Function at 0x1400177f0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x508
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
mov r13, qword [0x1401054a8]
mov rax, qword [r13]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov rdx, qword [rdx]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x70]
xor r8d, r8d
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x140017d4e
test byte [rsp + 0x9b], 1
je 0x140017d5e
mov r8, qword [rbx]
mov rax, qword [case.0x14001972e.0]
lea rdx, case.0x14001972e.0
lea rcx, [rsp + 0xb0]
call qword [rax + 0x58]
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x140017d4e
movzx ecx, word [rsp + 0xb0]
test cx, cx
je 0x140017d4e
movzx r8d, cx
mov ecx, r8d
and ecx, 0xfffffffe
add rcx, rax
add rcx, 0xfffffffffffffffe
mov rdx, rcx
cmp r8w, 2
jb 0x1400178cf
mov rdx, rcx
nop word cs:[rax + rax]
cmp word [rdx], 0x5c
je 0x1400178cf
add rdx, 0xfffffffffffffffe
cmp rdx, rax
jae 0x1400178c0
add rdx, 2
mov qword [rsp + 0x68], rdx
sub ecx, edx
add ecx, 2
mov word [rsp + 0x60], cx
mov word [rsp + 0x62], cx
movups xmm0, xmmword [0x140106298]
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov r12b, 1
mov r8b, 1
call sub.ntdll.dll_RtlCompareUnicodeString
xor r15d, r15d
test eax, eax
je 0x14001794e
lea rcx, [0x140148030]
call sub.ntdll.dll_RtlAcquireSRWLockShared
lea rcx, [0x140148018]
lea rdx, [0x14001a450]
xor r14d, r14d
xor r8d, r8d
xor r9d, r9d
call fcn.140102ab0
mov rbp, qword [0x140148028]
test rbp, rbp
je 0x14001799f
cmp dword [rbp], 3
jge 0x140017958
xor r14d, r14d
jmp 0x14001799f
xor ebp, ebp
xor r14d, r14d
jmp 0x140017ccd
mov eax, dword [0x14014803c]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
je 0x140017991
cmp byte [0x140148039], 0
je 0x140017991
mov eax, dword [0x140145660]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
jmp 0x140017996
call fcn.14001bdd0
lea r14, [rbp + 8]
test rax, rax
je 0x1400179fb
mov rdx, qword [rbx]
lea rcx, [rsp + 0x60]
mov r8, r14
call fcn.1400180a0
mov r15d, eax
xor ebp, ebp
lea rcx, [0x140148030]
call sub.ntdll.dll_RtlReleaseSRWLockShared
cmp r15d, 4
je 0x140017cc1
cmp r15d, 1
je 0x1400179e0
test r15d, r15d
jne 0x1400179ea
xor r15d, r15d
xor r14d, r14d
jmp 0x140017ccd
lea rcx, [rsp + 0x60]
call fcn.140018700
xor r12d, r12d
xor r14d, r14d
mov r15d, 1
jmp 0x140017ccd
xor ecx, ecx
call qword [rbp + 0x10]
mov r15, rax
and r15, 0xfffffffffffffffc
je 0x14001799f
movzx eax, word [r15]
cmp eax, 0x5a4d
jne 0x14001799f
movsxd rax, dword [r15 + 0x3c]
cmp dword [r15 + rax], 0x4550
jne 0x14001799f
movzx ecx, word [r15 + rax + 0x18]
cmp ecx, 0x20b
jne 0x14001799f
mov r8d, dword [r15 + rax + 0x50]
cmp r8d, 0x148
jb 0x14001799f
mov ecx, dword [r15 + rax + 0x84]
cmp ecx, 0x10
mov edx, 0x10
cmovb edx, ecx
cmp edx, 2
jb 0x14001799f
mov eax, dword [r15 + rax + 0x90]
cmp eax, r8d
jb 0x14001799f
cmp dword [r15 + rax], 0
je 0x14001799f
dec r8d
add rax, r15
xor ecx, ecx
mov dword [rsp + 0x4c], r8d
jmp 0x140017aa9
mov r8d, dword [rsp + 0x4c]
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x14], 0
lea rax, [rax + 0x14]
je 0x140017bbb
test cl, cl
jne 0x140017a9b
mov edx, dword [rax + 0xc]
cmp r8d, edx
jae 0x140017b0d
mov qword [rsp + 0x40], rax
add rdx, r15
lea rcx, [rsp + 0x4d0]
call sub.ntdll.dll_RtlInitAnsiString
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x4d0]
mov r8b, 1
call sub.ntdll.dll_RtlAnsiStringToUnicodeString
test eax, eax
js 0x140017b1e
movzx ecx, word [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
mov eax, ecx
and eax, 0xfffffffe
add rax, rdx
add rax, 0xfffffffffffffffe
cmp cx, 2
jae 0x140017b45
mov rcx, rax
jmp 0x140017b57
xor ecx, ecx
cmp dword [rax + 0x14], 0
lea rax, [rax + 0x14]
jne 0x140017aa9
jmp 0x14001799f
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov rax, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffe
jmp 0x140017b57
mov rcx, rax
cmp word [rcx], 0x5c
je 0x140017b57
add rcx, 0xfffffffffffffffe
cmp rcx, rdx
jae 0x140017b48
add rcx, 2
mov qword [rsp + 0x4d8], rcx
sub eax, ecx
add eax, 2
mov word [rsp + 0x4d0], ax
mov word [rsp + 0x4d2], ax
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x4d0]
mov r8b, 1
call sub.ntdll.dll_RtlCompareUnicodeString
test eax, eax
sete cl
cmp qword [rsp + 0xa8], 0
je 0x140017a91
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0xa0]
call sub.ntdll.dll_RtlFreeUnicodeString
mov ecx, dword [rsp + 0x38]
jmp 0x140017a91
test cl, cl
je 0x14001799f
lea rcx, [rsp + 0x4d0]
lea rdx, [rsp + 0xb0]
call fcn.140017e50
mov rdx, qword [rbx]
lea rcx, [rsp + 0x60]
mov r8, r14
call fcn.1400180a0
mov r15d, eax
and eax, 0xfffffffe
cmp eax, 2
jne 0x140017c45
mov r15, qword [rbx]
mov byte [rsp + 0x40], 1
test r15, r15
je 0x140017c4d
movzx eax, word [r15]
cmp eax, 0x5a4d
jne 0x140017c4d
movsxd rax, dword [r15 + 0x3c]
lea rcx, [r15 + rax]
mov qword [rsp + 0x38], rcx
cmp dword [r15 + rax], 0x4550
jne 0x140017c54
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140017c54
mov rax, qword [rsp + 0x38]
cmp dword [rax + 0x50], 0x148
setb byte [rsp + 0x40]
jmp 0x140017c54
mov bpl, 1
jmp 0x1400179b4
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0xa0], r14
lea rcx, [rsp + 0x4d0]
call qword [rbp + 0x18]
mov eax, dword [rsp + 0x4d4]
mov dword [rsp + 0xa8], eax
cmp byte [rsp + 0x40], 0
jne 0x140017d88
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x28]
add r15, rax
lea r9, [0x14001af80]
lea rcx, [rsp + 0x4d0]
lea rdx, [rsp + 0xa0]
mov r8, r15
call fcn.14001af90
test al, al
je 0x140017d88
lea rcx, [0x140148030]
call sub.ntdll.dll_RtlReleaseSRWLockShared
mov bpl, 1
mov r15d, 2
mov r14b, 1
xor r12d, r12d
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
cmp qword [rax + 0x30], 0
je 0x140017d49
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0x4d0]
mov ecx, 1
call sub.ntdll.dll_RtlDuplicateUnicodeString
test eax, eax
jns 0x140017d16
mov dword [rsp + 0x4d0], 0
mov qword [rsp + 0x4d8], 0
mov rdx, qword [rbx]
mov byte [rsp + 0x20], bpl
lea rcx, [rsp + 0x4d0]
mov r8d, esi
mov r9d, r15d
call fcn.1400187b0
cmp qword [rsp + 0x4d8], 0
je 0x140017d49
lea rcx, [rsp + 0x4d0]
call sub.ntdll.dll_RtlFreeUnicodeString
or r12b, r14b
jne 0x140017d5e
mov rdx, qword [rbx]
mov rcx, rdi
call sub.ntdll.dll_NtUnmapViewOfSection
mov esi, 0xc0000022
mov rax, qword [rsp + 0x500]
xor rax, rsp
mov rcx, qword [r13]
cmp rcx, rax
jne 0x140017d9c
mov eax, esi
add rsp, 0x508
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140148030]
call sub.ntdll.dll_RtlReleaseSRWLockShared
mov bpl, 1
jmp 0x1400179d5
call fcn.1400d58e0
int3