Function at 0x5397c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x62d040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, edx
push edi
push eax
push ebx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x148], eax
call fcn.005395e0
test eax, eax
jns 0x539a5b
lea ecx, [ecx]
cmp eax, 0xc0000017
jne 0x539a5b
mov dword [edi + 4], esi
mov dword [edi + 8], ebx
cmp ebx, 0x40
jb 0x539a56
lea ebx, [ebx]
test esi, esi
je 0x539a3e
cmp esi, 0xffffffff
je 0x539a3e
mov ecx, dword [ebp - 0x148]
lea eax, [ebp - 0x4c]
push 0
push 0x40
push eax
push esi
push dword [ebp - 0x14c]
lfence
call dword [0x5a28f0]
call dword [ebp - 0x148]
test eax, eax
jns 0x53986f
lfence
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x5a4d
cmp word [ebp - 0x4c], ax
je 0x539892
mov eax, 0xc000012f
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x539a56
lea ecx, [ecx]
cmp eax, ebx
jae 0x539a56
cmp eax, 0x10000000
jae 0x539a56
mov ebx, dword ds:[ebp - 0x148]
lea ecx, [ebp - 0x144]
push 0
push 0xf8
push ecx
add eax, esi
mov ecx, ebx
push eax
push dword [ebp - 0x14c]
lfence
mov dword [ebp - 0x150], eax
call dword [0x5a28f0]
call ebx
test eax, eax
js 0x539859
cmp dword ds:[ebp - 0x144], 0x4550
nop
jne 0x539a56
mov dx, word [ebp - 0x130]
mov eax, 0xe0
cmp dx, ax
je 0x53993d
mov eax, 0xf0
cmp dx, ax
je 0x53993d
mov eax, 0xc0000903
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret 0xc
mov ax, word [ebp - 0x12c]
mov ecx, 0x10b
mov word [edi + 0x18], ax
cmp ax, cx
je 0x539969
mov ecx, 0x20b
cmp ax, cx
jne 0x539a56
movzx eax, word [ebp - 0x13e]
mov dword [edi + 0x10], eax
cmp eax, 0x7f
jae 0x539a56
lea ecx, [eax + eax*4]
movzx eax, dx
lea eax, [eax + ecx*8]
add eax, 0x18
mov dword [ebp - 0x148], eax
cmp eax, 0x100000
ja 0x539a56
push eax
push 4
lfence
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push dword [ebp - 0x148]
mov esi, eax
push 0
push esi
call fcn.00580ff0
add esp, 0xc
mov dword [edi + 0xc], esi
mov ecx, ebx
push 0
push dword [ebp - 0x148]
push esi
push dword [ebp - 0x150]
mov esi, dword [ebp - 0x14c]
push esi
call dword [0x5a28f0]
nop
call ebx
mov ebx, eax
lfence
test ebx, ebx
jns 0x539a18
push dword [edi + 0xc]
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [edi + 0xc], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 0xc]
mov dword [edi], esi
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
mov dword [edi + 0x14], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xc000000d
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xc000007b
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret 0xc