Function at 0x140170880
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
test byte [0x1402c8248], 1
jne 0x140170bea
lock bts qword [0x1402c8248], 0x1f
setb al
test al, al
je 0x1401708cb
test byte [0x1402c8248], 1
jne 0x140170bea
xor edx, edx
lea rcx, [0x1402c8248]
call sym.SystemInformer.exe_PhfWaitForEvent
movzx eax, byte [0x1402cfb50]
add rsp, 0x38
ret
xor edx, edx
mov qword [rsp + 0x40], rbx
mov r8d, 0x800
lea rcx, str.bcd.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x140170939
xor edx, edx
lea rcx, str.bcd.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x140170939
cmp dword [0x1402c0f40], 0x3e
jae 0x140170b8b
xor r8d, r8d
lea rcx, str.bcd.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
je 0x140170b8b
mov qword [rsp + 0x30], rdi
mov rcx, r10
mov edi, 0x5a4d
mov qword [0x1402ceeb0], rcx
cmp word [r10], di
jne 0x1401709ae
mov edx, dword ds:[r10 + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401709ae
cmp dword [rdx + r10], 0x4550
jne 0x1401709ae
add rdx, 0x88
add rdx, r10
mov eax, dword [rdx]
test eax, eax
je 0x1401709ae
cmp dword [rdx + 4], 0
je 0x1401709ae
xor ebx, ebx
lea r8, [r10 + rax]
lea r9, str.BcdOpenSystemStore
mov word [rsp + 0x20], bx
call fcn.14017f180
mov rcx, qword [0x1402ceeb0]
jmp 0x1401709b2
xor ebx, ebx
mov eax, ebx
mov qword [0x1402ceed8], rax
cmp word [rcx], di
jne 0x140170a08
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140170a08
cmp dword [rdx + rcx], 0x4550
jne 0x140170a08
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140170a08
cmp dword [rdx + 4], 0
je 0x140170a08
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdCloseStore
call fcn.14017f180
mov rcx, qword [0x1402ceeb0]
jmp 0x140170a0b
mov rax, rbx
mov qword [0x1402ceed0], rax
cmp word [rcx], di
jne 0x140170a68
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140170a68
cmp dword [rdx + rcx], 0x4550
jne 0x140170a68
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140170a68
cmp dword [rdx + 4], 0
je 0x140170a68
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdOpenObject
call fcn.14017f180
mov rcx, qword [0x1402ceeb0]
jmp 0x140170a6b
mov rax, rbx
mov qword [0x1402ceee8], rax
cmp word [rcx], di
jne 0x140170ac8
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140170ac8
cmp dword [rdx + rcx], 0x4550
jne 0x140170ac8
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140170ac8
cmp dword [rdx + 4], 0
je 0x140170ac8
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdCloseObject
call fcn.14017f180
mov rcx, qword [0x1402ceeb0]
jmp 0x140170acb
mov rax, rbx
mov qword [0x1402ceeb8], rax
cmp word [rcx], di
jne 0x140170b28
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140170b28
cmp dword [rdx + rcx], 0x4550
jne 0x140170b28
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140170b28
cmp dword [rdx + 4], 0
je 0x140170b28
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdGetElementData
call fcn.14017f180
mov rcx, qword [0x1402ceeb0]
jmp 0x140170b2b
mov rax, rbx
cmp word [rcx], di
mov rdi, qword [rsp + 0x30]
mov qword [0x1402ceec0], rax
jne 0x140170b82
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x140170b82
cmp dword [rdx + rcx], 0x4550
jne 0x140170b82
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x140170b82
cmp dword [rdx + 4], 0
je 0x140170b82
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.BcdSetElementData
call fcn.14017f180
mov rbx, rax
mov qword [0x1402ceee0], rbx
jmp 0x140170b9b
xor ebx, ebx
mov qword [0x1402ceeb0], rbx
mov rbx, qword [0x1402ceee0]
cmp qword [0x1402ceed8], 0
je 0x140170bd9
cmp qword [0x1402ceed0], 0
je 0x140170bd9
cmp qword [0x1402ceee8], 0
je 0x140170bd9
cmp qword [0x1402ceeb8], 0
je 0x140170bd9
cmp qword [0x1402ceec0], 0
je 0x140170bd9
test rbx, rbx
je 0x140170bd9
mov byte [0x1402cfb50], 1
lea rcx, [0x1402c8248]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x40]
movzx eax, byte [0x1402cfb50]
add rsp, 0x38
ret