Function at 0x140067950
Capabilities:
Check processdebugport

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov rcx, rdi
xor edx, edx
mov r8d, 0x88
call fcn.1400e3c20
xor r14d, r14d
lea r8, [rbp + 0x30]
mov rcx, rsi
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea edx, [r14 + 0x1a]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ebx, eax
test eax, eax
js 0x1400679a7
cmp qword [rbp + 0x30], r14
setne al
jmp 0x1400679ab
movzx eax, byte [rbp + 0x30]
test ebx, ebx
js 0x1400679ba
test al, al
jne 0x1400679ba
mov edx, 5
jmp 0x1400679cb
lea rdx, [rbp + 0x30]
mov rcx, rsi
call sym.ProcessHacker.exe_PhGetProcessDepStatus
mov edx, dword [rbp + 0x30]
mov ebx, eax
test ebx, ebx
js 0x1400679ed
and dword [rdi + 0x58], 0xfffffffc
lea rcx, [rdi + 0x58]
mov eax, edx
mov ebx, r14d
and eax, 3
shr edx, 2
or dword [rcx], eax
and dl, 1
mov byte [rdi + 0x5c], dl
mov qword [rdi], rcx
mov r9d, 8
mov dword [rbp + 0x30], 1
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x140067a22
cmp ebx, 0xc0000073
jne 0x140067a2b
mov ebx, eax
jmp 0x140067a2b
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x60], eax
test ecx, ecx
js 0x140067a37
lea rax, [rdi + 0x60]
mov qword [rdi + 8], rax
mov r9d, 8
mov dword [rbp + 0x30], 2
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x140067a6c
cmp ebx, 0xc0000073
jne 0x140067a75
mov ebx, eax
jmp 0x140067a75
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x70], eax
test ecx, ecx
js 0x140067a81
lea rax, [rdi + 0x70]
mov qword [rdi + 0x10], rax
mov r9d, 8
mov dword [rbp + 0x30], 3
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x140067ab6
cmp ebx, 0xc0000073
jne 0x140067abf
mov ebx, eax
jmp 0x140067abf
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x64], eax
test ecx, ecx
js 0x140067acb
lea rax, [rdi + 0x64]
mov qword [rdi + 0x18], rax
mov r9d, 8
mov dword [rbp + 0x30], 4
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x140067b00
cmp ebx, 0xc0000073
jne 0x140067b09
mov ebx, eax
jmp 0x140067b09
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x68], eax
test ecx, ecx
js 0x140067b15
lea rax, [rdi + 0x68]
mov qword [rdi + 0x20], rax
mov r9d, 8
mov dword [rbp + 0x30], 6
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x140067b4a
cmp ebx, 0xc0000073
jne 0x140067b53
mov ebx, eax
jmp 0x140067b53
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x6c], eax
test ecx, ecx
js 0x140067b5f
lea rax, [rdi + 0x6c]
mov qword [rdi + 0x30], rax
mov r9d, 8
mov dword [rbp + 0x30], 7
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x140067b94
cmp ebx, 0xc0000073
jne 0x140067b9d
mov ebx, eax
jmp 0x140067b9d
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x74], eax
test ecx, ecx
js 0x140067ba9
lea rax, [rdi + 0x74]
mov qword [rdi + 0x38], rax
mov r9d, 8
mov dword [rbp + 0x30], 8
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x140067bde
cmp ebx, 0xc0000073
jne 0x140067be7
mov ebx, eax
jmp 0x140067be7
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x78], eax
test ecx, ecx
js 0x140067bf3
lea rax, [rdi + 0x78]
mov qword [rdi + 0x40], rax
mov r9d, 8
mov dword [rbp + 0x30], 9
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x140067c28
cmp ebx, 0xc0000073
jne 0x140067c31
mov ebx, eax
jmp 0x140067c31
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x7c], eax
test ecx, ecx
js 0x140067c3d
lea rax, [rdi + 0x7c]
mov qword [rdi + 0x48], rax
mov r9d, 8
mov dword [rbp + 0x30], 0xa
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x140067c72
cmp ebx, 0xc0000073
jne 0x140067c7e
mov ebx, eax
jmp 0x140067c7e
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x80], eax
mov eax, ebx
test ecx, ecx
js 0x140067c8f
lea rcx, [rdi + 0x80]
mov qword [rdi + 0x50], rcx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret