Function at 0x140176520
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1402cf070]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x14017675a
cmp dword [0x1402c0f40], 0x3f
mov ebp, 0x5a4d
jb 0x14017665a
lea r8, str.sechost.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140176594
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140176590
mov edx, ecx
shr rdx, 1
jmp 0x1401765d3
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x1401765c5
nop dword [rax]
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x1401765b0
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x1401765fc
mov qword [0x1402cf070], rsi
jmp 0x14017665a
nop dword [rax]
cmp word [rax], bp
jne 0x140176647
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140176647
cmp dword [rdx + rcx], 0x4550
jne 0x140176647
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140176647
cmp dword [rdx + 4], esi
je 0x140176647
lea r8, [rcx + rax]
mov word [rsp + 0x20], si
lea r9, str.I_QueryTagInformation
call fcn.14017f180
jmp 0x14017664a
mov rax, rsi
mov qword [0x1402cf070], rax
test rax, rax
jne 0x14017675a
lea r8, str.advapi32.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140176690
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x14017668c
mov edx, ecx
shr rdx, 1
jmp 0x1401766d3
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x1401766c5
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x1401766b0
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x1401766ff
mov qword [0x1402cf070], rsi
jmp 0x1401768d7
nop
cmp word [rax], bp
jne 0x140176747
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140176747
cmp dword [rdx + rcx], 0x4550
jne 0x140176747
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140176747
cmp dword [rdx + 4], esi
je 0x140176747
lea r8, [rcx + rax]
mov word [rsp + 0x20], si
lea r9, str.I_QueryTagInformation
call fcn.14017f180
jmp 0x14017674a
mov rax, rsi
mov qword [0x1402cf070], rax
test rax, rax
je 0x1401768d7
xorps xmm0, xmm0
mov dword [rsp + 0x44], esi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], edi
mov edx, 2
mov qword [rsp + 0x48], rbx
xor ecx, ecx
movdqu xmmword [rsp + 0x50], xmm0
call qword [case.0x14013dbaa.0]
cmp qword [rsp + 0x58], rsi
je 0x1401768d4
mov rdx, qword [0x1402cb8c0]
mov ecx, 0x52
mov qword [rsp + 0x30], 0x40
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
add rax, 0x10
mov qword [rsp + 0x38], rdi
mov qword [rdi + 8], rax
mov word [rax + 0x40], si
mov qword [rdi], rsi
mov rax, qword [rdi + 8]
mov word [rax], si
mov rbx, qword [rsp + 0x58]
cmp word [rbx], si
je 0x140176883
movaps xmmword [rsp + 0x60], xmm6
xorps xmm6, xmm6
nop
mov r8, rbx
lea rdx, [0x14028b730]
lea rcx, [rsp + 0x30]
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov rax, rbx
mov ecx, ebx
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x140176823
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
je 0x14017681f
mov eax, ecx
shr rax, 1
jmp 0x140176863
add rax, 0x10
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
jne 0x140176855
nop dword [rax]
nop dword [rax + rax]
add rax, 0x10
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
je 0x140176840
sub rax, rbx
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], si
jne 0x1401767e0
movaps xmm6, xmmword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x38]
mov r8, qword [rdi]
test r8, r8
je 0x1401768c8
mov rax, qword [rdi + 8]
mov rdx, r8
shr rdx, 1
sub rdx, 2
lea rcx, [rdx + rdx]
add rdx, 2
sub r8, rcx
add rcx, rax
sub r8, 4
lea rdx, [rax + rdx*2]
call fcn.14020be40
add qword [rdi], 0xfffffffffffffffc
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov word [rcx + rax], si
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
mov rsi, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret