Function at 0x47fa00
Capabilities:
Access peb ldr_data
Get process heap flags
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
mov eax, dword [0x5b642c]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push esi
push edi
push 0x5a08a4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x47fa73
mov ecx, dword [0x5b7f4c]
cmp ecx, 0x5b7f4c
je 0x47fa69
test byte [ecx + 0x2dc], 1
je 0x47fa69
cmp byte [ecx + 0x2d9], 2
jb 0x47fa69
mov eax, dword [ecx + 0x2d4]
mov edx, str.jJ3m
push eax
mov eax, dword [ecx + 0x2d0]
lea ecx, [esi + 0xd]
push eax
call fcn.0044d1d0
mov eax, 0xc0000135
jmp 0x47fb17
push str.NtSetCachedSigningLevel
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5b6e20], eax
test eax, eax
jne 0x47fabc
mov ecx, dword [0x5b7f4c]
cmp ecx, 0x5b7f4c
je 0x47fb12
test byte [ecx + 0x2dc], 1
je 0x47fb12
cmp byte [ecx + 0x2d9], 2
jb 0x47fb12
mov eax, dword [ecx + 0x2d4]
push eax
mov eax, dword [ecx + 0x2d0]
mov ecx, 0xe
jmp 0x47fb07
push str.NtGetCachedSigningLevel
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5b6e24], eax
test eax, eax
jne 0x47fb6f
mov ecx, dword [0x5b7f4c]
cmp ecx, 0x5b7f4c
je 0x47fb12
test byte [ecx + 0x2dc], 1
je 0x47fb12
cmp byte [ecx + 0x2d9], 2
jb 0x47fb12
mov eax, dword [ecx + 0x2d4]
push eax
mov eax, dword [ecx + 0x2d0]
mov ecx, 0xf
push eax
mov edx, str.jJ3m
call fcn.0044d1d0
mov eax, 0xc000007a
mov ecx, dword [0x5b7f4c]
cmp ecx, 0x5b7f4c
je 0x47fb55
test byte [ecx + 0x2dc], 1
je 0x47fb55
cmp byte [ecx + 0x2d9], 2
jb 0x47fb55
push eax
mov eax, dword [ecx + 0x2d4]
mov edx, str.jJ3m
push eax
mov eax, dword [ecx + 0x2d0]
mov ecx, 0x1e
push eax
call fcn.0044d1f0
mov eax, 0xc00000bb
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.0053a033
mov esp, ebp
pop ebp
ret
mov ecx, 0x5b7f44
mov dword [esp + 0x48], 0
xor bl, bl
mov dword [esp + 0x4c], 0
call fcn.0047f2d0
test al, al
jne 0x48000c
lea eax, [esp + 0x48]
mov edx, 0x59abb4
push eax
xor ecx, ecx
call fcn.00465e90
test eax, eax
js 0x47fbb3
lea ecx, [esp + 0x48]
call fcn.0047f2d0
mov bl, al
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test bl, bl
jne 0x48000c
push 0x101
lea eax, [esp + 0x54]
push eax
push str.PANW_XDR_CIG_DATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x47fbf9
cmp eax, 0x100
ja 0x47fbf9
mov edx, eax
lea ecx, [esp + 0x50]
call fcn.0047f1e0
test al, al
jne 0x48000c
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push eax
push 0
push 0
push 0x20
push str.CigData
push str.SYSTEMCyveraRuntimeSettingsCig
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x47fd0f
mov eax, dword [esp + 0x3c]
add eax, 2
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x47fc91
mov ecx, dword [0x5b7f4c]
cmp ecx, 0x5b7f4c
je 0x47fd0f
test byte [ecx + 0x2dc], 1
je 0x47fd0f
cmp byte [ecx + 0x2d9], 2
jb 0x47fd0f
mov eax, dword [ecx + 0x2d4]
mov edx, str.jJ3m
push eax
mov eax, dword [ecx + 0x2d0]
lea ecx, [edi + 0xc]
push eax
call fcn.0044d1d0
jmp 0x47fd0f
lea eax, [esp + 0x3c]
push eax
push edi
push 0
push 0x20
push str.CigData
push str.SYSTEMCyveraRuntimeSettingsCig
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x47fcf1
mov esi, edi
cmp dword [esp + 0x3c], eax
je 0x47fcef
cmp byte [edi], al
je 0x47fcef
push esi
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.ntdll.dll_RtlInitAnsiString]
movzx edx, word [esp + 0x40]
mov ecx, dword [esp + 0x44]
call fcn.0047f1e0
test al, al
jne 0x47fe70
movzx eax, word [esp + 0x40]
inc eax
add esi, eax
cmp byte [esi], 0
jne 0x47fcc0
xor bl, bl
mov eax, dword fs:[0x18]
push edi
push 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test bl, bl
jne 0x48000c
lea eax, [esp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.ntdll.dll_LdrLockLoaderLock]
mov ebx, eax
test ebx, ebx
js 0x47ffb7
xor edi, edi
lea ebx, [ebx]
