Function at 0x140172f80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1402c86d0]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x1401731ba
cmp dword [0x1402baf40], 0x3f
mov ebp, 0x5a4d
jb 0x1401730ba
lea r8, str.sechost.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140172ff4
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140172ff0
mov edx, ecx
shr rdx, 1
jmp 0x140173033
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140173025
nop dword [rax]
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140173010
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14017305c
mov qword [0x1402c86d0], rsi
jmp 0x1401730ba
nop dword [rax]
cmp word [rax], bp
jne 0x1401730a7
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401730a7
cmp dword [rdx + rcx], 0x4550
jne 0x1401730a7
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401730a7
cmp dword [rdx + 4], esi
je 0x1401730a7
lea r8, [rcx + rax]
mov word [rsp + 0x20], si
lea r9, str.I_QueryTagInformation
call fcn.140177a80
jmp 0x1401730aa
mov rax, rsi
mov qword [0x1402c86d0], rax
test rax, rax
jne 0x1401731ba
lea r8, str.advapi32.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x1401730f0
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x1401730ec
mov edx, ecx
shr rdx, 1
jmp 0x140173133
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140173125
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140173110
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x14017315f
mov qword [0x1402c86d0], rsi
jmp 0x140173337
nop
cmp word [rax], bp
jne 0x1401731a7
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401731a7
cmp dword [rdx + rcx], 0x4550
jne 0x1401731a7
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401731a7
cmp dword [rdx + 4], esi
je 0x1401731a7
lea r8, [rcx + rax]
mov word [rsp + 0x20], si
lea r9, str.I_QueryTagInformation
call fcn.140177a80
jmp 0x1401731aa
mov rax, rsi
mov qword [0x1402c86d0], rax
test rax, rax
je 0x140173337
xorps xmm0, xmm0
mov dword [rsp + 0x44], esi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], edi
mov edx, 2
mov qword [rsp + 0x48], rbx
xor ecx, ecx
movdqu xmmword [rsp + 0x50], xmm0
call qword [case.0x14013b5a0.0]
cmp qword [rsp + 0x58], rsi
je 0x140173334
mov rdx, qword [0x1402c4fb8]
mov ecx, 0x52
mov qword [rsp + 0x30], 0x40
call sym.SystemInformer.exe_QiCreateObject
mov rdi, rax
add rax, 0x10
mov qword [rsp + 0x38], rdi
mov qword [rdi + 8], rax
mov word [rax + 0x40], si
mov qword [rdi], rsi
mov rax, qword [rdi + 8]
mov word [rax], si
mov rbx, qword [rsp + 0x58]
cmp word [rbx], si
je 0x1401732e3
movaps xmmword [rsp + 0x60], xmm6
xorps xmm6, xmm6
nop
mov r8, rbx
lea rdx, [0x140286f68]
lea rcx, [rsp + 0x30]
call sym.SystemInformer.exe_QiAppendFormatStringBuilder
mov rax, rbx
mov ecx, ebx
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x140173283
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
je 0x14017327f
mov eax, ecx
shr rax, 1
jmp 0x1401732c3
add rax, 0x10
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
jne 0x1401732b5
nop dword [rax]
nop dword [rax + rax]
add rax, 0x10
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
je 0x1401732a0
sub rax, rbx
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], si
jne 0x140173240
movaps xmm6, xmmword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x38]
mov r8, qword [rdi]
test r8, r8
je 0x140173328
mov rax, qword [rdi + 8]
mov rdx, r8
shr rdx, 1
sub rdx, 2
lea rcx, [rdx + rdx]
add rdx, 2
sub r8, rcx
add rcx, rax
sub r8, 4
lea rdx, [rax + rdx*2]
call fcn.1402074d0
add qword [rdi], 0xfffffffffffffffc
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov word [rcx + rax], si
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
mov rsi, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret