Function at 0x140174d80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1402ce128]
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rax, rax
jne 0x140174fb6
cmp dword [0x1402bff40], 0x3f
mov ebp, 0x5a4d
jb 0x140174eba
lea r8, str.sechost.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140174df4
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140174df0
mov edx, ecx
shr rdx, 1
jmp 0x140174e33
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140174e25
nop dword [rax]
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140174e10
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140174e5c
mov qword [0x1402ce128], rbx
jmp 0x140174eba
nop dword [rax]
cmp word [rax], bp
jne 0x140174ea7
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140174ea7
cmp dword [rdx + rcx], 0x4550
jne 0x140174ea7
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140174ea7
cmp dword [rdx + 4], ebx
je 0x140174ea7
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.I_QueryTagInformation
call fcn.14017dc40
jmp 0x140174eaa
mov rax, rbx
mov qword [0x1402ce128], rax
test rax, rax
jne 0x140174fb6
lea r8, str.advapi32.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x140174ef0
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x140174eec
mov edx, ecx
shr rdx, 1
jmp 0x140174f33
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140174f25
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140174f10
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14017d8a0
mov rcx, rax
test rax, rax
jne 0x140174f5f
mov qword [0x1402ce128], rbx
jmp 0x140174ffb
nop
cmp word [rax], bp
jne 0x140174fa7
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140174fa7
cmp dword [rdx + rcx], 0x4550
jne 0x140174fa7
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140174fa7
cmp dword [rdx + 4], ebx
je 0x140174fa7
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.I_QueryTagInformation
call fcn.14017dc40
jmp 0x140174faa
mov rax, rbx
mov qword [0x1402ce128], rax
test rax, rax
je 0x140174ffb
xorps xmm0, xmm0
mov dword [rsp + 0x40], esi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x44], edi
mov edx, 1
xor ecx, ecx
movdqu xmmword [rsp + 0x48], xmm0
call qword [case.0x14013d64a.0]
mov rcx, qword ds:[rsp + 0x50]
test rcx, rcx
je 0x140174ff8
call sym.SystemInformer.exe_PhCreateString
mov rcx, qword [rsp + 0x50]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret