Function at 0x539c00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x62d040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, edx
push edi
push eax
push ebx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x148], eax
call fcn.00539a20
test eax, eax
jns 0x539e9b
lea ecx, [ecx]
cmp eax, 0xc0000017
jne 0x539e9b
mov dword [edi + 4], esi
mov dword [edi + 8], ebx
cmp ebx, 0x40
jb 0x539e96
lea ebx, [ebx]
test esi, esi
je 0x539e7e
cmp esi, 0xffffffff
je 0x539e7e
mov ecx, dword [ebp - 0x148]
lea eax, [ebp - 0x4c]
push 0
push 0x40
push eax
push esi
push dword [ebp - 0x14c]
lfence
call dword [0x5a38e4]
call dword [ebp - 0x148]
test eax, eax
jns 0x539caf
lfence
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x5a4d
cmp word [ebp - 0x4c], ax
je 0x539cd2
mov eax, 0xc000012f
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x539e96
lea ecx, [ecx]
cmp eax, ebx
jae 0x539e96
cmp eax, 0x10000000
jae 0x539e96
mov ebx, dword ds:[ebp - 0x148]
lea ecx, [ebp - 0x144]
push 0
push 0xf8
push ecx
add eax, esi
mov ecx, ebx
push eax
push dword [ebp - 0x14c]
lfence
mov dword [ebp - 0x150], eax
call dword [0x5a38e4]
call ebx
test eax, eax
js 0x539c99
cmp dword ds:[ebp - 0x144], 0x4550
nop
jne 0x539e96
mov dx, word [ebp - 0x130]
mov eax, 0xe0
cmp dx, ax
je 0x539d7d
mov eax, 0xf0
cmp dx, ax
je 0x539d7d
mov eax, 0xc0000903
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret 0xc
mov ax, word [ebp - 0x12c]
mov ecx, 0x10b
mov word [edi + 0x18], ax
cmp ax, cx
je 0x539da9
mov ecx, 0x20b
cmp ax, cx
jne 0x539e96
movzx eax, word [ebp - 0x13e]
mov dword [edi + 0x10], eax
cmp eax, 0x7f
jae 0x539e96
lea ecx, [eax + eax*4]
movzx eax, dx
lea eax, [eax + ecx*8]
add eax, 0x18
mov dword [ebp - 0x148], eax
cmp eax, 0x100000
ja 0x539e96
push eax
push 4
lfence
push dword [0x6337d4]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push dword [ebp - 0x148]
mov esi, eax
push 0
push esi
call fcn.00581cf0
add esp, 0xc
mov dword [edi + 0xc], esi
mov ecx, ebx
push 0
push dword [ebp - 0x148]
push esi
push dword [ebp - 0x150]
mov esi, dword [ebp - 0x14c]
push esi
call dword [0x5a38e4]
nop
call ebx
mov ebx, eax
lfence
test ebx, ebx
jns 0x539e58
push dword [edi + 0xc]
push 0
push dword [0x6337d4]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [edi + 0xc], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 0xc]
mov dword [edi], esi
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
mov dword [edi + 0x14], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xc000000d
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xc000007b
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret 0xc