Function at 0x1408763a0
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push rdi
push r12
push r14
sub rsp, 0x70
mov rax, qword [0x14089d020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r12, r8
mov r14, rdx
mov rdi, rcx
call fcn.140875ce0
test rax, rax
je 0x140876654
mov qword [rsp + 0xa8], rbx
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x60], rsi
call fcn.1408762c0
test rax, rax
je 0x1408765f6
cmp word [rax + 2], 0
je 0x1408765f6
xor esi, esi
mov qword [rsp + 0x50], r15
mov rcx, rdi
mov r15d, esi
lea edx, [rsi + 5]
call fcn.140875fa0
test rax, rax
jne 0x140876421
mov rcx, rdi
call fcn.1408760b0
mov r15, rax
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r13
test rdi, rdi
je 0x1408765df
mov edx, 0x40
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x1408765df
mov r13d, 0x5a4d
cmp word [rdi], r13w
jne 0x1408765df
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x1408765df
lea rbp, [rdi + rax]
mov edx, 0xf8
mov rcx, rbp
call fcn.1408772a0
test al, al
jne 0x1408765df
cmp dword [rbp], 0x4550
jne 0x1408765df
mov edx, 0x40
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x1408764da
cmp word [rdi], r13w
jne 0x1408764da
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x1408764da
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.1408772a0
test al, al
jne 0x1408764da
cmp dword [rbx], 0x4550
jne 0x1408764da
mov edx, 0xf8
mov rcx, rbx
call fcn.1408772a0
mov ebp, dword [rbp + 0x50]
test rbp, rbp
je 0x1408765df
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x1408765df
mov r9d, ebp
mov r8, rax
mov rdx, r14
mov rcx, rdi
call fcn.140876670
test al, al
je 0x1408765df
mov rcx, rbx
mov qword [r12], rbp
call fcn.1408760b0
mov r14, rax
cmp rbx, rax
je 0x1408765e2
mov edx, 0x40
mov rcx, rbx
call fcn.1408772a0
test al, al
jne 0x140876595
cmp word [rbx], r13w
jne 0x140876595
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140876595
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x140876595
cmp dword [rdi], 0x4550
jne 0x140876595
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
je 0x14087658f
movzx eax, si
jmp 0x140876597
movzx eax, word [rdi + 0x18]
jmp 0x140876597
mov eax, esi
mov ecx, 0x20b
mov qword [rsp + 0x30], r14
cmp ax, cx
mov qword [rsp + 0x38], rbx
lea rax, vtable.ApplyRelocCallback.0
mov rdx, rbp
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, rbx
sete byte [rsp + 0x28]
call fcn.140876930
test al, al
jne 0x1408765e2
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, rsi
mov r15, qword [rsp + 0x50]
mov rax, rbx
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
jmp 0x140876647
mov rcx, rdi
call fcn.1408760b0
mov rcx, rdi
mov rsi, rax
call fcn.1408761a0
mov ebx, eax
test eax, eax
je 0x140876642
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x140876642
mov r8, r14
mov rdx, rdi
mov rcx, rax
call fcn.14087bcc0
mov qword [r12], rbx
jmp 0x140876644
xor esi, esi
mov rax, rsi
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140879db0
add rsp, 0x70
pop r14
pop r12
pop rdi
ret