Function at 0x140003af0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov r14, r9
mov r12, r8
mov r15, rdx
mov r13, rcx
mov rbp, qword [0x1400f6380]
mov rax, qword [rbp]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, qword [r8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x60], 0
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rsi
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x438
lea rsi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
mov r8, rax
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [rsp + 0x68], 0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x74], 0
mov qword [rsp + 0x78], 0
lea rcx, [0x1400f6870]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x78], rax
lea rdx, [0x1400f6884]
lea r8, [0x140012ae0]
lea r9, [rsp + 0xa0]
mov rcx, rsi
call fcn.14000ab10
test al, al
je 0x140003bf8
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x80]
mov rdx, r12
call fcn.14000a810
cmp byte [rsp + 0x90], 0
je 0x140003c87
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
movabs rax, 0x8007050700000036
mov qword [r13 + 8], rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140003c2f
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003c48
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003c58
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0xd0]
xor rax, rsp
mov rcx, qword [rbp]
cmp rcx, rax
jne 0x1400040bc
mov rax, r13
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [r12]
mov rax, qword [r12 + 0x30]
mov rdx, qword [0x1400f6dd8]
test rax, rax
je 0x140003cc3
cmp qword [r12 + 0x10], rdx
ja 0x140003cc3
mov rbx, qword [r12 + 0x20]
cmp rbx, qword [0x1400f6dd8]
jb 0x140003cc3
mov rdx, qword [0x1400f6dd8]
sub rdx, qword [r12 + 8]
add rax, rdx
mov rdx, rax
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0xb8]
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003d51
lea rdx, str.LdrLoadDll
lea r8, [0x1400129f0]
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0xa0]
call fcn.14000ab10
test al, al
je 0x140003d32
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x80]
mov rdx, r12
call fcn.14000a810
cmp byte [rsp + 0x90], 0
je 0x140003d5c
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
movabs rax, 0x800705070000003c
jmp 0x140003c12
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140003bf8
mov rcx, qword [r12]
mov rax, qword [r12 + 0x30]
mov rdx, qword [0x1400f6dc8]
test rax, rax
je 0x140003d98
cmp qword [r12 + 0x10], rdx
ja 0x140003d98
mov rbx, qword [r12 + 0x20]
cmp rbx, qword [0x1400f6dc8]
jb 0x140003d98
mov rdx, qword [0x1400f6dc8]
sub rdx, qword [r12 + 8]
add rax, rdx
mov rdx, rax
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0xb8]
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003ded
lea rcx, [rsp + 0xa0]
mov rdx, r15
mov r8, r12
call fcn.140003790
mov al, byte [rsp + 0xb0]
test al, al
je 0x140003df8
mov byte [r13 + 0x10], al
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [r13], xmm0
jmp 0x140003c16
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140003d32
lea rcx, [0x1400f6870]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and rax, 0xfffffffffffffffc
je 0x140003e3d
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140003e3d
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140003e3d
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x140003e3d
mov ecx, dword [rax + rcx + 0x50]
cmp rcx, 0x148
jae 0x140003e5c
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
movabs rax, 0x800700c100000056
jmp 0x140003c12
lea rdx, [r12 + 0x10]
test r14, r14
je 0x140003e96
lea r8, [0x1400f68a2]
lea rcx, [rsp + 0x80]
xor r9d, r9d
call fcn.14000a960
mov rbx, qword [rsp + 0x80]
mov r15, qword [rsp + 0x88]
mov al, byte [rsp + 0x90]
jmp 0x140003ee7
add rcx, rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rcx
mov byte [rsp + 0x90], 1
lea r8, [0x1400f68a2]
lea rcx, [rsp + 0xb8]
lea r9, [rsp + 0x80]
call fcn.14000a960
mov rbx, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
mov al, byte [rsp + 0xc8]
mov r15, r14
test al, al
je 0x140003f2a
shl rbx, 3
lea rcx, [rsp + 0xb8]
mov rdx, r12
call fcn.14000a810
mov rax, qword [r12 + 0x30]
test rax, rax
je 0x140003f49
cmp qword [r12 + 0x10], r15
ja 0x140003f49
mov rdx, r15
cmp qword [r12 + 0x20], r15
jb 0x140003f4c
mov rcx, r15
sub rcx, qword [r12 + 8]
add rax, rcx
mov rdx, rax
jmp 0x140003f4c
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
movabs rax, 0x8007000d0000006e
jmp 0x140003c12
mov rdx, r15
mov rcx, qword [r12]
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rcx
lea rsi, [rsp + 0x98]
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x20], rsi
mov r8, rbx
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140003f9d
mov ecx, dword [rsp + 0x9c]
jmp 0x140003fb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x9c], ecx
test ecx, ecx
js 0x140004090
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0xb8]
mov rdx, r12
mov r8, r15
mov r9, r14
call fcn.14000a730
mov bl, byte [rsp + 0xc8]
test bl, bl
je 0x140003ff8
movups xmm0, xmmword [rsp + 0xb8]
movups xmmword [r13], xmm0
mov byte [r13 + 0x10], 1
cmp dword [rsp + 0x9c], 0
js 0x14000402d
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r9d, dword [rsp + 0x98]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test bl, bl
jne 0x140003c16
mov r8, qword [0x1400f6de0]
mov eax, dword [r8]
and eax, 2
cmp eax, 1
mov eax, 3
sbb eax, 0
mov dword [rsp + 0xb8], eax
mov qword [rsp + 0x20], 4
lea rcx, [rsp + 0x80]
lea r9, [rsp + 0xb8]
mov rdx, r12
call fcn.14000a730
cmp byte [rsp + 0x90], 0
je 0x1400040b1
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [r13], xmm0
mov al, 1
jmp 0x1400040b3
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_cc4c8eaff833_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
mov dword [r13 + 8], 0x7a
mov dword [r13 + 0xc], ecx
jmp 0x140003c16
xor eax, eax
mov byte [r13 + 0x10], al
jmp 0x140003c16
call fcn.140072349
int3