Function at 0x5239a0
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, ecx
mov eax, 0x5a4d
push ebx
mov dword [ebp - 4], edx
cmp word [edx], ax
je 0x5239c3
mov eax, 0xc000012f
lfence
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x3c]
test eax, eax
je 0x523bef
cmp eax, 0x7fffffff
jae 0x523bef
cmp dword [eax + edx], 0x4550
lea ebx, [eax + edx]
mov dword [ebp - 0x10], ebx
jne 0x523bef
mov eax, dword ds:[ebx + 0xa0]
lea ecx, [ebx + 0xa0]
mov dword [ebp - 0x20], ecx
test eax, eax
je 0x523be2
cmp dword [ecx + 4], 0
je 0x523be2
add eax, edx
mov dword [ebp - 0xc], 0
test byte [ebx + 0x16], 1
mov dword [ebp - 8], eax
je 0x523a2b
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
lea edi, [ebx + 6]
xor edx, edx
xor esi, esi
mov dword [ebp - 0x14], edi
cmp dx, word [edi]
mov edx, dword [ebp - 4]
jae 0x523a9e
xor edi, edi
movzx ecx, word [ebx + 0x14]
add ecx, edi
mov dword [ebp - 0xc], 0
mov eax, dword [ecx + ebx + 0x24]
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + ebx + 0x28]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov dword [ebp - 0xc], eax
test eax, eax
js 0x523a94
mov eax, dword [ebp - 0x14]
inc esi
mov edx, dword [ebp - 4]
add edi, 0x28
movzx eax, word [eax]
cmp esi, eax
jb 0x523a41
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
jmp 0x523aa4
pop edi
pop esi
lfence
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
lfence
mov ecx, dword [ecx + 4]
mov edi, edx
sub edi, dword [ebx + 0x34]
add ecx, eax
mov dword [ebp - 0x18], ecx
cmp eax, ecx
jae 0x523b2e
mov ebx, dword [eax + 4]
lea ecx, [eax + 4]
mov esi, dword [eax]
sub ebx, 8
add esi, edx
mov dword [ebp - 0x1c], ecx
lea ecx, [eax + 8]
xor edx, edx
shr ebx, 1
mov dword [ebp - 0x20], ecx
je 0x523b1b
movzx eax, word ds:[ecx + edx*2]
mov ecx, eax
shr ecx, 0xc
sub ecx, 2
je 0x523b07
sub ecx, 1
je 0x523afd
sub ecx, 7
jne 0x523b10
and eax, 0xfff
add dword [eax + esi], edi
adc dword [eax + esi + 4], ecx
jmp 0x523b10
and eax, 0xfff
add dword [eax + esi], edi
jmp 0x523b10
and eax, 0xfff
add word [eax + esi], di
mov ecx, dword [ebp - 0x20]
inc edx
cmp edx, ebx
jb 0x523ad4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
add eax, dword [ecx]
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x18]
jb 0x523ab8
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
xor esi, esi
cmp cx, word [eax]
jae 0x523bd8
xor edi, edi
movzx ecx, word [ebx + 0x14]
add ecx, edi
mov dword [ebp - 0x20], 0
mov eax, dword [ecx + ebx + 0x24]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ecx + ebx + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, 8
mov ecx, dword [ecx + ebx + 0x3c]
mov edx, ecx
shr edx, 0x1d
and edx, 2
test ecx, ecx
cmovs edx, eax
test ecx, 0x20000000
mov eax, 0x10
cmovne edx, eax
mov eax, ecx
and eax, 0x60000000
cmp eax, 0x60000000
mov eax, 0x20
cmove edx, eax
and ecx, 0xa0000000
cmp ecx, 0xa0000000
mov eax, 0x40
cmove edx, eax
lea eax, [ebp - 0x20]
push eax
push edx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov dword [ebp - 0xc], eax
test eax, eax
js 0x523bd8
movzx eax, word [ebx + 6]
inc esi
mov edx, dword [ebp - 4]
add edi, 0x28
cmp esi, eax
jb 0x523b40
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lfence
mov eax, 0xc0000020
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xc000007b
lfence
pop ebx
mov esp, ebp
pop ebp
ret