Function at 0x1400072e8
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rsi
add sil, r10b
and sil, r10b
bt si, 0x84
push rbp
bsr rsi, rbx
push rdi
sal sil, cl
rcl rsi, cl
push r15
lea rbp, [rsp - 0x47]
mov rsi, r14
sub rsp, 0x90
movsx esi, r8w
bts r15d, r11d
mov r15d, 0x5a4d
mov rsi, rdx
adc dil, 0x6a
mov rdi, rcx
stc
cmp spl, al
cmp word [rcx], r15w
jne 0x1400078c4
xor r8d, r8d
test rax, 0x36644718
jmp 0x140007349
cmp rcx, 0xffffffffffffffff
jmp 0x140007352
je 0x140007374
mov eax, dword [rcx + 0x3c]
cmp sil, bl
add rax, rcx
test spl, r15b
cmc
cmp dword [rax], 0x4550
cmove r8, rax
jmp 0x140007374
cmp dword [r8], 0x4550
jne 0x1400078c4
mov ecx, dword [r8 + 0x38]
sub ax, 0xa9e
cmc
cmp rbx, rdx
xor edx, edx
movsx ax, r9b
cwde
mov r8d, dword [r8 + 0x50]
not ax
inc r9
cmovnp r9, r14
dec r8d
ror ax, cl
btc r9w, 0x53
mov qword [rsp + 0xb8], rbx
movsx eax, bx
movzx r9, r10w
add r8d, ecx
and rax, 0x29474157
rcl r9b, cl
mov r9w, di
mov eax, r8d
rcr r9b, cl
div ecx
movzx r9d, dx
xor ecx, ecx
adc r9b, 0x62
or r9w, 0x721f
bts r9, r10
sub r8d, edx
mov edx, r8d
xchg r9w, r9w
mov r8d, 0x1000
setno r9b
movsx r9, r9w
movzx r9d, ax
mov dword [rbp + 0x67], edx
mov r9b, 0x9c
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test r12b, 0x83
test rax, rax
jmp 0x140007426
jne 0x1400075cb
movabs rax, 0xdccc26e4beac1086
btc cx, dx
shl rdx, 0xfa
clc
lea r8, [0x1400030f0]
rol rcx, 0x81
not ch
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x19]
movabs rax, 0xfc3629c0ca287019
not cx
cmova ecx, r12d
movabs rcx, 0x85fd75f2e767429b
clc
test si, 0x47f6
mov qword [rbp - 0x11], rax
test ch, 0xad
cmp di, r14w
sub r9d, r9d
movdqa xmm0, xmmword [rbp - 0x19]
movabs rax, 0xe13cf3e895a0b18
mov qword [rbp + 0x17], rcx
movsx cx, r9b
movzx cx, ch
movabs rcx, 0xad45a237ca08fd3c
jmp 0x1400074ae
mov qword [rbp - 9], rax
cbw
bswap rax
cdqe
movabs rax, 0x3f50aa14c9273591
jmp 0x1400074c8
mov qword [rbp + 0x1f], rcx
xchg ch, ch
movsx ecx, r11w
movsx cx, r14b
movabs rcx, 0x9fdea4ecee1a9ef5
jmp 0x1400074e6
pxor xmm0, xmmword [rbp + 0x17]
mov qword [rbp - 1], rax
cmovg ax, cx
movabs rax, 0xf98e874ebe929f68
jmp 0x140007502
movdqa xmm1, xmmword [rbp - 9]
mov qword [rbp + 0x27], rcx
jmp 0x140007510
movabs rcx, 0xb485fb999d2961be
jmp 0x14000751f
mov qword [rbp + 7], rax
mov eax, 0x64577709
movabs rax, 0x9b046b539445df90
mov qword [rbp + 0x2f], rcx
movabs rcx, 0xf98e874ebe929f5f
pxor xmm1, xmmword [rbp + 0x27]
mov qword [rbp + 0xf], rax
jmp 0x14000754e
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x37], rcx
cmc
xor ecx, ecx
jmp 0x140007564
mov qword [rbp + 0x3f], rax
jmp 0x14000756d
pxor xmm0, xmmword [rbp + 0x37]
movdqa xmmword [rbp + 7], xmm0
movdqa xmmword [rbp - 9], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
sub eax, eax
sbb r15, 0x22aa2a46
mov rbx, qword [rsp + 0xb8]
rcr dil, cl
movsxd rbp, edi
mov rsi, qword [rsp + 0xc8]
add rsp, 0x90
not ebp
movsxd r15, ebp
mov bpl, r14b
pop r15
movzx edi, r15w
movsx rbp, r12w
movsx ebp, r8w
pop rdi
movsx bp, sil
pop rbp
jmp 0x1400075ca
ret
mov r8, rbx
movsx ecx, r14w
cmovno dx, r8w
lea rdx, [rbp + 0x67]
mov cl, r13b
movsx rcx, r15w
not cx
mov rcx, rdi
jmp 0x1400075ed
call fcn.140006b18
test al, al
jne 0x140007765
movabs rax, 0xdccc26e4beac1086
lea r8, [0x1400030f0]
movsx rcx, dx
mov qword [rbp - 0x19], rax
bsf cx, di
sub ah, 0xfd
not rdx
lea rdx, [rbp - 0x19]
rcr cx, cl
movabs rax, 0xfc3629c0ca287019
movabs rcx, 0x85fd75f2e767429b
mov qword [rbp - 0x11], rax
xor r9d, r9d
jmp 0x140007644
movdqa xmm0, xmmword [rbp - 0x19]
movabs rax, 0xe13cf3e895a0b18
jmp 0x140007658
mov qword [rbp + 0x17], rcx
movzx cx, ch
movabs rcx, 0xad45a237ca08fd3c
jmp 0x14000766f
mov qword [rbp - 9], rax
movabs rax, 0x3f50aa14c9273591
jmp 0x140007682
mov qword [rbp + 0x1f], rcx
cmovle rcx, r9
movsx ecx, dx
movabs rcx, 0x9fdea4ecee1a9ef5
jmp 0x14000769c
pxor xmm0, xmmword [rbp + 0x17]
mov qword [rbp - 1], rax
movabs rax, 0xf98e874ebe929f67
jmp 0x1400076b4
movdqa xmm1, xmmword [rbp - 9]
mov qword [rbp + 0x27], rcx
mov ecx, 0x48ef7bb2
movabs rcx, 0xb485fb999d2961be
jmp 0x1400076d1
mov qword [rbp + 7], rax
movabs rax, 0x9b046b539445df90
mov qword [rbp + 0x2f], rcx
movabs rcx, 0xf98e874ebe929f5f
pxor xmm1, xmmword [rbp + 0x27]
mov qword [rbp + 0xf], rax
jmp 0x1400076fb
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x37], rcx
sub ecx, ecx
jmp 0x140007710
mov qword [rbp + 0x3f], rax
jmp 0x140007719
pxor xmm0, xmmword [rbp + 0x37]
movdqa xmmword [rbp + 7], xmm0
movdqa xmmword [rbp - 9], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
sub edx, edx
movzx rcx, bx
movsx r8d, bx
mov r8d, 0x8000
mov rcx, rbx
jmp 0x140007746
call qword [sym.imp.KERNEL32.dll_VirtualFree]
sub ebx, ebx
cwde
movsx ax, r11b
jmp 0x140007759
mov eax, ebx
jmp 0x140007760
jmp 0x14000758b
test rsi, rsi
jmp 0x14000776d
je 0x140007781
mov eax, dword [rbp + 0x67]
mov dword [rsi], eax
rol ch, cl
stc
sbb ecx, 0x46aa20fa
xor edx, edx
bswap rcx
mov rcx, rbx
jmp 0x14000778e
call fcn.1400063b2
test eax, eax
jmp 0x14000779a
jne 0x14000772e
mov rcx, rbx
jmp 0x1400077a8
call fcn.140006ead
test eax, eax
jmp 0x1400077b4
je 0x14000772e
mov r8d, 3
