Function at 0x140003a94
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8a0]
sub rsp, 0x9a0
mov rax, qword [0x14002b010]
xor rax, rsp
mov qword [rbp + 0x890], rax
xor ebx, ebx
mov r12, rdx
mov rdi, rcx
mov esi, ebx
mov r14d, 0xfff
lea r15d, [rbx + 0x30]
lea r13d, [rbx + 1]
xorps xmm0, xmm0
add rsi, 0x10000
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
mov r9, r15
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x140003df9
mov rcx, qword [rsp + 0x58]
mov rax, rcx
and rax, r14
cmp rax, r14
je 0x140003df9
mov rdx, qword [rsp + 0x40]
lea rax, [rcx + rdx]
cmp rax, rsi
jb 0x140003df9
cmp dword [rsp + 0x60], 0x1000
jne 0x140003b73
cmp byte [rsp + 0x64], r13b
je 0x140003b73
test dword [rsp + 0x64], 0x100
jne 0x140003b73
lea r8, [rbp + 0x790]
mov rdx, rsi
mov rcx, rdi
call fcn.140002ec8
test eax, eax
jne 0x140003b7c
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
lea rsi, [rcx + rdx]
jmp 0x140003af5
test rsi, rsi
je 0x140003df9
mov eax, 0x2000
test word [rbp + 0x7a6], ax
jne 0x140003adc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x140003e04
lea rdx, [rsp + 0x34]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x140003e04
mov eax, dword [rsp + 0x34]
lea r8, [rsp + 0x70]
cmp dword [rsp + 0x38], eax
xorps xmm0, xmm0
mov r15d, ebx
mov r9d, 0x30
mov rdx, rsi
mov rcx, rdi
setne r15b
mov r14d, ebx
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x140003dea
mov r9d, 0x40
mov qword [rsp + 0x20], rbx
lea r8, [rbp - 0x60]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140003dea
mov eax, 0x5a4d
cmp word [rbp - 0x60], ax
jne 0x140003ddf
movsxd rcx, dword [rbp - 0x24]
mov eax, ecx
cmp rax, qword [rbp - 0x78]
ja 0x140003ddf
cmp ecx, 0x40
jb 0x140003ddf
lea rdx, [rsi + rcx]
mov qword [rsp + 0x20], rbx
mov rcx, rdi
lea r8, [rbp + 0x690]
mov r9d, 0xf8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140003dea
cmp dword [rbp + 0x690], 0x4550
jne 0x140003ddf
mov eax, 0x10b
cmp word [rbp + 0x6a8], ax
jne 0x140003ca6
cmp word [rbp + 0x694], bx
cmovne r14d, r13d
lea r8, [rbp - 0x20]
mov rdx, rsi
mov rcx, rdi
call fcn.1400030f0
test eax, eax
je 0x140003df5
test r15d, r15d
jne 0x140003dd8
test r14d, r14d
je 0x140003d06
cmp qword [rbp], rbx
je 0x140003dd8
test byte [rbp + 0x660], r13b
je 0x140003dd8
test byte [rbp + 0x660], 2
jne 0x140003dd8
lea r9, [rbp - 0x20]
mov rdx, rsi
mov rcx, rdi
call fcn.14000371c
test eax, eax
je 0x140003df5
mov r8, r12
mov rdx, rsi
mov rcx, rdi
call fcn.140003250
test eax, eax
je 0x140003df5
mov rdx, qword [rbp]
test rdx, rdx
je 0x140003db8
mov eax, dword [rbp + 0x660]
mov esi, 0x14
movaps xmm0, xmmword [rbp + 0x650]
and eax, 0xfffffffe
mov dword [rbp + 0x680], eax
mov r8d, esi
lea rax, [rsp + 0x30]
mov rcx, rdi
lea r9d, [rsi - 0x10]
mov qword [rsp + 0x20], rax
movups xmmword [rbp + 0x670], xmm0
call fcn.1400045e0
test eax, eax
je 0x140003df5
mov rdx, qword [rbp]
lea r8, [rbp + 0x670]
mov r9d, esi
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003df5
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov rdx, qword [rbp]
mov r8d, esi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140003df5
test byte [rbp + 0x660], 2
jne 0x140003dd8
mov r9d, 0x688
lea r8, [rbp - 0x20]
lea rdx, [0x140027f10]
mov rcx, rdi
call fcn.140003e30
test eax, eax
setne bl
jmp 0x140003df5
mov ecx, 6
jmp 0x140003def
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x10dd
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x140003e06
mov ecx, 0x10dd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rbp + 0x890]
xor rcx, rsp
call fcn.140004f90
mov rbx, qword [rsp + 0x9f0]
add rsp, 0x9a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret