Function at 0x140002000
Capabilities:
Parse pe header

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov eax, 0x5a4d
mov qword [rbp - 0x49], rdx
mov r15, rdx
mov r12d, ecx
cmp word [rdx], ax
jne 0x14000224a
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x14000224a
lea rax, [rbp - 0x31]
mov dword [rbp + 7], ecx
mov qword [rbp + 0xf], rax
lea rcx, [rbp - 9]
mov eax, dword [rdi + 0x50]
xor r14d, r14d
mov dword [rbp + 0x17], eax
xor edx, edx
lea rax, [rbp + 7]
mov qword [rbp - 0x31], r14
mov qword [rbp - 1], rax
mov rax, qword [0x14000a948]
mov dword [rbp + 0xb], r14d
mov dword [rbp + 0x1b], 0x20
mov dword [rbp - 9], 0x92b
mov dword [rbp - 5], 0x149
call qword [rax]
mov r13, qword [rbp - 0x31]
mov r8, rdi
mov rcx, r13
mov rdx, r15
call fcn.1400019f0
test al, al
je 0x14000224a
mov rdx, rdi
mov rcx, r15
call fcn.1400017a0
test al, al
je 0x14000224a
movzx ebx, word [rdi + 0x14]
movzx eax, word [rdi + 6]
add rbx, 0x2c
mov qword [rsp + 0xe0], rsi
movzx esi, r14w
cmp r14w, ax
jae 0x140002147
add rbx, rdi
nop word [rax + rax]
mov eax, dword [rbx - 8]
lea rcx, [rbp - 0x41]
add rax, r13
mov dword [rbp - 0x25], r14d
mov qword [rbp - 0x21], rax
xor edx, edx
mov eax, dword [rbx]
add rax, r15
mov dword [rbp - 0x29], r12d
mov qword [rbp - 0x19], rax
mov eax, dword [rbx - 4]
mov qword [rbp - 0x11], rax
lea rax, [rbp - 0x29]
mov qword [rbp - 0x39], rax
mov rax, qword [0x14000a948]
mov dword [rbp - 0x41], 0x92b
mov dword [rbp - 0x3d], 0x139
call qword [rax]
movzx eax, word [rdi + 6]
lea rbx, [rbx + 0x28]
inc si
cmp si, ax
jb 0x1400020f0
movzx esi, word [rdi + 0x14]
xor ecx, ecx
add rsi, 0x28
cmp cx, ax
jae 0x1400021ef
add rsi, rdi
xor r15d, r15d
mov eax, dword [rsi]
test eax, eax
je 0x1400021d8
test dword [rsi + 0x14], 0x2000000
je 0x1400021d8
xor ecx, ecx
mov edx, eax
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [rsi - 4]
xor edx, edx
add rcx, r13
mov qword [rbp - 0x19], rax
mov rbx, rax
mov qword [rbp - 0x21], rcx
mov ecx, dword [rsi]
lea rax, [rbp - 0x29]
mov qword [rbp - 0x39], rax
mov rax, qword [0x14000a948]
mov qword [rbp - 0x11], rcx
lea rcx, [rbp - 0x41]
mov dword [rbp - 0x25], r15d
mov dword [rbp - 0x29], r12d
mov dword [rbp - 0x41], 0x92b
mov dword [rbp - 0x3d], 0x139
call qword [rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
inc r14w
add rsi, 0x28
cmp r14w, word [rdi + 6]
jb 0x140002160
mov r15, qword [rbp - 0x49]
lea rdx, str.RustClient
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov rsi, qword [rsp + 0xe0]
mov ebx, eax
test eax, eax
je 0x14000224a
lea rcx, str.fuck
call fcn.140001040
mov r9, rdi
mov r8, r13
mov edx, ebx
mov ecx, r12d
call fcn.140001b90
test al, al
je 0x14000224a
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000224c
xor al, al
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400040a0
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret