Function at 0x140021650
Capabilities:
Access pe header
Access peb ldr_data
Get process heap flags

Disassembly:
push rbp
push r15
sub rsp, 0x68
mov r15d, edx
mov rbp, rcx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
jne 0x140021676
mov eax, 0xc000007b
add rsp, 0x68
pop r15
pop rbp
ret
mov qword [rsp + 0x80], rbx
mov rcx, rbp
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400217e4
call fcn.140023e40
mov rcx, rax
call fcn.140023a50
mov r14, rax
test rax, rax
je 0x1400217e4
mov r12d, 0x2a
mov ecx, r12d
call fcn.1402143a4
mov rsi, rax
call fcn.140212d98
mov ebx, eax
call fcn.140212d98
mov r8d, eax
lea rdx, str._016llX.DLL
shl rbx, 0x20
mov rcx, rsi
or r8, rbx
call fcn.1400209e0
call fcn.140212d98
mov ebx, eax
call fcn.140212d98
mov edi, eax
mov r13d, 0x4c
shl rbx, 0x20
mov ecx, r13d
or rdi, rbx
call fcn.1402143a4
mov r9, rsi
lea rdx, str._016llX_s
mov r8, rdi
mov rcx, rax
mov rbx, rax
call fcn.1400209e0
mov ecx, r13d
call fcn.140023a50
mov qword [rsp + 0x48], rax
mov r8, rax
test rax, rax
je 0x1400217b3
mov dword [rsp + 0x40], 0x4c004a
mov rdx, rbx
sub r8, rbx
nop dword [rax]
movzx eax, word [rdx]
mov word [r8 + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140021760
mov rcx, r12
mov dword [rsp + 0x30], 0x2a0028
call fcn.140023a50
mov qword [rsp + 0x38], rax
mov rcx, rax
test rax, rax
jne 0x140021818
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x1400217b3
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rsi
call fcn.140214360
mov rcx, rbx
call fcn.140214360
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x1400217e4
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000017
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x50]
add rsp, 0x68
pop r15
pop rbp
ret
mov rdx, rsi
nop dword [rax + rax]
movzx eax, word [rdx]
lea rdx, [rdx + 2]
mov word [rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140021820
mov rcx, rsi
call fcn.140214360
mov rcx, rbx
call fcn.140214360
lea rax, [rsp + 0x40]
mov r8, rbp
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, r15d
mov rcx, r14
call fcn.140020f90
test al, al
jne 0x1400218d5
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x140021885
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x1400218a8
mov r8, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x1400218cb
mov r8, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000001
jmp 0x1400217e9
call fcn.1400241c0
cmp eax, 3
jne 0x140021970
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rsi, qword [rcx + 0x18]
call fcn.140023990
lea rcx, [r14 + 0x58]
mov dl, 1
mov rbx, rax
lea rdi, [r14 + 0x70]
call fcn.1400238b0
mov ecx, eax
lea rdx, [r14 + 0x10]
shl rcx, 4
add rcx, rbx
mov rax, qword [rcx + 8]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [rcx + 8], rdi
lea rcx, [rsi + 0x10]
mov rax, qword [rcx + 8]
mov qword [r14], rcx
mov qword [r14 + 8], rax
mov qword [rax], r14
mov rax, qword [rsi + 0x28]
mov qword [rcx + 8], r14
lea rcx, [rsi + 0x20]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov qword [rax], rdx
mov rax, qword [rsi + 0x38]
mov qword [rcx + 8], rdx
lea rdx, [r14 + 0x20]
lea rcx, [rsi + 0x30]
mov qword [rdx + 8], rax
mov qword [rdx], rcx
mov qword [rax], rdx
mov qword [rcx + 8], rdx
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x140021980
mov qword [rax], r14
xor eax, eax
jmp 0x1400217e9