Function at 0x140175020
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1402ce120]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x14017525a
cmp dword [0x1402bff40], 0x3f
mov ebp, 0x5a4d
jb 0x14017515a
lea r8, str.sechost.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140175094
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140175090
mov edx, ecx
shr rdx, 1
jmp 0x1401750d3
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x1401750c5
nop dword [rax]
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x1401750b0
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x1401750fc
mov qword [0x1402ce120], rsi
jmp 0x14017515a
nop dword [rax]
cmp word [rax], bp
jne 0x140175147
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140175147
cmp dword [rdx + rcx], 0x4550
jne 0x140175147
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140175147
cmp dword [rdx + 4], esi
je 0x140175147
lea r8, [rcx + rax]
mov word [rsp + 0x20], si
lea r9, str.I_QueryTagInformation
call fcn.14017dc40
jmp 0x14017514a
mov rax, rsi
mov qword [0x1402ce120], rax
test rax, rax
jne 0x14017525a
lea r8, str.advapi32.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140175190
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x14017518c
mov edx, ecx
shr rdx, 1
jmp 0x1401751d3
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x1401751c5
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x1401751b0
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x1401751ff
mov qword [0x1402ce120], rsi
jmp 0x1401753d7
nop
cmp word [rax], bp
jne 0x140175247
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140175247
cmp dword [rdx + rcx], 0x4550
jne 0x140175247
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140175247
cmp dword [rdx + 4], esi
je 0x140175247
lea r8, [rcx + rax]
mov word [rsp + 0x20], si
lea r9, str.I_QueryTagInformation
call fcn.14017dc40
jmp 0x14017524a
mov rax, rsi
mov qword [0x1402ce120], rax
test rax, rax
je 0x1401753d7
xorps xmm0, xmm0
mov dword [rsp + 0x44], esi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], edi
mov edx, 2
mov qword [rsp + 0x48], rbx
xor ecx, ecx
movdqu xmmword [rsp + 0x50], xmm0
call qword [case.0x14013d64a.0]
cmp qword [rsp + 0x58], rsi
je 0x1401753d4
mov rdx, qword [0x1402ca978]
mov ecx, 0x52
mov qword [rsp + 0x30], 0x40
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
add rax, 0x10
mov qword [rsp + 0x38], rdi
mov qword [rdi + 8], rax
mov word [rax + 0x40], si
mov qword [rdi], rsi
mov rax, qword [rdi + 8]
mov word [rax], si
mov rbx, qword [rsp + 0x58]
cmp word [rbx], si
je 0x140175383
movaps xmmword [rsp + 0x60], xmm6
xorps xmm6, xmm6
nop
mov r8, rbx
lea rdx, [0x14028a378]
lea rcx, [rsp + 0x30]
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov rax, rbx
mov ecx, ebx
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x140175323
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
je 0x14017531f
mov eax, ecx
shr rax, 1
jmp 0x140175363
add rax, 0x10
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
jne 0x140175355
nop dword [rax]
nop dword [rax + rax]
add rax, 0x10
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
je 0x140175340
sub rax, rbx
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], si
jne 0x1401752e0
movaps xmm6, xmmword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x38]
mov r8, qword [rdi]
test r8, r8
je 0x1401753c8
mov rax, qword [rdi + 8]
mov rdx, r8
shr rdx, 1
sub rdx, 2
lea rcx, [rdx + rdx]
add rdx, 2
sub r8, rcx
add rcx, rax
sub r8, 4
lea rdx, [rax + rdx*2]
call fcn.14020a640
add qword [rdi], 0xfffffffffffffffc
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov word [rcx + rax], si
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
mov rsi, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret