Function at 0x1400c59e0
Capabilities:
Parse pe header
Reference sql statements

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
xor ebx, ebx
mov r12, r8
mov r15d, ebx
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x51], rbx
mov r14, rdx
mov qword [rbp - 0x59], rbx
mov rsi, rcx
mov qword [rbp - 0x61], rbx
mov dword [rbp + 0x7f], ebx
call fcn.1400c5320
mov rcx, rax
test rax, rax
jne 0x1400c5a2f
lea eax, [rbx + 0x7e]
jmp 0x1400c5dc4
mov eax, 0x5a4d
mov qword [rsp + 0x120], rdi
cmp word [rcx], ax
jne 0x1400c5af4
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x1400c5af4
cmp dword [rdx + rcx], 0x4550
jne 0x1400c5af4
lea r8, [rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x1400c5af4
cmp dword [r8 + 4], ebx
je 0x1400c5af4
lea r9, [rcx + rax]
mov word [rsp + 0x28], bx
lea rax, str.DllGetClassObject
mov qword [rsp + 0x20], rax
call fcn.140104bd0
test rax, rax
je 0x1400c5af4
lea r8, [rbp - 0x41]
lea rdx, [0x140187ac0]
lea rcx, [0x140187980]
call qword [case.0x140101f48.0]
mov edi, eax
test eax, eax
js 0x1400c5aec
mov rcx, qword [rbp - 0x41]
lea r9, [rbp - 0x49]
lea r8, [0x140187990]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140101f48.0]
mov rcx, qword [rbp - 0x41]
mov edi, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140101f48.0]
test edi, edi
js 0x1400c5d6a
mov rcx, qword [rbp - 0x49]
lea rdx, [rbp - 0x51]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov rdx, qword [rsi + 8]
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov rax, qword [rcx]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov rax, qword [rax + 0x18]
call qword [case.0x140101f48.0]
mov edi, eax
test eax, eax
js 0x1400c5d6a
mov rdx, qword [r14 + 8]
lea rcx, str.SELECT_clsid_FROM___Win32Provider_WHERE_Name___s
mov qword [rsp + 0x128], r13
call sym.ProcessHacker.exe_PhFormatString
mov rcx, qword ds:[rbp - 0x51]
lea rdx, [rbp - 0x59]
mov r13, rax
mov qword [rsp + 0x28], rdx
mov r9d, 0x30
mov qword [rsp + 0x20], rbx
lea rdx, [0x1401c4c38]
mov rax, qword [rcx]
mov r8, qword [r13 + 8]
mov rax, qword [rax + 0xa0]
call qword [case.0x140101f48.0]
mov edi, eax
mov esi, 0xffffffff
test eax, eax
js 0x1400c5d4a
mov rcx, qword [rbp - 0x59]
lea rdx, [rbp + 0x7f]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x61]
lea r8d, [rsi + 2]
mov edx, esi
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140101f48.0]
mov edi, eax
test eax, eax
js 0x1400c5d4a
mov rcx, qword [rbp - 0x61]
lea r9, [rbp - 0x19]
mov qword [rsp + 0x28], rbx
lea rdx, str.CLSID
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140101f48.0]
test eax, eax
js 0x1400c5c12
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x1400c5c08
nop
call sym.ProcessHacker.exe_PhCreateString
mov r15, rax
lea rcx, [rbp - 0x19]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword ds:[rbp - 0x61]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140101f48.0]
test r15, r15
je 0x1400c5d4a
mov r8, qword [r15 + 8]
lea rax, [0x1401b4328]
lea r9, [0x14019286c]
mov qword [rsp + 0x20], rax
lea rdx, str.CLSID_
mov ecx, 4
call sym.ProcessHacker.exe_PhConcatStrings
mov r14, rax
movzx eax, word [rax]
mov word [rbp - 0x29], ax
add ax, 2
cmp qword [r14], 0xfffe
mov word [rbp - 0x27], ax
mov rax, qword [r14 + 8]
mov qword [rbp - 0x21], rax
jbe 0x1400c5c85
mov edi, 0xd0000106
jmp 0x1400c5d1f
xor r8d, r8d
lea rax, [rbp - 0x31]
lea r9, [rbp - 1]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x29]
lea rcx, [r8 - 7]
call fcn.140120390
mov edi, eax
test eax, eax
js 0x1400c5ccf
lea r8, [rbp - 1]
mov edx, 0x20019
lea rcx, [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rbp - 0x31]
mov edi, eax
test rcx, rcx
je 0x1400c5ccf
call qword [sym.imp.ntdll.dll_NtClose]
or edi, 0x10000000
jl 0x1400c5d1f
mov rcx, qword ds:[rbp - 0x39]
xor edx, edx
call sym.ProcessHacker.exe_PhQueryRegistryString
mov rbx, rax
test rax, rax
je 0x1400c5d15
mov rcx, rax
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
test rax, rax
je 0x1400c5d15
mov rcx, rbx
mov rbx, rax
add rcx, 0xfffffffffffffff0
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c5d15
call fcn.140106290
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [r14 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c5d34
call fcn.140106290
lea rcx, ds:[r15 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c5d4a
call fcn.140106290
lea rcx, ds:[r13 - 0x10]
lock xadd dword [rcx + 8], esi
mov r13, qword [rsp + 0x128]
cmp esi, 1
jne 0x1400c5d6a
call fcn.140106290
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x1400c5d86
mov rax, qword ds:[rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140101f48.0]
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x1400c5d9c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140101f48.0]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1400c5db2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140101f48.0]
test edi, edi
js 0x1400c5dba
mov qword [r12], rbx
mov eax, edi
mov rdi, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret