Function at 0x140022bb0
Capabilities:
Access pe header

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x140022f17
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x140022f17
movsxd r8, dword [rbx + 0x3c]
movabs r12, 0xaabbcc11ffee00
movzx edx, word [r8 + rbx + 6]
lea eax, [rdx + rdx*4]
lea ecx, [r8 + rax*8]
movsxd rdi, ecx
add rdi, 0x108
add rdi, rbx
cmp qword [rdi], r12
jne 0x140022f17
cmp qword [rdi + 0x10], rbx
jne 0x140022f17
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r9, rax
test rdi, rdi
je 0x140022f20
movzx edx, byte [rdi + 0xc]
test dl, 2
je 0x140022f20
movzx r8d, word [rdi + 0xe]
test r8b, 1
jne 0x140022c61
or dl, 4
mov rcx, rbx
mov byte [rdi + 0xc], dl
call fcn.1400234c0
xor edi, edi
mov ecx, 0xc0000001
test eax, eax
cmovne ecx, edi
mov eax, ecx
add rsp, 0x30
pop r12
pop rdi
pop rbx
ret
mov qword [rsp + 0x28], r14
mov r14, qword [rdi + 0x38]
mov eax, dword [r14 + 0x40]
cmp dword [r9 + 0x50], eax
je 0x140022c7b
mov ecx, 7
int 0x29
test r8b, 8
je 0x140022cd2
test dword [rdi + 0x2c], 0xfffffffe
je 0x140022cd2
mov eax, dword [rdi + 0x2c]
cmp eax, 0xffffffff
je 0x140022cc0
mov ecx, 0xffff
cmp word [r14 + 0x6c], cx
jne 0x140022cb7
mov r14, qword [rsp + 0x28]
mov dword [rdi + 0x2c], 0xffffffff
xor edi, edi
mov eax, edi
add rsp, 0x30
pop r12
pop rdi
pop rbx
ret
test eax, eax
je 0x140022cc0
dec eax
mov dword [rdi + 0x2c], eax
mov r14, qword [rsp + 0x28]
xor edi, edi
mov eax, edi
add rsp, 0x30
pop r12
pop rdi
pop rbx
ret
or dl, 4
mov byte [rdi + 0xc], dl
test dl, 1
je 0x140022cef
mov rcx, qword [rdi + 0x10]
xor r8d, r8d
mov eax, dword [r9 + 0x28]
xor edx, edx
add rax, rcx
call rax
movzx eax, word [rdi + 0xe]
xor edi, edi
mov qword [rsp + 0x60], rsi
test al, 1
je 0x140022e7c
mov qword [rsp + 0x58], rbp
test al, 2
je 0x140022d20
mov rcx, rbx
call fcn.1400214f0
mov edi, eax
test eax, eax
jns 0x140022d20
mov ecx, 3
int 0x29
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov rbp, qword [rdx + 0x30]
mov rdx, qword [0x140398f48]
movzx ecx, byte [rdx + 0x14]
dec ecx
cmp ecx, 8
ja case.default.0x140022d5c
movsxd rax, ecx
lea r8, [0x140000000]
mov ecx, dword [r8 + rax*4 + 0x22f30]
add rcx, r8
jmp rcx
mov rcx, r14
call fcn.140021610
mov r8, qword [r14 + 0x98]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdx, qword [0x140398f48]
mov rcx, qword [rdx + 0x48]
mov rax, qword [rcx + 0x18]
test rax, rax
je case.0x140022d5c.2
mov rcx, qword [rcx]
lea rdx, [r14 + 0xc8]
call rax
mov rdx, qword [0x140398f48]
movzx eax, word [rdx + 0x16]
mov ecx, reloc.OLEAUT32.dll_SetErrorInfo
cmp ax, cx
je 0x140022db7
mov ecx, 0xe0
cmp ax, cx
jne case.0x140022d5c.1
mov qword [rsp + 0x20], r15
lea r15, [r14 + 0x98]
mov rsi, qword [r15]
cmp r15, rsi
je 0x140022df5
nop dword [rax + rax]
mov rcx, qword [rsi + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [0x140398ff0]
mov rsi, qword [rsi]
xor edx, edx
mov rcx, rbp
mov r8, qword [rsi + 8]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp r15, rsi
jne 0x140022dd0
mov r15, qword [rsp + 0x20]
mov r8, qword [r14 + 0x60]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8, qword [r14 + 0x50]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword [0x140398f48]
cmp byte [rax + 0x14], 3
jne 0x140022e60
mov rax, qword [r14 + 8]
mov rcx, qword [r14]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rax, qword [r14 + 0x18]
mov rcx, qword [r14 + 0x10]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rax, qword [r14 + 0x28]
mov rdx, qword [r14 + 0x20]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rax, qword [r14 + 0x78]
mov rdx, qword [r14 + 0x70]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov r8, r14
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140022e77
mov ecx, 7
int 0x29
mov rbp, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x140022f05
movsxd rdx, dword [rbx + 0x3c]
movzx ecx, word [rdx + rbx + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rsi, ecx
add rsi, 0x108
add rsi, rbx
cmp qword [rsi], r12
jne 0x140022f05
cmp qword [rsi + 0x10], rbx
jne 0x140022f05
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rsi, rsi
je 0x140022f0e
movzx eax, byte [rsi + 0xc]
and al, 6
cmp al, 2
je 0x140022f0e
cmp qword [rsi + 0x20], 0
je 0x140022ed8
mov rcx, rsi
call fcn.14001fed0
cmp qword [rsi + 0x10], 0
je 0x140022ef0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, qword [rsp + 0x60]
mov eax, edi
mov r14, qword [rsp + 0x28]
add rsp, 0x30
pop r12
pop rdi
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, 7
int 0x29
jmp 0x140022ef0
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov eax, 0xc0000008
add rsp, 0x30
pop r12
pop rdi
pop rbx
ret