Function at 0x140006a40
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push rdi
push r12
push r14
sub rsp, 0x70
mov rax, qword [0x140299ac0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r12, r8
mov r14, rdx
mov rdi, rcx
call fcn.140006340
test rax, rax
je 0x140006d1a
mov qword [rsp + 0xa8], rbx
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x60], rsi
call fcn.140006950
test rax, rax
je 0x140006cbc
cmp word [rax + 2], 0
je 0x140006cbc
xor ebx, ebx
mov qword [rsp + 0x50], r15
mov edx, 5
mov rcx, rdi
mov r15d, ebx
call fcn.140006610
test rax, rax
jne 0x140006ac3
mov rcx, rdi
call fcn.140006720
mov r15, rax
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r13
test rdi, rdi
je 0x140006cab
mov edx, 0x40
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x140006cab
mov r13d, 0x5a4d
cmp word [rdi], r13w
jne 0x140006cab
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140006cab
lea rbp, [rdi + rax]
mov edx, 0xf8
mov rcx, rbp
call fcn.1400078d0
test al, al
jne 0x140006cab
cmp dword [rbp], 0x4550
jne 0x140006cab
test rbp, rbp
je 0x140006cab
mov edx, 0x40
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x140006b8a
cmp word [rdi], r13w
jne 0x140006b8a
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140006b8a
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.1400078d0
test al, al
jne 0x140006b8a
cmp dword [rsi], 0x4550
jne 0x140006b8a
test rsi, rsi
je 0x140006b8a
mov edx, 0xf8
mov rcx, rsi
call fcn.1400078d0
mov ebp, dword [rbp + 0x50]
test rbp, rbp
je 0x140006cab
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x140006cab
mov r9d, ebp
mov r8, rax
mov rdx, r14
mov rcx, rdi
call fcn.140006d40
test al, al
je 0x140006cab
mov rcx, rsi
mov qword [r12], rbp
call fcn.140006720
mov r14, rax
cmp rsi, rax
jne 0x140006bfd
mov r15, qword [rsp + 0x50]
mov rbx, rsi
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
jmp 0x140006d0a
mov edx, 0x40
mov rcx, rsi
call fcn.1400078d0
test al, al
jne 0x140006c5d
cmp word [rsi], r13w
jne 0x140006c5d
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x140006c5d
lea rdi, [rsi + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x140006c5d
cmp dword [rdi], 0x4550
jne 0x140006c5d
test rdi, rdi
je 0x140006c5d
mov edx, 0xf8
mov rcx, rdi
call fcn.1400078d0
test al, al
je 0x140006c57
movzx eax, bx
jmp 0x140006c5f
movzx eax, word [rdi + 0x18]
jmp 0x140006c5f
mov eax, ebx
mov ecx, 0x20b
mov qword [rsp + 0x30], r14
cmp ax, cx
mov qword [rsp + 0x38], rsi
lea rax, vtable.ApplyRelocCallback.0
mov rdx, rbp
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, rsi
sete byte [rsp + 0x28]
call fcn.140006f90
test al, al
jne 0x140006be6
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
jmp 0x140006d0a
mov rcx, rdi
call fcn.140006720
mov rcx, rdi
mov rbx, rax
call fcn.140006830
mov esi, eax
test eax, eax
je 0x140006d08
mov r9d, 0x40
mov r8d, 0x3000
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x140006d08
mov r8, r14
mov rdx, rdi
mov rcx, rax
call fcn.140049380
mov qword [r12], rsi
jmp 0x140006d0a
xor ebx, ebx
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14003dac0
add rsp, 0x70
pop r14
pop r12
pop rdi
ret