Function at 0x1400ef2e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, DllRegisterServer
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400ef34d
cmp dword [0x140187fa8], 1
jne 0x1400ef32f
call fcn.1400f4130
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetUBound
call fcn.1400f3ef0
mov ecx, 0xff
call fcn.1400f3800
mov eax, 0xff
jmp 0x1400ef57b
mov dword [rax], DllRegisterServer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1400ef37e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x1400ef57b
mov r13d, dword [rbx + 0x10]
mov esi, dword [rbx + 4]
mov r12d, dword [rbx + 8]
mov edi, dword [rbx + 0xc]
and edi, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, 2
je 0x1400ef3b0
bts edi, 0xf
mov eax, esi
shl eax, 8
add eax, r12d
mov dword [0x140187fb4], r13d
mov dword [0x140187fbc], eax
mov dword [0x140187fc0], esi
mov dword [0x140187fc4], r12d
mov dword [0x140187fb8], edi
cmp word [0x140000000], 0x5a4d
jne 0x1400ef442
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x1400ef407
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
jmp 0x1400ef452
cmp word [rax + 0x18], 0x20b
je 0x1400ef41a
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
jmp 0x1400ef452
cmp dword [rax + 0x84], 0xe
ja 0x1400ef42e
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
jmp 0x1400ef452
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xc0], ebx
jmp 0x1400ef452
xor ebx, ebx
mov dword [rsp + 0xc0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.1400f58f0
test eax, eax
jne 0x1400ef482
cmp dword [0x140187fa8], 1
jne 0x1400ef46e
call fcn.1400f4130
mov ecx, 0x1c
call fcn.1400f3ef0
mov ecx, 0xff
call fcn.1400f3800
call fcn.1400f57d0
test eax, eax
jne 0x1400ef4ad
cmp dword [0x140187fa8], 1
jne 0x1400ef499
call fcn.1400f4130
mov ecx, SafeArrayGetUBound
call fcn.1400f3ef0
mov ecx, 0xff
call fcn.1400f3800
call fcn.1400f5090
nop
call fcn.1400f4d50
test eax, eax
jns 0x1400ef4c6
mov ecx, 0x1b
call fcn.1400f37d0
call fcn.1400f4c30
mov qword [0x14018bd68], rax
call fcn.1400f4a30
mov qword [0x140187fa0], rax
call fcn.1400f47c0
test eax, eax
jns 0x1400ef4f1
mov ecx, 8
call fcn.1400f37d0
call fcn.1400f4490
test eax, eax
jns 0x1400ef504
mov ecx, 9
call fcn.1400f37d0
mov ecx, 1
call fcn.1400f3940
test eax, eax
je 0x1400ef519
mov ecx, eax
call fcn.1400f37d0
call fcn.1400f4430
test byte [rsp + 0x6c], 1
je 0x1400ef52d
movzx r9d, word [rsp + 0x70]
jmp 0x1400ef533
mov r9d, 0xa
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.140110dd8
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x1400ef551
mov ecx, eax
call fcn.1400f3b50
call fcn.1400f3b70
jmp 0x1400ef572
mov eax, edi
jmp 0x1400ef57b
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
sub rsp, 0x28
call fcn.1402ce000
add rsp, 0x28
jmp 0x1400ef2e0