Function at 0x140027130
Capabilities:
Check mutex on windows
Map section object

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd90]
sub rsp, 0xe90
mov rax, qword [0x14020a008]
xor rax, rsp
mov qword [rbp + 0xd80], rax
mov rax, qword [rcx + 0x10]
lea r13, [0x140192200]
mov rdi, rcx
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140027180
mov rdx, qword [rcx + 8]
jmp 0x140027183
mov rdx, r13
mov eax, dword [rdi + 0x88]
lea r9, [rbp + 0x350]
mov rcx, qword [rdi]
mov r15d, 1
mov qword [rbp + 0x368], rdx
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x350], r15d
mov dword [rbp + 0x358], r15d
mov dword [rbp + 0x354], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x1400271d5
mov rcx, qword [rcx + 8]
jmp 0x1400271d8
mov rcx, r13
mov eax, dword ds:[rdi + 0x8c]
lea r9, [rbp + 0x2f0]
mov qword [rbp + 0x308], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x2f0], r15d
mov dword [rbp + 0x2f4], eax
mov dword [rbp + 0x2f8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x10]
mov r14d, 0x30
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140027287
lea r8d, [r14 - 0x20]
mov dword [rbp + 0xa20], 0x780030
lea rdx, [rbp + 0xa24]
call fcn.1401659c4
mov eax, dword [rdi + 0x90]
lea r9, [rbp + 0x3b0]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x3b4], eax
mov edx, 0x104c
lea rax, [rbp + 0xa20]
mov dword [rbp + 0x3b0], r15d
mov qword [rbp + 0x3c8], rax
mov dword [rbp + 0x3b8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x10]
mov rcx, qword ds:[rax + 0x30]
test rcx, rcx
je 0x14002729b
mov rcx, qword [rcx + 8]
jmp 0x14002729e
mov rcx, r13
lea r8, [rbp - 0x50]
mov qword [rsp + 0xec8], rbx
lea rdx, [rbp + 0xa0]
call sym.ProcessHacker.exe_PhGetAccessEntries
mov rcx, qword [rdi + 0x10]
test al, al
je 0x1400273aa
mov rbx, qword [rbp + 0xa0]
mov r8d, dword [rbp - 0x50]
mov rdx, rbx
mov ecx, dword [rcx + 0x24]
call sym.ProcessHacker.exe_PhGetAccessString
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
cmp qword [rax], 0
je 0x140027332
mov rcx, qword [rdi + 0x10]
mov r8, qword [rax + 8]
mov edx, dword [rcx + 0x24]
lea rcx, str.0x_x___s_
call sym.ProcessHacker.exe_PhFormatString
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov dword ds:[rbp + 0x410], r15d
lea r9, [rbp + 0x410]
mov dword [rbp + 0x414], 3
mov dword [rbp + 0x418], r15d
mov rcx, qword [rax + 8]
mov qword [rbp + 0x428], rcx
jmp 0x140027382
mov rax, qword [rdi + 0x10]
lea rdx, [rbp + 0xa24]
mov r8d, 0x10
mov ecx, dword [rax + 0x24]
mov dword [rbp + 0xa20], 0x780030
call fcn.1401659c4
lea rax, [rbp + 0xa20]
mov dword [rbp + 0x260], r15d
mov qword [rbp + 0x278], rax
lea r9, [rbp + 0x260]
mov dword [rbp + 0x264], 3
mov dword [rbp + 0x268], r15d
mov rcx, qword ds:[rdi]
xor r8d, r8d
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140213cd0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140027407
mov ecx, dword [rcx + 0x24]
lea rdx, [rbp + 0xa24]
mov r8d, 0x10
mov dword [rbp + 0xa20], 0x780030
call fcn.1401659c4
mov rcx, qword [rdi]
lea rax, [rbp + 0xa20]
lea r9, [rbp + 0x260]
mov qword [rbp + 0x278], rax
xor r8d, r8d
mov dword [rbp + 0x260], r15d
mov edx, 0x104c
mov dword [rbp + 0x264], 3
mov dword [rbp + 0x268], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword ds:[rdi + 8]
lea r9, [rbp + 0x18]
xor esi, esi
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
mov qword [rbp + 0x20], rsi
lea r8, [rbp + 0xa8]
mov dword [rbp + 0xa8], r14d
lea rcx, [rbp + 8]
mov qword [rbp + 0xb0], rsi
lea edx, [rsi + 0x40]
mov dword [rbp + 0xc0], esi
mov qword [rbp + 0xb8], rsi
movdqu xmmword [rbp + 0xc8], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x14002747a
cmp byte [0x1402130ef], sil
je 0x140027642
lea r8, [rbp + 0x18]
lea edx, [rsi + 0x40]
lea rcx, [rbp + 8]
call fcn.140123530
test eax, eax
js 0x140027642
mov rax, qword [rdi + 0x10]
lea rcx, [rbp + 0x8c0]
mov qword [rsp + 0x48], rsi
xor r9d, r9d
mov qword [rsp + 0x40], rsi
mov r8d, 0xffffffff
mov qword [rsp + 0x38], rsi
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 8]
call sym.ProcessHacker.exe_PhGetHandleInformationEx
test eax, eax
js 0x140027638
mov eax, dword [rsp + 0x70]
test eax, eax
js 0x140027638
mov ecx, dword ds:[rbp + 0x8cc]
lea rdx, [rbp + 0xa20]
mov r8d, 0xa
call fcn.1401659e8
mov rcx, qword ds:[rdi]
lea rax, [rbp + 0xa20]
lea r9, [rbp + 0x470]
mov qword [rbp + 0x488], rax
xor r8d, r8d
mov dword [rbp + 0x470], r15d
mov edx, 0x104c
mov dword [rbp + 0x474], 4
mov dword [rbp + 0x478], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0x8c8]
lea rdx, [rbp + 0xa20]
mov r8d, 0xa
call fcn.1401659e8
mov rcx, qword [rdi]
lea rax, [rbp + 0xa20]
lea r9, [rbp + 0x4d0]
mov qword [rbp + 0x4e8], rax
xor r8d, r8d
mov dword [rbp + 0x4d0], r15d
mov edx, 0x104c
mov dword [rbp + 0x4d4], 5
mov dword [rbp + 0x4d8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0x8d0]
lea rdx, [rbp + 0xa20]
mov r8d, 0xa
call fcn.1401659e8
mov rcx, qword [rdi]
lea rax, [rbp + 0xa20]
lea r9, [rbp + 0x530]
mov qword [rbp + 0x548], rax
xor r8d, r8d
mov dword [rbp + 0x530], r15d
mov edx, 0x104c
mov dword [rbp + 0x534], 6
mov dword [rbp + 0x538], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0x8d4]
lea rdx, [rbp + 0xa20]
mov r8d, 0xa
call fcn.1401659e8
mov rcx, qword [rdi]
lea rax, [rbp + 0xa20]
lea r9, [rbp + 0x900]
mov qword [rbp + 0x918], rax
xor r8d, r8d
mov dword [rbp + 0x900], r15d
mov edx, 0x104c
mov dword [rbp + 0x904], 7
mov dword [rbp + 0x908], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword ds:[rdi + 0x10]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x140029016
cmp qword [rcx], rsi
je 0x140029016
lea rax, str.ALPC_Port
mov qword [rbp + 0x90], 0x12
movzx r8d, r15b
mov qword [rbp + 0x98], rax
lea rdx, [rbp + 0x90]
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x140027848
mov rax, qword [rdi + 8]
lea r9, [rbp + 0x18]
xorps xmm0, xmm0
mov qword [rbp + 0x18], rax
lea r8, [rbp + 0xa8]
mov qword [rbp + 0x20], rsi
mov edx, 0x40
mov dword [rbp + 0xa8], r14d
lea rcx, [rsp + 0x58]
mov qword [rbp + 0xb0], rsi
movdqu xmmword [rbp + 0xc8], xmm0
mov dword [rbp + 0xc0], esi
mov qword [rbp + 0xb8], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x14002770c
cmp byte [0x1402130ef], sil
je 0x140029016
lea r8, [rbp + 0x18]
mov edx, 0x40
lea rcx, [rsp + 0x58]
call fcn.140123530
nop dword [rax]
test eax, eax
js 0x140029016
mov rdx, qword [rdi + 0x10]
lea r9, [rbp - 0x70]
mov rcx, qword [rsp + 0x58]
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x20000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword ds:[rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140029016
mov rcx, qword [rbp - 0x70]
lea r8, [rbp + 0x90]
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x14002783f
mov ecx, dword [rbp + 0x94]
lea rdx, [rbp + 0xa20]
mov r8d, 0xa
call fcn.1401659e8
mov eax, dword [rdi + 0xa8]
lea r9, [rbp + 0x900]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x904], eax
mov edx, 0x104c
lea rax, [rbp + 0xa20]
mov dword [rbp + 0x900], r15d
mov qword [rbp + 0x918], rax
mov dword [rbp + 0x908], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x98]
lea rdx, [rbp + 0xa24]
mov r8d, 0x10
mov dword [rbp + 0xa20], 0x780030
call fcn.1401659c4
mov eax, dword [rdi + 0xac]
lea r9, [rbp + 0x900]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x904], eax
mov edx, 0x104c
lea rax, [rbp + 0xa20]
mov dword [rbp + 0x900], r15d
mov qword [rbp + 0x918], rax
mov dword [rbp + 0x908], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp - 0x70]
jmp 0x14002900f
mov rax, qword [rdi + 0x10]
lea rcx, str.EtwRegistration
mov qword [rbp + 0x148], rcx
lea rdx, [rbp + 0x140]
movzx r8d, r15b
mov qword [rbp + 0x140], 0x1e
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
mov rcx, qword [rdi + 0x10]
test al, al
je 0x1400278cc
mov rax, qword [rcx + 0x38]
test rax, rax
je 0x14002788e
mov rsi, qword [rax + 8]
mov eax, dword [rdi + 0xe8]
lea r9, [rbp + 0x900]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x904], eax
mov dword [rbp + 0x900], r15d
mov dword [rbp + 0x908], r15d
mov qword [rbp + 0x918], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140029016
mov rcx, qword [rcx + 0x30]
lea r12, [0x1401b5d98]
movzx r8d, r15b
mov qword [rbp + 0x168], r12
lea rdx, [rbp + 0x160]
mov qword [rbp + 0x160], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14002800c
mov rax, qword [rdi + 8]
lea r9, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x28]
mov qword [rbp - 0x78], rsi
mov edx, 0x40
mov dword [rbp - 0x28], r14d
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x20], rsi
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp - 0x10], esi
mov qword [rbp - 0x18], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140027961
cmp byte [0x1402130ef], sil
je 0x140029016
lea r8, [rbp - 0x80]
mov edx, 0x40
lea rcx, [rbp - 0x70]
call fcn.140123530
test eax, eax
js 0x140029016
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x58]
mov rcx, qword [rbp - 0x70]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x2000000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp - 0x70]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140029016
mov rcx, qword [rsp + 0x58]
lea r9d, [r14 + 9]
lea r8, [rbp + 0x850]
mov byte [rsp + 0x50], sil
lea rdx, [rbp + 0x1e0]
mov dword [rsp + 0x20], 4
xor r13b, r13b
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x140027b27
mov eax, dword ds:[rbp + 0x850]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x140027a12.9
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x29060]
mov ecx, dword [rdx + rax*4 + 0x2904c]
add rcx, rdx
jmp rcx
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0xa90]
mov dword [rbp + 0xa94], eax
lea rax, str.Pipe
mov qword [rbp + 0xaa8], rax
mov dword [rbp + 0xa90], r15d
mov dword [rbp + 0xa98], r15d
jmp 0x140027b16
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0xb00]
mov dword [rbp + 0xb04], eax
lea rax, str.Network
mov qword [rbp + 0xb18], rax
mov dword [rbp + 0xb00], r15d
mov dword [rbp + 0xb08], r15d
jmp 0x140027b16
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0x180]
mov dword [rbp + 0x184], eax
lea rax, str.File_or_directory
mov qword [rbp + 0x198], rax
mov byte [rsp + 0x50], r15b
