Function at 0x140006f40
Capabilities:
Access pe header

Disassembly:
push rbx
push rsi
push r12
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1400072b1
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400072b1
movsxd r8, dword [rbx + 0x3c]
movabs r12, 0xaabbcc11ffee00
movzx edx, word [r8 + rbx + 6]
lea eax, [rdx + rdx*4]
lea ecx, [r8 + rax*8]
movsxd rsi, ecx
add rsi, 0x108
add rsi, rbx
cmp qword [rsi], r12
jne 0x1400072b1
cmp qword [rsi + 0x10], rbx
jne 0x1400072b1
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r9, rax
test rsi, rsi
je 0x1400072ba
movzx edx, byte [rsi + 0xc]
test dl, 2
je 0x1400072ba
movzx r8d, word [rsi + 0xe]
mov qword [rsp + 0x60], rdi
test r8b, 1
jne 0x140006ffb
or dl, 4
mov rcx, rbx
mov byte [rsi + 0xc], dl
call fcn.1400078e0
xor edi, edi
mov ecx, 0xc0000001
test eax, eax
cmovne ecx, edi
mov rdi, qword [rsp + 0x60]
mov eax, ecx
add rsp, 0x30
pop r12
pop rsi
pop rbx
ret
mov qword [rsp + 0x28], r14
mov r14, qword [rsi + 0x38]
mov eax, dword [r14 + 0x40]
cmp dword [r9 + 0x50], eax
je 0x140007015
mov ecx, 7
int 0x29
test r8b, 8
je 0x140007061
test dword [rsi + 0x2c], 0xfffffffe
je 0x140007061
mov eax, dword [rsi + 0x2c]
cmp eax, 0xffffffff
je 0x14000703f
mov ecx, 0xffff
cmp word [r14 + 0x6c], cx
jne 0x140007056
mov dword [rsi + 0x2c], 0xffffffff
xor edi, edi
mov r14, qword [rsp + 0x28]
mov eax, edi
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rsi
pop rbx
ret
test eax, eax
je 0x14000703f
dec eax
mov dword [rsi + 0x2c], eax
jmp 0x14000703f
or dl, 4
mov byte [rsi + 0xc], dl
test dl, 1
je 0x14000707e
mov rcx, qword [rsi + 0x10]
xor r8d, r8d
mov eax, dword [r9 + 0x28]
xor edx, edx
add rax, rcx
call rax
movzx eax, word [rsi + 0xe]
xor edi, edi
test al, 1
je 0x14000721f
mov qword [rsp + 0x58], rbp
test al, 2
je 0x1400070aa
mov rcx, rbx
call fcn.140008c60
mov edi, eax
test eax, eax
jns 0x1400070aa
mov ecx, 3
int 0x29
test byte [rsi + 0xe], 4
je 0x1400070ce
mov rax, qword [0x1400f24f0]
mov rcx, r14
mov rdx, qword [rax + 0x78]
call qword [rdx + 0x20]
mov edi, eax
test eax, eax
jns 0x1400070ce
mov ecx, 7
int 0x29
mov rax, qword gs:[0x30]
mov rdx, qword [0x1400f24f0]
mov rcx, qword [rax + 0x60]
movzx eax, byte [rdx + 0x14]
dec eax
mov rbp, qword [rcx + 0x30]
cmp eax, 8
ja case.default.0x140007109
lea r8, [0x140000000]
cdqe
mov ecx, dword [r8 + rax*4 + 0x72c8]
add rcx, r8
jmp rcx
mov rcx, r14
call fcn.1400079a0
mov r8, qword [r14 + 0x98]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdx, qword [0x1400f24f0]
mov rcx, qword [rdx + 0x48]
mov rax, qword [rcx + 0x18]
test rax, rax
je case.0x140007109.2
mov rcx, qword [rcx]
lea rdx, [r14 + 0xc8]
call rax
mov rdx, qword [0x1400f24f0]
movzx eax, word [rdx + 0x16]
mov ecx, 0xc8
cmp ax, cx
je 0x140007164
mov ecx, 0xe0
cmp ax, cx
jne case.0x140007109.1
mov qword [rsp + 0x20], r15
lea r15, [r14 + 0x98]
mov rsi, qword [r15]
cmp r15, rsi
je 0x1400071a5
nop dword [rax + rax]
mov rcx, qword [rsi + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
mov rsi, qword [rsi]
xor edx, edx
mov rcx, rbp
mov r8, qword [rsi + 8]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp r15, rsi
jne 0x140007180
mov r15, qword [rsp + 0x20]
mov r8, qword [r14 + 0x60]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8, qword [r14 + 0x50]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword [r14 + 8]
mov r8, r14
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rcx, rbp
mov rax, qword [r14 + 0x18]
mov rdx, qword [r14 + 0x10]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rax, qword [r14 + 0x28]
mov rdx, qword [r14 + 0x20]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rdx, qword [r14 + 0x70]
mov rax, qword [r14 + 0x78]
mov qword [rax], rdx
mov qword [rdx + 8], rax
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14000721a
mov ecx, 7
int 0x29
mov rbp, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x14000729c
movsxd rdx, dword [rbx + 0x3c]
movzx ecx, word [rdx + rbx + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rsi, ecx
add rsi, 0x108
add rsi, rbx
cmp qword [rsi], r12
jne 0x14000729c
cmp qword [rsi + 0x10], rbx
jne 0x14000729c
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rsi, rsi
je 0x1400072a5
movzx eax, byte [rsi + 0xc]
and al, 6
cmp al, 2
je 0x1400072a5
cmp qword [rsi + 0x20], 0
je 0x14000727b
mov rcx, rsi
call fcn.14000a990
cmp qword [rsi + 0x10], 0
je 0x140007041
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140007041
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, 7
int 0x29
jmp 0x140007041
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov eax, 0xc0000008
add rsp, 0x30
pop r12
pop rsi
pop rbx
ret