Function at 0x1401758a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1402ce140]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x140175ada
cmp dword [0x1402bff40], 0x3f
mov ebp, 0x5a4d
jb 0x1401759da
lea r8, str.sechost.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140175914
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140175910
mov edx, ecx
shr rdx, 1
jmp 0x140175953
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140175945
nop dword [rax]
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140175930
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x14017597c
mov qword [0x1402ce140], rsi
jmp 0x1401759da
nop dword [rax]
cmp word [rax], bp
jne 0x1401759c7
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401759c7
cmp dword [rdx + rcx], 0x4550
jne 0x1401759c7
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401759c7
cmp dword [rdx + 4], esi
je 0x1401759c7
lea r8, [rcx + rax]
mov word [rsp + 0x20], si
lea r9, str.I_QueryTagInformation
call fcn.14017e4c0
jmp 0x1401759ca
mov rax, rsi
mov qword [0x1402ce140], rax
test rax, rax
jne 0x140175ada
lea r8, str.advapi32.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140175a10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140175a0c
mov edx, ecx
shr rdx, 1
jmp 0x140175a53
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140175a45
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140175a30
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x140175a7f
mov qword [0x1402ce140], rsi
jmp 0x140175c57
nop
cmp word [rax], bp
jne 0x140175ac7
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140175ac7
cmp dword [rdx + rcx], 0x4550
jne 0x140175ac7
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140175ac7
cmp dword [rdx + 4], esi
je 0x140175ac7
lea r8, [rcx + rax]
mov word [rsp + 0x20], si
lea r9, str.I_QueryTagInformation
call fcn.14017e4c0
jmp 0x140175aca
mov rax, rsi
mov qword [0x1402ce140], rax
test rax, rax
je 0x140175c57
xorps xmm0, xmm0
mov dword [rsp + 0x44], esi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], edi
mov edx, 2
mov qword [rsp + 0x48], rbx
xor ecx, ecx
movdqu xmmword [rsp + 0x50], xmm0
call qword [case.0x14013d84a.0]
cmp qword [rsp + 0x58], rsi
je 0x140175c54
mov rdx, qword [0x1402ca998]
mov ecx, 0x52
mov qword [rsp + 0x30], 0x40
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
add rax, 0x10
mov qword [rsp + 0x38], rdi
mov qword [rdi + 8], rax
mov word [rax + 0x40], si
mov qword [rdi], rsi
mov rax, qword [rdi + 8]
mov word [rax], si
mov rbx, qword [rsp + 0x58]
cmp word [rbx], si
je 0x140175c03
movaps xmmword [rsp + 0x60], xmm6
xorps xmm6, xmm6
nop
mov r8, rbx
lea rdx, [0x14028a3d0]
lea rcx, [rsp + 0x30]
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov rax, rbx
mov ecx, ebx
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x140175ba3
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
je 0x140175b9f
mov eax, ecx
shr rax, 1
jmp 0x140175be3
add rax, 0x10
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
jne 0x140175bd5
nop dword [rax]
nop dword [rax + rax]
add rax, 0x10
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
je 0x140175bc0
sub rax, rbx
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], si
jne 0x140175b60
movaps xmm6, xmmword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x38]
mov r8, qword [rdi]
test r8, r8
je 0x140175c48
mov rax, qword [rdi + 8]
mov rdx, r8
shr rdx, 1
sub rdx, 2
lea rcx, [rdx + rdx]
add rdx, 2
sub r8, rcx
add rcx, rax
sub r8, 4
lea rdx, [rax + rdx*2]
call fcn.14020af00
add qword [rdi], 0xfffffffffffffffc
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov word [rcx + rax], si
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
mov rsi, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret