Function at 0x140003d00
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov r12, r9
mov r15, r8
mov rbx, rdx
mov r13, rcx
mov r14, qword [0x1400f7448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, qword [r8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x60], 0
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rbp
mov rdi, rax
call rbp
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x438
lea rbp, [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
mov r8, rax
mov r9, rbp
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [rsp + 0x68], 0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x74], 0
mov qword [rsp + 0x78], 0
lea rcx, [0x1400f7a5a]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x78], rax
lea rax, [0x1400147a0]
mov qword [rsp + 0x20], rax
mov rcx, qword [0x1400f8038]
lea r9, [0x1400f7a6e]
mov rdx, r15
mov r8, rbp
call fcn.14000b7e0
test al, al
je 0x140003e3f
lea rax, [0x1400146b0]
mov qword [rsp + 0x20], rax
mov rcx, qword [0x1400f8028]
lea r9, str.LdrLoadDll
lea r8, [rsp + 0x40]
mov rdx, r15
call fcn.14000b8b0
test al, al
je 0x140003e5b
lea rcx, [rsp + 0xa0]
mov rdx, rbx
mov r8, r15
call fcn.1400039a0
mov al, byte [rsp + 0xb0]
test al, al
je 0x140003e77
mov byte [r13 + 0x10], al
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [r13], xmm0
jmp 0x140003ede
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
movabs rax, 0x8007050700000036
jmp 0x140003eda
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
movabs rax, 0x800705070000003c
jmp 0x140003eda
lea rcx, [0x1400f7a5a]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and rax, 0xfffffffffffffffc
je 0x140003ec0
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140003ec0
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140003ec0
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x140003ec0
mov ecx, dword [rax + rcx + 0x50]
cmp rcx, 0x148
jae 0x140003f4e
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
movabs rax, 0x800700c100000056
mov qword [r13 + 8], rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140003ef7
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003f10
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003f20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0xd0]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x1400041a8
mov rax, r13
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [r15 + 0x10]
test r12, r12
je 0x140003f87
lea r8, [0x1400f7a8c]
lea rcx, [rsp + 0x80]
xor r9d, r9d
call fcn.14000b980
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov al, byte [rsp + 0x90]
jmp 0x140003fd8
add rcx, rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rcx
mov byte [rsp + 0x90], 1
lea r8, [0x1400f7a8c]
lea rcx, [rsp + 0xb8]
lea r9, [rsp + 0x80]
call fcn.14000b980
mov rdi, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xc0]
mov al, byte [rsp + 0xc8]
mov rsi, r12
test al, al
je 0x140004017
shl rdi, 3
lea rcx, [rsp + 0xb8]
mov rdx, r15
call fcn.14000b690
mov rax, qword [r15 + 0x30]
test rax, rax
je 0x140004036
cmp qword [r15 + 0x10], rsi
ja 0x140004036
mov rdx, rsi
cmp qword [r15 + 0x20], rsi
jb 0x140004039
mov rcx, rsi
sub rcx, qword [r15 + 8]
add rax, rcx
mov rdx, rax
jmp 0x140004039
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
movabs rax, 0x8007000d0000006e
jmp 0x140003eda
mov rdx, rsi
mov rcx, qword [r15]
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rcx
lea rbp, [rsp + 0x98]
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x20], rbp
mov r8, rdi
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140004089
mov ecx, dword [rsp + 0x9c]
jmp 0x1400040a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x9c], ecx
test ecx, ecx
js 0x14000417c
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0xb8]
mov rdx, r15
mov r8, rsi
mov r9, r12
call fcn.14000b5b0
mov bl, byte [rsp + 0xc8]
test bl, bl
je 0x1400040e4
movups xmm0, xmmword [rsp + 0xb8]
movups xmmword [r13], xmm0
mov byte [r13 + 0x10], 1
cmp dword [rsp + 0x9c], 0
js 0x140004119
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r9d, dword [rsp + 0x98]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test bl, bl
jne 0x140003ede
mov r8, qword [0x1400f8040]
mov eax, dword [r8]
and eax, 2
cmp eax, 1
mov eax, 3
sbb eax, 0
mov dword [rsp + 0xb8], eax
mov qword [rsp + 0x20], 4
lea rcx, [rsp + 0x80]
lea r9, [rsp + 0xb8]
mov rdx, r15
call fcn.14000b5b0
cmp byte [rsp + 0x90], 0
je 0x14000419d
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [r13], xmm0
mov al, 1
jmp 0x14000419f
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_7913966da16e_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
mov dword [r13 + 8], 0x7a
mov dword [r13 + 0xc], ecx
jmp 0x140003ede
xor eax, eax
mov byte [r13 + 0x10], al
jmp 0x140003ede
call fcn.1400763e0
int3