edi, [edx + edi - 1]
and edi, eax
mov dword [ebp - 0x2c], eax
cmp edi, edx
jne 0x412158
mov eax, dword [ebp - 0xc]
mov eax, dword [eax - 0x1c]
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
cmp eax, edi
ja 0x412127
add ecx, eax
cmp ecx, edi
ja 0x412127
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx - 0x14]
mov edi, dword [ebp - 0x34]
lea edi, [ecx + edi - 1]
and edi, dword [ebp - 0x38]
cmp ecx, edi
jne 0x4120fd
mov edi, dword [ebp - 0x20]
lea eax, [eax + edi - 1]
and eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
cmp ecx, eax
ja 0x4120fd
cmp byte [ebx + 0x2e6], 0
je 0x411ef5
cmp dword [ebp + 8], 0
jne 0x4120da
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
and eax, 0xe0000000
cmp eax, 0x60000000
ja 0x411f5c
je 0x411f55
cmp eax, 0x20000000
je 0x411f4e
cmp eax, 0x40000000
je 0x411faf
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
push ecx
push edx
lea ecx, [eax + eax*4]
mov edx, dword [esi + ecx*8 + 0x463c]
push edx
push eax
mov eax, dword [ebx + 8]
push eax
push str._s:_Section__u:_Unexpected_characteristics:__x__uSectRva_x__cbMap_x_
mov edi, 0xffffe9f0
call fcn.0040f980
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0x10
jmp 0x411fb4
mov edi, 0x20
jmp 0x411fb4
cmp eax, 0xc0000000
je 0x411f84
cmp eax, 0xe0000000
jne 0x411f1a
cmp byte [ebx + 0x2e4], 0
jne 0x411f1a
mov edi, dword [esi]
sub edi, 2
neg edi
sbb edi, edi
and edi, 0xffffffe0
add edi, 0x40
jmp 0x411fb4
mov eax, dword [esi]
mov edi, 4
cmp eax, 1
je 0x411fb4
cmp eax, 2
je 0x411fb4
mov eax, dword [ebp - 0xc]
push 8
add eax, 0xffffffdc
push str..mrdata
push eax
call fcn.00402530
add esp, 0xc
test eax, eax
jne 0x411fb4
mov edi, 2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx]
test eax, 0x20000020
je 0x411fc4
test eax, eax
jns 0x411fe9
and eax, 0xc0000000
cmp eax, 0x40000000
je 0x411fe9
mov eax, dword [esi]
cmp eax, 1
jne 0x411fe0
cmp byte [ebx + 0x2e4], 0
jne 0x411fe9
cmp eax, 2
jne 0x4120aa
mov edx, dword [ebp - 8]
cmp dword [ebp - 0x1c], edx
jae 0x412029
cmp byte [ebx + 0x2e6], 0
jne 0x412029
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x1c]
push 0
push 0
dec ecx
push ecx
lea ecx, [eax + edx]
mov edx, dword [ebp - 8]
push ecx
sub edx, eax
push edx
push ebx
push esi
call fcn.0040fa00
add esp, 0x20
test eax, eax
js 0x4121c8
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
push edi
push eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 4]
push edx
lea edx, [eax + ecx]
mov ecx, dword [ebp - 0x10]
push edx
push ecx
push ebx
push esi
call fcn.0040fa00
add esp, 0x20
test eax, eax
js 0x4121c8
mov edx, dword [ebp + 8]
inc edx
cmp edx, dword [ebp - 0x18]
jae 0x41206d
cmp byte [ebx + 0x2e6], 0
jne 0x41206d
mov ecx, dword [ebp - 0x2c]
jmp 0x41207c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfff
and ecx, 0xfffff000
cmp ecx, dword [ebp - 0x10]
jbe 0x4120a2
mov eax, dword [ebp + 8]
push edi
push 0
push 0
push eax
mov eax, dword [ebp - 0x10]
push sym.VBoxNetDHCP.exe_g_abRTZero16K
sub ecx, eax
add eax, dword [ebp - 8]
push ecx
push ebx
push esi
call fcn.0040fa00
add esp, 0x20
test eax, eax
js 0x4121c8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
push edi
add edx, 0xfff
and edx, 0xfffff000
push edx
push eax
push ebx
push esi
call fcn.0040fd80
add esp, 0x14
test eax, eax
js 0x4121c8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edi
add dword [ebp - 0xc], 0x28
lea ecx, [eax + edx]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 0x18]
jb 0x411e64
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
push edx
mov edx, dword [ebx + 8]
push eax
push ecx
mov ecx, dword [ebp + 8]
push ecx
push edx
push str._s:_Section__u:_Invalid_file_size:__x__cbMap_x__uSectRva_x_
mov edi, 0xffffea15
call fcn.0040f980
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebx + 8]
push eax
push ecx
push edx
push str._s:_Section__u:_Invalid_virtual_size:__x__uSectRva_x__uRva_x__cbImage_x_
mov edi, 0xffffea13
call fcn.0040f980
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebx + 8]
push eax
push ecx
push edx
push str._s:_Section__u:_Invalid_virtual_address:__x__uRva_x__cbImage_x__cbSectAlign_x_
mov edi, 0xffffea14
call fcn.0040f980
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebx + 8]
push eax
push ecx
push edx
push str._s:_Unexpected_FileAlignment_value:__x__cbSectAlign_x_
mov edi, 0xffffea1c
call fcn.0040f980
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebx + 8]
push eax
push ecx
push str._s:_Unexpected_SectionAlignment_value:__x
mov edi, 0xffffea16
call fcn.0040f980
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret