Function at 0x14014e600
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdx, qword [0x1402ca980]
mov ecx, 0x48
call sym.SystemInformer.exe_PhCreateObject
mov rcx, qword [0x1402caaf0]
mov rbx, rax
mov edx, 4
mov r8d, 0x40
mov dword [rax], 0x10
lea rax, [0x140147d30]
mov qword [rbx + 8], rax
lea rax, [0x140147d40]
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x18], 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbx + 0x18]
mov edx, 0xff
shl r8, 2
mov rcx, rax
mov qword [rbx + 0x20], rax
call fcn.14020ab40
mov r8d, dword [rbx + 0x18]
mov edx, 4
mov rcx, qword [0x1402caaf0]
mov dword [rbx + 0x28], r8d
shl r8, 5
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [0x1402ca980]
xor edi, edi
mov ecx, 0x48
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x38], edi
mov dword [rbx + 0x40], edi
mov dword [rbx + 0x3c], 0xffffffff
mov qword [0x1402cdc40], rbx
call sym.SystemInformer.exe_PhCreateObject
mov rcx, qword [0x1402caaf0]
mov rbx, rax
mov edx, 4
mov r8d, 0x40
mov dword [rax], 0x18
lea rax, [0x140151aa0]
mov qword [rbx + 8], rax
lea rax, [0x140151ac0]
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x18], 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbx + 0x18]
mov edx, 0xff
shl r8, 2
mov rcx, rax
mov qword [rbx + 0x20], rax
call fcn.14020ab40
mov eax, dword [rbx + 0x18]
mov edx, 4
mov rcx, qword [0x1402caaf0]
mov dword [rbx + 0x28], eax
lea r8, [rax + rax*4]
shl r8, 3
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov dword [rbx + 0x38], edi
mov r8d, 0x800
mov qword [rbx + 0x30], rax
lea rcx, str.uxtheme.dll
mov dword [rbx + 0x3c], 0xffffffff
mov dword [rbx + 0x40], edi
mov qword [0x1402cdc08], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
mov ebp, 0x5a4d
test rax, rax
jne 0x14014e7c9
xor edx, edx
lea rcx, str.uxtheme.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14014e7c9
cmp dword [0x1402bff40], 0x3e
nop dword [rax]
jae 0x14014eb31
xor r8d, r8d
lea rcx, str.uxtheme.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x14014eb31
mov rsi, rbx
cmp word [rbx], bp
jne 0x14014e819
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e819
cmp dword [rcx + rbx], 0x4550
jne 0x14014e819
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e816
cmp dword [rdx + 4], edi
je 0x14014e816
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.OpenThemeDataForDpi
mov rcx, rbx
call fcn.14017e4c0
jmp 0x14014e81c
mov rsi, rbx
mov rax, rdi
mov qword [0x1402cdbd0], rax
cmp word [rbx], bp
jne 0x14014e86d
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e86d
cmp dword [rcx + rbx], 0x4550
jne 0x14014e86d
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e86d
cmp dword [rdx + 4], edi
je 0x14014e86d
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.OpenThemeData
mov rcx, rbx
call fcn.14017e4c0
jmp 0x14014e870
mov rax, rdi
mov qword [0x1402cdbf0], rax
cmp word [rbx], bp
jne 0x14014e8c7
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e8c7
cmp dword [rcx + rbx], 0x4550
jne 0x14014e8c7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e8c7
cmp dword [rdx + 4], edi
je 0x14014e8c7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.CloseThemeData
mov rcx, rbx
call fcn.14017e4c0
jmp 0x14014e8ca
mov rax, rdi
mov qword [0x1402cdc28], rax
cmp word [rbx], bp
jne 0x14014e927
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e927
cmp dword [rcx + rbx], 0x4550
jne 0x14014e927
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e927
cmp dword [rdx + 4], edi
je 0x14014e927
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.SetWindowTheme
mov rcx, rbx
call fcn.14017e4c0
jmp 0x14014e92a
mov rax, rdi
mov qword [0x1402cdb50], rax
cmp word [rbx], bp
jne 0x14014e987
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e987
cmp dword [rcx + rbx], 0x4550
jne 0x14014e987
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e987
cmp dword [rdx + 4], edi
je 0x14014e987
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.IsThemeActive
mov rcx, rbx
call fcn.14017e4c0
jmp 0x14014e98a
mov rax, rdi
mov qword [0x1402cdc88], rax
cmp word [rbx], bp
jne 0x14014e9e7
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014e9e7
cmp dword [rcx + rbx], 0x4550
jne 0x14014e9e7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014e9e7
cmp dword [rdx + 4], edi
je 0x14014e9e7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.IsThemePartDefined
mov rcx, rbx
call fcn.14017e4c0
jmp 0x14014e9ea
mov rax, rdi
mov qword [0x1402cdbb0], rax
cmp word [rbx], bp
jne 0x14014ea47
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014ea47
cmp dword [rcx + rbx], 0x4550
jne 0x14014ea47
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014ea47
cmp dword [rdx + 4], edi
je 0x14014ea47
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetThemeInt
mov rcx, rbx
call fcn.14017e4c0
jmp 0x14014ea4a
mov rax, rdi
mov qword [0x1402cdb90], rax
cmp word [rbx], bp
jne 0x14014eaa7
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014eaa7
cmp dword [rcx + rbx], 0x4550
jne 0x14014eaa7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014eaa7
cmp dword [rdx + 4], edi
je 0x14014eaa7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetThemePartSize
mov rcx, rbx
call fcn.14017e4c0
jmp 0x14014eaaa
mov rax, rdi
mov qword [0x1402cdbf8], rax
cmp word [rbx], bp
jne 0x14014eb07
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014eb07
cmp dword [rcx + rbx], 0x4550
jne 0x14014eb07
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014eb07
cmp dword [rdx + 4], edi
je 0x14014eb07
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.DrawThemeBackground
mov rcx, rbx
call fcn.14017e4c0
jmp 0x14014eb0a
mov rax, rdi
cmp dword [0x1402bff40], 0x72
mov qword [0x1402cdbe0], rax
jb 0x14014eb31
xor edx, edx
mov r8d, 0x4a
mov rcx, rbx
call fcn.14017e360
mov qword [0x1402cdb80], rax
cmp dword [0x1402bff40], 0x3f
jb 0x14014ebf1
xor edx, edx
lea rcx, str.shcore.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14014eb9c
xor edx, edx
lea rcx, str.shcore.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x14014eb9c
cmp dword [0x1402bff40], 0x3e
nop
jae 0x14014ebf1
xor r8d, r8d
lea rcx, str.shcore.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x14014ebf1
nop dword [rax]
cmp word [rcx], bp
jne 0x14014ebe7
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14014ebe7
cmp dword [rdx + rcx], 0x4550
jne 0x14014ebe7
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014ebe7
cmp dword [rdx + 4], edi
je 0x14014ebe7
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetDpiForMonitor
call fcn.14017e4c0
jmp 0x14014ebea
mov rax, rdi
mov qword [0x1402cdc18], rax
cmp dword [0x1402bff40], 0x66
jb 0x14014edcf
xor edx, edx
lea rcx, [0x1402675e0]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14014ec69
xor edx, edx
lea rcx, [0x1402675e0]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14014ec69
cmp dword [0x1402bff40], 0x3e
nop
jae 0x14014edcf
xor r8d, r8d
lea rcx, [0x1402675e0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x14014edcf
mov rsi, rbx
cmp word [rbx], bp
jne 0x14014ecb9
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014ecb9
cmp dword [rcx + rbx], 0x4550
jne 0x14014ecb9
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014ecb6
cmp dword [rdx + 4], edi
je 0x14014ecb6
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetDpiForWindow
mov rcx, rbx
call fcn.14017e4c0
jmp 0x14014ecbc
mov rsi, rbx
mov rax, rdi
mov qword [0x1402cdc68], rax
cmp word [rbx], bp
jne 0x14014ed0d
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014ed0d
cmp dword [rcx + rbx], 0x4550
jne 0x14014ed0d
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014ed0d
cmp dword [rdx + 4], edi
je 0x14014ed0d
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetDpiForSystem
mov rcx, rbx
call fcn.14017e4c0
jmp 0x14014ed10
mov rax, rdi
mov qword [0x1402cdbc8], rax
cmp word [rbx], bp
jne 0x14014ed67
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014ed67
cmp dword [rcx + rbx], 0x4550
jne 0x14014ed67
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014ed67
cmp dword [rdx + 4], edi
je 0x14014ed67
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetSystemMetricsForDpi
mov rcx, rbx
call fcn.14017e4c0
jmp 0x14014ed6a
mov rax, rdi
mov qword [0x1402cdbe8], rax
cmp word [rbx], bp
jne 0x14014edc8
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014edc8
cmp dword [rcx + rbx], 0x4550
jne 0x14014edc8
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014edc8
cmp dword [rdx + 4], edi
je 0x14014edc8
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.SystemParametersInfoForDpi
mov rcx, rbx
call fcn.14017e4c0
mov rdi, rax
mov qword [0x1402cdc80], rdi
xor ecx, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.14014ee00