Function at 0x140059860
Capabilities:
Allocate or change rwx memory
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov r13d, r8d
mov r12, rdx
mov r8, rcx
xor ecx, ecx
mov qword [r11 - 0x80], rcx
mov esi, ecx
mov qword [r11 - 0x78], rcx
xor dl, dl
mov byte [r11 + 0x20], dl
mov byte [rsp + 0x30], dl
mov eax, ecx
mov qword [r8], rcx
mov r15, r12
mov qword [r11 - 0x80], r12
mov ecx, 0x5a4d
cmp word [r12], cx
jne 0x140059926
movsxd rsi, dword [r12 + 0x3c]
add rsi, r12
mov qword [r11 - 0x78], rsi
cmp dword [rsi], 0x4550
jne 0x140059926
test byte [rsi + 0x38], 1
jne 0x140059926
cmp dword [rsi + 0xfc], 0
je 0x1400598e8
cmp dword [rsi + 0xf8], 0
je 0x1400598e8
mov dl, 1
jmp 0x1400598ea
xor dl, dl
mov byte [rsp + 0xf8], dl
mov byte [rsp + 0x30], dl
mov ecx, 0x8664
mov edi, 0x2000
mov ebx, 0xc000007b
cmp word [rsi + 4], cx
je 0x140059915
mov eax, 0x4000000e
mov dword [rsp + 0x34], eax
jmp 0x140059936
test word [rsi + 0x16], di
jne 0x140059936
mov eax, 0xc00000bb
mov dword [rsp + 0x34], eax
jmp 0x140059936
mov ebx, 0xc000007b
mov edi, 0x2000
mov dword [rsp + 0x34], ebx
mov eax, ebx
jmp 0x14005996c
test eax, eax
js 0x140059eca
cmp eax, 0x4000000e
je 0x140059eca
mov edx, dword [rsi + 0x50]
mov r9d, 4
mov r8d, 0x1000
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400599ca
test byte [rsi + 0x5e], 0x40
je 0x1400599ca
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140059a09
mov ecx, dword [0x1406f4b2c]
lea edx, [rcx + 0x39]
add edx, dword [rsi + 0x54]
lea eax, [rcx - 1]
not eax
and rdx, rax
mov r9d, 4
mov r8d, 0x1000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, r14
test rax, rax
jne 0x140059a13
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0xc0000017
jmp 0x140059eca
movsxd rax, dword [r15 + 0x3c]
add rax, r14
mov qword [rsp + 0x38], rax
mov r8d, dword [rsi + 0x54]
mov rdx, r15
call fcn.14011c9b0
mov r10, qword [rsp + 0x38]
mov qword [r10 + 0x30], r14
mov edi, dword [rsi + 0x54]
add rdi, r14
mov qword [rsp + 0x40], rdi
xor eax, eax
mov qword [rdi + 8], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x10], r14
mov dword [rdi + 0x30], r13d
movabs rax, 0xaabbcc11ffee00
mov qword [rdi], rax
mov eax, dword [rsi + 0x54]
mov dword [rdi + 8], eax
mov qword [rdi + 0x18], r12
movzx eax, word [r10 + 0x14]
xor ecx, ecx
mov r15d, ecx
cmp cx, word [r10 + 6]
jae 0x140059b06
lea rdi, [r10 + 0x28]
add rdi, rax
mov ecx, dword [r10 + 0x38]
mov edx, dword [rdi - 8]
inc edx
add edx, ecx
lea eax, [rcx - 1]
not eax
and edx, eax
cmp edx, dword [rdi]
jb 0x140059ec0
mov ecx, dword [rdi - 4]
add rcx, qword [r10 + 0x30]
mov r9d, 4
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140059afc
mov ecx, dword [rdi]
test ecx, ecx
je 0x140059adf
mov r8d, ecx
mov edx, dword [rdi + 4]
add rdx, r12
mov rcx, rax
call fcn.14011c9b0
inc r15d
add rdi, 0x28
mov r10, qword [rsp + 0x38]
movzx eax, word [r10 + 6]
cmp r15d, eax
jb 0x140059a90
mov rdi, qword [rsp + 0x40]
jmp 0x140059b06
mov ebx, 0xc0000017
jmp 0x140059ec0
mov r11, qword [r10 + 0x30]
sub r11, qword [rsi + 0x30]
je 0x140059bbd
mov eax, dword [r10 + 0xb0]
lea r8, [r14 + rax]
xor r12d, r12d
cmp dword [r10 + 0xb4], r12d
je 0x140059bc0
test eax, eax
je 0x140059bc0
cmp dword [r8], r12d
jbe 0x140059bc0
lea r9, [r8 + 8]
mov r10d, r12d
mov eax, dword [r8 + 4]
sub eax, 8
test eax, 0xfffffffe
jbe 0x140059baa
nop word [rax + rax]
movzx eax, word [r9]
mov ecx, eax
shr ecx, 0xc
cmp ecx, 3
je 0x140059b85
cmp ecx, 0xa
jne 0x140059b95
and eax, 0xfff
mov edx, dword [r8]
lea rcx, [r14 + rax]
add qword [rdx + rcx], r11
jmp 0x140059b95
and eax, 0xfff
mov edx, dword [r8]
lea rcx, [r14 + rax]
add dword [rdx + rcx], r11d
inc r10d
add r9, 2
mov eax, dword [r8 + 4]
sub eax, 8
shr eax, 1
cmp r10d, eax
jb 0x140059b60
mov eax, dword [r8 + 4]
add r8, rax
cmp dword [r8], r12d
ja 0x140059b40
mov r10, qword [rsp + 0x38]
jmp 0x140059bc0
xor r12d, r12d
mov r15, r12
mov r13d, r12d
lea rcx, [r10 + 0x90]
mov rax, r12
mov qword [rsp + 0x68], rax
mov ebx, r12d
mov dword [rsp + 0x34], ebx
test rcx, rcx
je 0x140059bfe
cmp dword [rcx + 4], 0
je 0x140059bfe
mov r15d, dword [rcx]
add r15, qword [r10 + 0x30]
mov qword [rsp + 0x88], r15
mov rax, r15
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140059c1c
cmp dword [rax + 0xc], 0
je 0x140059c1c
inc r13d
mov dword [rsp + 0x70], r13d
add rax, 0x14
mov qword [rsp + 0x68], rax
jmp 0x140059c03
test r15, r15
je 0x140059d47
test r13d, r13d
je 0x140059d47
mov esi, r13d
mov eax, 8
mul rsi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ec130
mov qword [rdi + 0x20], rax
test rax, rax
jne 0x140059c63
mov ebx, 0xc0000017
mov dword [rsp + 0x34], ebx
jmp 0x140059ec0
lea r8, [rsi*8]
xor edx, edx
mov rcx, rax
call fcn.14011d670
mov eax, r12d
mov dword [rsp + 0x48], eax
cmp eax, r13d
jae 0x140059d3f
mov ecx, dword [r15 + 0xc]
add rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
test rax, rax
jne 0x140059ca4
mov ebx, 0xc0000135
jmp 0x140059d3b
mov ecx, dword [rdi + 0x28]
mov rax, qword [rdi + 0x20]
mov qword [rax + rcx*8], r12
inc dword [rdi + 0x28]
mov eax, dword [r15]
test eax, eax
jne 0x140059cbd
mov eax, dword [r15 + 0x10]
mov edi, eax
add rdi, r14
mov qword [rsp + 0x78], rdi
mov esi, dword [r15 + 0x10]
add rsi, r14
mov qword [rsp + 0x80], rsi
mov rax, qword [rdi]
test rax, rax
je 0x140059d1b
jns 0x140059ce5
movzx edx, ax
jmp 0x140059cec
lea rdx, [r14 + 2]
add rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi], rax
test rax, rax
jne 0x140059d04
mov ebx, 0xc0000139
jmp 0x140059d3b
add rdi, 8
mov qword [rsp + 0x78], rdi
add rsi, 8
mov qword [rsp + 0x80], rsi
jmp 0x140059cd6
test ebx, ebx
js 0x140059d3f
mov eax, dword [rsp + 0x48]
inc eax
add r15, 0x14
mov qword [rsp + 0x88], r15
mov rdi, qword [rsp + 0x40]
jmp 0x140059c78
mov dword [rsp + 0x34], ebx
mov r10, qword [rsp + 0x38]
xor r12d, r12d
or r11, 0xffffffffffffffff
mov rsi, qword [rsp + 0x40]
movzx r15d, byte [rsp + 0xf8]
jmp 0x140059d7d
test ebx, ebx
jns 0x140059dbd
mov edi, r12d
cmp dword [rsi + 0x28], 0
jbe 0x140059da7
nop word [rax + rax]
mov eax, edi
mov rcx, qword [rsi + 0x20]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
inc edi
cmp edi, dword [rsi + 0x28]
jb 0x140059d90
mov rcx, qword [rsi + 0x20]
call fcn.1400ec138
mov qword [rsi + 0x20], r12
mov dword [rsi + 0x28], r12d
jmp 0x140059ec0
movzx eax, word [r10 + 0x14]
cmp r12w, word [r10 + 6]
jae 0x140059ea8
lea rdi, [r10 + 0x3c]
add rdi, rax
lea rsi, [0x1406e7b88]
nop dword [rax + rax]
mov r9d, dword [rdi - 0x18]
add r9, r14
mov qword [rsp + 0x90], r9
mov ecx, dword [r10 + 0x38]
mov edx, dword [rdi - 0x1c]
inc rdx
add rdx, rcx
lea rax, [rcx - 1]
not rax
and rdx, rax
mov qword [rsp + 0x40], rdx
mov r8d, dword [rdi]
bt r8d, 0x19
jae 0x140059e2b
test r15b, r15b
jne 0x140059e2b
mov r8d, 0x4000
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140059e87
mov rcx, r8
shr rcx, 0x1d
and ecx, 1
mov rax, r8
shr rax, 0x1e
and eax, 1
lea rcx, [rax + rcx*2]
mov rax, r8
shr rax, 0x1f
lea rcx, [rax + rcx*2]
mov r9d, dword [rsi + rcx*4]
bt r8d, 0x1a
jae 0x140059e5e
bts r9d, 9
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x90]
mov rcx, r11
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov ebx, eax
test eax, eax
js 0x140059ea8
inc r12d
add rdi, 0x28
mov r10, qword [rsp + 0x38]
movzx eax, word [r10 + 6]
cmp r12d, eax
mov r11, 0xffffffffffffffff
jb 0x140059de0
test ebx, ebx
js 0x140059ec0
mov rax, qword [rsp + 0xe0]
mov qword [rax], r14
jmp 0x140059ec8
mov rcx, r14
call fcn.140059ef0
mov eax, ebx
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret