Function at 0x14009f2a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, reloc.OLEAUT32.dll_SysStringByteLen
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14009f30d
cmp dword [0x140433df0], 1
jne 0x14009f2ef
call fcn.1405f3000
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetUBound
call fcn.1400a6dc0
mov ecx, 0xff
call fcn.1400a3730
mov eax, 0xff
jmp 0x14009f53b
mov dword [rax], reloc.OLEAUT32.dll_SysStringByteLen
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x14009f33e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x14009f53b
mov r13d, dword [rbx + 0x10]
mov esi, dword [rbx + 4]
mov r12d, dword [rbx + 8]
mov edi, dword [rbx + 0xc]
and edi, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, 2
je 0x14009f370
bts edi, 0xf
mov eax, esi
shl eax, 8
add eax, r12d
mov dword [0x140433dfc], r13d
mov dword [0x140433e04], eax
mov dword [0x140433e08], esi
mov dword [0x140433e0c], r12d
mov dword [0x140433e00], edi
cmp word [0x140000000], 0x5a4d
jne 0x14009f402
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x14009f3c7
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
jmp 0x14009f412
cmp word [rax + 0x18], 0x20b
je 0x14009f3da
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
jmp 0x14009f412
cmp dword [rax + 0x84], 0xe
ja 0x14009f3ee
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
jmp 0x14009f412
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xc0], ebx
jmp 0x14009f412
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.1400a8aa0
test eax, eax
jne 0x14009f442
cmp dword [0x140433df0], 1
jne 0x14009f42e
call fcn.1400a7030
mov ecx, 0x1c
call fcn.1400a6dc0
mov ecx, 0xff
call fcn.1400a3730
call fcn.1400a8980
test eax, eax
jne 0x14009f46d
cmp dword [0x140433df0], 1
jne 0x14009f459
call fcn.1400a7030
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.1400a6dc0
mov ecx, 0xff
call fcn.1400a3730
call fcn.1400a8080
nop
call fcn.1400a7cc0
test eax, eax
jns 0x14009f486
mov ecx, reloc.OLEAUT32.dll_DispGetParam
call fcn.1400a36c0
call fcn.1400a7ba0
mov qword [0x140436108], rax
call fcn.1400a79a0
mov qword [0x140433de8], rax
call fcn.1400a7730
test eax, eax
jns 0x14009f4b1
mov ecx, 8
call fcn.1400a36c0
call fcn.1400a73f0
test eax, eax
jns 0x14009f4c4
mov ecx, 9
call fcn.1400a36c0
mov ecx, 1
call fcn.1400a3a40
test eax, eax
je 0x14009f4d9
mov ecx, eax
call fcn.1400a36c0
call fcn.1400a7390
test byte [rsp + 0x6c], 1
je 0x14009f4ed
movzx r9d, word [rsp + 0x70]
jmp 0x14009f4f3
mov r9d, 0xa
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.1400ec110
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x14009f511
mov ecx, eax
call fcn.1400a3c50
call fcn.1400a3c70
jmp 0x14009f532
mov eax, edi
jmp 0x14009f53b
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
sub rsp, 0x28
call fcn.1400a8b40
add rsp, 0x28
jmp 0x14009f2a0