Function at 0x140008e20
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push rdi
push r12
push r14
sub rsp, 0x70
mov rax, qword [0x14012aab8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r12, r8
mov r14, rdx
mov rdi, rcx
call fcn.140008760
test rax, rax
je 0x1400090d4
mov qword [rsp + 0xa8], rbx
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x60], rsi
call fcn.140008d40
test rax, rax
je 0x140009076
cmp word [rax + 2], 0
je 0x140009076
xor esi, esi
mov qword [rsp + 0x50], r15
mov rcx, rdi
mov r15d, esi
lea edx, [rsi + 5]
call fcn.140008a20
test rax, rax
jne 0x140008ea1
mov rcx, rdi
call fcn.140008b30
mov r15, rax
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r13
test rdi, rdi
je 0x14000905f
mov edx, 0x40
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x14000905f
mov r13d, 0x5a4d
cmp word [rdi], r13w
jne 0x14000905f
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000905f
lea rbp, [rdi + rax]
mov edx, 0xf8
mov rcx, rbp
call fcn.140009d00
test al, al
jne 0x14000905f
cmp dword [rbp], 0x4550
jne 0x14000905f
mov edx, 0x40
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008f5a
cmp word [rdi], r13w
jne 0x140008f5a
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140008f5a
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x140008f5a
cmp dword [rbx], 0x4550
jne 0x140008f5a
mov edx, 0xf8
mov rcx, rbx
call fcn.140009d00
mov ebp, dword [rbp + 0x50]
test rbp, rbp
je 0x14000905f
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14000905f
mov r9d, ebp
mov r8, rax
mov rdx, r14
mov rcx, rdi
call fcn.1400090f0
test al, al
je 0x14000905f
mov rcx, rbx
mov qword [r12], rbp
call fcn.140008b30
mov r14, rax
cmp rbx, rax
je 0x140009062
mov edx, 0x40
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x140009015
cmp word [rbx], r13w
jne 0x140009015
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140009015
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140009015
cmp dword [rdi], 0x4550
jne 0x140009015
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
je 0x14000900f
movzx eax, si
jmp 0x140009017
movzx eax, word [rdi + 0x18]
jmp 0x140009017
mov eax, esi
mov ecx, 0x20b
mov qword [rsp + 0x30], r14
cmp ax, cx
mov qword [rsp + 0x38], rbx
lea rax, vtable.ApplyRelocCallback.0
mov rdx, rbp
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, rbx
sete byte [rsp + 0x28]
call fcn.1400093b0
test al, al
jne 0x140009062
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, rsi
mov r15, qword [rsp + 0x50]
mov rax, rbx
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
jmp 0x1400090c7
mov rcx, rdi
call fcn.140008b30
mov rcx, rdi
mov rsi, rax
call fcn.140008c20
mov ebx, eax
test eax, eax
je 0x1400090c2
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x1400090c2
mov r8, r14
mov rdx, rdi
mov rcx, rax
call fcn.1400459a0
mov qword [r12], rbx
jmp 0x1400090c4
xor esi, esi
mov rax, rsi
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400439e0
add rsp, 0x70
pop r14
pop r12
pop rdi
ret