Well, started play for some reassembly & meet this XGETBV instruction (AVX related?), which quite puzzled me.
this instruction is included in CPU detection routines with bunch of CPUIDs. ..and..
when I ripped these routines, XGETBV does fault in my prog! while not doing in there.. (FFox)
now I have few assumpts:
1. instruction activated by specifically compiled mz-pe header?? (tried some flags..) or signed pe-images?
2. instruction activated by some call to system?
3. or in registry is granted some keys upon installation? (less likely)

also, checked inet, where is few info:

here is written about ECX=1. while in FFox ECX=0

"Currently, only the value '0' is allowed."

    push ebx
    push edi
    push esi
    pop eax
    mov ecx eax
    xor eax 0200000
    push eax
    pop eax
    mov edx 0
    cmp ecx eax | je Code01000102E
    mov edx 01
    test edx edx | je Code0100010F1
    xor eax eax
    test eax eax | je Code0100010F1
    mov esi eax
    xor ecx ecx
    mov eax 01
    mov eax ecx
    shr edx 017
    and al 01
    and dl 01
    mov B$Virtual0100695ED al
    mov eax ecx
    mov B$Virtual0100695EC dl
    shr eax 09
    and al 01
    cmp esi 080000001
    mov B$Virtual0100695EE al
    mov eax 0 | jb Code01000108F
    mov edi ecx
    mov eax 080000001
    xor ecx ecx
    mov eax ecx
    shr al 06
    mov ecx edi
    and al 01
    mov B$Virtual0100695EF al
    mov eax ecx
    mov edx ecx
    shr eax 013
    and edx 01C000000
    and al 01
    mov B$Virtual0100695F0 al
    mov eax ecx
    shr eax 014
    and al 01
    cmp edx 01C000000
    mov B$Virtual0100695F1 al | jne Code01000112D
    mov edi ecx
    xor ecx ecx
    and eax 06
    xor ebx ebx
    cmp eax 06
    sete B$Virtual0100695F2
    cmp esi 07