Function at 0x140004050
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push rdi
push r12
push r14
sub rsp, 0x70
mov rax, qword [0x140282a80]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r12, r8
mov r14, rdx
mov rdi, rcx
call fcn.140003950
test rax, rax
je 0x14000432a
mov qword [rsp + 0xa8], rbx
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x60], rsi
call fcn.140003f60
test rax, rax
je 0x1400042cc
cmp word [rax + 2], 0
je 0x1400042cc
xor ebx, ebx
mov qword [rsp + 0x50], r15
mov edx, 5
mov rcx, rdi
mov r15d, ebx
call fcn.140003c20
test rax, rax
jne 0x1400040d3
mov rcx, rdi
call fcn.140003d30
mov r15, rax
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r13
test rdi, rdi
je 0x1400042bb
mov edx, 0x40
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x1400042bb
mov r13d, 0x5a4d
cmp word [rdi], r13w
jne 0x1400042bb
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x1400042bb
lea rbp, [rdi + rax]
mov edx, 0xf8
mov rcx, rbp
call fcn.140004f00
test al, al
jne 0x1400042bb
cmp dword [rbp], 0x4550
jne 0x1400042bb
test rbp, rbp
je 0x1400042bb
mov edx, 0x40
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x14000419a
cmp word [rdi], r13w
jne 0x14000419a
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000419a
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140004f00
test al, al
jne 0x14000419a
cmp dword [rsi], 0x4550
jne 0x14000419a
test rsi, rsi
je 0x14000419a
mov edx, 0xf8
mov rcx, rsi
call fcn.140004f00
mov ebp, dword [rbp + 0x50]
test rbp, rbp
je 0x1400042bb
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x1400042bb
mov r9d, ebp
mov r8, rax
mov rdx, r14
mov rcx, rdi
call fcn.140004350
test al, al
je 0x1400042bb
mov rcx, rsi
mov qword [r12], rbp
call fcn.140003d30
mov r14, rax
cmp rsi, rax
jne 0x14000420d
mov r15, qword [rsp + 0x50]
mov rbx, rsi
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
jmp 0x14000431a
mov edx, 0x40
mov rcx, rsi
call fcn.140004f00
test al, al
jne 0x14000426d
cmp word [rsi], r13w
jne 0x14000426d
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x14000426d
lea rdi, [rsi + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x14000426d
cmp dword [rdi], 0x4550
jne 0x14000426d
test rdi, rdi
je 0x14000426d
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
je 0x140004267
movzx eax, bx
jmp 0x14000426f
movzx eax, word [rdi + 0x18]
jmp 0x14000426f
mov eax, ebx
mov ecx, 0x20b
mov qword [rsp + 0x30], r14
cmp ax, cx
mov qword [rsp + 0x38], rsi
lea rax, vtable.ApplyRelocCallback.0
mov rdx, rbp
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, rsi
sete byte [rsp + 0x28]
call fcn.1400045a0
test al, al
jne 0x1400041f6
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
jmp 0x14000431a
mov rcx, rdi
call fcn.140003d30
mov rcx, rdi
mov rbx, rax
call fcn.140003e40
mov esi, eax
test eax, eax
je 0x140004318
mov r9d, 0x40
mov r8d, 0x3000
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x140004318
mov r8, r14
mov rdx, rdi
mov rcx, rax
call fcn.1400374c0
mov qword [r12], rsi
jmp 0x14000431a
xor ebx, ebx
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002e100
add rsp, 0x70
pop r14
pop r12
pop rdi
ret