Function at 0x17008
Capabilities:
Access pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebp, ebp
mov r12, rcx
mov r13d, ebp
mov dword [rax - 0x78], ebp
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
lea r8d, [rbp + 1]
lea r9, [rsp + 0x20]
mov rcx, r12
mov dl, r8b
mov r15, rax
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
mov rsi, rax
cmp rax, rbp
jne 0x1705c
xor eax, eax
jmp 0x17237
cmp dword [rax + 0xc], ebp
je 0x17234
cmp r13d, ebp
jl 0x17234
mov eax, dword [rsi]
cmp eax, ebp
jne 0x17077
mov eax, dword [rsi + 0x10]
mov edx, dword [rsi + 0xc]
mov edi, eax
xor eax, eax
lea rcx, [rsp + 0x48]
add rdx, r12
mov word [rsp + 0x28], bp
add rdi, r12
mov qword [rsp + 0x2a], rax
mov dword [rsp + 0x32], eax
mov word [rsp + 0x36], ax
mov word [rsp + 0x38], bp
mov qword [rsp + 0x3a], rax
mov dword [rsp + 0x42], eax
mov word [rsp + 0x46], ax
mov word [rsp + 0x58], bp
mov qword [rsp + 0x5a], rax
mov dword [rsp + 0x62], eax
mov word [rsp + 0x66], ax
mov word [rsp + 0x48], bp
mov qword [rsp + 0x4a], rax
mov dword [rsp + 0x52], eax
mov word [rsp + 0x56], ax
mov r14d, ebp
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
cmp qword [rsp + 0x30], rbp
je 0x17152
cmp word [rsp + 0x28], bp
jne 0x17110
mov word [rsp + 0x3a], bp
mov word [rsp + 0x38], bp
mov qword [rsp + 0x40], rbp
jmp 0x17152
movzx edx, word [rsp + 0x2a]
mov ecx, 1
mov r8d, 0x656e6f42
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
movzx ecx, word [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov r11, rax
mov qword [rsp + 0x40], rax
movzx eax, word [rsp + 0x2a]
mov word [rsp + 0x38], cx
mov r8, rcx
mov rcx, r11
mov word [rsp + 0x3a], ax
call fcn.000135b0
lea rcx, [rsp + 0x28]
xor edx, edx
call fcn.000121c0
mov rbx, rax
cmp rax, rbp
je 0x172c4
mov r10d, 0x20b
movzx ecx, word [r15 + 0x18]
cmp cx, r10w
jne 0x17180
mov rax, qword [rdi]
jmp 0x17182
mov eax, dword [rdi]
cmp rax, rbp
je 0x17211
cmp cx, r10w
jne 0x17196
mov r8, qword [rdi]
jmp 0x17199
mov r8d, dword [rdi]
cmp cx, r10w
jne 0x171a4
mov rdx, qword [rdi]
jmp 0x171a6
mov edx, dword [rdi]
cmp cx, r10w
mov eax, 0x80000000
movabs r9, 0x8000000000000000
cmove rax, r9
cmp rdx, rax
jae 0x171cd
lea rbp, [r8 + r12 + 2]
cmp byte [rbp], 0
jne 0x171dd
cmp cx, r10w
jne 0x171d8
mov rax, qword [rdi]
jmp 0x171da
mov eax, dword [rdi]
movzx ebp, ax
mov rcx, qword [rbx + 0x30]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbp
call fcn.00012434
mov r11, rax
test rax, rax
jne 0x17255
mov rcx, rbp
call fcn.00012a04
xor ebp, ebp
mov r11, rax
cmp rax, rbp
jne 0x17257
mov r13d, 0xc0000225
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
add rsi, 0x14
cmp dword [rsi + 0xc], ebp
jne 0x17065
mov eax, r13d
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor ebp, ebp
mov r10d, 0x20b
cmp word [r15 + 0x18], r10w
jne 0x17281
cmp dword [rsi + 0x10], ebp
je 0x17278
mov eax, dword [rsi + 0x10]
mov ecx, r14d
add rax, r12
mov qword [rcx + rax], r11
jmp 0x1729b
mov rax, qword [rdi]
mov qword [rax + r12], r11
jmp 0x1729b
cmp dword [rsi + 0x10], ebp
je 0x17295
mov eax, dword [rsi + 0x10]
mov ecx, r14d
add rax, r12
mov dword [rcx + rax], r11d
jmp 0x1729b
mov eax, dword [rdi]
mov dword [rax + r12], r11d
cmp word [r15 + 0x18], r10w
mov ecx, 4
lea edx, [rcx + 4]
mov rax, rcx
cmove rax, rdx
add rdi, rax
cmp word [r15 + 0x18], r10w
mov eax, ecx
cmove eax, edx
add r14d, eax
jmp 0x17170
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, 0xc0000225
jmp 0x17237