Function at 0x1401665a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x1402bcf90], 1
jne 0x1401668ea
lock bts qword [0x1402bcf90], 0x1f
jae 0x1401665e4
test byte [0x1402bcf90], 1
jne 0x1401668ea
xor edx, edx
lea rcx, [0x1402bcf90]
call sym.SystemInformer.exe_PhfWaitForEvent
movzx eax, byte [0x1402c3ed0]
add rsp, 0x38
ret
xor edx, edx
mov qword [rsp + 0x40], rbx
mov r8d, 0x800
lea rcx, str.bcd.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x140166652
xor edx, edx
lea rcx, str.bcd.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x140166652
cmp dword [0x1402b5e88], 0x3e
jae 0x14016688b
xor r8d, r8d
lea rcx, str.bcd.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
je 0x14016688b
mov qword [rsp + 0x30], rdi
mov rcx, r10
mov edi, 0x5a4d
mov qword [0x1402c3240], rcx
cmp word [r10], di
jne 0x1401666ba
mov edx, dword [r10 + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401666ba
cmp dword [rdx + r10], 0x4550
jne 0x1401666ba
add rdx, 0x88
add rdx, r10
mov eax, dword [rdx]
test eax, eax
je 0x1401666ba
cmp dword [rdx + 4], 0
je 0x1401666ba
xor ebx, ebx
lea r8, [r10 + rax]
lea r9, str.BcdOpenSystemStore
mov word [rsp + 0x20], bx
call fcn.140174840
mov rcx, qword [0x1402c3240]
jmp 0x1401666be
xor ebx, ebx
mov eax, ebx
mov qword [0x1402c3268], rax
cmp word [rcx], di
jne 0x140166716
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140166716
cmp dword ds:[rdx + rcx], 0x4550
jne 0x140166716
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140166716
cmp dword [rdx + 4], 0
je 0x140166716
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdCloseStore
call fcn.140174840
mov rcx, qword [0x1402c3240]
jmp 0x140166719
mov rax, rbx
mov qword [0x1402c3260], rax
cmp word [rcx], di
jne 0x14016676f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14016676f
cmp dword [rdx + rcx], 0x4550
jne 0x14016676f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14016676f
cmp dword [rdx + 4], 0
je 0x14016676f
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdOpenObject
call fcn.140174840
mov rcx, qword [0x1402c3240]
jmp 0x140166772
mov rax, rbx
mov qword [0x1402c3278], rax
cmp word [rcx], di
jne 0x1401667c8
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401667c8
cmp dword [rdx + rcx], 0x4550
jne 0x1401667c8
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401667c8
cmp dword [rdx + 4], 0
je 0x1401667c8
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdCloseObject
call fcn.140174840
mov rcx, qword [0x1402c3240]
jmp 0x1401667cb
mov rax, rbx
mov qword [0x1402c3248], rax
cmp word [rcx], di
jne 0x140166828
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140166828
cmp dword [rdx + rcx], 0x4550
jne 0x140166828
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140166828
cmp dword [rdx + 4], 0
je 0x140166828
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdGetElementData
call fcn.140174840
mov rcx, qword [0x1402c3240]
jmp 0x14016682b
mov rax, rbx
cmp word [rcx], di
mov rdi, qword [rsp + 0x30]
mov qword [0x1402c3250], rax
jne 0x140166882
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140166882
cmp dword [rdx + rcx], 0x4550
jne 0x140166882
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140166882
cmp dword [rdx + 4], 0
je 0x140166882
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdSetElementData
call fcn.140174840
mov rbx, rax
mov qword [0x1402c3270], rbx
jmp 0x14016689b
xor ebx, ebx
mov qword [0x1402c3240], rbx
mov rbx, qword [0x1402c3270]
cmp qword [0x1402c3268], 0
je 0x1401668d9
cmp qword [0x1402c3260], 0
je 0x1401668d9
cmp qword [0x1402c3278], 0
je 0x1401668d9
cmp qword [0x1402c3248], 0
je 0x1401668d9
cmp qword [0x1402c3250], 0
je 0x1401668d9
test rbx, rbx
je 0x1401668d9
mov byte [0x1402c3ed0], 1
lea rcx, [0x1402bcf90]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x40]
movzx eax, byte [0x1402c3ed0]
add rsp, 0x38
ret