Function at 0x14000ba70
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push rdi
push r12
push r14
sub rsp, 0x70
mov rax, qword [0x14034dac0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r12, r8
mov r14, rdx
mov rdi, rcx
call fcn.14000b370
test rax, rax
je 0x14000bd4a
mov qword [rsp + 0xa8], rbx
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x60], rsi
call fcn.14000b980
test rax, rax
je 0x14000bcec
cmp word [rax + 2], 0
je 0x14000bcec
xor ebx, ebx
mov qword [rsp + 0x50], r15
mov edx, 5
mov rcx, rdi
mov r15d, ebx
call fcn.14000b640
test rax, rax
jne 0x14000baf3
mov rcx, rdi
call fcn.14000b750
mov r15, rax
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r13
test rdi, rdi
je 0x14000bcdb
mov edx, 0x40
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000bcdb
mov r13d, 0x5a4d
cmp word [rdi], r13w
jne 0x14000bcdb
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000bcdb
lea rbp, [rdi + rax]
mov edx, 0xf8
mov rcx, rbp
call fcn.14000c900
test al, al
jne 0x14000bcdb
cmp dword [rbp], 0x4550
jne 0x14000bcdb
test rbp, rbp
je 0x14000bcdb
mov edx, 0x40
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000bbba
cmp word [rdi], r13w
jne 0x14000bbba
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000bbba
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14000c900
test al, al
jne 0x14000bbba
cmp dword [rsi], 0x4550
jne 0x14000bbba
test rsi, rsi
je 0x14000bbba
mov edx, 0xf8
mov rcx, rsi
call fcn.14000c900
mov ebp, dword [rbp + 0x50]
test rbp, rbp
je 0x14000bcdb
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x14000bcdb
mov r9d, ebp
mov r8, rax
mov rdx, r14
mov rcx, rdi
call fcn.14000bd70
test al, al
je 0x14000bcdb
mov rcx, rsi
mov qword [r12], rbp
call fcn.14000b750
mov r14, rax
cmp rsi, rax
jne 0x14000bc2d
mov r15, qword [rsp + 0x50]
mov rbx, rsi
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
jmp 0x14000bd3a
mov edx, 0x40
mov rcx, rsi
call fcn.14000c900
test al, al
jne 0x14000bc8d
cmp word [rsi], r13w
jne 0x14000bc8d
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x14000bc8d
lea rdi, [rsi + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000bc8d
cmp dword [rdi], 0x4550
jne 0x14000bc8d
test rdi, rdi
je 0x14000bc8d
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
je 0x14000bc87
movzx eax, bx
jmp 0x14000bc8f
movzx eax, word [rdi + 0x18]
jmp 0x14000bc8f
mov eax, ebx
mov ecx, 0x20b
mov qword [rsp + 0x30], r14
cmp ax, cx
mov qword [rsp + 0x38], rsi
lea rax, vtable.ApplyRelocCallback.0
mov rdx, rbp
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, rsi
sete byte [rsp + 0x28]
call fcn.14000bfc0
test al, al
jne 0x14000bc16
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
jmp 0x14000bd3a
mov rcx, rdi
call fcn.14000b750
mov rcx, rdi
mov rbx, rax
call fcn.14000b860
mov esi, eax
test eax, eax
je 0x14000bd38
mov r9d, 0x40
mov r8d, 0x3000
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14000bd38
mov r8, r14
mov rdx, rdi
mov rcx, rax
call fcn.140085990
mov qword [r12], rsi
jmp 0x14000bd3a
xor ebx, ebx
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14006ee80
add rsp, 0x70
pop r14
pop r12
pop rdi
ret