Function at 0x14003cd91
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x14003d421
mov rsi, rcx
mov eax, dword [rcx + 0x3c]
test eax, eax
je 0x14003d421
cmp eax, 0x40
jb 0x14003d436
movsxd r13, eax
cmp r13, rdx
ja 0x14003d436
movzx eax, word [r13 + rsi + 0x18]
cmp eax, 0x20b
je 0x14003ce2c
cmp eax, 0x10b
jne 0x14003d421
cmp dword [rsi + r13], 0x4550
jne 0x14003d421
lea rbp, [rsi + r13]
movzx eax, word [rbp + 4]
cmp eax, 0x14c
jne 0x14003d421
movzx eax, word [rbp + 0x16]
not eax
or eax, 0xfffd
cmp ax, 0xffff
je 0x14003d421
mov ecx, 0x138
xor eax, eax
jmp 0x14003ce6c
cmp dword [rsi + r13], 0x4550
jne 0x14003d421
lea rbp, [rsi + r13]
movzx eax, word [rbp + 4]
cmp eax, 0x8664
jne 0x14003d421
movzx eax, word [rbp + 0x16]
mov ecx, eax
xor ecx, 0xfffd
test cx, ax
je 0x14003d421
mov ecx, 0x148
mov eax, 1
add r13, 0xffffffffffffffc0
mov r8d, ecx
and r8d, r13d
or r13, rcx
add r13, r8
cmp rdx, r13
jb 0x14003d436
mov rcx, rdx
not rcx
and rcx, r13
mov r8, r13
not r8
and r8, rdx
sub r8, rcx
movzx edi, word [rbp + 6]
mov ecx, edi
not ecx
mov edx, edi
and edx, 0xffffffd7
and ecx, 0x28
imul rcx, rdx
mov edx, edi
and edx, 0x28
mov r9, rdi
or r9, 0x28
imul r9, rdx
add r9, rcx
cmp r9, r8
ja 0x14003d436
test rax, rax
je 0x14003d421
movzx eax, word [rbp + 0x16]
mov ecx, eax
xor ecx, 0xdfff
or eax, 0x2000
test ax, cx
jne 0x14003d421
cmp dword [rbp + 0xfc], 0
je 0x14003cf03
cmp dword [rbp + 0xf8], 0
jne 0x14003d421
mov eax, dword [rbp + 0x28]
test rax, rax
je 0x14003d421
mov qword [rsp + 0x78], rax
mov rax, qword [rbp + 0x30]
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
mov eax, dword [rbp + 0x50]
lea rdx, [rsp + 0x80]
mov qword [rdx], rax
call fcn.14003ccd5
cmp eax, 0xb
je 0x14003cf5a
lea rcx, [rsp + 0x28]
mov qword [rcx], 0
lea rdx, [rsp + 0x80]
call fcn.14003ccd5
cmp eax, 0xb
jne 0x14003d421
mov rax, rdi
not rax
or rax, 0xff00
add rax, rdi
inc rax
mov ecx, edi
not ecx
or ecx, 0xff
add ecx, edi
inc ecx
movzx r15d, cx
mov rcx, rax
not rcx
or rax, r15
not r15
and r15, rcx
not r15
and r15, rax
je 0x14003cfd0
lea rdi, [rsi + r13]
add rdi, 0x14
lea rax, [r15*8]
lea rbx, [rax + rax*4]
xor r14d, r14d
mov edx, dword [rdi + r14]
add rdx, rsi
mov ecx, dword [rdi + r14 - 8]
mov r8d, dword [rdi + r14 - 4]
add rcx, qword [rsp + 0x28]
call fcn.140070050
add r14, 0x28
cmp rbx, r14
jne 0x14003cfac
mov rdi, qword [rsp + 0x28]
mov rax, qword [rbp + 0x30]
cmp rdi, rax
je 0x14003d0b2
mov ecx, dword [rbp + 0xb0]
test rcx, rcx
je 0x14003d0b2
cmp dword [rbp + 0xb4], 0
je 0x14003d0b2
mov rdx, rdi
not rdx
and rdx, rax
not rax
and rax, rdi
sub rax, rdx
add rcx, rdi
mov edx, 1
mov r8d, dword [rcx + 4]
test r8, r8
je 0x14003d09d
cmp r8d, 0xa
jb 0x14003d0a5
lea r9, [r8 - 8]
shr r9, 0x3f
add r8, r9
add r8, 0xfffffffffffffff8
sar r8, 1
cmp r8, 2
cmovl r8, rdx
xor r9d, r9d
movzx r10d, word [rcx + r9*2 + 8]
mov r11d, r10d
xor r11d, 0xfff
and r11d, r10d
movzx r11d, r11w
cmp r11d, 0xa000
jne 0x14003d083
mov r11d, dword [rcx]
mov ebx, r10d
not ebx
or ebx, 0xfff
add r10d, ebx
inc r10d
movzx r10d, r10w
add r10, r11
add qword [rdi + r10], rax
mov r10d, r9d
and r10d, 1
xor r9, 1
lea r9, [r9 + r10*2]
cmp r9, r8
jne 0x14003d044
mov r8d, dword [rcx + 4]
jmp 0x14003d0a5
cmp dword [rcx], 0
je 0x14003d0ad
xor r8d, r8d
add rcx, r8
jmp 0x14003d018
mov rdi, qword [rsp + 0x28]
cmp dword [rbp + 0x94], 0
je 0x14003d22a
mov ebx, dword [rbp + 0x90]
test rbx, rbx
je 0x14003d22a
mov qword [rsp + 0x68], r15
add rbx, rdi
lea rax, [rdi + 2]
mov qword [rsp + 0x50], rax
lea r14, [rsp + 0x30]
mov r15d, dword [rbx + 0xc]
test r15, r15
jne 0x14003d108
cmp dword [rbx + 0x10], 0
jne 0x14003d108
cmp dword [rbx], 0
jne 0x14003d108
cmp dword [rbx + 4], 0
jne 0x14003d108
cmp dword [rbx + 8], 0
je 0x14003d220
add r15, rdi
mov rcx, r15
call fcn.140063eb0
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.1400394bd
cmp qword [rsp + 0x30], 0
jne 0x14003d421
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov rcx, r14
call fcn.14003cadb
cmp dword [rsp + 0x30], 0
jne 0x14003d421
mov eax, dword [rbx]
mov qword [rsp + 0x70], rbx
mov ebx, dword [rbx + 0x10]
add rbx, rdi
lea r14, [rdi + rax]
test rax, rax
cmove r14, rbx
mov r12, qword [r14]
test r12, r12
je 0x14003d212
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
xor r15d, r15d
test r12, r12
js 0x14003d1e4
mov rax, qword [rsp + 0x50]
cmp byte [rax + r12], 0
je 0x14003d212
add r12, qword [rsp + 0x50]
mov rcx, r12
call fcn.140063eb0
lea rcx, [rsp + 0x30]
mov rdx, r12
mov r8, rax
call fcn.1400394bd
cmp qword [rsp + 0x30], 0
jne 0x14003d421
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
call fcn.14003cb91
cmp dword [rsp + 0x58], 0
jne 0x14003d421
mov rax, qword [rsp + 0x60]
jmp 0x14003d1fc
movzx edx, r12w
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14003d421
mov qword [rbx + r15], rax
mov r12, qword [r14 + r15 + 8]
add r15, 8
test r12, r12
jne 0x14003d17b
mov rbx, qword [rsp + 0x70]
add rbx, 0x14
jmp 0x14003d0df
mov rdi, qword [rsp + 0x28]
mov r15, qword [rsp + 0x68]
cmp dword [rbp + 0xa4], 0
je 0x14003d298
lea rdx, str.kernel32.dllRtlAddFunctionTable
lea rbx, [rsp + 0x30]
mov r8d, 0xc
mov rcx, rbx
call fcn.14003cadb
cmp dword [rbx], 0
jne 0x14003d298
lea rbx, [rsp + 0x30]
mov rdx, qword [rbx + 8]
lea r8, [0x14007e043]
mov r9d, 0x13
mov rcx, rbx
call fcn.14003cb91
cmp dword [rbx], 0
jne 0x14003d298
mov ecx, dword [rbp + 0xa0]
mov eax, dword [rbp + 0xa4]
add rcx, rdi
mov edx, 0xaaaaaaab
imul rdx, rax
shr rdx, 0x23
mov r8, rdi
call qword [rsp + 0x38]
test r15, r15
je 0x14003d3d2
lea rbx, [rsi + r13]
add rbx, 0xc
shl r15, 3
lea rsi, [r15 + r15*4]
xor r14d, r14d
lea rdi, [rsp + 0x30]
lea r12, [rsp + 0x88]
mov eax, dword [rbx + r14 + 4]
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14003d3c5
mov eax, dword [rbx + r14]
add rax, qword [rsp + 0x28]
mov qword [rsp + 0x90], rax
mov r13d, dword [rbx + r14 + 0x18]
mov ecx, r13d
xor ecx, 0xdfffffff
mov eax, r13d
not eax
or eax, 0x40000000
add eax, r13d
inc eax
test ecx, r13d
je 0x14003d31c
test eax, eax
je 0x14003d32e
shr r13d, 0x1a
and r13d, 0xffffffe0
add r13d, 0x20
jmp 0x14003d33c
test eax, eax
je 0x14003d336
shr r13d, 0x1f
lea r13d, [r13*2 + 2]
jmp 0x14003d33c
mov r13d, 0x10
jmp 0x14003d33c
mov r13d, 1
mov r15, qword [0x14008faf8]
test r15, r15
jne 0x14003d39b
mov r8d, 9
mov rcx, rdi
lea rdx, str.ntdll.dllNtAllocateVirtualMemoryNtProtectVirtualMemory
call fcn.14003cadb
cmp dword [rsp + 0x30], 0
jne 0x14003d421
mov rdx, qword [rsp + 0x38]
mov r9d, 0x16
lea rcx, [rsp + 0x58]
lea r8, [0x14007e098]
call fcn.14003cb91
cmp dword [rsp + 0x58], 0
jne 0x14003d421
mov r15, qword [rsp + 0x60]
mov qword [0x14008faf8], r15
mov dword [rsp + 0x30], 0
call sub.kernel32.dll_GetCurrentProcess
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea rdx, [rsp + 0x90]
mov r8, r12
mov r9d, r13d
call r15
test eax, eax
jne 0x14003d421
add r14, 0x28
cmp rsi, r14
jne 0x14003d2c1
mov rsi, qword [rsp + 0x28]
cmp dword [rbp + 0xd4], 0
je 0x14003d41a
mov eax, dword [rbp + 0xd0]
test rax, rax
je 0x14003d41a
mov rdi, qword [rsi + rax + 0x18]
mov rax, qword [rdi]
test rax, rax
je 0x14003d41a
add rdi, 8
mov rcx, rsi
mov edx, 2
xor r8d, r8d
call rax
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x14003d3fc
mov rsi, qword [rsp + 0x28]
add rsi, qword [rsp + 0x78]
call rsi
nop
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2