Function at 0x140003180
Capabilities:
Access pe header

Disassembly:
push rbx
push rsi
push r12
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1400034f1
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400034f1
movsxd r8, dword [rbx + 0x3c]
movabs r12, 0xaabbcc11ffee00
movzx edx, word [r8 + rbx + 6]
lea eax, [rdx + rdx*4]
lea ecx, [r8 + rax*8]
movsxd rsi, ecx
add rsi, 0x108
add rsi, rbx
cmp qword [rsi], r12
jne 0x1400034f1
cmp qword [rsi + 0x10], rbx
jne 0x1400034f1
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r9, rax
test rsi, rsi
je 0x1400034fa
movzx edx, byte [rsi + 0xc]
test dl, 2
je 0x1400034fa
movzx r8d, word [rsi + 0xe]
mov qword [rsp + 0x60], rdi
test r8b, 1
jne 0x14000323b
or dl, 4
mov rcx, rbx
mov byte [rsi + 0xc], dl
call fcn.140003b20
xor edi, edi
mov ecx, 0xc0000001
test eax, eax
cmovne ecx, edi
mov rdi, qword [rsp + 0x60]
mov eax, ecx
add rsp, 0x30
pop r12
pop rsi
pop rbx
ret
mov qword [rsp + 0x28], r14
mov r14, qword [rsi + 0x38]
mov eax, dword [r14 + 0x40]
cmp dword [r9 + 0x50], eax
je 0x140003255
mov ecx, 7
int 0x29
test r8b, 8
je 0x1400032a1
test dword [rsi + 0x2c], 0xfffffffe
je 0x1400032a1
mov eax, dword [rsi + 0x2c]
cmp eax, 0xffffffff
je 0x14000327f
mov ecx, 0xffff
cmp word [r14 + 0x6c], cx
jne 0x140003296
mov dword [rsi + 0x2c], 0xffffffff
xor edi, edi
mov r14, qword [rsp + 0x28]
mov eax, edi
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rsi
pop rbx
ret
test eax, eax
je 0x14000327f
dec eax
mov dword [rsi + 0x2c], eax
jmp 0x14000327f
or dl, 4
mov byte [rsi + 0xc], dl
test dl, 1
je 0x1400032be
mov rcx, qword [rsi + 0x10]
xor r8d, r8d
mov eax, dword [r9 + 0x28]
xor edx, edx
add rax, rcx
call rax
movzx eax, word [rsi + 0xe]
xor edi, edi
test al, 1
je 0x14000345f
mov qword [rsp + 0x58], rbp
test al, 2
je 0x1400032ea
mov rcx, rbx
call fcn.140004f10
mov edi, eax
test eax, eax
jns 0x1400032ea
mov ecx, 3
int 0x29
test byte [rsi + 0xe], 4
je 0x14000330e
mov rax, qword [0x14008ac28]
mov rcx, r14
mov rdx, qword [rax + 0x78]
call qword [rdx + 0x20]
mov edi, eax
test eax, eax
jns 0x14000330e
mov ecx, 7
int 0x29
mov rax, qword gs:[0x30]
mov rdx, qword [0x14008ac28]
mov rcx, qword [rax + 0x60]
movzx eax, byte [rdx + 0x14]
dec eax
mov rbp, qword [rcx + 0x30]
cmp eax, 8
ja case.default.0x140003349
lea r8, [0x140000000]
cdqe
mov ecx, dword [r8 + rax*4 + 0x3508]
add rcx, r8
jmp rcx
mov rcx, r14
call fcn.140003be0
mov r8, qword [r14 + 0x98]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdx, qword [0x14008ac28]
mov rcx, qword [rdx + 0x48]
mov rax, qword [rcx + 0x18]
test rax, rax
je case.0x140003349.2
mov rcx, qword [rcx]
lea rdx, [r14 + 0xc8]
call rax
mov rdx, qword [0x14008ac28]
movzx eax, word [rdx + 0x16]
mov ecx, 0xc8
cmp ax, cx
je 0x1400033a4
mov ecx, 0xe0
cmp ax, cx
jne case.0x140003349.1
mov qword [rsp + 0x20], r15
lea r15, [r14 + 0x98]
mov rsi, qword [r15]
cmp r15, rsi
je 0x1400033e5
nop dword [rax + rax]
mov rcx, qword [rsi + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
mov rsi, qword [rsi]
xor edx, edx
mov rcx, rbp
mov r8, qword [rsi + 8]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp r15, rsi
jne 0x1400033c0
mov r15, qword [rsp + 0x20]
mov r8, qword [r14 + 0x60]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8, qword [r14 + 0x50]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword [r14 + 8]
mov r8, r14
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rcx, rbp
mov rax, qword [r14 + 0x18]
mov rdx, qword [r14 + 0x10]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rax, qword [r14 + 0x28]
mov rdx, qword [r14 + 0x20]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rdx, qword [r14 + 0x70]
mov rax, qword [r14 + 0x78]
mov qword [rax], rdx
mov qword [rdx + 8], rax
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14000345a
mov ecx, 7
int 0x29
mov rbp, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400034dc
movsxd rdx, dword [rbx + 0x3c]
movzx ecx, word [rdx + rbx + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rsi, ecx
add rsi, 0x108
add rsi, rbx
cmp qword [rsi], r12
jne 0x1400034dc
cmp qword [rsi + 0x10], rbx
jne 0x1400034dc
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rsi, rsi
je 0x1400034e5
movzx eax, byte [rsi + 0xc]
and al, 6
cmp al, 2
je 0x1400034e5
cmp qword [rsi + 0x20], 0
je 0x1400034bb
mov rcx, rsi
call fcn.140006a30
cmp qword [rsi + 0x10], 0
je 0x140003281
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140003281
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, 7
int 0x29
jmp 0x140003281
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov eax, 0xc0000008
add rsp, 0x30
pop r12
pop rsi
pop rbx
ret