Function at 0x1401c6c20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x1402c1e40], 1
jne 0x1401c6e94
lock bts qword [0x1402c1e40], 0x1f
jae 0x1401c6c64
test byte [0x1402c1e40], 1
jne 0x1401c6e94
xor edx, edx
lea rcx, [0x1402c1e40]
call sym.SystemInformer.exe_QifWaitForEvent
movzx eax, byte [0x1402c5475]
add rsp, 0x38
ret
mov qword ss:[rsp + 0x40], rbx
lea rcx, str.dnsapi.dll
xor edx, edx
mov qword [rsp + 0x30], rdi
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x1401c6cdd
xor edx, edx
lea rcx, str.dnsapi.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x1401c6cdd
cmp dword [0x1402baf40], 0x3e
jae 0x1401c6cd1
xor r8d, r8d
lea rcx, str.dnsapi.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x1401c6cdd
mov rdi, qword [0x1402c9150]
jmp 0x1401c6e54
mov qword [rsp + 0x48], rbp
mov ebp, 0x5a4d
mov qword [rsp + 0x50], rsi
cmp word [rbx], bp
jne 0x1401c6d39
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6d39
cmp dword [rcx + rbx], 0x4550
jne 0x1401c6d39
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6d39
cmp dword [rdx + 4], 0
je 0x1401c6d39
xor edi, edi
lea r8, [rbx + rax]
lea r9, str.DnsQuery_W
mov word [rsp + 0x20], di
mov rcx, rbx
call fcn.140177a80
jmp 0x1401c6d3d
xor edi, edi
mov eax, edi
mov qword [0x1402c9168], rax
cmp word [rbx], bp
jne 0x1401c6d8f
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6d8f
cmp dword [rcx + rbx], 0x4550
jne 0x1401c6d8f
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6d8f
cmp dword [rdx + 4], 0
je 0x1401c6d8f
lea r8, [rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.DnsExtractRecordsFromMessage_W
mov rcx, rbx
call fcn.140177a80
jmp 0x1401c6d92
mov rax, rdi
mov qword [0x1402c9160], rax
cmp word [rbx], bp
jne 0x1401c6de7
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6de7
cmp dword [rcx + rbx], 0x4550
jne 0x1401c6de7
lea rdx, [rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6de7
cmp dword [rdx + 4], 0
je 0x1401c6de7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.DnsWriteQuestionToBuffer_W
mov rcx, rbx
call fcn.140177a80
jmp 0x1401c6dea
mov rax, rdi
cmp word [rbx], bp
mov rbp, qword [rsp + 0x48]
mov qword [0x1402c9158], rax
jne 0x1401c6e48
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c6e48
cmp dword [rcx + rbx], 0x4550
jne 0x1401c6e48
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c6e48
cmp dword [rdx + 4], 0
je 0x1401c6e48
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.DnsFree
mov rcx, rbx
call fcn.140177a80
mov rdi, rax
mov rsi, qword [rsp + 0x50]
mov qword [0x1402c9150], rdi
cmp qword [0x1402c9168], 0
mov rbx, qword [rsp + 0x40]
je 0x1401c6e83
cmp qword [0x1402c9160], 0
je 0x1401c6e83
cmp qword [0x1402c9158], 0
je 0x1401c6e83
test rdi, rdi
je 0x1401c6e83
mov byte [0x1402c5475], 1
lea rcx, [0x1402c1e40]
call sym.SystemInformer.exe_QifSetEvent
mov rdi, qword [rsp + 0x30]
movzx eax, byte [0x1402c5475]
add rsp, 0x38
ret