Function at 0x1700352b0
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1188
call fcn.17006c0e4
sub rsp, rax
mov r14, r9
mov r15, r8
mov rbx, rdx
mov r13, rcx
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x280], xmm0
movzx eax, word [rsp + 0x280]
cmp ax, 9
jae 0x170035461
mov qword [rbx], 0
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x98], 0x40
mov qword [rsp + 0x90], r13
pxor xmm0, xmm0
movdqu xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0x28], 0x60
mov dword [rsp + 0x20], 5
lea rcx, [rsp + 0x50]
lea r8, [rsp + 0x80]
lea rsi, [rsp + 0xb0]
mov edx, 0x80100000
mov r9, rsi
call sym.ntdll.dll_NtOpenFile
cmp eax, 0xc0000034
je 0x17003551e
mov ebp, eax
cmp eax, 0xc000003a
je 0x17003551e
test ebp, ebp
jne 0x170035505
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x100]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x9009c
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_NtFsControlFile
test eax, eax
je 0x170035539
mov qword [rsp + 0x78], 0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 0x20
lea r9, [rsp + 0x78]
mov rcx, r15
mov edx, 0xf000d
xor r8d, r8d
call sym.ntdll.dll_NtCreateSection
mov ebp, eax
test eax, eax
jne 0x170035452
mov rcx, qword [r15]
mov qword [rsp + 0x20], 0
mov r9d, 0x40
mov edx, 1
mov r8, r14
call sym.ntdll.dll_NtQuerySection
movzx eax, word [r14 + 0x30]
cmp eax, 0x8664
je 0x170035450
mov rax, qword gs:[0x30]
cmp dword [rax + 0x180c], 0
je 0x17003563b
xor ebp, ebp
mov rcx, qword [rsp + 0x50]
call sym.ntdll.dll_NtClose
jmp 0x170035523
add eax, 0xfffffff8
mov word [rsp + 0x280], ax
add qword [rsp + 0x288], 8
mov rdx, qword [0x17008f570]
test rdx, rdx
je 0x1700354a2
add rdx, 0x48
lea rcx, [rsp + 0x280]
mov r8b, 1
call sym.ntdll.dll_RtlEqualUnicodeString
test al, al
je 0x1700354a2
mov rdi, qword [0x17008f570]
jmp 0x1700354f6
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rbp, qword [rax + 0x18]
add rbp, 0x10
lea rsi, [rsp + 0x280]
mov rdi, rbp
nop word cs:[rax + rax]
nop dword [rax]
mov rdi, qword [rdi]
cmp rdi, rbp
je 0x1700352f4
lea rdx, [rdi + 0x48]
mov rcx, rsi
mov r8b, 1
call sym.ntdll.dll_RtlEqualUnicodeString
test al, al
je 0x1700354d0
mov qword [0x17008f570], rdi
mov qword [rbx], rdi
xor ebp, ebp
test rdi, rdi
jne 0x170035523
jmp 0x1700352fb
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x280]
call sym.ntdll.dll_NtQueryAttributesFile
test eax, eax
je 0x170035523
mov ebp, 0xc0000135
mov eax, ebp
add rsp, 0x1188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x11f0]
movdqu xmm0, xmmword [rsp + 0x100]
movdqu xmmword [rax], xmm0
mov rcx, qword [0x17008f570]
test rcx, rcx
je 0x170035576
movdqu xmm0, xmmword [rcx + 0x118]
movdqu xmm1, xmmword [rax]
pcmpeqb xmm1, xmm0
pmovmskb edx, xmm1
cmp edx, 0xffff
je 0x1700355d4
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rdx, qword [rcx + 0x18]
add rdx, 0x10
mov rcx, rdx
nop
mov rcx, qword [rcx]
cmp rcx, rdx
je 0x1700355c8
movdqu xmm0, xmmword [rcx + 0x118]
movdqu xmm1, xmmword [rax]
pcmpeqb xmm1, xmm0
pmovmskb ebp, xmm1
cmp ebp, 0xffff
jne 0x170035590
mov qword [0x17008f570], rcx
mov qword [rbx], rcx
test rcx, rcx
jne 0x1700355d7
jmp 0x1700353d1
mov qword [rbx], 0
jmp 0x1700353d1
mov qword [rbx], rcx
test byte [0x17008d458], 8
je 0x17003562a
mov rcx, qword [r13 + 8]
call fcn.170030560
mov rsi, rax
mov rax, qword [rbx]
mov rdi, qword [rax + 0x30]
mov rcx, qword [rax + 0x50]
call fcn.170030560
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
lea rdx, [0x17008d458]
lea r8, str.open_dll_file
lea r9, str._s_is_the_same_file_as_existing_module__p__s_n
mov ecx, 3
call fcn.17002dd80
mov rcx, qword [rsp + 0x50]
call sym.ntdll.dll_NtClose
xor ebp, ebp
jmp 0x170035523
cmp byte [r14 + 0x32], 0
je 0x170035450
test byte [r14 + 0x33], 1
mov ebp, 0
jne 0x170035452
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x58], 0
lea rsi, [rsp + 0x58]
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0x40
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_NtReadFile
test eax, eax
jne 0x1700357d5
cmp qword [rsp + 0x70], 0x40
jne 0x1700357d5
movzx eax, word [rsp + 0xc0]
cmp eax, 0x5a4d
jne 0x1700357d5
mov eax, dword [rsp + 0xfc]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x140]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0xf8
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_NtReadFile
test eax, eax
jne 0x1700357d5
cmp qword [rsp + 0x70], 0xf8
jne 0x1700357d5
cmp dword [rsp + 0x140], 0x4550
jne 0x1700357d5
movzx eax, word [rsp + 0x158]
cmp eax, 0x10b
jne 0x1700357d5
mov r12d, dword [rsp + 0x228]
test r12d, r12d
je 0x1700357d5
cmp dword [rsp + 0x22c], 0x48
jb 0x1700357d5
movzx eax, word [rsp + 0x154]
mov rcx, qword [rsp + 0x58]
add rax, rcx
add rax, 0x18
mov qword [rsp + 0x58], rax
movzx eax, word [rsp + 0x146]
cmp eax, 0x60
mov edi, 0x60
cmovb edi, eax
lea eax, [rdi*8]
lea eax, [rax + rax*4]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x280]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x40], 0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_NtReadFile
test eax, eax
je 0x17003582c
test byte [0x17008d458], 8
je 0x170035813
mov rcx, r13
call fcn.170040430
movzx ecx, word [r14 + 0x30]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
lea rdx, [0x17008d458]
lea r8, str.open_dll_file
lea r9, str._s_is_for_arch__x__continuing_search_n
mov ecx, 3
call fcn.17002dd80
mov rcx, qword [r15]
call sym.ntdll.dll_NtClose
mov qword [r15], 0
mov ebp, 0x4000000e
jmp 0x170035452
mov eax, dword [rsp + 0x64]
cmp qword [rsp + 0x70], rax
jne 0x1700357d5
test edi, edi
je 0x1700357d5
xor ecx, ecx
jmp 0x170035848
add rcx, 0x28
cmp rax, rcx
je 0x1700357d5
mov edx, r12d
sub edx, dword [rsp + rcx + 0x28c]
jb 0x17003583f
mov edi, dword [rsp + rcx + 0x288]
test edi, edi
je 0x170035863
cmp edx, edi
jae 0x17003583f
add edx, dword [rsp + 0x294]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x238]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0x48
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_NtReadFile
test eax, eax
jne 0x1700357d5
cmp qword [rsp + 0x70], 0x48
jne 0x1700357d5
xor ebp, ebp
test byte [rsp + 0x248], 1
jne 0x170035452
jmp 0x1700357d5