Function at 0x14014e400
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdx, qword [0x1402ca960]
mov ecx, 0x48
call sym.SystemInformer.exe_PhCreateObject
mov rcx, qword [0x1402caad0]
mov rbx, rax
mov edx, 4
mov r8d, 0x40
mov dword [rax], 0x10
lea rax, [0x140147b30]
mov qword [rbx + 8], rax
lea rax, [0x140147b40]
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x18], 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbx + 0x18]
mov edx, 0xff
shl r8, 2
mov rcx, rax
mov qword [rbx + 0x20], rax
call fcn.14020a280
mov r8d, dword [rbx + 0x18]
mov edx, 4
mov rcx, qword [0x1402caad0]
mov dword [rbx + 0x28], r8d
shl r8, 5
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [0x1402ca960]
xor edi, edi
mov ecx, 0x48
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x38], edi
mov dword [rbx + 0x40], edi
mov dword [rbx + 0x3c], 0xffffffff
mov qword [0x1402cdc20], rbx
call sym.SystemInformer.exe_PhCreateObject
mov rcx, qword [0x1402caad0]
mov rbx, rax
mov edx, 4
mov r8d, 0x40
mov dword [rax], 0x18
lea rax, [0x1401518a0]
mov qword [rbx + 8], rax
lea rax, [0x1401518c0]
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x18], 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbx + 0x18]
mov edx, 0xff
shl r8, 2
mov rcx, rax
mov qword [rbx + 0x20], rax
call fcn.14020a280
mov eax, dword [rbx + 0x18]
mov edx, 4
mov rcx, qword [0x1402caad0]
mov dword [rbx + 0x28], eax
lea r8, [rax + rax*4]
shl r8, 3
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov dword [rbx + 0x38], edi
mov r8d, 0x800
mov qword [rbx + 0x30], rax
lea rcx, str.uxtheme.dll
mov dword [rbx + 0x3c], 0xffffffff
mov dword [rbx + 0x40], edi
mov qword [0x1402cdbe8], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
mov ebp, 0x5a4d
test rax, rax
jne 0x14014e5c9
xor edx, edx
lea rcx, str.uxtheme.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14014e5c9
cmp dword [0x1402bff40], 0x3e
nop dword [rax]
jae 0x14014e931
xor r8d, r8d
lea rcx, str.uxtheme.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x14014e931
mov rsi, rbx
cmp word [rbx], bp
jne 0x14014e619
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e619
cmp dword [rcx + rbx], 0x4550
jne 0x14014e619
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e616
cmp dword [rdx + 4], edi
je 0x14014e616
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.OpenThemeDataForDpi
mov rcx, rbx
call fcn.14017dc40
jmp 0x14014e61c
mov rsi, rbx
mov rax, rdi
mov qword [0x1402cdbb0], rax
cmp word [rbx], bp
jne 0x14014e66d
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e66d
cmp dword [rcx + rbx], 0x4550
jne 0x14014e66d
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e66d
cmp dword [rdx + 4], edi
je 0x14014e66d
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.OpenThemeData
mov rcx, rbx
call fcn.14017dc40
jmp 0x14014e670
mov rax, rdi
mov qword [0x1402cdbd0], rax
cmp word [rbx], bp
jne 0x14014e6c7
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e6c7
cmp dword [rcx + rbx], 0x4550
jne 0x14014e6c7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e6c7
cmp dword [rdx + 4], edi
je 0x14014e6c7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.CloseThemeData
mov rcx, rbx
call fcn.14017dc40
jmp 0x14014e6ca
mov rax, rdi
mov qword [0x1402cdc08], rax
cmp word [rbx], bp
jne 0x14014e727
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e727
cmp dword [rcx + rbx], 0x4550
jne 0x14014e727
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e727
cmp dword [rdx + 4], edi
je 0x14014e727
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.SetWindowTheme
mov rcx, rbx
call fcn.14017dc40
jmp 0x14014e72a
mov rax, rdi
mov qword [0x1402cdb30], rax
cmp word [rbx], bp
jne 0x14014e787
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e787
cmp dword [rcx + rbx], 0x4550
jne 0x14014e787
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e787
cmp dword [rdx + 4], edi
je 0x14014e787
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.IsThemeActive
mov rcx, rbx
call fcn.14017dc40
jmp 0x14014e78a
mov rax, rdi
mov qword [0x1402cdc68], rax
cmp word [rbx], bp
jne 0x14014e7e7
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e7e7
cmp dword [rcx + rbx], 0x4550
jne 0x14014e7e7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e7e7
cmp dword [rdx + 4], edi
je 0x14014e7e7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.IsThemePartDefined
mov rcx, rbx
call fcn.14017dc40
jmp 0x14014e7ea
mov rax, rdi
mov qword [0x1402cdb90], rax
cmp word [rbx], bp
jne 0x14014e847
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e847
cmp dword [rcx + rbx], 0x4550
jne 0x14014e847
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e847
cmp dword [rdx + 4], edi
je 0x14014e847
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetThemeInt
mov rcx, rbx
call fcn.14017dc40
jmp 0x14014e84a
mov rax, rdi
mov qword [0x1402cdb70], rax
cmp word [rbx], bp
jne 0x14014e8a7
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e8a7
cmp dword [rcx + rbx], 0x4550
jne 0x14014e8a7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e8a7
cmp dword [rdx + 4], edi
je 0x14014e8a7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetThemePartSize
mov rcx, rbx
call fcn.14017dc40
jmp 0x14014e8aa
mov rax, rdi
mov qword [0x1402cdbd8], rax
cmp word [rbx], bp
jne 0x14014e907
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e907
cmp dword [rcx + rbx], 0x4550
jne 0x14014e907
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e907
cmp dword [rdx + 4], edi
je 0x14014e907
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.DrawThemeBackground
mov rcx, rbx
call fcn.14017dc40
jmp 0x14014e90a
mov rax, rdi
cmp dword [0x1402bff40], 0x72
mov qword [0x1402cdbc0], rax
jb 0x14014e931
xor edx, edx
mov r8d, 0x4a
mov rcx, rbx
call fcn.14017dae0
mov qword [0x1402cdb60], rax
cmp dword [0x1402bff40], 0x3f
jb 0x14014e9f1
xor edx, edx
lea rcx, str.shcore.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14014e99c
xor edx, edx
lea rcx, str.shcore.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14014e99c
cmp dword [0x1402bff40], 0x3e
nop
jae 0x14014e9f1
xor r8d, r8d
lea rcx, str.shcore.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14014e9f1
nop dword [rax]
cmp word [rcx], bp
jne 0x14014e9e7
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e9e7
cmp dword [rdx + rcx], 0x4550
jne 0x14014e9e7
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e9e7
cmp dword [rdx + 4], edi
je 0x14014e9e7
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetDpiForMonitor
call fcn.14017dc40
jmp 0x14014e9ea
mov rax, rdi
mov qword [0x1402cdbf8], rax
cmp dword [0x1402bff40], 0x66
jb 0x14014ebcf
xor edx, edx
lea rcx, [0x1402675e0]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14014ea69
xor edx, edx
lea rcx, [0x1402675e0]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14014ea69
cmp dword [0x1402bff40], 0x3e
nop
jae 0x14014ebcf
xor r8d, r8d
lea rcx, [0x1402675e0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x14014ebcf
mov rsi, rbx
cmp word [rbx], bp
jne 0x14014eab9
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014eab9
cmp dword [rcx + rbx], 0x4550
jne 0x14014eab9
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014eab6
cmp dword [rdx + 4], edi
je 0x14014eab6
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetDpiForWindow
mov rcx, rbx
call fcn.14017dc40
jmp 0x14014eabc
mov rsi, rbx
mov rax, rdi
mov qword [0x1402cdc48], rax
cmp word [rbx], bp
jne 0x14014eb0d
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014eb0d
cmp dword [rcx + rbx], 0x4550
jne 0x14014eb0d
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014eb0d
cmp dword [rdx + 4], edi
je 0x14014eb0d
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetDpiForSystem
mov rcx, rbx
call fcn.14017dc40
jmp 0x14014eb10
mov rax, rdi
mov qword [0x1402cdba8], rax
cmp word [rbx], bp
jne 0x14014eb67
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014eb67
cmp dword [rcx + rbx], 0x4550
jne 0x14014eb67
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014eb67
cmp dword [rdx + 4], edi
je 0x14014eb67
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetSystemMetricsForDpi
mov rcx, rbx
call fcn.14017dc40
jmp 0x14014eb6a
mov rax, rdi
mov qword [0x1402cdbc8], rax
cmp word [rbx], bp
jne 0x14014ebc8
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014ebc8
cmp dword [rcx + rbx], 0x4550
jne 0x14014ebc8
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014ebc8
cmp dword [rdx + 4], edi
je 0x14014ebc8
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.SystemParametersInfoForDpi
mov rcx, rbx
call fcn.14017dc40
mov rdi, rax
mov qword [0x1402cdc60], rdi
xor ecx, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.14014ec00