Function at 0x111fc
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1e8
mov eax, dword [0x1abe0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push esi
push edi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x24]
lea esi, [ebp + 0xc]
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xa0], eax
push 4
movsd dword es:[edi], dword [esi]
add eax, 0x1b8
push 0x1000
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0xac]
push eax
movsd dword es:[edi], dword [esi]
xor edi, edi
push edi
lea eax, [ebp - 0xa4]
push eax
push ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0x98], edi
call dword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
cmp eax, edi
jl 0x1148b
push ebx
push 0x40
pop esi
push esi
lea eax, [ebp - 0x94]
push edi
push eax
call sub.ntoskrnl.exe_memset
mov ebx, dword [ebp - 0xa4]
add esp, 0xc
mov eax, 0x5a4d
mov word [ebp - 0x94], ax
lea eax, [ebp - 0x98]
push eax
push esi
lea eax, [ebp - 0x94]
push eax
push ebx
push dword [ebp - 0x9c]
mov dword [ebp - 0x58], esi
call dword [0x1b070]
cmp eax, edi
jl 0x1148a
cmp dword [ebp - 0x98], esi
jne 0x1148a
mov edi, 0xf8
push edi
lea eax, [ebp - 0x1e8]
push 0
push eax
add ebx, esi
call sub.ntoskrnl.exe_memset
lea eax, [edi - 0x18]
mov word [ebp - 0x1d4], ax
mov eax, 0x2000
mov word [ebp - 0x1d2], ax
xor eax, eax
inc eax
mov word [ebp - 0x1e2], ax
add esp, 0xc
lea eax, [edi + 0x13]
mov word [ebp - 0x1d0], ax
lea eax, [ebp - 0x98]
push eax
push edi
lea eax, [ebp - 0x1e8]
push eax
push ebx
push dword [ebp - 0x9c]
mov dword [ebp - 0x1e8], 0x4550
call dword [0x1b070]
test eax, eax
jl 0x1148a
cmp dword [ebp - 0x98], edi
jne 0x1148a
push 0xa
xor eax, eax
add ebx, edi
pop ecx
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov eax, dword [0x140aa]
mov edi, dword [ebp - 0xa0]
mov dword [ebp - 0x44], eax
mov eax, dword [0x140ae]
mov dword [ebp - 0x40], eax
mov eax, ebx
sub eax, dword [ebp - 0xa4]
add edi, 0x58
add eax, 0x28
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x98]
push eax
push 0x28
lea eax, [ebp - 0x44]
push eax
push ebx
push dword [ebp - 0x9c]
mov dword [ebp - 0x34], edi
call dword [0x1b070]
test eax, eax
jl 0x1148a
cmp dword [ebp - 0x98], 0x28
jne 0x1148a
push esi
lea eax, [ebp - 0xf0]
push 0
push eax
add ebx, 0x28
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
push esi
lea eax, [ebp - 0xf0]
push eax
push ebx
push dword [ebp - 0x9c]
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0xec], 0x727444
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xe4], edi
call dword [0x1b070]
test eax, eax
jl 0x1148a
cmp dword [ebp - 0x98], esi
jne 0x1148a
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0xa0]
add eax, 0x18
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xb0]
add ebx, esi
mov dword [ebp - 0x18], eax
lea esi, [ebp - 0x54]
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x98]
push eax
movsd dword es:[edi], dword [esi]
push 0x18
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
push ebx
push dword [ebp - 0x9c]
movsd dword es:[edi], dword [esi]
call dword [0x1b070]
test eax, eax
jl 0x1148a
cmp dword [ebp - 0x98], 0x18
jne 0x1148a
mov esi, dword [ebp - 0xa0]
lea eax, [ebp - 0x98]
push eax
push esi
push dword [ebp - 0xa8]
add ebx, 0x18
push ebx
push dword [ebp - 0x9c]
call dword [0x1b070]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00013c58
leave
ret 0x20