mov dword [rbp + 0x67], 0
mov r9b, r13b
mov cl, 0x19
lea r9, [rbp + 0x67]
mov rcx, rbx
jmp 0x1400077d8
call section..code0
mov r9, rax
test rax, rax
jmp 0x1400077e8
je 0x14000782f
mov ecx, dword [rbp + 0x67]
test ecx, ecx
je 0x14000782f
movabs rax, 0xaaaaaaaaaaaaaaab
mov r8, rbx
sar dl, cl
movzx dx, al
mul rcx
cmc
mov rcx, r9
shr rdx, 3
call qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
movzx eax, al
clc
stc
test eax, eax
jmp 0x140007829
je 0x14000772e
xor eax, eax
stc
cmp rbx, 0xffffffffffffffff
jmp 0x14000783b
je 0x14000786c
cmp word [rbx], r15w
jmp 0x14000784a
jne 0x14000786c
mov ecx, dword [rbx + 0x3c]
test rax, rbx
lea rcx, [rcx + rbx]
clc
cmp dword [rcx], 0x4550
jne 0x14000786c
mov rax, rcx
cwd
mov dword [rbp + 0x77], 0
mov r8b, r13b
mov r8b, 0xc8
lea r9, [rbp + 0x77]
movsx r8, r14w
movzx rcx, si
mov edx, dword [rax + 0x50]
movsxd r8, r10d
jmp 0x140007892
mov r8d, 0x40
setnp ch
mov cx, 0x597
xchg ch, ch
mov rcx, rbx
jmp 0x1400078a9
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbx
call fcn.14000706c
mov rax, rbx
jmp 0x1400078bf
jmp 0x14000758b
movabs rax, 0xdccc26e4beac1086
bswap dx
lea r8, [0x1400030f0]
movsx ecx, bx
mov qword [rbp - 0x19], rax
movsx cx, r13b
lea rdx, [rbp - 0x19]
cmp r12d, edi
seta cl
rol cx, cl
movabs rax, 0xfc3629c0ca287019
bt cx, r11w
movabs rcx, 0x85fd75f2e767429b
jmp 0x14000790f
mov qword [rbp - 0x11], rax
xor r9d, r9d
movdqa xmm0, xmmword [rbp - 0x19]
movabs rax, 0xe13cf3e895a0b18
mov qword [rbp + 0x17], rcx
movabs rcx, 0xad45a237ca08fd3c
mov qword [rbp - 9], rax
not al
movsx ax, r8b
movzx eax, ax
movabs rax, 0x3f50aa14c9273591
jmp 0x140007950
mov qword [rbp + 0x1f], rcx
movabs rcx, 0x9fdea4ecee1a9ef5
jmp 0x140007963
pxor xmm0, xmmword [rbp + 0x17]
mov qword [rbp - 1], rax
mov rax, rsi
movzx eax, r10w
movabs rax, 0xf98e874ebe929f69
jmp 0x140007982
movdqa xmm1, xmmword [rbp - 9]
mov qword [rbp + 0x27], rcx
movabs rcx, 0xb485fb999d2961be
jmp 0x14000799a
mov qword [rbp + 7], rax
setns ah
cwde
mov eax, 0x3fd6148a
movabs rax, 0x9b046b539445df90
jmp 0x1400079b6
mov qword [rbp + 0x2f], rcx
mov cx, 0x748a
movzx rcx, r9w
setle ch
movabs rcx, 0xf98e874ebe929f5f
jmp 0x1400079d4
pxor xmm1, xmmword [rbp + 0x27]
mov qword [rbp + 0xf], rax
jmp 0x1400079e2
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x37], rcx
clc
cmp dl, r14b
sub ecx, ecx
jmp 0x1400079fb
mov qword [rbp + 0x3f], rax
jmp 0x140007a04
pxor xmm0, xmmword [rbp + 0x37]
movdqa xmmword [rbp + 7], xmm0
movdqa xmmword [rbp - 9], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x140007a20
jmp 0x140007599