Function at 0x140020a50
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8a0]
sub rsp, 0x9a0
mov rax, qword [0x140121c38]
xor rax, rsp
mov qword [rbp + 0x890], rax
xor edi, edi
mov r13d, r8d
mov r15d, edi
mov ebx, edi
mov r12, rdx
mov rsi, rcx
mov r14d, 0x2000
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x790]
mov r8d, 0xf8
call fcn.140085ae0
xorps xmm0, xmm0
lea r8, [rsp + 0x40]
add rbx, 0x10000
mov r9d, 0x30
mov rdx, rbx
mov rcx, rsi
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x140020b6b
nop dword [rax]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
and eax, 0xfff
cmp rax, 0xfff
je 0x140020b6b
mov rdx, qword [rsp + 0x40]
lea rax, [rcx + rdx]
cmp rax, rbx
jb 0x140020b6b
cmp dword [rsp + 0x60], 0x1000
jne 0x140020b4c
mov eax, dword [rsp + 0x64]
cmp al, 1
je 0x140020b4c
bt eax, 8
jb 0x140020b4c
lea r8, [rbp + 0x790]
mov rdx, rbx
mov rcx, rsi
call fcn.14001e560
test rax, rax
jne 0x140020b81
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
lea rbx, [rcx + rdx]
mov r9d, 0x30
mov rdx, rbx
lea r8, [rsp + 0x40]
mov rcx, rsi
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
jne 0x140020af0
test r15, r15
jne 0x140020b9d
mov ecx, 0x10dd
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x140020df9
test rbx, rbx
je 0x140020b6b
test word [rbp + 0x7a6], r14w
mov rax, rbx
cmovne rax, r15
mov r15, rax
jmp 0x140020aa0
lea rdx, [rsp + 0x38]
mov rcx, rsi
call sub.KERNEL32.dll_IsWow64Process
test eax, eax
je 0x140020b7a
mov r14d, dword [rsp + 0x38]
lea rcx, [rbp + 0x690]
xor edx, edx
mov r8d, 0xf8
mov ebx, edi
call fcn.140085ae0
xorps xmm0, xmm0
lea r8, [rsp + 0x70]
mov r9d, 0x30
mov rdx, r15
mov rcx, rsi
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x140020ded
mov r9d, 0x40
mov qword [rsp + 0x20], rdi
lea r8, [rbp - 0x60]
mov rdx, r15
mov rcx, rsi
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x140020ded
mov eax, 0x5a4d
cmp word [rbp - 0x60], ax
jne 0x140020de3
movsxd rcx, dword [rbp - 0x24]
mov eax, ecx
cmp rax, qword [rbp - 0x78]
ja 0x140020de3
cmp ecx, 0x40
jb 0x140020de3
lea rdx, [r15 + rcx]
mov qword [rsp + 0x20], rdi
mov rcx, rsi
lea r8, [rbp + 0x690]
mov r9d, 0xf8
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x140020ded
cmp dword [rbp + 0x690], 0x4550
jne 0x140020de3
movsxd rax, dword [rbp - 0x24]
add rax, r15
je 0x140020ded
mov eax, 0x10b
cmp word [rbp + 0x6a8], ax
jne 0x140020ca2
cmp word [rbp + 0x694], bx
mov eax, 1
cmovne ebx, eax
lea r8, [rbp - 0x20]
mov rdx, r15
mov rcx, rsi
call fcn.14001e680
test eax, eax
je 0x140020df7
test r14d, r14d
jne 0x140020ddc
test ebx, ebx
je 0x140020d03
cmp qword [rbp], rdi
je 0x140020ddc
mov eax, dword [rbp + 0x660]
test al, 1
je 0x140020ddc
test al, 2
jne 0x140020ddc
mov r8d, 0x8664
lea r9, [rbp - 0x20]
mov rdx, r15
mov rcx, rsi
call fcn.14001e9e0
test eax, eax
je 0x140020df7
mov r9d, r13d
mov r8, r12
mov rdx, r15
mov rcx, rsi
call fcn.14001eda0
test eax, eax
je 0x140020df7
mov rdx, qword [rbp]
test rdx, rdx
je 0x140020dba
mov eax, dword [rbp + 0x660]
mov r9d, 4
movaps xmm0, xmmword [rbp + 0x650]
and eax, 0xfffffffe
mov dword [rbp + 0x680], eax
mov rcx, rsi
lea rax, [rsp + 0x30]
lea r8d, [r9 + 0x10]
mov qword [rsp + 0x20], rax
movups xmmword [rbp + 0x670], xmm0
call fcn.1400228f0
test eax, eax
je 0x140020df7
mov rdx, qword [rbp]
lea r8, [rbp + 0x670]
mov r9d, 0x14
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140020df7
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov rdx, qword [rbp]
mov r8d, 0x14
mov rcx, rsi
mov qword [rsp + 0x20], rax
call sub.KERNEL32.dll_VirtualProtectEx
test eax, eax
je 0x140020df7
test byte [rbp + 0x660], 2
jne 0x140020ddc
mov r9d, 0x688
lea r8, [rbp - 0x20]
lea rdx, [0x1400eea90]
mov rcx, rsi
call fcn.14001f570
test rax, rax
setne dil
jmp 0x140020df7
mov ecx, 6
jmp 0x140020df2
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
mov ecx, 0x10dd
call sub.KERNEL32.dll_SetLastError
mov eax, edi
mov rcx, qword [rbp + 0x890]
xor rcx, rsp
call fcn.140056c90
mov rbx, qword [rsp + 0x9f8]
add rsp, 0x9a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret