Function at 0x14000cfa0
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rdi
push r15
sub rsp, 0x38
movsxd r15, dword [rcx + 0x3c]
lea r9, [rsp + 0x68]
add r15, rcx
mov dword [rsp + 0x28], 0x40
xor ebx, ebx
mov dword [rsp + 0x20], 0x1000
mov rbp, rcx
xor r8d, r8d
movzx edi, word [r15 + 0x14]
mov qword [rsp + 0x60], rbx
lea rcx, [rbx - 1]
mov eax, dword [r15 + 0x50]
add rdi, 0x2c
mov qword [rdx], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x68], rax
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jns 0x14000d007
xor eax, eax
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret
mov r8d, dword [r15 + 0x54]
mov rdx, rbp
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x30], r14
call fcn.140022ae0
mov esi, ebx
cmp bx, word [r15 + 6]
jae 0x14000d055
add rdi, r15
nop
mov edx, dword [rdi]
mov ecx, dword [rdi - 8]
add rdx, rbp
add rcx, qword [rsp + 0x60]
mov r8d, dword [rdi - 4]
call fcn.140022ae0
movzx eax, word [r15 + 6]
lea rdi, [rdi + 0x28]
inc esi
cmp esi, eax
jl 0x14000d030
mov r8, qword [rsp + 0x60]
mov r9d, dword [r15 + 0xb0]
movsxd r10, dword [r8 + 0x3c]
add r10, r8
movzx eax, word [r10 + 0x14]
lea rdx, [r10 + 0x18]
movzx r11d, word [r10 + 6]
add rdx, rax
lea rax, [r11 + r11*4]
mov ecx, dword [rdx + rax*8 - 0x1c]
add ecx, dword [rdx + rax*8 - 0x18]
mov eax, ecx
cmp rax, r9
jae 0x14000d0a2
lea rcx, str.Out_of_FileSize_range
call fcn.140005ff0
mov r8, qword [rsp + 0x60]
mov r9, rbx
jmp 0x14000d0e0
mov eax, dword [r10 + 0x54]
cmp r9, rax
jb 0x14000d0e0
dec r11d
mov ecx, ebx
test r11d, r11d
jle 0x14000d0d4
mov r10d, dword [rdx + 0xc]
cmp r9, r10
jb 0x14000d0c9
mov eax, dword [rdx + 8]
add eax, r10d
cmp r9, rax
jbe 0x14000d0d4
add rdx, 0x28
inc ecx
cmp ecx, r11d
jl 0x14000d0b5
mov ecx, dword [rdx + 0x14]
mov eax, dword [rdx + 0xc]
sub rcx, rax
add r9, rcx
movsxd r11, dword [r8 + 0x3c]
lea rdi, [r9 + rbp]
mov r10d, dword [r15 + 0x90]
add r11, r8
movzx r9d, word [r11 + 0x14]
movzx esi, word [r11 + 6]
add r9, 0x18
add r9, r11
lea rax, [rsi + rsi*4]
mov edx, dword [r9 + rax*8 - 0x1c]
add edx, dword [r9 + rax*8 - 0x18]
mov eax, edx
cmp rax, r10
jae 0x14000d12b
lea rcx, str.Out_of_FileSize_range
call fcn.140005ff0
mov r8, qword [rsp + 0x60]
jmp 0x14000d16c
mov eax, dword [r11 + 0x54]
cmp r10, rax
jae 0x14000d139
mov rbx, r10
jmp 0x14000d16c
lea edx, [rsi - 1]
test edx, edx
jle 0x14000d15e
mov ecx, dword [r9 + 0xc]
cmp r10, rcx
jb 0x14000d154
mov eax, dword [r9 + 8]
add eax, ecx
cmp r10, rax
jbe 0x14000d15e
add r9, 0x28
inc ebx
cmp ebx, edx
jl 0x14000d140
mov ebx, dword [r9 + 0x14]
mov eax, dword [r9 + 0xc]
sub rbx, rax
add rbx, r10
lea r14, [rbp + 0x10]
add r14, rbx
mov eax, dword [r14]
test eax, eax
je 0x14000d1d9
nop word [rax + rax]
mov ecx, dword [r14 - 4]
mov ebx, eax
add rcx, r8
add rbx, r8
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rbx]
mov rsi, rax
test rcx, rcx
je 0x14000d1c8
jns 0x14000d1a4
movzx edx, cx
jmp 0x14000d1b0
mov rdx, qword [rsp + 0x60]
add rdx, 2
add rdx, rcx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
add rbx, 8
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14000d19d
mov eax, dword [r14 + 0x14]
add r14, 0x14
mov r8, qword [rsp + 0x60]
test eax, eax
jne 0x14000d180
mov r14, qword [rsp + 0x30]
mov r10, r8
sub r10, qword [r15 + 0x30]
cmp dword [rdi + 4], 0
mov rsi, qword [rsp + 0x70]
je 0x14000d24e
cmp dword [rdi], 0
je 0x14000d24e
mov eax, dword [rdi + 4]
lea rdx, [rdi + 8]
sub eax, 8
shr eax, 1
cmp eax, 1
jb 0x14000d242
mov r9d, eax
nop dword [rax]
movzx ecx, word [rdx]
mov eax, ecx
shr ecx, 0xc
and eax, 0xfff
add eax, dword [rdi]
cmp ecx, 3
je 0x14000d22f
cmp ecx, 0xa
jne 0x14000d238
add qword [rax + r8], r10
jmp 0x14000d233
add dword [rax + r8], r10d
mov r8, qword [rsp + 0x60]
add rdx, 2
sub r9, 1
jne 0x14000d210
mov ecx, dword [rdi + 4]
add rdi, rcx
cmp dword [rdi + 4], 0
jne 0x14000d1f0
mov rax, r8
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret