Function at 0x140038700
Capabilities:
Access pe header

Disassembly:
push rsi
push r14
sub rsp, 0x38
xor r14d, r14d
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r14
call fcn.1400383e0
test al, al
je 0x140038af8
mov qword [rsp + 0x58], rbx
mov rbx, qword [rsp + 0x20]
test rbx, rbx
jne 0x14003874f
mov rbx, qword [rsp + 0x58]
mov r14d, 0xffffffff
test r14d, r14d
setne al
add rsp, 0x38
pop r14
pop rsi
ret
call qword [rsp + 0x28]
mov rcx, rbx
mov r14d, eax
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
jne 0x140038780
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rbx, qword [rsp + 0x58]
test r14d, r14d
setne al
add rsp, 0x38
pop r14
pop rsi
ret
movsxd rdx, dword [rbx + 0x3c]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r15
movabs r15, 0xaabbcc11ffee00
movzx ecx, word [rdx + rbx + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rdi, ecx
add rdi, 0x108
add rdi, rbx
cmp qword [rdi], r15
jne 0x140038ae0
cmp qword [rdi + 0x10], rbx
jne 0x140038ae0
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r9, rax
test rdi, rdi
je 0x140038ae9
movzx edx, byte [rdi + 0xc]
test dl, 2
je 0x140038ae9
movzx r8d, word [rdi + 0xe]
test r8b, 1
jne 0x14003888d
or dl, 4
mov rcx, rbx
mov byte [rdi + 0xc], dl
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x14003887f
movsxd rdx, dword [rbx + 0x3c]
movzx ecx, word [rdx + rbx + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rdi, ecx
add rdi, 0x108
add rdi, rbx
cmp qword [rdi], r15
jne 0x14003887f
cmp qword [rdi + 0x10], rbx
jne 0x14003887f
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rdi, rdi
je 0x140038ae9
movzx eax, byte [rdi + 0xc]
and al, 6
cmp al, 2
je 0x140038ae9
cmp qword [rdi + 0x20], 0
je 0x14003885e
mov rcx, rdi
call fcn.14001fed0
cmp qword [rdi + 0x10], 0
je 0x140038ae9
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140038ae9
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
jmp 0x140038ae9
mov rsi, qword [rdi + 0x38]
mov eax, dword [rsi + 0x40]
cmp dword [r9 + 0x50], eax
je 0x1400388a1
mov ecx, 7
int 0x29
test r8b, 8
je 0x1400388e5
test dword [rdi + 0x2c], 0xfffffffe
je 0x1400388e5
mov eax, dword [rdi + 0x2c]
cmp eax, 0xffffffff
je 0x140038ae9
mov ecx, 0xffff
cmp word [rsi + 0x6c], cx
jne 0x1400388d3
mov dword [rdi + 0x2c], 0xffffffff
jmp 0x140038ae9
test eax, eax
je 0x140038ae9
dec eax
mov dword [rdi + 0x2c], eax
jmp 0x140038ae9
or dl, 4
mov byte [rdi + 0xc], dl
test dl, 1
je 0x140038902
mov rcx, qword [rdi + 0x10]
xor r8d, r8d
mov eax, dword [r9 + 0x28]
xor edx, edx
add rax, rcx
call rax
movzx eax, word [rdi + 0xe]
test al, 1
je 0x140038a7c
mov qword [rsp + 0x60], rbp
test al, 2
je 0x14003892a
mov rcx, rbx
call fcn.1400214f0
test eax, eax
jns 0x14003892a
mov ecx, 3
int 0x29
mov rax, qword gs:[0x30]
mov rdx, qword [0x140398f48]
mov rcx, qword [rax + 0x60]
movzx eax, byte [rdx + 0x14]
dec eax
mov rbp, qword [rcx + 0x30]
cmp eax, 8
ja case.default.0x140038965
lea r8, [0x140000000]
cdqe
mov ecx, dword [r8 + rax*4 + 0x38b08]
add rcx, r8
jmp rcx
mov rcx, rsi
call fcn.140021610
mov r8, qword [rsi + 0x98]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdx, qword [0x140398f48]
mov rcx, qword [rdx + 0x48]
mov rax, qword [rcx + 0x18]
test rax, rax
je case.0x140038965.2
mov rcx, qword [rcx]
lea rdx, [rsi + 0xc8]
call rax
mov rdx, qword [0x140398f48]
movzx eax, word [rdx + 0x16]
mov ecx, reloc.OLEAUT32.dll_SetErrorInfo
cmp ax, cx
je 0x1400389c0
mov ecx, 0xe0
cmp ax, cx
jne case.0x140038965.1
lea rdi, [rsi + 0x98]
mov rbx, qword [rdi]
cmp rdi, rbx
je case.0x140038965.1
nop
mov rcx, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [0x140398ff0]
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbp
mov r8, qword [rbx + 8]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp rdi, rbx
jne 0x1400389d0
mov r8, qword [rsi + 0x60]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8, qword [rsi + 0x50]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword [0x140398f48]
cmp byte [rax + 0x14], 3
jne 0x140038a5b
mov rax, qword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rax, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rax, qword [rsi + 0x28]
mov rdx, qword [rsi + 0x20]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rax, qword [rsi + 0x78]
mov rdx, qword [rsi + 0x70]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140038a72
mov ecx, 7
int 0x29
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x140038ace
movsxd rdx, dword [rbx + 0x3c]
movzx ecx, word [rdx + rbx + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rdi, ecx
add rdi, 0x108
add rdi, rbx
cmp qword [rdi], r15
jne 0x140038ace
cmp qword [rdi + 0x10], rbx
jne 0x140038ace
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rdi, rdi
je 0x140038ad7
movzx eax, byte [rdi + 0xc]
and al, 6
cmp al, 2
je 0x140038ad7
jmp 0x14003884f
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, 7
int 0x29
jmp 0x140038ae9
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
test r14d, r14d
setne al
add rsp, 0x38
pop r14
pop rsi
ret