Function at 0x7ff6ccb83d00
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov r12, r9
mov r15, r8
mov rbx, rdx
mov r13, rcx
mov r14, qword [0x7ff6ccc77448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, qword [r8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x60], 0
mov rbp, qword [0x7ff6cccb3fe8]
call rbp
mov rdi, rax
call rbp
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x438
lea rbp, [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
mov r8, rax
mov r9, rbp
call qword [0x7ff6cccb3f78]
mov dword [rsp + 0x68], 0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x74], 0
mov qword [rsp + 0x78], 0
lea rcx, [0x7ff6ccc77a5a]
call qword [0x7ff6cccb4178]
mov qword [rsp + 0x78], rax
lea rax, [0x7ff6ccb947a0]
mov qword [rsp + 0x20], rax
mov rcx, qword [0x7ff6ccc78038]
lea r9, [0x7ff6ccc77a6e]
mov rdx, r15
mov r8, rbp
call fcn.7ff6ccb8b7e0
test al, al
je 0x7ff6ccb83e3f
lea rax, [0x7ff6ccb946b0]
mov qword [rsp + 0x20], rax
mov rcx, qword [0x7ff6ccc78028]
lea r9, str.LdrLoadDll
lea r8, [rsp + 0x40]
mov rdx, r15
call fcn.7ff6ccb8b8b0
test al, al
je 0x7ff6ccb83e5b
lea rcx, [rsp + 0xa0]
mov rdx, rbx
mov r8, r15
call fcn.7ff6ccb839a0
mov al, byte [rsp + 0xb0]
test al, al
je 0x7ff6ccb83e77
mov byte [r13 + 0x10], al
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [r13], xmm0
jmp 0x7ff6ccb83ede
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_ee0e3ac21abb_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
movabs rax, 0x8007050700000036
jmp 0x7ff6ccb83eda
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_ee0e3ac21abb_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
movabs rax, 0x800705070000003c
jmp 0x7ff6ccb83eda
lea rcx, [0x7ff6ccc77a5a]
call qword [0x7ff6cccb4070]
and rax, 0xfffffffffffffffc
je 0x7ff6ccb83ec0
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x7ff6ccb83ec0
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x7ff6ccb83ec0
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x7ff6ccb83ec0
mov ecx, dword [rax + rcx + 0x50]
cmp rcx, 0x148
jae 0x7ff6ccb83f4e
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_ee0e3ac21abb_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
movabs rax, 0x800700c100000056
mov qword [r13 + 8], rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x7ff6ccb83ef7
call qword [0x7ff6cccb4300]
mov qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x7ff6ccb83f10
call qword [0x7ff6cccb3ef0]
mov qword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x7ff6ccb83f20
call qword [0x7ff6cccb3ef0]
mov rax, qword [rsp + 0xd0]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x7ff6ccb841a8
mov rax, r13
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [r15 + 0x10]
test r12, r12
je 0x7ff6ccb83f87
lea r8, [0x7ff6ccc77a8c]
lea rcx, [rsp + 0x80]
xor r9d, r9d
call fcn.7ff6ccb8b980
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov al, byte [rsp + 0x90]
jmp 0x7ff6ccb83fd8
add rcx, rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rcx
mov byte [rsp + 0x90], 1
lea r8, [0x7ff6ccc77a8c]
lea rcx, [rsp + 0xb8]
lea r9, [rsp + 0x80]
call fcn.7ff6ccb8b980
mov rdi, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xc0]
mov al, byte [rsp + 0xc8]
mov rsi, r12
test al, al
je 0x7ff6ccb84017
shl rdi, 3
lea rcx, [rsp + 0xb8]
mov rdx, r15
call fcn.7ff6ccb8b690
mov rax, qword [r15 + 0x30]
test rax, rax
je 0x7ff6ccb84036
cmp qword [r15 + 0x10], rsi
ja 0x7ff6ccb84036
mov rdx, rsi
cmp qword [r15 + 0x20], rsi
jb 0x7ff6ccb84039
mov rcx, rsi
sub rcx, qword [r15 + 8]
add rax, rcx
mov rdx, rax
jmp 0x7ff6ccb84039
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_ee0e3ac21abb_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
movabs rax, 0x8007000d0000006e
jmp 0x7ff6ccb83eda
mov rdx, rsi
mov rcx, qword [r15]
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rcx
lea rbp, [rsp + 0x98]
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x20], rbp
mov r8, rdi
mov r9d, 4
call qword [0x7ff6cccb4350]
test eax, eax
je 0x7ff6ccb84089
mov ecx, dword [rsp + 0x9c]
jmp 0x7ff6ccb840a4
call qword [0x7ff6cccb4048]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x9c], ecx
test ecx, ecx
js 0x7ff6ccb8417c
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0xb8]
mov rdx, r15
mov r8, rsi
mov r9, r12
call fcn.7ff6ccb8b5b0
mov bl, byte [rsp + 0xc8]
test bl, bl
je 0x7ff6ccb840e4
movups xmm0, xmmword [rsp + 0xb8]
movups xmmword [r13], xmm0
mov byte [r13 + 0x10], 1
cmp dword [rsp + 0x9c], 0
js 0x7ff6ccb84119
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r9d, dword [rsp + 0x98]
mov qword [rsp + 0x20], rbp
call qword [0x7ff6cccb4350]
test bl, bl
jne 0x7ff6ccb83ede
mov r8, qword [0x7ff6ccc78040]
mov eax, dword [r8]
and eax, 2
cmp eax, 1
mov eax, 3
sbb eax, 0
mov dword [rsp + 0xb8], eax
mov qword [rsp + 0x20], 4
lea rcx, [rsp + 0x80]
lea r9, [rsp + 0xb8]
mov rdx, r15
call fcn.7ff6ccb8b5b0
cmp byte [rsp + 0x90], 0
je 0x7ff6ccb8419d
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [r13], xmm0
mov al, 1
jmp 0x7ff6ccb8419f
mov byte [r13 + 0x10], 1
lea rax, str._var_tmp_build_firefox_ee0e3ac21abb_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r13], rax
mov dword [r13 + 8], 0x7a
mov dword [r13 + 0xc], ecx
jmp 0x7ff6ccb83ede
xor eax, eax
mov byte [r13 + 0x10], al
jmp 0x7ff6ccb83ede
call fcn.7ff6ccbf63e0
int3