Function at 0x17000fd40
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x2188
call fcn.17006c0e4
sub rsp, rax
movaps xmmword [rsp + 0x2170], xmm6
cmp dword [rcx + 0x10], 0
je 0x170010bd1
mov rdi, rcx
xor r14d, r14d
xorps xmm6, xmm6
mov r13, qword [str.C:windows]
mov qword [rsp + 0x68], rcx
jmp 0x17000fda0
add r14, 1
mov eax, dword [rdi + 0x10]
cmp r14, rax
jae 0x170010bd1
mov rbx, qword [rdi + 8]
imul rbp, r14, 0x38
lea r12, [rbx + rbp]
test byte [0x17008d130], 8
je 0x17000fe2b
mov rcx, qword [r12]
mov edx, 0xffffffff
call fcn.170014e40
mov r15, rax
movzx edx, word [rbx + rbp + 0x28]
movzx r8d, word [rbx + rbp + 0x2a]
movzx r9d, word [rbx + rbp + 0x2c]
movzx eax, word [rbx + rbp + 0x2e]
mov dword [rsp + 0x20], eax
lea rcx, [0x17006dc22]
call fcn.170015080
mov rsi, rdi
mov rdi, rax
mov rcx, qword [rbx + rbp + 8]
mov edx, 0xffffffff
call fcn.170014e40
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov rdi, rsi
mov qword [rsp + 0x20], r15
mov ecx, 3
lea r8, str.lookup_assembly
lea r9, str.looking_for_name_s_version_s_arch_s_n
call fcn.17000f350
mov r15d, 0xc000000f
cmp qword [rbx + rbp + 8], 0
je 0x17000ffa0
cmp qword [r12], 0
je 0x17000ffa0
cmp qword [rbx + rbp + 0x10], 0
je 0x17000ffa0
mov rax, qword gs:[0x30]
mov qword [rsp + 0xa0], rax
mov rax, qword [rax + 0x60]
mov rsi, qword [rax + 0x30]
mov rcx, r13
call sym.ntdll.dll_wcslen
lea r8, [rax + rax]
add r8, 0x24
mov rcx, rsi
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x17000ff8f
mov rsi, rax
mov qword [rsp + 0x60], rbx
mov rcx, rax
mov rdx, r13
call sym.ntdll.dll_wcscpy
mov rcx, rsi
lea rdx, str.winsxsmanifests
call sym.ntdll.dll_wcscat
mov rcx, rsi
lea r13, [rsp + 0xd0]
mov rdx, r13
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_RtlDosPathNameToNtPathName_U
mov ebx, eax
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rsi
call sym.ntdll.dll_RtlFreeHeap
test bl, bl
je 0x170010b2c
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x88], rbp
mov dword [rsp + 0x140], 0x30
mov qword [rsp + 0x148], 0
mov dword [rsp + 0x158], 0x40
mov qword [rsp + 0x150], r13
lea rax, [rsp + 0x160]
movups xmmword [rax], xmm6
mov dword [rsp + 0x28], 0x21
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0xa8]
mov edx, 0x80100000
lea r8, [rsp + 0x140]
lea r9, [rsp + 0x130]
call sym.ntdll.dll_NtOpenFile
test eax, eax
mov rbx, qword [rsp + 0x60]
je 0x1700104cf
lea rcx, [rsp + 0xd0]
call sym.ntdll.dll_RtlFreeUnicodeString
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x70]
jmp 0x170010b31
mov r15d, 0xc0000017
nop word cs:[rax + rax]
nop
cmp r15d, 0xc000000f
jne 0x170010702
mov r15, r12
mov qword [rsp + 0x60], rbx
mov rax, qword [rdi]
mov rax, qword [rax + 0x28]
mov rcx, qword [rax + 0x48]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_RtlGetFullPathName_U
mov esi, eax
shr esi, 1
mov r13, rdi
mov rdi, qword [rdi]
mov rcx, qword [rdi + 0x20]
call sym.ntdll.dll_wcslen
cmp rax, rsi
jae 0x17000fffc
mov rax, qword [rdi + 0x28]
mov rcx, qword [rax + 0x48]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_RtlGetFullPathName_U
shr eax, 1
mov qword [rsp + 0x148], 0
mov r12, qword gs:[0x30]
mov rcx, qword [r12 + 0x60]
mov rsi, qword [rcx + 0x30]
mov qword [rsp + 0x80], rax
mov edi, eax
mov rcx, qword [r15]
call sym.ntdll.dll_wcslen
lea rax, [rdi + rax*2]
lea r8, [rax + rax]
add r8, 0x18
mov rcx, rsi
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x170010454
mov rbx, rax
mov qword [rsp + 0x98], r14
mov rdx, qword [rsp + 0x60]
lea rax, [rdx + rbp]
add rax, 8
mov rdi, qword [rax]
test rdi, rdi
lea rax, str.none
cmove rdi, rax
mov r14, qword [rdx + rbp + 0x10]
test r14, r14
cmove r14, rax
mov rcx, r15
mov qword [rsp + 0x88], rbp
mov r15, qword [rdx + rbp + 0x18]
test r15, r15
cmove r15, rax
mov qword [rsp + 0x70], rcx
mov r13, qword [rcx]
test r13, r13
cmove r13, rax
mov rcx, rdi
call sym.ntdll.dll_wcslen
mov qword [rsp + 0x90], rax
mov rcx, r13
call sym.ntdll.dll_wcslen
mov rbp, rax
mov rcx, r14
call sym.ntdll.dll_wcslen
mov rsi, rax
mov rcx, r15
call sym.ntdll.dll_wcslen
add rbp, qword [rsp + 0x90]
add rbp, rsi
add rbp, rax
lea rsi, [rbp + 0x4a]
add rsi, rbp
mov qword [rsp + 0x90], r12
mov rax, qword [r12 + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rsi
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x170010469
mov rbp, rax
mov rcx, rax
mov rdx, rdi
call sym.ntdll.dll_wcscpy
mov rcx, rbp
lea r12, [0x17006ed8c]
mov rdx, r12
call sym.ntdll.dll_wcscat
mov rcx, rbp
mov rdx, r13
call sym.ntdll.dll_wcscat
mov rcx, rbp
mov rdx, r12
call sym.ntdll.dll_wcscat
mov rcx, rbp
mov rdx, r14
call sym.ntdll.dll_wcscat
mov rcx, rbp
mov rdx, r12
call sym.ntdll.dll_wcscat
mov rcx, rbp
call sym.ntdll.dll_wcslen
lea rcx, [rax*2]
add rcx, rbp
sub rsi, rax
mov rdi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x88]
movzx r9d, word [rdi + rax + 0x28]
movzx r8d, word [rdi + rax + 0x2a]
movzx edx, word [rdi + rax + 0x2c]
movzx edi, word [rdi + rax + 0x2e]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
mov rdx, rsi
lea r8, [0x17006ed90]
call fcn.17001c0e0
mov rcx, rbp
mov rdx, r12
call sym.ntdll.dll_wcscat
mov rcx, rbp
mov rdx, r15
call sym.ntdll.dll_wcscat
mov rcx, rbp
mov rdx, r12
call sym.ntdll.dll_wcscat
mov qword [rsp + 0x60], rbp
mov rcx, rbp
lea rdx, str.deadbeef
call sym.ntdll.dll_wcscat
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rdx, qword [rax + 0x20]
mov rcx, rbx
call sym.ntdll.dll_wcscpy
mov rcx, rbx
call sym.ntdll.dll_wcslen
lea rax, [rbx + rax*2]
mov qword [rsp + 0xb0], rax
mov r14, qword [rsp + 0x80]
add r14d, r14d
mov r15d, 0xc000000f
mov edi, 4
lea r12, [rsp + 0x190]
lea r13, [rsp + 0xb0]
jmp 0x17001024f
mov r15d, 0xc0150004
add edi, 0xffffffff
je 0x1700106ab
cmp edi, 2
jne 0x170010280
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rax, qword [rax + 0x28]
mov rcx, qword [rax + 0x48]
mov edx, r14d
mov r8, rbx
mov r9, r13
call sym.ntdll.dll_RtlGetFullPathName_U
test eax, eax
jne 0x170010299
jmp 0x1700106ab
mov rax, qword [rsp + 0xb0]
lea rcx, [rax + 2]
mov qword [rsp + 0xb0], rcx
mov word [rax], 0x5c
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
call sym.ntdll.dll_wcscpy
mov rsi, qword [rsp + 0xb0]
mov rcx, rsi
call sym.ntdll.dll_wcslen
lea rcx, [rsi + rax*2]
mov qword [rsp + 0xb0], rcx
lea rdx, [0x17006ec92]
call sym.ntdll.dll_wcscpy
mov rcx, rbx
lea rbp, [rsp + 0x140]
mov rdx, rbp
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_RtlDosPathNameToNtPathName_U
test al, al
je 0x1700103b5
mov dword [rsp + 0x170], 0x30
mov qword [rsp + 0x178], 0
mov dword [rsp + 0x188], 0x40
mov qword [rsp + 0x180], rbp
movups xmmword [r12], xmm6
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0xc0]
mov edx, 0x80100000
lea r8, [rsp + 0x170]
lea r9, [rsp + 0xf0]
call sym.ntdll.dll_NtOpenFile
test eax, eax
jne 0x1700103ad
mov r8, qword [rsp + 0x148]
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 1
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov r9, qword [rsp + 0x60]
call fcn.17000f9a0
mov esi, eax
mov rcx, qword [rsp + 0xc0]
call sym.ntdll.dll_NtClose
test esi, esi
je 0x1700106a8
mov rcx, rbp
call sym.ntdll.dll_RtlFreeUnicodeString
mov rcx, qword [rsp + 0xb0]
lea rdx, str..manifest
call sym.ntdll.dll_wcscpy
mov rcx, rbx
mov rdx, rbp
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_RtlDosPathNameToNtPathName_U
test al, al
je 0x170010240
mov dword [rsp + 0x170], 0x30
mov qword [rsp + 0x178], 0
mov dword [rsp + 0x188], 0x40
mov qword [rsp + 0x180], rbp
movups xmmword [r12], xmm6
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0xc0]
mov edx, 0x80100000
lea r8, [rsp + 0x170]
lea r9, [rsp + 0xf0]
call sym.ntdll.dll_NtOpenFile
test eax, eax
je 0x170010489
mov rcx, rbp
call sym.ntdll.dll_RtlFreeUnicodeString
jmp 0x170010240
mov r15d, 0xc0000017
mov rdi, r13
mov r13, qword [str.C:windows]
jmp 0x170010702
mov r15d, 0xc0000017
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
jmp 0x1700106e1
mov r8, qword [rsp + 0x148]
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov r9, qword [rsp + 0x60]
call fcn.17000fb70
mov r15d, eax
mov rcx, qword [rsp + 0xc0]
call sym.ntdll.dll_NtClose
jmp 0x1700106ab
mov qword [rsp + 0x98], r14
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x120], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmm2, xmmword [rcx + 0x20]
movaps xmmword [rsp + 0x110], xmm2
movaps xmmword [rsp + 0x100], xmm1
movaps xmmword [rsp + 0xf0], xmm0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xe8], rax
mov rbx, qword [rsp + 0x108]
test rbx, rbx
je 0x17001053b
mov rcx, rbx
lea rdx, [0x17006ed32]
call sym.ntdll.dll__wcsicmp
test eax, eax
jne 0x170010542
lea rbx, [0x17006dbce]
mov r14, qword [rsp + 0xf8]
mov rcx, r14
call sym.ntdll.dll_wcslen
mov r12, rax
mov rbp, qword [rsp + 0xf0]
mov rcx, rbp
call sym.ntdll.dll_wcslen
mov rsi, rax
mov r13, qword [rsp + 0x100]
mov rcx, r13
call sym.ntdll.dll_wcslen
mov rdi, rax
mov rcx, rbx
call sym.ntdll.dll_wcslen
add esi, r12d
add edi, esi
add edi, eax
add edi, 0x35
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
lea r8, [rdi + rdi]
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x17001072a
mov rsi, rax
movzx eax, word [rsp + 0x118]
movzx ecx, word [rsp + 0x11a]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov rdx, rdi
lea r8, str._s__s__s__u._u..__s_.manifest
mov r9, r14
call fcn.17001c0e0
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov rdx, rsi
call sym.ntdll.dll_RtlInitUnicodeString
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 0x170]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x50], 1
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 0x2000
mov rcx, qword [rsp + 0xe8]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_NtQueryDirectoryFile
test eax, eax
je 0x170010756
test byte [0x17008d130], 4
mov r14, qword [rsp + 0x98]
lea r12, [rsp + 0x190]
je 0x17001069c
mov rcx, rsi
mov edx, 0xffffffff
call fcn.170014e40
mov qword [rsp + 0x20], rax
mov ecx, 2
lea r8, str.lookup_manifest_file
lea r9, str.no_matching_file_for__s_n
call fcn.17000f350
xor ebp, ebp
mov rbx, qword [rsp + 0x60]
jmp 0x1700109b4
xor r15d, r15d
lea rcx, [rsp + 0x140]
call sym.ntdll.dll_RtlFreeUnicodeString
mov rsi, qword [rsp + 0x90]
mov rax, qword [rsi + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, qword [rsp + 0x60]
call sym.ntdll.dll_RtlFreeHeap
mov r14, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x68]
mov rax, qword [rsi + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rbx
call sym.ntdll.dll_RtlFreeHeap
mov r13, qword [str.C:windows]
mov rbp, qword [rsp + 0x88]
test r15d, r15d
je 0x17000fd90
mov rax, qword [rdi + 8]
cmp dword [rax + rbp + 0x30], 0
jne 0x17000fd90
cmp dword [rax + rbp + 0x34], 0
jne 0x17000fd90
jmp 0x170010bf1
xor ebp, ebp
mov r14, qword [rsp + 0x98]
lea r12, [rsp + 0x190]
lea rdi, [rsp + 0xb0]
mov rbx, qword [rsp + 0x60]
mov r13, qword [rsp + 0xa0]
jmp 0x1700109ce
mov qword [rsp + 0x90], rsi
movzx eax, word [rsp + 0x11c]
mov dword [rsp + 0x80], eax
movzx eax, word [rsp + 0x11e]
mov dword [rsp + 0x7c], eax
mov r13d, dword [rsp + 0xc8]
xor edi, edi
xor ebp, ebp
mov qword [rsp + 0xe0], rbp
nop dword [rax]
cmp edi, r13d
mov rsi, qword [rsp + 0x90]
jb 0x170010805
lea rdi, [rsp + 0xb0]
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 0x170]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 0x2000
mov rcx, qword [rsp + 0xe8]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sym.ntdll.dll_NtQueryDirectoryFile
test eax, eax
jne 0x170010997
mov r13d, dword [rsp + 0xc8]
xor edi, edi
mov ebx, edi
lea r12, [rsp + rbx]
add r12, 0x170
mov eax, dword [rsp + rbx + 0x170]
add edi, eax
test eax, eax
cmove edi, r13d
mov rcx, rsi
mov dx, 0x2a
call sym.ntdll.dll_wcschr
sub rax, rsi
lea rsi, [rax + r12]
add rsi, 0x5e
mov rcx, rsi
xor edx, edx
mov r8d, 0xa
call sym.ntdll.dll_wcstoul
cmp eax, dword [rsp + 0x80]
jb 0x170010790
mov r14d, eax
mov rcx, rsi
mov dx, 0x2e
call sym.ntdll.dll_wcschr
mov rsi, rax
add rsi, 2
mov rcx, rsi
xor edx, edx
mov r8d, 0xa
call sym.ntdll.dll_wcstoul
mov ebp, eax
cmp r14d, dword [rsp + 0x80]
jne 0x170010891
cmp ebp, dword [rsp + 0x7c]
jb 0x170010790
add rbx, rsp
add rbx, 0x1ce
mov rcx, rsi
mov dx, 0x5f
call sym.ntdll.dll_wcschr
lea rcx, [rax + 2]
mov dx, 0x5f
call sym.ntdll.dll_wcschr
add rax, 2
mov ecx, dword [r12 + 0x3c]
mov rdx, rbx
sub rdx, rax
add rdx, rcx
cmp rdx, 0x22
jne 0x170010915
mov r8d, 0x11
mov rcx, rax
lea rdx, str.deadbeef.manifestneutral
call sym.ntdll.dll__wcsnicmp
test eax, eax
jne 0x1700108f4
cmp qword [rsp + 0xe0], 0
jne 0x170010790
test eax, eax
mov eax, dword [rsp + 0x80]
cmovne eax, r14d
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x7c]
cmovne eax, ebp
mov dword [rsp + 0x7c], eax
jmp 0x170010921
mov dword [rsp + 0x80], r14d
mov dword [rsp + 0x7c], ebp
mov word [rsp + 0x11c], r14w
mov word [rsp + 0x11e], bp
mov rsi, qword [rsp + 0xa0]
mov rax, qword [rsi + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, qword [rsp + 0xe0]
call sym.ntdll.dll_RtlFreeHeap
mov rax, qword [rsi + 0x60]
mov rcx, qword [rax + 0x30]
mov r8d, dword [r12 + 0x3c]
add r8, 2
xor edx, edx
call sym.ntdll.dll_RtlAllocateHeap
mov rbp, rax
test rax, rax
je 0x170010785
mov esi, dword [r12 + 0x3c]
mov rcx, rbp
mov rdx, rbx
mov r8, rsi
call sym.ntdll.dll_memcpy
and esi, 0xfffffffe
mov word [rbp + rsi], 0
jmp 0x170010785
mov r14, qword [rsp + 0x98]
lea r12, [rsp + 0x190]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xe0]
mov r13, qword [rsp + 0xa0]
mov rax, qword [r13 + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rsi
call sym.ntdll.dll_RtlFreeHeap
mov rcx, qword [rsp + 0xa8]
call sym.ntdll.dll_NtClose
test rbp, rbp
je 0x17000ff70
mov rax, qword [r13 + 0x60]
mov rsi, qword [rax + 0x30]
mov r15, rbp
mov rbp, qword [rsp + 0xd8]
movzx ebx, word [rsp + 0xd0]
mov rcx, r15
call sym.ntdll.dll_wcslen
lea r9, [rbx + rax*2]
add r9, 4
mov rcx, rsi
xor edx, edx
mov r8, rbp
call sym.ntdll.dll_RtlReAllocateHeap
test rax, rax
je 0x170010afa
mov rsi, rax
movzx eax, word [rsp + 0xd0]
and eax, 0xfffffffe
mov word [rsi + rax], 0x5c
movzx eax, word [rsp + 0xd0]
and eax, 0xfffffffe
lea rcx, [rax + rsi]
add rcx, 2
mov rdx, r15
call sym.ntdll.dll_wcscpy
lea rbx, [rsp + 0xd0]
mov rcx, rbx
mov rdx, rsi
call sym.ntdll.dll_RtlInitUnicodeString
mov rcx, r15
mov dx, 0x2e
call sym.ntdll.dll_wcsrchr
mov word [rax], 0
mov dword [rsp + 0x170], 0x30
mov qword [rsp + 0x178], 0
mov dword [rsp + 0x188], 0x40
mov qword [rsp + 0x180], rbx
movups xmmword [r12], xmm6
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0xa8]
mov edx, 0x80100000
lea r8, [rsp + 0x170]
mov r9, rdi
call sym.ntdll.dll_NtOpenFile
test eax, eax
je 0x170010b4f
mov dword [rsp + 0x130], 0xc000000f
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
jmp 0x170010ba5
mov rax, qword [r13 + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, r15
call sym.ntdll.dll_RtlFreeHeap
lea rcx, [rsp + 0xd0]
call sym.ntdll.dll_RtlFreeUnicodeString
mov r15d, 0xc0000017
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov r13, qword [str.C:windows]
cmp r15d, 0xc000000f
je 0x17000ffad
jmp 0x170010702
mov r8, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
lea rdx, [rsp + 0xf0]
mov r9, r15
call fcn.17000fb70
mov dword [rsp + 0x130], eax
mov rcx, qword [rsp + 0xa8]
call sym.ntdll.dll_NtClose
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x70]
mov rax, qword [r13 + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, r15
call sym.ntdll.dll_RtlFreeHeap
mov rcx, rbx
call sym.ntdll.dll_RtlFreeUnicodeString
mov r15d, dword [rsp + 0x130]
mov rbx, qword [rsp + 0x60]
jmp 0x170010b36
xor esi, esi
mov eax, esi
movaps xmm6, xmmword [rsp + 0x2170]
add rsp, 0x2188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 0xc0150002
test byte [0x17008d130], 1
je 0x170010bd3
mov ecx, r14d
imul rbx, rcx, 0x38
mov rcx, qword [rax + rbx]
mov edx, 0xffffffff
call fcn.170014e40
mov rcx, rdi
mov rdi, rax
mov rax, qword [rcx + 8]
movzx edx, word [rax + rbx + 0x28]
movzx r8d, word [rax + rbx + 0x2a]
movzx r9d, word [rax + rbx + 0x2c]
movzx eax, word [rax + rbx + 0x2e]
mov dword [rsp + 0x20], eax
lea rcx, [0x17006dc22]
call fcn.170015080
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r8, str.parse_depend_manifests
lea r9, str.Could_not_find_dependent_assembly__s___s__n
xor ecx, ecx
call fcn.17000f350
jmp 0x170010bd3