push dword [0x5b7f1c]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov esi, dword [ebx]
cmp esi, ebx
je 0x47fd8c
jmp 0x47fd60
lea edx, [esi + 0x2c]
lea ecx, [esp + 0x1c]
call fcn.00463240
push 1
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
test eax, eax
je 0x47fe77
mov esi, dword [esi]
cmp esi, ebx
jne 0x47fd60
mov ebx, 0xc0000135
call fcn.00464b60
push dword [esp + 0xc]
push 0
call dword [sym.imp.ntdll.dll_LdrUnlockLoaderLock]
test ebx, ebx
js 0x47ffb7
lea eax, [esp + 0x10]
push eax
push 0
push 0
call dword [sym.imp.ntdll.dll_LdrLockLoaderLock]
test eax, eax
js 0x47fe0f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov esi, dword [edi]
cmp esi, edi
je 0x47fdfe
lea edx, [esi + 0x2c]
lea ecx, [esp + 0x2c]
call fcn.00463240
push 1
lea eax, [esp + 0x30]
push eax
push 0x599550
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
test eax, eax
je 0x47ff10
mov esi, dword [esi]
cmp esi, edi
jne 0x47fdd2
push dword [esp + 0x10]
push 0
call dword [sym.imp.ntdll.dll_LdrUnlockLoaderLock]
mov eax, 0xc0000135
mov ecx, dword [0x5b7f4c]
cmp ecx, 0x5b7f4c
je 0x480049
test byte [ecx + 0x2dc], 1
je 0x480049
cmp byte [ecx + 0x2d9], 3
jb 0x480049
push eax
mov eax, dword [ecx + 0x2d4]
mov edx, str.jJ3m
push eax
mov eax, dword [ecx + 0x2d0]
mov ecx, 0x21
push eax
call fcn.0044d1f0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.0053a033
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x47fcf1
test esi, esi
je 0x47fd8c
mov edx, dword [edi + 0x5b7f20]
lea eax, [esp + 0x14]
mov ecx, dword [esi + 0x18]
push eax
call fcn.00467130
mov ebx, eax
test ebx, ebx
js 0x47fed0
test byte [edi + 0x5b7f2c], 1
mov edx, dword [esp + 0x14]
je 0x47feb5
mov ecx, dword [esi + 0x18]
cmp edx, ecx
jb 0x47ff06
mov eax, dword [esi + 0x20]
add eax, ecx
cmp edx, eax
jae 0x47ff06
mov ecx, dword [edi + 0x5b7f24]
mov eax, dword [edi + 0x5b7f28]
push ecx
push eax
push ecx
push ecx
call fcn.00466e60
mov ebx, eax
test ebx, ebx
jns 0x47fee9
cmp ebx, 0xc000007a
jne 0x47fd91
test byte [edi + 0x5b7f2c], 2
je 0x47fd91
add edi, 0x14
cmp edi, 0x28
jb 0x47fd30
push dword [esp + 0xc]
push 0
call dword [sym.imp.ntdll.dll_LdrUnlockLoaderLock]
jmp 0x47fdaa
mov ebx, 0xc00000bb
jmp 0x47fd91
push dword [esp + 0x10]
push 0
call dword [sym.imp.ntdll.dll_LdrUnlockLoaderLock]
test esi, esi
je 0x47fe0a
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0x48]
push eax
mov edx, str.LdrResolveDelayLoadsFromDll
call fcn.00467130
test eax, eax
js 0x47fe0f
lea eax, [esp + 0x18]
push eax
push 0xd
push 1
push 0x400000
call dword [sym.imp.ntdll.dll_RtlImageDirectoryEntryToData]
test eax, eax
je 0x480049
mov esi, dword [esp + 0x18]
shr esi, 5
test esi, esi
je 0x480049
mov ebx, dword [esp + 0x48]
lea edi, [eax + 4]
mov eax, dword [edi]
add eax, 0x400000
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.ntdll.dll_RtlInitAnsiString]
push 0
push dword [esp + 0x3c]
mov ecx, ebx
push 0x400000
call dword [0x56c434]
call ebx
lea edi, [edi + 0x20]
sub esi, 1
jne 0x47ff70
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.0053a033
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x5b7f4c]
cmp ecx, 0x5b7f4c
je 0x47fff5
test byte [ecx + 0x2dc], 1
je 0x47fff5
cmp byte [ecx + 0x2d9], 2
jb 0x47fff5
mov eax, dword [ecx + 0x2d4]
mov edx, str.jJ3m
push ebx
push eax
mov eax, dword [ecx + 0x2d0]
mov ecx, 0x20
push eax
call fcn.0044d1f0
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.0053a033
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x5b7f4c]
cmp ecx, 0x5b7f4c
je 0x480049
test byte [ecx + 0x2dc], 1
je 0x480049
cmp byte [ecx + 0x2d9], 4
jb 0x480049
mov eax, dword [ecx + 0x2d4]
mov edx, str.jJ3m
push eax
mov eax, dword [ecx + 0x2d0]
mov ecx, 0x1f
push eax
call fcn.0044d1d0
mov ecx, dword [esp + 0x15c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0053a033
mov esp, ebp
pop ebp
ret