Function at 0x75ea00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov r15, rcx
call fcn.0075e9a0
test eax, eax
je 0x75ea59
lea rcx, [0x009562d2]
call fcn.00766380
mov rdi, rax
test rdi, rdi
jne 0x75ec9f
lea rdx, [0x009562e0]
lea r8, [0x0095631f]
xor ecx, ecx
mov r9d, 0x2001
call sub.USER32_MessageBoxA
jmp 0x75ec9f
test r15, r15
je 0x75ec9d
movzx eax, word [r15]
cmp eax, 0x5a4d
jne 0x75ec9d
mov r14d, dword [r15 + 0x3c]
cmp dword [r15 + r14], 0x4550
jne 0x75ec9d
add r14, r15
mov edx, dword [r14 + 0x50]
xor edi, edi
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call fcn.00766530
mov r12, rax
test r12, r12
je 0x75ec9f
lea rax, [r14 + 0x18]
mov qword [rbp], rax
mov r8d, dword [r14 + 0x54]
add r8d, dword [r15 + 0x3c]
mov rcx, r12
mov rdx, r15
call fcn.0072a120
cmp word [r14 + 6], 0
je 0x75ec74
mov rax, qword [rbp]
sub rax, r15
add rax, r12
movzx edi, word [r14 + 0x14]
add rdi, rax
xor esi, esi
xor r13d, r13d
nop dword [rax]
mov rcx, rdi
lea rdx, [0x0095632c]
call fcn.0072ac30
test eax, eax
cmove r13, rdi
mov ebx, dword [rdi + 0xc]
mov r8d, dword [rdi + 0x10]
add rbx, r12
mov edx, dword [rdi + 0x14]
add rdx, r15
mov rcx, rbx
call fcn.0072a120
mov dword [rdi + 8], ebx
add rdi, 0x28
inc rsi
movzx eax, word [r14 + 6]
cmp rsi, rax
jb 0x75eaf0
test r13, r13
je 0x75ec74
cmp dword [r13 + 0x10], 0
mov rcx, qword [rbp]
je 0x75ebbf
mov eax, dword [r13 + 0x14]
add rax, r15
xor r8d, r8d
nop
mov ebx, dword [rax + 4]
mov edx, 8
cmp rbx, 9
jb 0x75ebb0
nop
movzx edi, word [rax + rdx]
mov ebx, edi
shr ebx, 0xc
and edi, 0xfff
cmp bl, 0xa
je 0x75eb90
cmp bl, 3
jne 0x75eba4
movzx ebx, di
add ebx, dword [rax]
mov edi, dword [rcx + 0x18]
mov esi, r12d
sub esi, edi
add dword [rbx + r12], esi
jmp 0x75eba4
movzx ebx, di
add ebx, dword [rax]
mov rdi, qword [rbx + r12]
add rdi, r12
sub rdi, qword [rcx + 0x18]
mov qword [rbx + r12], rdi
add rdx, 2
mov ebx, dword [rax + 4]
cmp rdx, rbx
jb 0x75eb60
add r8, rdx
add rax, rbx
mov edx, dword [r13 + 0x10]
cmp r8, rdx
jb 0x75eb50
mov esi, dword [rcx + 0x78]
test rsi, rsi
je 0x75ec74
cmp dword [rsi + r12], 0
je 0x75ec74
add rsi, r12
xor edi, edi
movabs r15, 0x7fffffffffffffff
mov rax, rsi
mov qword [rbp - 8], rax
mov r14d, dword [rsi + 0xc]
mov r13d, dword [rsi + 0x10]
add r14, r12
mov rcx, r14
call fcn.00766210
mov rbx, rax
test rbx, rbx
jne 0x75ec1b
mov rcx, r14
call fcn.00766380
mov rbx, rax
test rbx, rbx
je 0x75ec9f
mov esi, dword [rsi]
cmp dword [r12 + rsi], 0
je 0x75ec5f
add r13, r12
add rsi, r12
nop word [rax + rax]
mov rax, qword [rsi]
mov rcx, rax
and rcx, r15
cmp rcx, rax
lea rdx, [r12 + rcx + 2]
cmovne rdx, rcx
mov rcx, rbx
call fcn.00766238
mov qword [r13], rax
add r13, 8
cmp dword [rsi + 8], 0
lea rsi, [rsi + 8]
jne 0x75ec30
mov rax, qword [rbp - 8]
lea rsi, [rax + 0x14]
cmp dword [rax + 0x14], 0
mov rax, rsi
jne 0x75ebe8
mov rax, qword [rbp]
mov esi, dword [rax + 0x10]
add rsi, r12
xor edi, edi
mov edx, 1
xor r8d, r8d
mov rcx, r12
call rsi
test eax, eax
je 0x75ec9f
mov qword [0x010b5f70], rsi
mov rdi, r12
jmp 0x75ec9f
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret