Function at 0x14011fc40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x14023f730], 1
jne 0x14011ff76
lock bts qword [0x14023f730], 0x1f
jae 0x14011fc84
test byte [0x14023f730], 1
jne 0x14011ff76
xor edx, edx
lea rcx, [0x14023f730]
call sym.ProcessHacker.exe_PhfWaitForEvent
movzx eax, byte [0x140245788]
add rsp, 0x38
ret
xor edx, edx
mov qword [rsp + 0x40], rbx
mov r8d, 0x800
lea rcx, str.bcd.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x14011fcc9
xor edx, edx
lea rcx, str.bcd.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
je 0x14011ff0b
mov qword ss:[rsp + 0x30], rdi
mov rcx, r10
mov edi, 0x5a4d
mov qword [0x140244b50], rcx
cmp word [r10], di
jne 0x14011fd34
mov edx, dword [r10 + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14011fd34
cmp dword [rdx + r10], 0x4550
jne 0x14011fd34
add rdx, 0x88
add rdx, r10
mov eax, dword [rdx]
test eax, eax
je 0x14011fd34
cmp dword [rdx + 4], 0
je 0x14011fd34
xor ebx, ebx
lea r8, [r10 + rax]
lea r9, str.BcdOpenSystemStore
mov word [rsp + 0x20], bx
call fcn.1400fa1a0
mov rcx, qword [0x140244b50]
jmp 0x14011fd38
xor ebx, ebx
mov eax, ebx
mov qword [0x140244b78], rax
nop
cmp word [rcx], di
jne 0x14011fd8f
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14011fd8f
cmp dword [rdx + rcx], 0x4550
jne 0x14011fd8f
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14011fd8f
cmp dword [rdx + 4], 0
je 0x14011fd8f
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdCloseStore
call fcn.1400fa1a0
mov rcx, qword [0x140244b50]
jmp 0x14011fd92
mov rax, rbx
mov qword [0x140244b70], rax
cmp word [rcx], di
jne 0x14011fde8
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14011fde8
cmp dword [rdx + rcx], 0x4550
jne 0x14011fde8
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14011fde8
cmp dword [rdx + 4], 0
je 0x14011fde8
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdOpenObject
call fcn.1400fa1a0
mov rcx, qword [0x140244b50]
jmp 0x14011fdeb
mov rax, rbx
mov qword [0x140244b88], rax
cmp word [rcx], di
jne 0x14011fe48
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14011fe48
cmp dword [rdx + rcx], 0x4550
jne 0x14011fe48
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14011fe48
cmp dword [rdx + 4], 0
je 0x14011fe48
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdCloseObject
call fcn.1400fa1a0
mov rcx, qword [0x140244b50]
jmp 0x14011fe4b
mov rax, rbx
mov qword [0x140244b58], rax
cmp word [rcx], di
jne 0x14011fea8
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14011fea8
cmp dword [rdx + rcx], 0x4550
jne 0x14011fea8
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14011fea8
cmp dword [rdx + 4], 0
je 0x14011fea8
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdGetElementData
call fcn.1400fa1a0
mov rcx, qword [0x140244b50]
jmp 0x14011feab
mov rax, rbx
cmp word [rcx], di
mov rdi, qword [rsp + 0x30]
mov qword [0x140244b60], rax
jne 0x14011ff02
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14011ff02
cmp dword [rdx + rcx], 0x4550
jne 0x14011ff02
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14011ff02
cmp dword [rdx + 4], 0
je 0x14011ff02
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdSetElementData
call fcn.1400fa1a0
mov rbx, rax
mov qword [0x140244b80], rbx
jmp 0x14011ff1b
xor ebx, ebx
mov qword [0x140244b50], rbx
mov rbx, qword [0x140244b80]
cmp qword [0x140244b78], 0
je 0x14011ff65
cmp qword [0x140244b70], 0
je 0x14011ff65
cmp qword [0x140244b88], 0
je 0x14011ff65
cmp qword [0x140244b58], 0
je 0x14011ff65
cmp qword [0x140244b60], 0
je 0x14011ff65
movzx eax, byte [0x140245788]
test rbx, rbx
mov ecx, 1
cmovne eax, ecx
mov byte [0x140245788], al
lea rcx, [0x14023f730]
call sym.ProcessHacker.exe_PhfSetEvent
mov rbx, qword [rsp + 0x40]
movzx eax, byte [0x140245788]
add rsp, 0x38
ret