Function at 0x140172ce0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1402c86d8]
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rax, rax
jne 0x140172f16
cmp dword [0x1402baf40], 0x3f
mov ebp, 0x5a4d
jb 0x140172e1a
lea r8, str.sechost.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140172d54
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140172d50
mov edx, ecx
shr rdx, 1
jmp 0x140172d93
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140172d85
nop dword [rax]
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140172d70
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x140172dbc
mov qword [0x1402c86d8], rbx
jmp 0x140172e1a
nop dword [rax]
cmp word [rax], bp
jne 0x140172e07
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140172e07
cmp dword [rdx + rcx], 0x4550
jne 0x140172e07
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140172e07
cmp dword [rdx + 4], ebx
je 0x140172e07
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.I_QueryTagInformation
call fcn.140177a80
jmp 0x140172e0a
mov rax, rbx
mov qword [0x1402c86d8], rax
test rax, rax
jne 0x140172f16
lea r8, str.advapi32.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140172e50
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140172e4c
mov edx, ecx
shr rdx, 1
jmp 0x140172e93
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140172e85
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140172e70
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.1401776c0
mov rcx, rax
test rax, rax
jne 0x140172ebf
mov qword [0x1402c86d8], rbx
jmp 0x140172f5b
nop
cmp word [rax], bp
jne 0x140172f07
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140172f07
cmp dword [rdx + rcx], 0x4550
jne 0x140172f07
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140172f07
cmp dword [rdx + 4], ebx
je 0x140172f07
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.I_QueryTagInformation
call fcn.140177a80
jmp 0x140172f0a
mov rax, rbx
mov qword [0x1402c86d8], rax
test rax, rax
je 0x140172f5b
xorps xmm0, xmm0
mov dword [rsp + 0x40], esi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x44], edi
mov edx, 1
xor ecx, ecx
movdqu xmmword [rsp + 0x48], xmm0
call qword [case.0x14013b5a0.0]
mov rcx, qword ds:[rsp + 0x50]
test rcx, rcx
je 0x140172f58
call sym.SystemInformer.exe_QiCreateString
mov rcx, qword [rsp + 0x50]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret