Function at 0x140005d40
Capabilities:
Parse pe header

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x230
mov rax, qword [0x140016030]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov ebp, r9d
mov r13, r8
mov r12, rdx
lea r8d, [rbp + 0x1c8]
xor edx, edx
mov r9d, 0x1000
mov rsi, rcx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x140005d99
xor eax, eax
jmp 0x14000604f
xor edx, edx
lea rcx, [rsp + 0x1d0]
mov qword [rsp + 0x30], 0
lea r8d, [rdx + 0x40]
call sub.MSVCR90.dll_memset
lea rax, [rsp + 0x30]
mov r11d, 0x5a4d
lea r8, [rsp + 0x1d0]
mov r9d, 0x40
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov word [rsp + 0x1d0], r11w
mov dword [rsp + 0x20c], 0x40
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140005d92
cmp qword [rsp + 0x30], 0x40
jne 0x140005d92
mov qword [rsp + 0x228], rbx
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x108
mov qword [rsp + 0x220], r14
lea rbx, [rdi + 0x40]
call sub.MSVCR90.dll_memset
mov eax, pe_nt_image_headers64
lea r8, [rsp + 0x80]
mov word [rsp + 0x94], ax
mov eax, 0x2000
mov r14d, 1
mov word [rsp + 0x96], ax
mov eax, 0x20b
mov r9d, 0x108
mov word [rsp + 0x98], ax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x80], 0x4550
mov word [rsp + 0x86], r14w
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000603d
cmp qword [rsp + 0x30], 0x108
jne 0x14000603d
lea r8d, [r14 + 0x27]
lea rcx, [rsp + 0x1a8]
xor edx, edx
call sub.MSVCR90.dll_memset
lea eax, [rbx + 0x108]
movabs r11, 0x72756f7465642e
sub eax, edi
lea edi, [rbp + 0x58]
lea r9d, [r14 + 0x27]
add eax, 0x28
lea r8, [rsp + 0x1a8]
lea rdx, [rbx + 0x108]
mov dword [rsp + 0x1b4], eax
lea rax, [rsp + 0x30]
mov rcx, rsi
mov qword [rsp + 0x1a8], r11
mov dword [rsp + 0x1b8], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000603d
cmp qword [rsp + 0x30], 0x28
jne 0x14000603d
lea r8d, [r14 + 0x3f]
lea rcx, [rsp + 0x40]
xor edx, edx
call sub.MSVCR90.dll_memset
lea rax, [rsp + 0x30]
lea r9d, [r14 + 0x3f]
lea r8, [rsp + 0x40]
lea rdx, [rbx + 0x130]
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x40
mov dword [rsp + 0x44], 0x727444
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x4c], edi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000603d
cmp qword [rsp + 0x30], 0x40
jne 0x14000603d
xor eax, eax
lea rcx, [rsp + 0x198]
lea r9d, [r14 + 0x17]
mov dword [rsp + 0x190], eax
mov dword [rsp + 0x194], eax
mov dword [rsp + 0x198], eax
mov dword [rsp + 0x19c], eax
mov dword [rsp + 0x1a0], eax
mov dword [rsp + 0x1a4], eax
mov dword [rsp + 0x194], 0
lea eax, [rbp + 0x18]
lea r8, [rsp + 0x190]
mov dword [rsp + 0x190], eax
mov rax, qword [r12]
lea rdx, [rbx + 0x170]
mov qword [rcx], rax
mov rax, qword [r12 + 8]
mov qword [rcx + 8], rax
lea rax, [rsp + 0x30]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000603d
cmp qword [rsp + 0x30], 0x18
jne 0x14000603d
lea rcx, [rsp + 0x30]
lea rdx, [rbx + 0x188]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov r8, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000603d
cmp qword [rsp + 0x30], rbp
jne 0x14000603d
mov eax, r14d
jmp 0x14000603f
xor eax, eax
mov rbx, qword [rsp + 0x228]
mov r14, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.140009f00
add rsp, 0x230
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret