Function at 0x14016c140
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1402c3410]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x14016c37a
cmp dword [0x1402b5e88], 0x3f
mov ebp, 0x5a4d
jb 0x14016c27a
lea r8, str.sechost.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14016c1b4
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x14016c1b0
mov edx, ecx
shr rdx, 1
jmp 0x14016c1f3
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x14016c1e5
nop dword [rax]
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x14016c1d0
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x14016c21c
mov qword [0x1402c3410], rsi
jmp 0x14016c27a
nop dword [rax]
cmp word [rax], bp
jne 0x14016c267
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016c267
cmp dword [rdx + rcx], 0x4550
jne 0x14016c267
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016c267
cmp dword [rdx + 4], esi
je 0x14016c267
lea r8, [rcx + rax]
mov word [rsp + 0x20], si
lea r9, str.I_QueryTagInformation
call fcn.140174840
jmp 0x14016c26a
mov rax, rsi
mov qword [0x1402c3410], rax
test rax, rax
jne 0x14016c37a
lea r8, str.advapi32.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14016c2b0
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x14016c2ac
mov edx, ecx
shr rdx, 1
jmp 0x14016c2f3
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x14016c2e5
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x14016c2d0
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.140174480
mov rcx, rax
test rax, rax
jne 0x14016c31f
mov qword [0x1402c3410], rsi
jmp 0x14016c4f7
nop
cmp word [rax], bp
jne 0x14016c367
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016c367
cmp dword [rdx + rcx], 0x4550
jne 0x14016c367
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016c367
cmp dword [rdx + 4], esi
je 0x14016c367
lea r8, [rcx + rax]
mov word [rsp + 0x20], si
lea r9, str.I_QueryTagInformation
call fcn.140174840
jmp 0x14016c36a
mov rax, rsi
mov qword [0x1402c3410], rax
test rax, rax
je 0x14016c4f7
xorps xmm0, xmm0
mov dword [rsp + 0x44], esi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], edi
mov edx, 2
mov qword [rsp + 0x48], rbx
xor ecx, ecx
movdqu xmmword [rsp + 0x50], xmm0
call qword [str.PB__]
cmp qword [rsp + 0x58], rsi
je 0x14016c4f4
mov rdx, qword [0x1402bfcf8]
mov ecx, 0x52
mov qword [rsp + 0x30], 0x40
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
add rax, 0x10
mov qword [rsp + 0x38], rdi
mov qword [rdi + 8], rax
mov word [rax + 0x40], si
mov qword [rdi], rsi
mov rax, qword [rdi + 8]
mov word [rax], si
mov rbx, qword [rsp + 0x58]
cmp word [rbx], si
je 0x14016c4a3
movaps xmmword [rsp + 0x60], xmm6
xorps xmm6, xmm6
nop
mov r8, rbx
lea rdx, [0x1402826e8]
lea rcx, [rsp + 0x30]
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov rax, rbx
mov ecx, ebx
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x14016c443
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
je 0x14016c43f
mov eax, ecx
shr rax, 1
jmp 0x14016c483
add rax, 0x10
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
jne 0x14016c475
nop dword [rax]
nop dword [rax + rax]
add rax, 0x10
movdqa xmm0, xmm6
pcmpeqw xmm0, xmmword [rax]
pmovmskb ecx, xmm0
bsf edx, ecx
je 0x14016c460
sub rax, rbx
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], si
jne 0x14016c400
movaps xmm6, xmmword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x38]
mov r8, qword [rdi]
test r8, r8
je 0x14016c4e8
mov rax, qword [rdi + 8]
mov rdx, r8
shr rdx, 1
sub rdx, 2
lea rcx, [rdx + rdx]
add rdx, 2
sub r8, rcx
add rcx, rax
sub r8, 4
lea rdx, [rax + rdx*2]
call fcn.1401e3aa0
add qword [rdi], 0xfffffffffffffffc
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov word [rcx + rax], si
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
mov rsi, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret