Function at 0x140176280
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1402cf078]
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rax, rax
jne 0x1401764b6
cmp dword [0x1402c0f40], 0x3f
mov ebp, 0x5a4d
jb 0x1401763ba
lea r8, str.sechost.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x1401762f4
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x1401762f0
mov edx, ecx
shr rdx, 1
jmp 0x140176333
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140176325
nop dword [rax]
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140176310
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x14017635c
mov qword [0x1402cf078], rbx
jmp 0x1401763ba
nop dword [rax]
cmp word [rax], bp
jne 0x1401763a7
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401763a7
cmp dword [rdx + rcx], 0x4550
jne 0x1401763a7
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401763a7
cmp dword [rdx + 4], ebx
je 0x1401763a7
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.I_QueryTagInformation
call fcn.14017f180
jmp 0x1401763aa
mov rax, rbx
mov qword [0x1402cf078], rax
test rax, rax
jne 0x1401764b6
lea r8, str.advapi32.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x1401763f0
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x1401763ec
mov edx, ecx
shr rdx, 1
jmp 0x140176433
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140176425
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140176410
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.14017ede0
mov rcx, rax
test rax, rax
jne 0x14017645f
mov qword [0x1402cf078], rbx
jmp 0x1401764fb
nop
cmp word [rax], bp
jne 0x1401764a7
mov edx, dword [rax + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401764a7
cmp dword [rdx + rcx], 0x4550
jne 0x1401764a7
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401764a7
cmp dword [rdx + 4], ebx
je 0x1401764a7
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.I_QueryTagInformation
call fcn.14017f180
jmp 0x1401764aa
mov rax, rbx
mov qword [0x1402cf078], rax
test rax, rax
je 0x1401764fb
xorps xmm0, xmm0
mov dword [rsp + 0x40], esi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x44], edi
mov edx, 1
xor ecx, ecx
movdqu xmmword [rsp + 0x48], xmm0
call qword [case.0x14013dbaa.0]
mov rcx, qword ds:[rsp + 0x50]
test rcx, rcx
je 0x1401764f8
call sym.SystemInformer.exe_PhCreateString
mov rcx, qword [rsp + 0x50]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret