Function at 0x1400fa480
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
movzx esi, r8w
mov rdi, rcx
lea rdx, [0x1401f02a0]
mov rcx, rbx
call fcn.1401a8df0
test eax, eax
jne 0x1400fa4b8
lea rax, [0x1400fa180]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x1400fa785
mov ecx, dword [rdi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1400fa785
cmp dword [rdi + rcx], 0x4550
lea r9, [rdi + rcx]
jne 0x1400fa785
mov eax, dword [r9 + 0x88]
test eax, eax
je 0x1400fa785
cmp dword [r9 + 0x8c], 0
je 0x1400fa785
lea r8, [rdi + rax]
mov qword [rsp + 0x60], rbp
cmp esi, dword [r8 + 0x18]
jae 0x1400fa76b
lfence
mov eax, dword [r8 + 0x20]
mov r11d, dword [r8 + 0x1c]
add rax, rdi
mov ebp, dword [r8 + 0x24]
add r11, rdi
add rbp, rdi
mov r10d, dword [rax + rsi*4]
mov rax, rbx
add r10, rdi
sub r10, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x1400fa553
inc rax
test ecx, ecx
jne 0x1400fa540
test edx, edx
jne 0x1400fa76b
lfence
movzx eax, word [rbp + rsi*2]
mov ebx, dword [r11 + rax*4]
add rbx, rdi
cmp rbx, r8
jb 0x1400fa75b
mov eax, dword ds:[r9 + 0x8c]
add rax, r8
cmp rbx, rax
jae 0x1400fa75b
lfence
mov rsi, 0xffffffffffffffff
mov rdx, rsi
inc rdx
cmp byte [rbx + rdx], 0
jne 0x1400fa596
mov rcx, rbx
call sym.ProcessHacker.exe_PhZeroExtendToUtf16Ex
mov edx, 0x2e
xor r8d, r8d
mov rcx, rax
mov rbp, rax
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
call sym.ProcessHacker.exe_PhFindCharInStringRef
cmp rax, rsi
je 0x1400fa745
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + rax]
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x70], r13
sub rdi, rdx
mov qword [rsp + 0x38], r14
sub rdi, 2
lea r14, [rdx + rcx]
mov qword [rsp + 0x30], r15
call sym.ProcessHacker.exe_PhCreateStringEx
mov rdx, rdi
lea rcx, [r14 + 2]
mov r15, rax
call sym.ProcessHacker.exe_PhConvertUtf16ToUtf8Ex
mov rcx, qword [r15 + 8]
mov r13, rax
call fcn.1400f9d00
mov r10, rax
test rax, rax
jne 0x1400fa633
mov rcx, qword [r15 + 8]
call sym.ProcessHacker.exe_PhLoadLibrary
mov r10, rax
test rax, rax
je 0x1400fa708
mov rbx, qword ds:[r13 + 8]
cmp byte [rbx], 0x23
jne 0x1400fa6f4
add r14, 4
mov qword [rsp + 0x68], r12
mov r12b, 0
sub rdi, 2
je 0x1400fa679
movzx eax, word ds:[r14]
cmp ax, 0x2d
je 0x1400fa66e
cmp ax, 0x2b
jne 0x1400fa679
jmp 0x1400fa671
mov r12b, 1
add r14, 2
add rdi, 0xfffffffffffffffe
shr rdi, 1
mov r11d, 0
mov ecx, r11d
mov edx, r11d
mov r9b, 1
je 0x1400fa6c9
lea rbx, [0x1401f2c20]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r14 + rdx*2]
mov r8d, dword [rbx + rax*4]
cmp r8d, 0xa
jae 0x1400fa6b9
lea rcx, [rcx + rcx*4]
lea rcx, [r8 + rcx*2]
jmp 0x1400fa6bc
xor r9b, r9b
inc rdx
cmp rdx, rdi
jb 0x1400fa6a0
mov rbx, qword [r13 + 8]
mov r8, rcx
neg r8
test r12b, r12b
cmove r8, rcx
test r9b, r9b
mov rcx, r10
cmove r8w, r11w
cmove r11, rbx
mov rdx, r11
call fcn.1400fa100
mov r12, qword [rsp + 0x68]
jmp 0x1400fa705
xor r8d, r8d
mov rdx, rbx
mov rcx, r10
call fcn.1400fa100
mov rbx, rax
lea rcx, ds:[r13 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x70]
cmp eax, 1
jne 0x1400fa72a
call fcn.1400fbcc0
lea rcx, [r15 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
mov r15, qword [rsp + 0x30]
cmp eax, 1
jne 0x1400fa745
nop
call fcn.1400fbcc0
lea rcx, [rbp - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x1400fa75b
lfence
call fcn.1400fbcc0
mov rbp, qword [rsp + 0x60]
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
jmp fcn.1400fa100
xor eax, eax
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret