Function at 0x140174d40
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x490]
sub rsp, 0x590
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov r13d, 0x5a4d
movzx r11d, r8w
mov rbx, rdx
mov r9, rcx
cmp word [rcx], r13w
jne 0x140175105
mov ecx, dword [rcx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140175105
cmp dword [r9 + rcx], 0x4550
lea r8, [r9 + rcx]
jne 0x140175105
mov eax, dword [r8 + 0x88]
test eax, eax
je 0x140175105
cmp dword [r8 + 0x8c], 0
je 0x140175105
cmp r11d, dword [r9 + rax + 0x18]
lea r10, [r9 + rax]
jae 0x1401751fd
lfence
mov ecx, dword [r10 + 0x20]
mov r14d, r11d
mov edi, dword [r10 + 0x1c]
add rcx, r9
mov esi, dword [r10 + 0x24]
add rdi, r9
add rsi, r9
mov rax, rdx
mov r11d, dword [rcx + r11*4]
add r11, r9
sub r11, rdx
movzx edx, byte [rax]
movzx ecx, byte [rax + r11]
sub edx, ecx
jne 0x140174e14
inc rax
test ecx, ecx
jne 0x140174e01
test edx, edx
jne 0x1401751fd
lfence
movzx eax, word [rsi + r14*2]
mov ebx, dword [rdi + rax*4]
add rbx, r9
cmp rbx, r10
jb 0x1401751f5
mov eax, dword ds:[r8 + 0x8c]
add rax, r10
cmp rbx, rax
jae 0x1401751f5
lfence
xor r12d, r12d
lea rcx, [rbp + 0x62]
mov r8d, 0x206
mov word [rbp + 0x60], r12w
call fcn.1401dff50
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], r12b
jne 0x140174e70
lea r8, [rbp + 0x60]
mov rcx, rbx
call sym.SystemInformer.exe_PhZeroExtendToUtf16Buffer
lea rdx, [rbp + 0x60]
xorps xmm1, xmm1
and rdx, 0xfffffffffffffff1
lea rcx, [rbp + 0x60]
and ecx, 0xf
je 0x140174eb6
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140174eb2
mov edx, ecx
shr rdx, 1
jmp 0x140174ef7
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140174ee5
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140174ed0
lea rax, [rbp + 0x60]
sub rdx, rax
mov eax, ecx
shr rax, 1
sar rdx, 1
add rdx, rax
lea r15, [rdx + rdx]
mov r9, r15
lea rcx, [rbp + 0x60]
shr r9, 1
mov r8, r15
mov rdx, r9
shr r8, 4
and edx, 7
test r8, r8
je 0x140174f4c
movdqa xmm1, xmmword [0x140288d10]
lea rcx, [rbp + 0x60]
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf r10d, eax
jne 0x140174f6e
add rcx, 0x10
sub r8, 1
jne 0x140174f30
test rdx, rdx
je 0x1401751f5
cmp word [rcx], 0x2e
je 0x140174f84
add rcx, 2
sub rdx, 1
jne 0x140174f55
mov rax, rbx
jmp 0x140175107
shl r8, 4
mov r9, r15
sub r9, r8
mov eax, r10d
shr r9, 1
shr rax, 1
add r9, rax
sub r9, rdx
cmp r9, 0xffffffffffffffff
je 0x1401751f5
lea rdi, [r9 + r9]
mov word [rbp + 0x270], r12w
sub r15, rdi
lea rsi, [rbp + 0x62]
xor edx, edx
lea rcx, [rbp + 0x272]
mov r8d, 0x206
add rsi, rdi
lea r14, [r15 - 2]
call fcn.1401dff50
nop
test rdi, rdi
je 0x140174fe5
lea rcx, [rbp + 0x270]
cmp rdi, 0x208
ja 0x1401750e5
mov r8, rdi
lea rdx, [rbp + 0x60]
call fcn.1401e3aa0
xor edx, edx
lea rcx, [rbp + 0x270]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x140175052
xor edx, edx
lea rcx, [rbp + 0x270]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x140175052
cmp dword [0x1402b5e88], 0x3e
jae 0x1401751f5
xor r8d, r8d
lea rcx, [rbp + 0x270]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x1401751f5
xor edx, edx
mov byte [rsp + 0x50], r12b
mov r8d, 0x103
lea rcx, [rsp + 0x51]
call fcn.1401dff50
mov r9, rsi
mov dword [rsp + 0x30], r12d
lea r8, [rsp + 0x30]
mov dword [rsp + 0x20], r14d
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlUnicodeToUTF8N]
test eax, eax
js 0x140175105
cmp byte [rsp + 0x50], 0x23
jne 0x140175197
lea rax, ds:[r15 - 4]
xor bl, bl
mov qword [rsp + 0x40], rax
lea rdx, [rsi + 2]
mov qword [rsp + 0x48], rdx
mov r9, rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
test rax, rax
je 0x140175131
movzx ecx, word [rdx]
cmp cx, 0x2d
je 0x1401750d4
cmp cx, 0x2b
jne 0x140175131
cmp cx, 0x2d
lea r11, [rdx + 2]
lea r9, [rax - 2]
sete bl
jmp 0x140175136
xor edx, edx
mov r8d, 0x208
call fcn.1401dff50
call fcn.1401ec10c
mov dword ds:[rax], 0x22
call fcn.1401ebfd0
xor eax, eax
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.1401dd6a0
mov rbx, qword [rsp + 0x5e8]
add rsp, 0x590
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r11, qword [rsp + 0x48]
shr r9, 1
mov r10b, 1
mov rcx, r12
mov rdx, r12
je 0x140175174
lea rsi, [0x1402835c0]
nop dword [rax + rax]
movzx eax, byte [r11 + rdx*2]
mov r8d, dword [rsi + rax*4]
cmp r8d, 0xa
jae 0x140175169
lea rcx, [rcx + rcx*4]
lea rcx, [r8 + rcx*2]
jmp 0x14017516c
xor r10b, r10b
inc rdx
cmp rdx, r9
jb 0x140175150
mov r8, rcx
neg r8
test bl, bl
cmove r8, rcx
test r10b, r10b
je 0x140175197
xor edx, edx
mov rcx, rdi
call fcn.1401746e0
mov rbx, rax
jmp 0x140175107
cmp word [rdi], r13w
jne 0x1401751f2
mov ecx, dword [rdi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401751f2
cmp dword [rcx + rdi], 0x4550
jne 0x1401751f2
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
cmp dword [rdx], r12d
je 0x1401751f2
cmp dword [rdx + 4], r12d
je 0x1401751f2
lfence
mov r8d, dword [rdx]
add r8, rdi
lfence
lea r9, [rsp + 0x50]
mov word [rsp + 0x20], r12w
mov rcx, rdi
call fcn.140174840
mov rbx, rax
jmp 0x140175107
mov rbx, r12
mov rax, rbx
jmp 0x140175107
xor r8d, r8d
mov rdx, rbx
mov rcx, r9
call fcn.1401746e0
jmp 0x140175107