Function at 0x140175600
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1402ce148]
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rax, rax
jne 0x140175836
cmp dword [0x1402bff40], 0x3f
mov ebp, 0x5a4d
jb 0x14017573a
lea r8, str.sechost.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140175674
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140175670
mov edx, ecx
shr rdx, 1
jmp 0x1401756b3
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x1401756a5
nop dword [rax]
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140175690
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x1401756dc
mov qword [0x1402ce148], rbx
jmp 0x14017573a
nop dword [rax]
cmp word [rax], bp
jne 0x140175727
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140175727
cmp dword [rdx + rcx], 0x4550
jne 0x140175727
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140175727
cmp dword [rdx + 4], ebx
je 0x140175727
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.I_QueryTagInformation
call fcn.14017e4c0
jmp 0x14017572a
mov rax, rbx
mov qword [0x1402ce148], rax
test rax, rax
jne 0x140175836
lea r8, str.advapi32.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140175770
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x14017576c
mov edx, ecx
shr rdx, 1
jmp 0x1401757b3
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x1401757a5
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140175790
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14017e120
mov rcx, rax
test rax, rax
jne 0x1401757df
mov qword [0x1402ce148], rbx
jmp 0x14017587b
nop
cmp word [rax], bp
jne 0x140175827
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140175827
cmp dword [rdx + rcx], 0x4550
jne 0x140175827
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140175827
cmp dword [rdx + 4], ebx
je 0x140175827
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.I_QueryTagInformation
call fcn.14017e4c0
jmp 0x14017582a
mov rax, rbx
mov qword [0x1402ce148], rax
test rax, rax
je 0x14017587b
xorps xmm0, xmm0
mov dword [rsp + 0x40], esi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x44], edi
mov edx, 1
xor ecx, ecx
movdqu xmmword [rsp + 0x48], xmm0
call qword [case.0x14013d84a.0]
mov rcx, qword ds:[rsp + 0x50]
test rcx, rcx
je 0x140175878
call sym.SystemInformer.exe_PhCreateString
mov rcx, qword [rsp + 0x50]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret