Function at 0x14016bea0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1402c3418]
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rax, rax
jne 0x14016c0d6
cmp dword [0x1402b5e88], 0x3f
mov ebp, 0x5a4d
jb 0x14016bfda
lea r8, str.sechost.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14016bf14
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x14016bf10
mov edx, ecx
shr rdx, 1
jmp 0x14016bf53
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x14016bf45
nop dword [rax]
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x14016bf30
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x14016bf7c
mov qword [0x1402c3418], rbx
jmp 0x14016bfda
nop dword [rax]
cmp word [rax], bp
jne 0x14016bfc7
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016bfc7
cmp dword [rdx + rcx], 0x4550
jne 0x14016bfc7
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016bfc7
cmp dword [rdx + 4], ebx
je 0x14016bfc7
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.I_QueryTagInformation
call fcn.140174840
jmp 0x14016bfca
mov rax, rbx
mov qword [0x1402c3418], rax
test rax, rax
jne 0x14016c0d6
lea r8, str.advapi32.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14016c010
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x14016c00c
mov edx, ecx
shr rdx, 1
jmp 0x14016c053
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x14016c045
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x14016c030
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x14016c07f
mov qword [0x1402c3418], rbx
jmp 0x14016c11b
nop
cmp word [rax], bp
jne 0x14016c0c7
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016c0c7
cmp dword [rdx + rcx], 0x4550
jne 0x14016c0c7
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016c0c7
cmp dword [rdx + 4], ebx
je 0x14016c0c7
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.I_QueryTagInformation
call fcn.140174840
jmp 0x14016c0ca
mov rax, rbx
mov qword [0x1402c3418], rax
test rax, rax
je 0x14016c11b
xorps xmm0, xmm0
mov dword [rsp + 0x40], esi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x44], edi
mov edx, 1
xor ecx, ecx
movdqu xmmword [rsp + 0x48], xmm0
call qword [str.PB__]
mov rcx, qword ds:[rsp + 0x50]
test rcx, rcx
je 0x14016c118
call sym.SystemInformer.exe_PhCreateString
mov rcx, qword [rsp + 0x50]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret