Function at 0x1401b2740
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x1402c7cf8], 1
jne 0x1401b29df
lock bts qword [0x1402c7cf8], 0x1f
setb al
test al, al
je 0x1401b278b
test byte [0x1402c7cf8], 1
jne 0x1401b29df
xor edx, edx
lea rcx, [0x1402c7cf8]
call sym.SystemInformer.exe_PhfWaitForEvent
movzx eax, byte [0x1402cbe69]
add rsp, 0x38
ret
mov qword [rsp + 0x40], rbx
lea rcx, str.dnsapi.dll
mov qword [rsp + 0x50], rsi
xor edx, edx
mov r8d, 0x800
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x1401b2809
xor edx, edx
lea rcx, str.dnsapi.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x1401b2809
cmp dword [0x1402c0f40], 0x3e
nop dword [rax + rax]
jae 0x1401b2991
xor r8d, r8d
lea rcx, str.dnsapi.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x1401b2991
mov qword [rsp + 0x48], rbp
mov rsi, rbx
mov ebp, 0x5a4d
cmp word [rbx], bp
jne 0x1401b286a
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401b286a
cmp dword [rcx + rbx], 0x4550
jne 0x1401b286a
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401b2867
cmp dword [rdx + 4], 0
je 0x1401b2867
xor edi, edi
lea r8, [rbx + rax]
lea r9, str.DnsQuery_W
mov word [rsp + 0x20], di
mov rcx, rbx
call fcn.14017f180
jmp 0x1401b286e
mov rsi, rbx
xor edi, edi
mov eax, edi
mov qword [0x1402cfb18], rax
cmp word [rbx], bp
jne 0x1401b28c7
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401b28c7
cmp dword [rcx + rbx], 0x4550
jne 0x1401b28c7
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401b28c7
cmp dword [rdx + 4], 0
je 0x1401b28c7
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.DnsExtractRecordsFromMessage_W
mov rcx, rbx
call fcn.14017f180
jmp 0x1401b28ca
mov rax, rdi
mov qword [0x1402cfb10], rax
cmp word [rbx], bp
jne 0x1401b2927
mov ecx, dword ds:[rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401b2927
cmp dword [rcx + rbx], 0x4550
jne 0x1401b2927
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401b2927
cmp dword [rdx + 4], 0
je 0x1401b2927
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.DnsWriteQuestionToBuffer_W
mov rcx, rbx
call fcn.14017f180
jmp 0x1401b292a
mov rax, rdi
cmp word [rbx], bp
mov rbp, qword [rsp + 0x48]
mov qword [0x1402cfb08], rax
jne 0x1401b2988
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401b2988
cmp dword [rcx + rbx], 0x4550
jne 0x1401b2988
lea rdx, ds:[rbx + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401b2988
cmp dword [rdx + 4], 0
je 0x1401b2988
lea r8, ds:[rbx + rax]
mov word [rsp + 0x20], di
lea r9, str.DnsFree
mov rcx, rbx
call fcn.14017f180
mov rdi, rax
mov qword [0x1402cfb00], rdi
jmp 0x1401b2998
mov rdi, qword [0x1402cfb00]
cmp qword [0x1402cfb18], 0
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
je 0x1401b29ce
cmp qword [0x1402cfb10], 0
je 0x1401b29ce
cmp qword [0x1402cfb08], 0
nop
je 0x1401b29ce
test rdi, rdi
je 0x1401b29ce
mov byte [0x1402cbe69], 1
lea rcx, [0x1402c7cf8]
call sym.SystemInformer.exe_PhfSetEvent
mov rdi, qword [rsp + 0x30]
movzx eax, byte [0x1402cbe69]
add rsp, 0x38
ret