Function at 0x140149540
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdx, qword [0x1402bfce0]
mov ecx, 0x48
call sym.SystemInformer.exe_PhCreateObject
mov rcx, qword [0x1402bfe50]
mov rbx, rax
mov edx, 4
mov dword [rax], 0x10
lea rax, [0x140143010]
mov qword [rbx + 8], rax
lea rax, [0x140143020]
lea r8d, [rdx + 0x3c]
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x18], 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbx + 0x18]
mov edx, 0xff
shl r8, 2
mov rcx, rax
mov qword [rbx + 0x20], rax
call fcn.1401dff50
mov eax, dword [rbx + 0x18]
mov edx, 4
mov rcx, qword [0x1402bfe50]
mov dword [rbx + 0x28], eax
lea r8, [rax + rax*2]
shl r8, 3
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [0x1402bfce0]
xor edi, edi
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x38], edi
mov dword [rbx + 0x3c], 0xffffffff
lea ecx, [rdi + 0x48]
mov dword [rbx + 0x40], edi
mov qword [0x1402c2f20], rbx
call sym.SystemInformer.exe_PhCreateObject
mov rcx, qword [0x1402bfe50]
lea edx, ds:[rdi + 4]
mov rbx, rax
lea r8d, [rdi + 0x40]
mov dword [rax], 0x18
lea rax, [0x14014c880]
mov qword [rbx + 8], rax
lea rax, [0x14014c8a0]
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x18], 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbx + 0x18]
mov edx, 0xff
shl r8, 2
mov rcx, rax
mov qword [rbx + 0x20], rax
call fcn.1401dff50
mov r8d, dword [rbx + 0x18]
lea edx, [rdi + 4]
mov rcx, qword [0x1402bfe50]
mov dword [rbx + 0x28], r8d
shl r8, 5
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov dword [rbx + 0x38], edi
mov r8d, 0x800
mov qword [rbx + 0x30], rax
lea rcx, str.uxtheme.dll
mov dword [rbx + 0x3c], 0xffffffff
mov dword [rbx + 0x40], edi
mov qword [0x1402c2ee8], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
mov ebp, 0x5a4d
test rax, rax
jne 0x1401496fd
xor edx, edx
lea rcx, str.uxtheme.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x1401496fd
cmp dword [0x1402b5e88], 0x3e
jae 0x140149a6f
xor r8d, r8d
lea rcx, str.uxtheme.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x140149a6f
nop dword [rax]
cmp word [rbx], bp
jne 0x14014974a
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14014974a
cmp dword [rcx + rbx], 0x4550
jne 0x14014974a
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14014974a
cmp dword [rdx + 4], edi
je 0x14014974a
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.OpenThemeDataForDpi
mov rcx, rbx
call fcn.140174840
jmp 0x14014974d
mov rax, rdi
mov qword [0x1402c2eb0], rax
cmp word [rbx], bp
jne 0x1401497a7
mov ecx, dword ds:[rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401497a7
cmp dword [rcx + rbx], 0x4550
jne 0x1401497a7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401497a7
cmp dword [rdx + 4], edi
je 0x1401497a7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.OpenThemeData
mov rcx, rbx
call fcn.140174840
jmp 0x1401497aa
mov rax, rdi
mov qword [0x1402c2ed0], rax
cmp word [rbx], bp
jne 0x140149807
mov ecx, dword ds:[rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140149807
cmp dword [rcx + rbx], 0x4550
jne 0x140149807
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140149807
cmp dword [rdx + 4], edi
je 0x140149807
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.CloseThemeData
mov rcx, rbx
call fcn.140174840
jmp 0x14014980a
mov rax, rdi
mov qword [0x1402c2f08], rax
cmp word [rbx], bp
jne 0x140149867
mov ecx, dword ds:[rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140149867
cmp dword [rcx + rbx], 0x4550
jne 0x140149867
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140149867
cmp dword [rdx + 4], edi
je 0x140149867
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.SetWindowTheme
mov rcx, rbx
call fcn.140174840
jmp 0x14014986a
mov rax, rdi
mov qword [0x1402c2e30], rax
cmp word [rbx], bp
jne 0x1401498c7
mov ecx, dword ds:[rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401498c7
cmp dword [rcx + rbx], 0x4550
jne 0x1401498c7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401498c7
cmp dword [rdx + 4], edi
je 0x1401498c7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.IsThemeActive
mov rcx, rbx
call fcn.140174840
jmp 0x1401498ca
mov rax, rdi
mov qword [0x1402c2f60], rax
cmp word [rbx], bp
jne 0x140149927
mov ecx, dword ds:[rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140149927
cmp dword [rcx + rbx], 0x4550
jne 0x140149927
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140149927
cmp dword [rdx + 4], edi
je 0x140149927
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.IsThemePartDefined
mov rcx, rbx
call fcn.140174840
jmp 0x14014992a
mov rax, rdi
mov qword [0x1402c2e90], rax
cmp word [rbx], bp
jne 0x140149987
mov ecx, dword ds:[rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140149987
cmp dword [rcx + rbx], 0x4550
jne 0x140149987
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140149987
cmp dword [rdx + 4], edi
je 0x140149987
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetThemeInt
mov rcx, rbx
call fcn.140174840
jmp 0x14014998a
mov rax, rdi
mov qword [0x1402c2e70], rax
cmp word [rbx], bp
jne 0x1401499e7
mov ecx, dword ds:[rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401499e7
cmp dword [rcx + rbx], 0x4550
jne 0x1401499e7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401499e7
cmp dword [rdx + 4], edi
je 0x1401499e7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetThemePartSize
mov rcx, rbx
call fcn.140174840
jmp 0x1401499ea
mov rax, rdi
mov qword [0x1402c2ed8], rax
cmp word [rbx], bp
jne 0x140149a47
mov ecx, dword ds:[rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140149a47
cmp dword [rcx + rbx], 0x4550
jne 0x140149a47
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140149a47
cmp dword [rdx + 4], edi
je 0x140149a47
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.DrawThemeBackground
mov rcx, rbx
call fcn.140174840
jmp 0x140149a4a
mov rax, rdi
cmp dword [0x1402b5e88], 0x72
mov qword [0x1402c2ec0], rax
jb 0x140149a6f
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x4a]
call fcn.1401746e0
mov qword [0x1402c2e60], rax
cmp dword [0x1402b5e88], 0x3f
jb 0x140149b2c
xor edx, edx
lea rcx, str.shcore.dll
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140149ad9
xor edx, edx
lea rcx, str.shcore.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
jne 0x140149ad9
cmp dword [0x1402b5e88], 0x3e
jae 0x140149b2c
xor r8d, r8d
lea rcx, str.shcore.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
test rax, rax
je 0x140149b2c
cmp word [rcx], bp
jne 0x140149b22
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140149b22
cmp dword [rdx + rcx], 0x4550
jne 0x140149b22
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140149b22
cmp dword [rdx + 4], edi
je 0x140149b22
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetDpiForMonitor
call fcn.140174840
nop
jmp 0x140149b25
mov rax, rdi
mov qword [0x1402c2ef8], rax
cmp dword [0x1402b5e88], 0x66
jb 0x140149d0f
xor edx, edx
lea rcx, [0x1402601c0]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x140149ba9
xor edx, edx
lea rcx, [0x1402601c0]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x140149ba9
cmp dword [0x1402b5e88], 0x3e
nop word [rax + rax]
jae 0x140149d0f
xor r8d, r8d
lea rcx, [0x1402601c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x140149d0f
cmp word [rbx], bp
jne 0x140149bf3
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140149bf3
cmp dword [rcx + rbx], 0x4550
jne 0x140149bf3
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140149bf3
cmp dword [rdx + 4], edi
je 0x140149bf3
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetDpiForWindow
mov rcx, rbx
call fcn.140174840
jmp 0x140149bf6
mov rax, rdi
mov qword [0x1402c2f40], rax
nop dword [rax]
cmp word [rbx], bp
jne 0x140149c4a
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140149c4a
cmp dword [rcx + rbx], 0x4550
jne 0x140149c4a
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140149c4a
cmp dword [rdx + 4], edi
je 0x140149c4a
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetDpiForSystem
mov rcx, rbx
call fcn.140174840
jmp 0x140149c4d
mov rax, rdi
mov qword [0x1402c2ea8], rax
cmp word [rbx], bp
jne 0x140149ca7
mov ecx, dword ds:[rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140149ca7
cmp dword [rcx + rbx], 0x4550
jne 0x140149ca7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140149ca7
cmp dword [rdx + 4], edi
je 0x140149ca7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.GetSystemMetricsForDpi
mov rcx, rbx
call fcn.140174840
jmp 0x140149caa
mov rax, rdi
mov qword [0x1402c2ec8], rax
cmp word [rbx], bp
jne 0x140149d08
mov ecx, dword ds:[rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140149d08
cmp dword [rcx + rbx], 0x4550
jne 0x140149d08
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140149d08
cmp dword [rdx + 4], edi
je 0x140149d08
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.SystemParametersInfoForDpi
mov rcx, rbx
call fcn.140174840
mov rdi, rax
mov qword [0x1402c2f58], rdi
xor ecx, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140149d40