Function at 0x140003d40
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push rdi
push r12
push r14
sub rsp, 0x70
mov rax, qword [0x1400faa60]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r12, r8
mov r14, rdx
mov rdi, rcx
call fcn.140003680
test rax, rax
je 0x140003ff4
mov qword [rsp + 0xa8], rbx
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x60], rsi
call fcn.140003c60
test rax, rax
je 0x140003f96
cmp word [rax + 2], 0
je 0x140003f96
xor esi, esi
mov qword [rsp + 0x50], r15
mov rcx, rdi
mov r15d, esi
lea edx, [rsi + 5]
call fcn.140003940
test rax, rax
jne 0x140003dc1
mov rcx, rdi
call fcn.140003a50
mov r15, rax
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r13
test rdi, rdi
je 0x140003f7f
mov edx, 0x40
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003f7f
mov r13d, 0x5a4d
cmp word [rdi], r13w
jne 0x140003f7f
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140003f7f
lea rbp, [rdi + rax]
mov edx, 0xf8
mov rcx, rbp
call fcn.140004c40
test al, al
jne 0x140003f7f
cmp dword [rbp], 0x4550
jne 0x140003f7f
mov edx, 0x40
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003e7a
cmp word [rdi], r13w
jne 0x140003e7a
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140003e7a
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140004c40
test al, al
jne 0x140003e7a
cmp dword [rbx], 0x4550
jne 0x140003e7a
mov edx, 0xf8
mov rcx, rbx
call fcn.140004c40
mov ebp, dword [rbp + 0x50]
test rbp, rbp
je 0x140003f7f
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x140003f7f
mov r9d, ebp
mov r8, rax
mov rdx, r14
mov rcx, rdi
call fcn.140004010
test al, al
je 0x140003f7f
mov rcx, rbx
mov qword [r12], rbp
call fcn.140003a50
mov r14, rax
cmp rbx, rax
je 0x140003f82
mov edx, 0x40
mov rcx, rbx
call fcn.140004c40
test al, al
jne 0x140003f35
cmp word [rbx], r13w
jne 0x140003f35
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003f35
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
jne 0x140003f35
cmp dword [rdi], 0x4550
jne 0x140003f35
mov edx, 0xf8
mov rcx, rdi
call fcn.140004c40
test al, al
je 0x140003f2f
movzx eax, si
jmp 0x140003f37
movzx eax, word [rdi + 0x18]
jmp 0x140003f37
mov eax, esi
mov ecx, 0x20b
mov qword [rsp + 0x30], r14
cmp ax, cx
mov qword [rsp + 0x38], rbx
lea rax, vtable.ApplyRelocCallback.0
mov rdx, rbp
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, rbx
sete byte [rsp + 0x28]
call fcn.1400042d0
test al, al
jne 0x140003f82
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, rsi
mov r15, qword [rsp + 0x50]
mov rax, rbx
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
jmp 0x140003fe7
mov rcx, rdi
call fcn.140003a50
mov rcx, rdi
mov rsi, rax
call fcn.140003b40
mov ebx, eax
test eax, eax
je 0x140003fe2
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x140003fe2
mov r8, r14
mov rdx, rdi
mov rcx, rax
call fcn.14002f3f0
mov qword [r12], rbx
jmp 0x140003fe4
xor esi, esi
mov rax, rsi
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002d6f0
add rsp, 0x70
pop r14
pop r12
pop rdi
ret