Function at 0x1400e7124
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov rbp, r8
mov edi, edx
mov r12, rcx
cmp edx, 0x40
jb 0x1400e73f3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400e73f3
movsxd rcx, dword [rcx + 0x3c]
lea eax, [rcx + 0x108]
cmp edx, eax
jl 0x1400e73f3
lea rbx, [r12 + rcx]
cmp dword [rbx], 0x4550
jne 0x1400e73f3
mov eax, 0x2000
test word [rbx + 0x16], ax
jne 0x1400e73f3
test byte [rbx + 0x16], 2
je 0x1400e73f3
mov ecx, 0xe0
cmp word [rbx + 0x14], cx
je 0x1400e71b9
lea eax, [rcx + 0x10]
cmp word [rbx + 0x14], ax
jne 0x1400e73f3
cmp word [rbx + 0x14], cx
sete dl
test dl, dl
je 0x1400e71e7
mov al, byte [0x14013a84e]
mov byte [0x14013a84d], 4
mov ecx, pe_nt_image_headers64
mov byte [0x14013e2f9], al
mov al, byte [0x14013a852]
mov byte [0x14013a84c], 0
jmp 0x1400e720c
mov al, byte [0x14013a84f]
mov byte [0x14013a84d], 8
mov ecx, 0x108
mov byte [0x14013e2f9], al
mov al, byte [0x14013a853]
mov byte [0x14013a84c], 0x30
mov byte [0x14013e2f8], al
mov word [0x14013a850], cx
test dl, dl
je 0x1400e726c
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Wow64GetThreadContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x14013e248], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Wow64SetThreadContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov cx, word [0x14013a850]
mov qword [0x14013e250], rax
movsx rsi, cx
mov r8, rbx
mov edx, edi
add rsi, rbx
mov rcx, r12
mov r9, rsi
call fcn.1400e4078
mov r14, qword [rsp + 0x78]
mov qword [r14], rax
mov r11, rax
test rax, rax
je 0x1400e73f3
movzx ecx, word [rbx + 6]
mov r8b, byte [0x14013a84d]
mov edi, dword [rbx + 0x54]
test ecx, ecx
jle 0x1400e72c4
lea rax, [rsi + 0x14]
mov rdx, rcx
cmp dword [rax], 0
je 0x1400e72ba
cmp dword [rax], edi
cmovb edi, dword [rax]
add rax, 0x28
sub rdx, 1
jne 0x1400e72b0
movsxd rax, dword [r12 + 0x3c]
cmp r8b, 4
jne 0x1400e72d6
mov ecx, dword [rax + r12 + 0x34]
jmp 0x1400e72db
mov rcx, qword [rax + r12 + 0x30]
mov ebx, 0x1000
mov r9d, 0x40
mov rdx, r11
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, qword [rsp + 0x70]
mov qword [r13], rax
test rax, rax
jne 0x1400e731f
mov rdx, qword [r14]
lea r9d, [rax + 0x40]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [r13], rax
test rax, rax
je 0x1400e73f3
mov rcx, qword [r13]
mov r8d, edi
mov rdx, r12
call fcn.14001d744
mov r11, qword [r13]
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov qword [rbp], rcx
movsx r9, word [0x14013a850]
add r9, rcx
mov qword [r15], r9
mov dl, byte [0x14013a84d]
cmp dl, 4
jne 0x1400e735b
mov esi, dword [rcx + 0x38]
jmp 0x1400e7362
mov rax, qword [rbp]
mov esi, dword [rax + 0x38]
mov rax, qword [rbp]
movzx r10d, word [rax + 6]
cmp dl, 4
jne 0x1400e7375
mov eax, dword [rcx + 0x54]
jmp 0x1400e7378
mov eax, dword [rax + 0x54]
mov ecx, eax
mov edx, esi
call fcn.1400e4064
mov rbx, rax
movzx eax, r10w
add rbx, qword [r13]
test eax, eax
jle 0x1400e73ec
xor edi, edi
mov rbp, rax
mov eax, dword [rdi + r9 + 0xc]
test eax, eax
je 0x1400e73a5
mov rbx, rax
add rbx, qword [r13]
mov eax, dword [rdi + r9 + 0x10]
test eax, eax
je 0x1400e73d3
mov edx, dword [rdi + r9 + 0x14]
mov r8, rax
mov rcx, rbx
add rdx, r12
call fcn.14001d744
mov r9, qword [r15]
mov eax, dword [rdi + r9 + 0x10]
mov rcx, rax
cmp dword [rdi + r9 + 8], eax
jb 0x1400e73d8
mov ecx, dword [rdi + r9 + 8]
mov edx, esi
call fcn.1400e4064
add rdi, 0x28
add rbx, rax
sub rbp, 1
jne 0x1400e7395
mov eax, 1
jmp 0x1400e73f5
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret