Function at 0x140001790
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140010008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140001963
cmp qword [rbx + 8], 0
je 0x140001963
mov eax, 0x5a4d
mov qword [rbx + 0x20], rcx
cmp word [rcx], ax
jne 0x140001963
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
mov qword [rbx + 0x28], rcx
cmp dword [rcx], 0x4550
jne 0x140001963
lea rdx, [rcx + 0x90]
mov qword [rbx + 0x30], rdx
lea r9, [rcx + 0xd0]
mov qword [rbx + 0x38], r9
lea r10, [rcx + 0xb0]
mov qword [rbx + 0x40], r10
lea r8, [rcx + 0xa0]
mov qword [rbx + 0x48], r8
lea rax, [rcx + 0x108]
mov qword [rbx + 0x50], rax
test rcx, rcx
je 0x140001963
test rdx, rdx
je 0x140001963
test r9, r9
je 0x140001963
test r10, r10
je 0x140001963
test r8, r8
je 0x140001963
test rax, rax
je 0x140001963
mov eax, dword [rcx + 0x50]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x68], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x30]
mov rcx, rax
mov dword [rsp + 0x20], 0x3000
xor r8d, r8d
lea rdx, [rbx + 0x10]
call fcn.140002cc7
mov edi, eax
test eax, eax
jns 0x1400018f4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Sw3NtAllocateVirtualMemory_fail:
call fcn.140001300
mov rcx, rax
lea rdx, [0x140001510]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400014d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000c880
add rsp, 0x40
pop rbx
ret
mov rax, qword [rbx + 0x28]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x58], rsi
mov r8d, dword [rax + 0x54]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbx + 0x28]
xor esi, esi
mov rdi, qword [rbx + 0x50]
cmp si, word [rax + 6]
jae 0x140001957
add rdi, 0x14
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rdi]
mov ecx, dword [rdi - 8]
add rdx, qword [rbx]
add rcx, qword [rbx + 0x10]
mov r8d, dword [rdi - 4]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbx + 0x28]
lea rdi, [rdi + 0x28]
inc esi
movzx ecx, word [rax + 6]
cmp esi, ecx
jl 0x140001930
mov rsi, qword [rsp + 0x58]
mov al, 1
jmp 0x1400018d7
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000c880
add rsp, 0x40
pop rbx
ret