Function at 0x7ff7c00879d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x7ff7c01ce3e0], 1
jne 0x7ff7c0087c36
lock bts qword [0x7ff7c01ce3e0], 0x1f
jae 0x7ff7c0087a18
test byte [0x7ff7c01ce3e0], 1
jne 0x7ff7c0087c36
xor edx, edx
lea rcx, [0x7ff7c01ce3e0]
call sym.ProcessHacker.exe_PhfWaitForEvent
cmp qword [0x7ff7c01d5af8], 0
setne al
add rsp, 0x38
ret
lea rcx, [0x7ff7c0184f48]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov qword [0x7ff7c01d5af8], rax
mov rdx, rax
test rax, rax
je 0x7ff7c0087c2a
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rdi
mov edi, 0x5a4d
cmp word [rax], di
jne 0x7ff7c0087aa4
mov eax, dword [rax + 0x3c]
lea ecx, [rax - 1]
cmp ecx, 0xffffffe
ja 0x7ff7c0087aa4
cmp dword [rax + rdx], 0x4550
jne 0x7ff7c0087aa4
lea r8, [rax + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c0087aa4
cmp dword [r8 + 4], 0
je 0x7ff7c0087aa4
lea r9, [rdx + rax]
xor ebx, ebx
lea rax, [0x7ff7c0184f68]
mov word [rsp + 0x28], bx
mov rcx, rdx
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
mov rdx, qword [0x7ff7c01d5af8]
jmp 0x7ff7c0087aa8
xor ebx, ebx
mov eax, ebx
mov qword [0x7ff7c01d5b00], rax
nop
cmp word [rdx], di
jne 0x7ff7c0087b09
mov ecx, dword [rdx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c0087b09
cmp dword [rcx + rdx], 0x4550
jne 0x7ff7c0087b09
lea r8, [rdx + 0x88]
add r8, rcx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c0087b09
cmp dword [r8 + 4], 0
je 0x7ff7c0087b09
lea r9, [rdx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c0184f78]
mov rcx, rdx
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
mov rdx, qword [0x7ff7c01d5af8]
jmp 0x7ff7c0087b0c
mov rax, rbx
mov qword [0x7ff7c01d5b10], rax
cmp word [rdx], di
jne 0x7ff7c0087b6f
mov ecx, dword [rdx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c0087b6f
cmp dword [rcx + rdx], 0x4550
jne 0x7ff7c0087b6f
lea r8, [rdx + 0x88]
add r8, rcx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c0087b6f
cmp dword [r8 + 4], 0
je 0x7ff7c0087b6f
lea r9, [rdx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c0184f88]
mov rcx, rdx
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
mov rdx, qword [0x7ff7c01d5af8]
mov rcx, rax
jmp 0x7ff7c0087b72
mov rcx, rbx
cmp word [rdx], di
mov rdi, qword [rsp + 0x30]
mov qword [0x7ff7c01d5a80], rcx
jne 0x7ff7c0087be8
mov r8d, dword ds:[rdx + 0x3c]
lea eax, [r8 - 1]
cmp eax, 0xffffffe
ja 0x7ff7c0087be8
cmp dword [r8 + rdx], 0x4550
jne 0x7ff7c0087be8
add r8, 0x88
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c0087be8
cmp dword [r8 + 4], 0
je 0x7ff7c0087be8
lea r9, [rdx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c0184f98]
mov rcx, rdx
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
mov rdx, qword [0x7ff7c01d5af8]
mov rcx, qword [0x7ff7c01d5a80]
jmp 0x7ff7c0087beb
mov rax, rbx
cmp qword [0x7ff7c01d5b00], 0
mov qword [0x7ff7c01d5b18], rax
je 0x7ff7c0087c15
cmp qword [0x7ff7c01d5b10], 0
je 0x7ff7c0087c15
test rcx, rcx
je 0x7ff7c0087c15
nop dword [rax + rax]
test rax, rax
jne 0x7ff7c0087c25
mov rcx, rdx
call qword [sym.imp.kernel32.dll_FreeLibrary]
mov qword [0x7ff7c01d5af8], rbx
mov rbx, qword [rsp + 0x40]
lea rcx, [0x7ff7c01ce3e0]
call sym.ProcessHacker.exe_PhfSetEvent
cmp qword [0x7ff7c01d5af8], 0
setne al
add rsp, 0x38
ret