Function at 0x14002cfa0
Capabilities:
Create thread
Get system information on windows
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140042088]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov eax, 0x5a4d
mov qword [rsp + 0x40], r8
xorps xmm0, xmm0
mov r12, rdx
mov r13, rcx
mov qword [rsp + 0x38], rdx
movups xmmword [rsp + 0x48], xmm0
cmp word [rcx], ax
jne 0x14002d4f5
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
je 0x14002d4f5
cmp dword [rsi], 0x4550
jne 0x14002d4f5
mov eax, 0x8664
cmp word [rsi + 4], ax
jne 0x14002d4f5
mov r9d, dword [rsi + 0x38]
test r9b, 1
jne 0x14002d4f5
movzx ecx, word [rsi + 0x14]
xor edx, edx
movzx eax, word [rsi + 6]
add rcx, 0x24
movzx r14d, word [rsi + 0x16]
mov ebx, edx
mov dword [rsp + 0x30], r14d
cmp dx, ax
jae 0x14002d072
add rcx, rsi
mov r8d, eax
nop word [rax + rax]
mov eax, dword [rcx + 4]
mov edx, dword [rcx]
test eax, eax
jne 0x14002d05f
lea eax, [rdx + r9]
jmp 0x14002d061
add eax, edx
cmp eax, ebx
cmovbe eax, ebx
add rcx, 0x28
mov ebx, eax
sub r8, 1
jne 0x14002d050
lea rcx, [rsp + 0x60]
call qword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x64]
mov eax, edx
neg eax
lea ebp, [rdx - 1]
add ebp, dword [rsi + 0x50]
lea rcx, [rdx - 1]
and rbp, rax
mov eax, ebx
add rcx, rax
lea rax, [rdx - 1]
not rax
and rcx, rax
cmp rbp, rcx
jne 0x14002d4f5
mov rcx, qword [rsi + 0x30]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbp
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14002d0e5
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rdi, rax
movsxd rax, dword [r13 + 0x3c]
mov dword [rdi + 0x3c], eax
mov r8d, dword [rsi + 0x54]
sub r8d, dword [r13 + 0x3c]
lea rdx, [rax + r13]
lea rcx, [rdi + rax]
call fcn.14002e9b0
movsxd r15, dword [rdi + 0x3c]
xor ebp, ebp
add r15, rdi
mov esi, ebp
movzx ebx, word [r15 + 0x14]
add rbx, 0x2c
cmp bp, word [r15 + 6]
jae 0x14002d143
add rbx, r15
nop
mov edx, dword [rbx]
mov ecx, dword [rbx - 8]
add rdx, r13
mov r8d, dword [rbx - 4]
add rcx, rdi
call fcn.14002e9b0
movzx eax, word [r15 + 6]
lea rbx, [rbx + 0x28]
inc esi
cmp esi, eax
jb 0x14002d120
mov r10, rdi
sub r10, qword [r15 + 0x30]
je 0x14002d22b
cmp dword [r15 + 0xb4], ebp
je 0x14002d22b
mov r8d, dword [r15 + 0xb0]
add r8, rdi
cmp dword [r8], ebp
je 0x14002d22b
mov eax, dword [r8 + 4]
lea r9, [r8 + 8]
add rax, r8
cmp r9, rax
je 0x14002d21f
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r9]
movzx ecx, dx
movzx eax, dx
shr cx, 0xc
cmp cx, 0xa
jne 0x14002d1b7
mov ecx, dword [r8]
and edx, 0xfff
lea rax, [rdi + rdx]
add qword [rcx + rax], r10
jmp 0x14002d20b
cmp cx, 3
jne 0x14002d1d0
mov edx, dword [r8]
and eax, 0xfff
add rax, rdi
add rdx, rax
mov eax, r10d
jmp 0x14002d208
cmp cx, 1
jne 0x14002d1f0
mov edx, dword [r8]
and eax, 0xfff
add rax, rdi
add rdx, rax
mov rax, r10
shr rax, 0x10
movzx eax, ax
jmp 0x14002d208
cmp cx, 2
jne 0x14002d20b
mov edx, dword [r8]
and eax, 0xfff
add rax, rdi
add rdx, rax
movzx eax, r10w
add qword [rdx], rax
mov eax, dword [r8 + 4]
add r9, 2
add rax, r8
cmp r9, rax
jne 0x14002d190
mov r8, r9
cmp dword [r9], ebp
jne 0x14002d170
cmp dword [r15 + 0x94], ebp
je 0x14002d2eb
mov ebp, dword [r15 + 0x90]
add rbp, rdi
cmp dword [rbp + 0xc], 0
je 0x14002d2e9
xor r12d, r12d
nop
mov ecx, dword [rbp + 0xc]
add rcx, rdi
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebx, dword [rbp]
mov r14, rax
mov esi, dword [rbp + 0x10]
add rbx, rdi
add rsi, rdi
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002d2d1
jns 0x14002d27e
movzx r8d, word [rbx]
mov rdx, r12
jmp 0x14002d2b5
mov rdx, qword [rbx]
mov rcx, r12
add rdx, 2
add rdx, rdi
cmp byte [rdx], cl
je 0x14002d29e
mov rax, rdx
inc rcx
lea rax, [rax + 1]
cmp byte [rax], r12b
jne 0x14002d292
mov qword [rsp + 0x50], rdx
mov r8d, r12d
lea rdx, [rsp + 0x48]
mov word [rsp + 0x48], cx
mov word [rsp + 0x4a], cx
mov r9, rsi
mov rcx, r14
call sub.ntdll.dll_LdrGetProcedureAddress
mov rcx, qword [rbx + 8]
add rbx, 8
add rsi, 8
test rcx, rcx
jne 0x14002d273
add rbp, 0x14
cmp dword [rbp + 0xc], r12d
jne 0x14002d250
mov r12, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x30]
xor ebp, ebp
movzx ebx, word [r15 + 0x14]
mov esi, ebp
add rbx, 0x28
mov edx, 1
cmp bp, word [r15 + 6]
jae 0x14002d3cc
add rbx, r15
mov r9d, 2
mov r10d, 0x10
mov r11d, 0x20
nop dword [rax + rax]
cmp dword [rbx], 0
je 0x14002d3b9
mov ecx, dword [rbx + 0x14]
mov eax, ecx
and eax, 0x40000000
bt ecx, 0x1d
jb 0x14002d359
test eax, eax
jne 0x14002d34b
test ecx, ecx
mov r8d, 8
cmovns r8d, edx
jmp 0x14002d377
test ecx, ecx
mov r8d, 4
cmovns r8d, r9d
jmp 0x14002d377
test eax, eax
jne 0x14002d36b
test ecx, ecx
mov r8d, 0x80
cmovns r8d, r10d
jmp 0x14002d377
test ecx, ecx
mov r8d, 0x40
cmovns r8d, r11d
mov dword [rsp + 0x58], r8d
test dword [rbx + 0x14], 0x4000000
je 0x14002d38f
bts r8d, 9
mov dword [rsp + 0x58], r8d
mov ecx, dword [rbx - 4]
lea r9, [rsp + 0x58]
mov edx, dword [rbx]
add rcx, rdi
call qword [sym.imp.kernel32.dll_VirtualProtect]
mov edx, 1
mov r9d, 2
mov r10d, 0x10
mov r11d, 0x20
movzx eax, word [r15 + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jb 0x14002d320
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.kernel32.dll_FlushInstructionCache]
mov eax, dword [r15 + 0x28]
add rax, rdi
bt r14d, 0xd
jb 0x14002d402
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov dword [rsp + 0x20], ebp
mov r8, rax
jmp 0x14002d4ab
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call rax
test r12, r12
je 0x14002d4d2
cmp dword [r15 + 0x8c], 0
je 0x14002d4d2
mov r14d, dword [r15 + 0x88]
add r14, rdi
mov eax, dword [r14 + 0x18]
test eax, eax
je 0x14002d4d2
cmp dword [r14 + 0x14], 0
je 0x14002d4d2
mov esi, dword [r14 + 0x20]
mov ebx, dword [r14 + 0x24]
add rsi, rdi
add rbx, rdi
test eax, eax
je 0x14002d4d2
nop dword [rax]
mov edx, dword [rsi]
add rdx, rdi
je 0x14002d4d2
mov rcx, r12
call fcn.140031758
test eax, eax
jne 0x14002d478
test rbx, rbx
jne 0x14002d48a
inc ebp
add rsi, 4
add rbx, 2
cmp ebp, dword [r14 + 0x18]
jb 0x14002d460
jmp 0x14002d4d2
movzx edx, word [rbx]
mov ecx, dword [r14 + 0x1c]
mov r9, qword [rsp + 0x40]
add rcx, rdi
mov r8d, dword [rcx + rdx*4]
add r8, rdi
xor edx, edx
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x14002d4f5
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.kernel32.dll_VirtualFree]
test eax, eax
jne 0x14002d4f0
mov rcx, r13
call qword [sym.imp.kernel32.dll_LocalFree]
mov rax, rdi
jmp 0x14002d4f7
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14002d930
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret