Function at 0x1400071d8
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rsi
sub rsi, rsi
push rbp
adc bpl, spl
sub si, si
push rdi
movzx rbp, r10w
sar dil, 0xcb
test ebx, r10d
push r15
movsx si, spl
xadd rsi, r15
lea rbp, [rsp - 0x47]
btr r15, 0xa3
cmp bl, r15b
shr si, cl
sub rsp, 0x90
movsx edi, sp
mov r15d, 0x5a4d
bts di, si
mov rsi, rdx
rol dil, cl
sar dil, cl
shrd edi, esi, 0x11
mov rdi, rcx
cmp word [rcx], r15w
jmp 0x14000723b
jne 0x140007799
sub r8d, r8d
cmp rcx, 0xffffffffffffffff
jmp 0x14000724d
je 0x140007269
mov eax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jmp 0x140007264
cmove r8, rax
clc
cmp dword [r8], 0x4550
jmp 0x140007275
jne 0x140007799
mov ecx, dword [r8 + 0x38]
shl ah, 0x39
adc r9b, dl
xor edx, edx
xchg al, r9b
mov r8d, dword [r8 + 0x50]
dec r8d
mov qword [rsp + 0xb8], rbx
cwde
add r8d, ecx
movsx rax, r11w
mov eax, r8d
div ecx
xor r9w, 0x381e
and r9d, r15d
xor ecx, ecx
movsx r9w, dil
sub r8d, edx
movzx r9, r8w
mov edx, r8d
movsxd r9, r8d
mov r8d, 0x1000
xchg r9d, r9d
mov dword [rbp + 0x67], edx
not r9w
lea r9d, [rcx + 4]
jmp 0x1400072dc
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
cmp r14b, dl
test rax, rax
jmp 0x1400072f0
jne 0x14000746d
movabs rax, 0x604aa1438440e518
jmp 0x140007308
lea r8, [0x1400030f0]
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x19]
movabs rax, 0xa92be30f9b22292f
movsxd rcx, edi
btc ecx, 0xd6
movabs rcx, 0x397bf255dd8bb705
test r8b, 0x63
cmp ax, r12w
clc
mov qword [rbp - 0x11], rax
xor r9d, r9d
jmp 0x140007347
movdqa xmm0, xmmword [rbp - 0x19]
movabs rax, 0x684267d036c53ba
jmp 0x14000735b
mov qword [rbp + 0x17], rcx
movabs rcx, 0xf85868f89b02a40a
jmp 0x14000736e
mov qword [rbp - 9], rax
mov ah, 0x56
xchg al, ah
movabs rax, 0x7f04e3f74c7783ab
mov qword [rbp + 0x1f], rcx
movabs rcx, 0x97494daf642cc657
jmp 0x140007394
pxor xmm0, xmmword [rbp + 0x17]
mov qword [rbp - 1], rax
movabs rax, 0xc242dac1dc90938e
jmp 0x1400073ac
movdqa xmm1, xmmword [rbp - 9]
mov qword [rbp + 0x27], rcx
not ch
mov cl, r13b
xchg rcx, rcx
movabs rcx, 0xf4d1b27a1879d784
mov qword [rbp + 7], rax
not ax
cwde
movabs rax, 0x5f5cf9741afa929e
jmp 0x1400073de
mov qword [rbp + 0x2f], rcx
movabs rcx, 0xc242dac1dc9093b9
pxor xmm1, xmmword [rbp + 0x27]
mov qword [rbp + 0xf], rax
jmp 0x1400073fa
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x37], rcx
xor ecx, ecx
mov qword [rbp + 0x3f], rax
jmp 0x140007413
pxor xmm0, xmmword [rbp + 0x37]
movdqa xmmword [rbp + 7], xmm0
movdqa xmmword [rbp - 9], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0xb8]
bts bp, r10w
dec dil
shld r15d, esp, 0xe8
mov rsi, qword [rsp + 0xc8]
bt r15w, 0x2a
add rsp, 0x90
xchg di, bp
cmovge ebp, esp
pop r15
bswap bp
pop rdi
movsx rbp, r11w
setnp bpl
movsxd rbp, r11d
pop rbp
ret
mov r8, rbx
movsx ecx, ax
lea rdx, [rbp + 0x67]
movzx ecx, ax
cmovl rcx, r8
mov rcx, rdi
jmp 0x140007486
call fcn.140006a88
test al, al
jne 0x140007612
movabs rax, 0x604aa1438440e518
lea r8, [0x1400030f0]
rcr dh, cl
mov qword [rbp - 0x19], rax
movzx ax, dil
lea rdx, [rbp - 0x19]
btc eax, ebp
movabs rax, 0xa92be30f9b22292f
bt cx, bp
movzx rcx, r12w
movabs rcx, 0x397bf255dd8bb705
clc
mov qword [rbp - 0x11], rax
stc
cmp r15w, bx
jmp 0x1400074e1
xor r9d, r9d
jmp 0x1400074e9
movdqa xmm0, xmmword [rbp - 0x19]
movabs rax, 0x684267d036c53ba
jmp 0x1400074fd
mov qword [rbp + 0x17], rcx
movabs rcx, 0xf85868f89b02a40a
mov qword [rbp - 9], rax
movsx eax, r9w
movabs rax, 0x7f04e3f74c7783ab
jmp 0x140007522
mov qword [rbp + 0x1f], rcx
movsx ecx, bx
movabs rcx, 0x97494daf642cc657
jmp 0x140007538
pxor xmm0, xmmword [rbp + 0x17]
mov qword [rbp - 1], rax
movabs rax, 0xc242dac1dc909381
movdqa xmm1, xmmword [rbp - 9]
mov qword [rbp + 0x27], rcx
mov cx, r12w
movabs rcx, 0xf4d1b27a1879d784
jmp 0x140007567
mov qword [rbp + 7], rax
setae al
movabs rax, 0x5f5cf9741afa929e
jmp 0x14000757d
mov qword [rbp + 0x2f], rcx
bswap rcx
movabs rcx, 0xc242dac1dc9093b9
jmp 0x140007593
pxor xmm1, xmmword [rbp + 0x27]
mov qword [rbp + 0xf], rax
jmp 0x1400075a1
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x37], rcx
sub ecx, ecx
jmp 0x1400075b6
mov qword [rbp + 0x3f], rax
jmp 0x1400075bf
pxor xmm0, xmmword [rbp + 0x37]
movdqa xmmword [rbp + 7], xmm0
movdqa xmmword [rbp - 9], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
movzx ecx, si
movsx ecx, r12w
mov r8d, 0x8000
bswap cx
jmp 0x1400075ed
mov rcx, rbx
jmp 0x1400075f5
call qword [sym.imp.KERNEL32.dll_VirtualFree]
sub ebx, ebx
mov eax, edi
bswap ax
movzx ax, ch
mov eax, ebx
jmp 0x14000760d
jmp 0x14000742a
test rsi, rsi
jmp 0x14000761a
je 0x14000762e
mov eax, dword [rbp + 0x67]
mov dword [rsi], eax
shl cl, cl
movzx cx, al
sets ch
xor edx, edx
bswap rcx
movzx cx, cl
mov rcx, rbx
call fcn.1400063a9
test eax, eax
jmp 0x140007646
jne 0x1400075d4
mov rcx, rbx
jmp 0x140007654
call fcn.140006e1b
test eax, eax
jmp 0x140007660
je 0x1400075d4
mov r8d, 3
movsxd r9, esi
movsx cx, al
mov dword [rbp + 0x67], 0
lea r9, [rbp + 0x67]
movsx cx, r14b
movsx ecx, r10w
movzx cx, r9b
mov rcx, rbx
jmp 0x140007694
call section..code0
mov r9, rax
test rax, rax
jmp 0x1400076a4
je 0x1400076f8
mov ecx, dword [rbp + 0x67]
cmc
clc
test ecx, ecx
jmp 0x1400076b6
je 0x1400076f8
movabs rax, 0xaaaaaaaaaaaaaaab
mov r8, rbx
sar rdx, 0x8c
mul rcx
btr cx, 0xeb
or cl, 0xaf
mov rcx, r9
cmp sil, r12b
shr rdx, 3
jmp 0x1400076e7
call qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
movzx eax, al
test eax, eax
je 0x1400075d4
sub eax, eax
stc
cmp rbx, 0xffffffffffffffff
jmp 0x140007704
je 0x140007740
cmp word [rbx], r15w
jmp 0x140007713
jne 0x140007740
mov ecx, dword [rbx + 0x3c]
lea rcx, [rcx + rbx]
cmp bpl, spl
jmp 0x140007728
cmp dword [rcx], 0x4550
jmp 0x140007733
jne 0x140007740
mov rax, rcx
cdq
movsxd r8, r14d
mov dword [rbp + 0x77], 0
movzx r8d, dx
mov r8w, bx
mov r9, 0x77c254a4
lea r9, [rbp + 0x77]
movzx r8w, r11b
mov r8b, bpl
mov r8b, 0x2d
mov edx, dword [rax + 0x50]
xchg r8, rcx
mov r8d, 0x40
mov rcx, rbx
jmp 0x140007779
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbx
jmp 0x140007787
call fcn.140006fa9
mov rax, rbx
jmp 0x140007794
jmp 0x14000742a
movabs rax, 0x604aa1438440e518
and ch, 0xd9
lea r8, [0x1400030f0]
rcr dl, cl
mov qword [rbp - 0x19], rax
movsxd rax, ecx
sar cl, 0xf3
lea rdx, [rbp - 0x19]
cmp r8w, 0x40b7
movabs rax, 0xa92be30f9b22292f
shr rcx, cl
sar cl, 0x38
movabs rcx, 0x397bf255dd8bb705
stc
mov qword [rbp - 0x11], rax
xor r9d, r9d
jmp 0x1400077ea
movdqa xmm0, xmmword [rbp - 0x19]
movabs rax, 0x684267d036c53ba
mov qword [rbp + 0x17], rcx
movsx cx, r13b
seta cl
movabs rcx, 0xf85868f89b02a40a
jmp 0x140007814
mov qword [rbp - 9], rax
movzx ax, ch
movabs rax, 0x7f04e3f74c7783ab
jmp 0x14000782b
mov qword [rbp + 0x1f], rcx
movabs rcx, 0x97494daf642cc657
pxor xmm0, xmmword [rbp + 0x17]
mov qword [rbp - 1], rax
cwde
mov eax, r15d
setl al
movabs rax, 0xc242dac1dc90938f
jmp 0x140007858
movdqa xmm1, xmmword [rbp - 9]
mov qword [rbp + 0x27], rcx
bswap cx
movabs rcx, 0xf4d1b27a1879d784
mov qword [rbp + 7], rax
cmova ax, si
movsx ax, dh
movabs rax, 0x5f5cf9741afa929e
mov qword [rbp + 0x2f], rcx
not cl
mov cx, 0x3136
mov cl, r9b
movabs rcx, 0xc242dac1dc9093b9
jmp 0x1400078a0
pxor xmm1, xmmword [rbp + 0x27]
mov qword [rbp + 0xf], rax
jmp 0x1400078ae
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x37], rcx
xor ecx, ecx
mov qword [rbp + 0x3f], rax
jmp 0x1400078c7
pxor xmm0, xmmword [rbp + 0x37]
movdqa xmmword [rbp + 7], xmm0
movdqa xmmword [rbp - 9], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x14000743f