Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x40
mov r12, r9
mov r13, r8
mov edi, edx
mov r15, rcx
cmp edx, 0x40
jb 0x140001363
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001363
movsxd rcx, dword [rcx + 0x3c]
lea eax, [rcx + 0x108]
cmp edx, eax
jl 0x140001363
cmp dword [r15 + rcx], 0x4550
lea rbx, [r15 + rcx]
jne 0x140001363
movzx eax, word [rbx + 0x16]
bt ax, 0xd
jb 0x140001363
test al, 2
je 0x140001363
mov eax, 0xf0
cmp word [rbx + 0x14], ax
jne 0x140001363
mov r9d, dword [rbx + 0x38]
xor edx, edx
mov r8d, dword [rbx + 0x54]
xor esi, esi
dec r8d
add r8d, r9d
mov eax, r8d
div r9d
movzx eax, word [rbx + 6]
sub r8d, edx
cmp si, ax
jae 0x140001133
mov ebp, eax
lea r10, [rbx + 0x118]
mov r11d, esi
nop word [rax + rax]
mov ecx, dword [r10 + 4]
mov edx, dword [r10]
add ecx, edx
cmp ecx, edi
ja 0x140001359
mov eax, dword [r10 - 4]
test eax, eax
je 0x140001109
mov ecx, dword [r10 - 8]
lea r8d, [r9 - 1]
test ecx, ecx
je 0x1400010f7
add eax, ecx
xor edx, edx
add r8d, eax
mov eax, r8d
div r9d
sub r8d, edx
jmp 0x140001127
add eax, edx
xor edx, edx
add r8d, eax
mov eax, r8d
div r9d
sub r8d, edx
jmp 0x140001127
mov eax, dword [r10 - 8]
lea ecx, [r9 - 1]
cmp eax, edx
jae 0x140001119
add ecx, edx
jmp 0x14000111b
add ecx, eax
mov eax, ecx
xor edx, edx
div r9d
sub ecx, edx
add r8d, ecx
inc r11
add r10, 0x28
cmp r11, rbp
jl 0x1400010c0
mov rax, qword [rsp + 0x98]
mov dword [rax], r8d
test r8d, r8d
je 0x140001363
xor ecx, ecx
mov edx, r8d
mov r8d, 0x1000
mov qword [rsp + 0x70], r14
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, qword [rsp + 0x90]
mov r14, rax
mov qword [rcx], rax
test rax, rax
je 0x1400013a3
movzx r8d, word [rbx + 6]
mov edx, esi
mov ecx, dword [rbx + 0x54]
cmp r8d, 8
jb 0x1400012a8
cmp dword [0x140005018], 2
jl 0x1400012a8
movd xmm4, ecx
mov eax, 0xfffffff8
movaps xmmword [rsp + 0x30], xmm6
mov ecx, r8d
pshufd xmm4, xmm4, 0
and rcx, rax
movaps xmmword [rsp + 0x20], xmm7
lea rax, [rbx + 0x16c]
movdqa xmm7, xmmword [0x140003420]
movdqa xmm5, xmm4
mov r9, rsi
xorps xmm6, xmm6
movd xmm1, dword [rax + 0x28]
add edx, 8
movd xmm0, dword [rax - 0x28]
add r9, 8
movd xmm2, dword [rax]
movd xmm3, dword [rax - 0x50]
lea rax, [rax + 0x140]
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
movdqa xmm0, xmm4
punpcklqdq xmm3, xmm2
movd xmm2, dword [rax - 0xa0]
pminud xmm0, xmm3
movdqa xmm1, xmm3
movd xmm3, dword [rax - 0xf0]
pcmpeqd xmm1, xmm6
pandn xmm1, xmm7
pand xmm0, xmm1
pandn xmm1, xmm4
movdqa xmm4, xmm0
movd xmm0, dword [rax - 0xc8]
punpckldq xmm3, xmm0
por xmm4, xmm1
movd xmm1, dword [rax - 0x78]
movdqa xmm0, xmm5
punpckldq xmm2, xmm1
punpcklqdq xmm3, xmm2
movdqa xmm1, xmm3
pminud xmm0, xmm3
pcmpeqd xmm1, xmm6
pandn xmm1, xmm7
pand xmm0, xmm1
pandn xmm1, xmm5
movdqa xmm5, xmm0
por xmm5, xmm1
cmp r9, rcx
jl 0x1400011d0
movaps xmm7, xmmword [rsp + 0x20]
pminud xmm4, xmm5
movaps xmm6, xmmword [rsp + 0x30]
movdqa xmm0, xmm4
psrldq xmm0, 8
pminud xmm4, xmm0
movdqa xmm0, xmm4
psrldq xmm0, 4
pminud xmm4, xmm0
movd ecx, xmm4
movsxd r9, edx
cmp r9, r8
jge 0x1400012d7
lea rax, [r9 + r9*4]
sub r8, r9
lea rdx, [rbx + 0x11c]
lea rdx, [rdx + rax*8]
mov eax, dword [rdx]
test eax, eax
je 0x1400012cd
cmp eax, ecx
cmovb ecx, eax
add rdx, 0x28
sub r8, 1
jne 0x1400012c2
mov r8d, ecx
mov rdx, r15
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
movsxd rbp, dword [r14 + 0x3c]
xor edx, edx
add rbp, r14
mov qword [r13], rbp
mov r8d, dword [rbp + 0x38]
lea rbx, [rbp + 0x108]
mov ecx, dword [rbp + 0x54]
dec ecx
mov qword [r12], rbx
add ecx, r8d
mov eax, ecx
div r8d
sub ecx, edx
mov edi, ecx
add rdi, r14
cmp si, word [rbp + 6]
jae 0x1400013a3
add rbx, 0x10
mov eax, dword [rbx - 4]
test eax, eax
je 0x14000132e
lea rdi, [r14 + rax]
mov eax, dword [rbx]
test eax, eax
je 0x14000137f
mov edx, dword [rbx + 4]
mov r8d, eax
add rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [rbx - 8]
xor edx, edx
mov ecx, dword [rbx]
mov r8d, dword [rbp + 0x38]
cmp eax, ecx
jb 0x140001384
lea ecx, [rax - 1]
jmp 0x140001386
mov rax, qword [rsp + 0x98]
mov dword [rax], esi
xor eax, eax
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
mov ecx, dword [rbx - 8]
xor edx, edx
dec ecx
add ecx, r8d
inc esi
mov eax, ecx
add rbx, 0x28
div r8d
sub ecx, edx
mov eax, ecx
add rdi, rax
movzx eax, word [rbp + 6]
cmp esi, eax
jl 0x140001323
mov r14, qword [rsp + 0x70]
mov eax, 1
jmp 0x140001365