Function at 0x14014eb60
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdx, qword [0x1402cb8a8]
mov ecx, 0x48
call sym.SystemInformer.exe_PhCreateObject
mov rcx, qword [0x1402cba10]
mov rbx, rax
mov edx, 4
mov r8d, 0x40
mov dword [rax], 0x10
lea rax, [0x140148190]
mov qword [rbx + 8], rax
lea rax, [0x1401481a0]
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x18], 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbx + 0x18]
mov edx, 0xff
shl r8, 2
mov rcx, rax
mov qword [rbx + 0x20], rax
call fcn.14020ba80
mov r8d, dword [rbx + 0x18]
mov edx, 4
mov rcx, qword [0x1402cba10]
mov dword [rbx + 0x28], r8d
shl r8, 5
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [0x1402cb8a8]
xor edi, edi
mov ecx, 0x48
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x38], edi
mov dword [rbx + 0x40], edi
mov dword [rbx + 0x3c], 0xffffffff
mov qword [0x1402ceb70], rbx
call sym.SystemInformer.exe_PhCreateObject
mov rcx, qword [0x1402cba10]
mov rbx, rax
mov edx, 4
mov r8d, 0x40
mov dword [rax], 0x18
lea rax, [0x140152000]
mov qword [rbx + 8], rax
lea rax, [0x140152020]
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x18], 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbx + 0x18]
mov edx, 0xff
shl r8, 2
mov rcx, rax
mov qword [rbx + 0x20], rax
call fcn.14020ba80
mov eax, dword [rbx + 0x18]
mov edx, 4
mov rcx, qword [0x1402cba10]
mov dword [rbx + 0x28], eax
lea r8, [rax + rax*4]
shl r8, 3
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov dword [rbx + 0x38], edi
mov r8d, 0x800
mov qword [rbx + 0x30], rax
lea rcx, str.uxtheme.dll
mov dword [rbx + 0x3c], 0xffffffff
mov dword [rbx + 0x40], edi
mov qword [0x1402ceb38], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
mov ebp, 0x5a4d
test rax, rax
jne 0x14014ed29
xor edx, edx
lea rcx, str.uxtheme.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14014ed29
cmp dword [0x1402c0f40], 0x3e
nop dword [rax]
jae 0x14014f091
xor r8d, r8d
lea rcx, str.uxtheme.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x14014f091
mov rsi, rbx
cmp word [rbx], bp
jne 0x14014ed79
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014ed79
cmp dword [rcx + rbx], 0x4550
jne 0x14014ed79
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014ed76
cmp dword [rdx + 4], edi
je 0x14014ed76
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.OpenThemeDataForDpi
mov rcx, rbx
call fcn.14017f180
jmp 0x14014ed7c
mov rsi, rbx
mov rax, rdi
mov qword [0x1402ceb00], rax
cmp word [rbx], bp
jne 0x14014edcd
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014edcd
cmp dword [rcx + rbx], 0x4550
jne 0x14014edcd
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014edcd
cmp dword [rdx + 4], edi
je 0x14014edcd
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.OpenThemeData
mov rcx, rbx
call fcn.14017f180
jmp 0x14014edd0
mov rax, rdi
mov qword [0x1402ceb20], rax
cmp word [rbx], bp
jne 0x14014ee27
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014ee27
cmp dword [rcx + rbx], 0x4550
jne 0x14014ee27
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014ee27
cmp dword [rdx + 4], edi
je 0x14014ee27
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.CloseThemeData
mov rcx, rbx
call fcn.14017f180
jmp 0x14014ee2a
mov rax, rdi
mov qword [0x1402ceb58], rax
cmp word [rbx], bp
jne 0x14014ee87
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014ee87
cmp dword [rcx + rbx], 0x4550
jne 0x14014ee87
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014ee87
cmp dword [rdx + 4], edi
je 0x14014ee87
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.SetWindowTheme
mov rcx, rbx
call fcn.14017f180
jmp 0x14014ee8a
mov rax, rdi
mov qword [0x1402cea80], rax
cmp word [rbx], bp
jne 0x14014eee7
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014eee7
cmp dword [rcx + rbx], 0x4550
jne 0x14014eee7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014eee7
cmp dword [rdx + 4], edi
je 0x14014eee7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.IsThemeActive
mov rcx, rbx
call fcn.14017f180
jmp 0x14014eeea
mov rax, rdi
mov qword [0x1402cebb8], rax
cmp word [rbx], bp
jne 0x14014ef47
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014ef47
cmp dword [rcx + rbx], 0x4550
jne 0x14014ef47
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014ef47
cmp dword [rdx + 4], edi
je 0x14014ef47
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.IsThemePartDefined
mov rcx, rbx
call fcn.14017f180
jmp 0x14014ef4a
mov rax, rdi
mov qword [0x1402ceae0], rax
cmp word [rbx], bp
jne 0x14014efa7
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014efa7
cmp dword [rcx + rbx], 0x4550
jne 0x14014efa7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014efa7
cmp dword [rdx + 4], edi
je 0x14014efa7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetThemeInt
mov rcx, rbx
call fcn.14017f180
jmp 0x14014efaa
mov rax, rdi
mov qword [0x1402ceac0], rax
cmp word [rbx], bp
jne 0x14014f007
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014f007
cmp dword [rcx + rbx], 0x4550
jne 0x14014f007
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014f007
cmp dword [rdx + 4], edi
je 0x14014f007
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetThemePartSize
mov rcx, rbx
call fcn.14017f180
jmp 0x14014f00a
mov rax, rdi
mov qword [0x1402ceb28], rax
cmp word [rbx], bp
jne 0x14014f067
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014f067
cmp dword [rcx + rbx], 0x4550
jne 0x14014f067
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014f067
cmp dword [rdx + 4], edi
je 0x14014f067
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.DrawThemeBackground
mov rcx, rbx
call fcn.14017f180
jmp 0x14014f06a
mov rax, rdi
cmp dword [0x1402c0f40], 0x72
mov qword [0x1402ceb10], rax
jb 0x14014f091
xor edx, edx
mov r8d, 0x4a
mov rcx, rbx
call fcn.14017f020
mov qword [0x1402ceab0], rax
cmp dword [0x1402c0f40], 0x3f
jb 0x14014f151
xor edx, edx
lea rcx, str.shcore.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14014f0fc
xor edx, edx
lea rcx, str.shcore.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14014f0fc
cmp dword [0x1402c0f40], 0x3e
nop
jae 0x14014f151
xor r8d, r8d
lea rcx, str.shcore.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14014f151
nop dword [rax]
cmp word [rcx], bp
jne 0x14014f147
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14014f147
cmp dword [rdx + rcx], 0x4550
jne 0x14014f147
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014f147
cmp dword [rdx + 4], edi
je 0x14014f147
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetDpiForMonitor
call fcn.14017f180
jmp 0x14014f14a
mov rax, rdi
mov qword [0x1402ceb48], rax
cmp dword [0x1402c0f40], 0x66
jb 0x14014f32f
xor edx, edx
lea rcx, [0x140268980]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14014f1c9
xor edx, edx
lea rcx, [0x140268980]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14014f1c9
cmp dword [0x1402c0f40], 0x3e
nop
jae 0x14014f32f
xor r8d, r8d
lea rcx, [0x140268980]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x14014f32f
mov rsi, rbx
cmp word [rbx], bp
jne 0x14014f219
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014f219
cmp dword [rcx + rbx], 0x4550
jne 0x14014f219
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014f216
cmp dword [rdx + 4], edi
je 0x14014f216
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetDpiForWindow
mov rcx, rbx
call fcn.14017f180
jmp 0x14014f21c
mov rsi, rbx
mov rax, rdi
mov qword [0x1402ceb98], rax
cmp word [rbx], bp
jne 0x14014f26d
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014f26d
cmp dword [rcx + rbx], 0x4550
jne 0x14014f26d
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014f26d
cmp dword [rdx + 4], edi
je 0x14014f26d
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetDpiForSystem
mov rcx, rbx
call fcn.14017f180
jmp 0x14014f270
mov rax, rdi
mov qword [0x1402ceaf8], rax
cmp word [rbx], bp
jne 0x14014f2c7
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014f2c7
cmp dword [rcx + rbx], 0x4550
jne 0x14014f2c7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014f2c7
cmp dword [rdx + 4], edi
je 0x14014f2c7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetSystemMetricsForDpi
mov rcx, rbx
call fcn.14017f180
jmp 0x14014f2ca
mov rax, rdi
mov qword [0x1402ceb18], rax
cmp word [rbx], bp
jne 0x14014f328
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014f328
cmp dword [rcx + rbx], 0x4550
jne 0x14014f328
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014f328
cmp dword [rdx + 4], edi
je 0x14014f328
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.SystemParametersInfoForDpi
mov rcx, rbx
call fcn.14017f180
mov rdi, rax
mov qword [0x1402cebb0], rdi
xor ecx, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.14014f360