Function at 0x14001229c
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x1400499b8]
xor rax, rsp
mov qword [rbp + 0x37], rax
movsx edi, byte [0x140049480]
mov eax, 0x11
movdqa xmm0, xmmword [0x140036860]
mov r15d, r8d
mov qword [rbp - 0x21], 0x4a817217
mov r12, rdx
mov word [rbp - 0x2d], ax
movsx eax, word [0x140049450]
mov byte [rbp - 0x30], 0x32
mov dword [rbp - 0x29], eax
movabs rax, 0xbf70b61e495cc
mov qword [rbp - 0x21], rax
movabs rax, 0x6ffa9e0d8c3d0
mov byte [rbp - 0x39], 0xa5
mov qword [rbp - 0x19], rax
mov esi, dword [0x140049478]
mov eax, dword [0x140049424]
movzx eax, word [0x14004949c]
mov word [rbp - 0x2d], ax
movzx eax, word [0x140049464]
mov word [rbp - 0x35], ax
mov rax, qword [0x1400494b0]
mov byte [rbp - 0x31], al
movabs rax, 0x313ba99a6b38d
mov qword [rbp - 0x21], rax
movzx eax, byte [0x1400493d6]
mov dword [rbp - 0x29], eax
mov eax, dword [0x140049484]
mov dword [rbp - 0x29], eax
mov eax, 0x55
movzx r14d, word [0x14004943c]
mov dword [rbp - 0x29], 1
mov word [rbp - 0x35], ax
mov rax, qword [0x140049470]
mov qword [rbp - 0x11], rax
mov rax, qword [0x1400494b8]
mov qword [rbp - 0x11], rax
movzx eax, word [0x140049480]
mov byte [rbp - 0x35], 0x9d
mov byte [rbp - 0x35], 0x5d
mov word [rbp - 0x35], ax
mov eax, 0xffffe166
mov byte [rbp - 0x35], 0xe4
mov word [rbp - 0x35], ax
mov al, byte [0x140049438]
mov byte [rbp - 0x35], al
mov al, byte [0x14004938f]
mov cl, byte [rbp - 0x39]
add cl, al
mov dword [rbp + 7], 0x96969690
mov byte [rbp - 0x39], cl
movzx eax, word [0x140049460]
mov rbx, qword gs:[0x30]
movdqu xmmword [rbp - 9], xmm0
mov dword [rbp + 0xb], 0x9e9e9e9e
mov byte [rbp + 0xf], 0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov byte [0x1400493d6], al
xor r8d, r8d
movsx eax, byte [rbp - 0x31]
movzx edx, byte [0x1400493d6]
mov rbx, qword [rbx + 0x60]
cmp edx, eax
setge r8b
xor eax, eax
cmp dl, 0x5d
setae al
cmp r8d, eax
je 0x14001243e
lea rcx, str.comdlg32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov word [rbp - 0x35], ax
jmp 0x14001246b
movsx ecx, byte [0x1400493d7]
mov eax, edi
add ecx, dword [0x1400494a8]
imul eax, dword [0x1400494ac]
not ecx
cmp eax, ecx
jne 0x14001246b
mov al, byte [rbp - 0x30]
movzx eax, byte [0x1400493b6]
mov word [0x140049460], ax
mov rax, qword [rbx + 0x18]
movups xmm0, xmmword [str.Content_Type]
movsd xmm1, qword [0x140036848]
mov rcx, qword [rax + 0x20]
movzx eax, word [0x140036850]
mov rdi, qword [rcx]
lea rcx, [rbp + 0x17]
movups xmmword [rbp + 0x17], xmm0
mov word [rbp + 0x2f], ax
movsd qword [rbp + 0x27], xmm1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x14004949c], eax
lea rbx, [rdi - 0x10]
mov rax, qword [0x140049488]
add rax, rsi
mov qword [0x140049488], rax
jmp 0x140012531
mov rax, qword [rbp - 0x19]
movzx ecx, word [0x140049454]
mov eax, 0xe56d
imul ecx, eax
mov eax, dword [rbp - 0x29]
add eax, 0x2a5a624e
cdqe
mov qword [0x140049470], rax
mov word [0x14004947c], cx
mov rcx, qword [rbx + 0x60]
call fcn.140011ce8
cmp eax, 0x18cf5f14
je 0x140012578
mov rax, qword [0x1400494b0]
test rax, rax
je 0x14001252e
movsxd rcx, dword [rbp - 0x29]
xor edx, edx
mov rax, qword [rbp - 0x21]
cmp rcx, rax
mov eax, dword [rbp - 0x29]
setbe dl
xor ecx, ecx
mov cl, al
movzx eax, word [rbp - 0x2d]
cmp edx, ecx
jb 0x14001252e
add al, 2
mov byte [str.7Expression], al
mov rbx, qword [rbx]
cmp qword [rbx], rdi
jne 0x1400124c0
mov ecx, dword [0x1400494a8]
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov word [0x140049444], ax
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400267f0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
movzx eax, word [0x14004946c]
mov r9d, r15d
mov edx, dword [rbx + 0x40]
mov r8, r12
mov rcx, qword [rbx + 0x30]
call fcn.140011678
jmp 0x14001254b