Function at 0x14017eea0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
sub rsp, 0x58
mov eax, 0x5a4d
mov rbp, rcx
cmp word [rcx], ax
je 0x14017eec3
mov eax, 0xc000012f
lfence
add rsp, 0x58
pop rsi
pop rbp
ret
mov ecx, dword [rcx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14017f184
cmp dword ds:[rcx + rbp], 0x4550
lea rsi, [rcx + rbp]
jne 0x14017f184
mov eax, dword [rsi + 0xb0]
mov qword [rsp + 0x38], r14
test eax, eax
je 0x14017f170
cmp dword [rsi + 0xb4], 0
je 0x14017f170
mov qword [rsp + 0x50], rdi
lea rdi, [rax + rbp]
mov qword [rsp + 0x40], r13
xor r13d, r13d
test byte [rsi + 0x16], 1
je 0x14017ef25
xor eax, eax
jmp 0x14017efce
mov qword ss:[rsp + 0x88], rbx
mov ebx, r13d
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x30], r15
cmp r13w, word [rsi + 6]
jae 0x14017efe4
nop dword [rax + rax]
movzx ecx, word ds:[rsi + 0x14]
lea r8, [rsp + 0x78]
add rcx, rsi
mov dword [rsp + 0x70], r13d
mov eax, ebx
mov r9d, 4
lea rdx, [rax + rax*4]
mov eax, dword [rcx + rdx*8 + 0x24]
add rax, rbp
mov qword [rsp + 0x80], rax
mov eax, dword [rcx + rdx*8 + 0x28]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x78], rax
mov rcx, 0xffffffffffffffff
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov r15d, eax
test eax, eax
js 0x14017efb9
movzx eax, word [rsi + 6]
inc ebx
cmp ebx, eax
jb 0x14017ef50
jmp 0x14017efe7
lfence
mov rbx, qword [rsp + 0x88]
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x40]
mov r14, qword [rsp + 0x38]
add rsp, 0x58
pop rsi
pop rbp
ret
mov r15d, r13d
lfence
mov r14d, dword [rsi + 0xb4]
mov r11, rbp
sub r11, qword [rsi + 0x30]
add r14, rdi
cmp rdi, r14
jae 0x14017f088
nop dword [rax]
mov eax, dword [rdi + 4]
lea r10, [rdi + 8]
mov r9d, dword [rdi]
sub rax, 8
shr rax, 1
add r9, rbp
test eax, eax
je 0x14017f07d
mov ebx, eax
nop word [rax + rax]
movzx r8d, word ds:[r10]
mov eax, r8d
movzx edx, r8w
shr eax, 0xc
sub eax, 2
je 0x14017f068
sub eax, 1
je 0x14017f05c
cmp eax, 7
jne 0x14017f073
and r8d, 0xfff
add qword [r8 + r9], r11
jmp 0x14017f073
and edx, 0xfff
add dword [rdx + r9], r11d
jmp 0x14017f073
and edx, 0xfff
add word [rdx + r9], r11w
add r10, 2
sub rbx, 1
jne 0x14017f030
mov eax, dword [rdi + 4]
add rdi, rax
cmp rdi, r14
jb 0x14017f010
mov ebx, r13d
cmp r13w, word [rsi + 6]
jae 0x14017f168
mov edi, 8
mov r14d, 0x10
mov r12d, 0x20
mov r10d, 0x40
nop dword [rax]
movzx ecx, word ds:[rsi + 0x14]
add rcx, rsi
mov dword [rsp + 0x70], r13d
mov eax, ebx
lea rdx, [rax + rax*4]
mov eax, dword [rcx + rdx*8 + 0x24]
add rax, rbp
mov qword [rsp + 0x80], rax
mov eax, dword [rcx + rdx*8 + 0x28]
mov qword [rsp + 0x78], rax
mov r8d, dword [rcx + rdx*8 + 0x3c]
mov eax, r8d
mov r9d, r8d
lea rdx, [rsp + 0x80]
shr r9d, 0x1d
mov rcx, 0xffffffffffffffff
and r9d, 2
test r8d, r8d
cmovs r9d, edi
bt r8d, 0x1d
cmovb r9d, r14d
and eax, 0x60000000
cmp eax, 0x60000000
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
cmove r9d, r12d
and r8d, 0xa0000000
cmp r8d, 0xa0000000
lea r8, [rsp + 0x78]
cmove r9d, r10d
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov r15d, eax
test eax, eax
js 0x14017f168
movzx eax, word ds:[rsi + 6]
inc ebx
mov r10d, 0x40
cmp ebx, eax
jb 0x14017f0b0
mov eax, r15d
jmp 0x14017efbc
lfence
mov r14, qword [rsp + 0x38]
mov eax, 0xc0000020
add rsp, 0x58
pop rsi
pop rbp
ret
mov eax, 0xc000007b
lfence
add rsp, 0x58
pop rsi
pop rbp
ret