Function at 0x140021620
Capabilities:
Access pe header
Access peb ldr_data
Get process heap flags

Disassembly:
push rbp
push r15
sub rsp, 0x68
mov r15d, edx
mov rbp, rcx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
jne 0x140021646
mov eax, 0xc000007b
add rsp, 0x68
pop r15
pop rbp
ret
mov qword [rsp + 0x80], rbx
mov rcx, rbp
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400217b4
call fcn.140023e10
mov rcx, rax
call fcn.140023a20
mov r14, rax
test rax, rax
je 0x1400217b4
mov r12d, 0x2a
mov ecx, r12d
call fcn.140214374
mov rsi, rax
call fcn.140212d68
mov ebx, eax
call fcn.140212d68
mov r8d, eax
lea rdx, str._016llX.DLL
shl rbx, 0x20
mov rcx, rsi
or r8, rbx
call fcn.1400209b0
call fcn.140212d68
mov ebx, eax
call fcn.140212d68
mov edi, eax
mov r13d, 0x4c
shl rbx, 0x20
mov ecx, r13d
or rdi, rbx
call fcn.140214374
mov r9, rsi
lea rdx, str._016llX_s
mov r8, rdi
mov rcx, rax
mov rbx, rax
call fcn.1400209b0
mov ecx, r13d
call fcn.140023a20
mov qword [rsp + 0x48], rax
mov r8, rax
test rax, rax
je 0x140021783
mov dword [rsp + 0x40], 0x4c004a
mov rdx, rbx
sub r8, rbx
nop dword [rax]
movzx eax, word [rdx]
mov word [r8 + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140021730
mov rcx, r12
mov dword [rsp + 0x30], 0x2a0028
call fcn.140023a20
mov qword [rsp + 0x38], rax
mov rcx, rax
test rax, rax
jne 0x1400217e8
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x140021783
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rsi
call fcn.140214330
mov rcx, rbx
call fcn.140214330
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x1400217b4
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000017
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x50]
add rsp, 0x68
pop r15
pop rbp
ret
mov rdx, rsi
nop dword [rax + rax]
movzx eax, word [rdx]
lea rdx, [rdx + 2]
mov word [rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400217f0
mov rcx, rsi
call fcn.140214330
mov rcx, rbx
call fcn.140214330
lea rax, [rsp + 0x40]
mov r8, rbp
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, r15d
mov rcx, r14
call fcn.140020f60
test al, al
jne 0x1400218a5
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x140021855
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x140021878
mov r8, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x14002189b
mov r8, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000001
jmp 0x1400217b9
call fcn.140024190
cmp eax, 3
jne 0x140021940
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rsi, qword [rcx + 0x18]
call fcn.140023960
lea rcx, [r14 + 0x58]
mov dl, 1
mov rbx, rax
lea rdi, [r14 + 0x70]
call fcn.140023880
mov ecx, eax
lea rdx, [r14 + 0x10]
shl rcx, 4
add rcx, rbx
mov rax, qword [rcx + 8]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [rcx + 8], rdi
lea rcx, [rsi + 0x10]
mov rax, qword [rcx + 8]
mov qword [r14], rcx
mov qword [r14 + 8], rax
mov qword [rax], r14
mov rax, qword [rsi + 0x28]
mov qword [rcx + 8], r14
lea rcx, [rsi + 0x20]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov qword [rax], rdx
mov rax, qword [rsi + 0x38]
mov qword [rcx + 8], rdx
lea rdx, [r14 + 0x20]
lea rcx, [rsi + 0x30]
mov qword [rdx + 8], rax
mov qword [rdx], rcx
mov qword [rax], rdx
mov qword [rcx + 8], rdx
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x140021950
mov qword [rax], r14
xor eax, eax
jmp 0x1400217b9