mov dword [rbp + 0x180], r15d
mov dword [rbp + 0x188], r15d
jmp 0x140027b16
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0x200]
mov dword [rbp + 0x204], eax
movzx r13d, r15b
lea rax, str.Console
mov dword [rbp + 0x200], r15d
mov qword [rbp + 0x218], rax
mov dword [rbp + 0x208], r15d
jmp 0x140027b16
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0xe0]
mov dword [rbp + 0xe4], eax
lea rax, [0x1401b7be0]
mov qword [rbp + 0xf8], rax
mov dword [rbp + 0xe0], r15d
mov dword [rbp + 0xe8], r15d
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140213cd0]
mov edx, 4
mov rbx, qword [rsp + 0x58]
lea r8d, [rdx + 0x2c]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rbp + 0x840]
mov qword [rbp + 0x840], 0xffffffffff676980
mov r15, rax
mov rdx, r15
mov dword [rax], 3
mov dword [rax + 4], 0xc0000001
mov qword [rax + 8], rbx
mov dword [rax + 0x10], 0x10
lea rax, [rbp - 0x58]
mov qword [r15 + 0x18], rax
mov dword [r15 + 0x20], 4
call fcn.14012c7c0
mov ebx, eax
test eax, eax
js 0x140027b91
mov ebx, dword [r15 + 4]
mov rcx, qword [0x140213cd0]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
js 0x140027cd7
mov eax, dword ds:[rbp - 0x58]
mov r8d, 6
mov edx, eax
mov ecx, eax
btr edx, 0x18
bts ecx, 0x18
test al, 0x30
cmovne ecx, edx
lea rdx, str._ve_
call sym.ProcessHacker.exe_PhGetAccessString
mov ecx, dword [rbp - 0x58]
lea r8, [rbp + 0xb70]
mov rbx, rax
mov dword [rbp + 0x9b0], ecx
mov r15d, 1
mov qword [rbp + 0x990], 4
lea rax, [0x1401b7bec]
mov dword [rbp + 0x980], r15d
mov qword [rbp + 0x998], rax
lea rcx, [rbp + 0x980]
lea rax, [0x1401b6954]
mov dword [rbp + 0x9a0], 0x108
mov qword [rbp + 0x9d8], rax
lea edx, [r15 + 4]
mov byte [rbp + 0x9aa], 0x10
lea rax, [0x1401b7bf4]
mov dword [rbp + 0x9c0], r15d
mov r9d, 0x208
mov qword [rbp + 0x9d0], 4
mov dword [rbp + 0x9e0], r15d
movups xmm0, xmmword [rbx]
mov dword [rbp + 0xa00], r15d
mov qword [rbp + 0xa10], 2
movaps xmmword [rbp + 0x9f0], xmm0
mov qword [rbp + 0xa18], rax
mov qword [rsp + 0x20], rsi
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
je 0x140027cc0
mov eax, dword [rdi + 0xb4]
lea r9, [rbp + 0x30]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x34], eax
mov edx, 0x104c
lea rax, [rbp + 0xb70]
mov dword [rbp + 0x30], r15d
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x38], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, r15d
jne 0x140027cdd
nop
call fcn.140106290
jmp 0x140027cdd
mov r15d, 1
test r13b, r13b
jne 0x140028002
mov rcx, qword [0x140213cd0]
mov r13d, 0x30
mov rbx, qword [rsp + 0x58]
mov r8d, r13d
lea edx, [r13 - 0x2c]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rbp + 0x840]
mov qword [rbp + 0x840], 0xffffffffff676980
mov r14, rax
mov rdx, r14
mov dword [rax], 3
mov dword [rax + 4], 0xc0000001
mov qword [rax + 8], rbx
mov dword [rax + 0x10], 5
lea rax, [rbp + 0x800]
mov qword [r14 + 0x18], rax
mov dword [r14 + 0x20], 0x18
call fcn.14012c7c0
mov ebx, eax
test eax, eax
js 0x140027d58
mov ebx, dword [r14 + 4]
mov rcx, qword [0x140213cd0]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop word [rax + rax]
test ebx, ebx
js 0x140027e4b
mov rax, qword ds:[rbp + 0x808]
lea r8, [rbp + 0xb00]
mov r9d, 0x64
mov qword [rbp + 0x170], rax
mov edx, r15d
mov dword [rbp + 0x160], 0xc
lea rcx, [rbp + 0x160]
mov qword [rsp + 0x20], rsi
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
je 0x140027df9
mov eax, dword [rdi + 0xbc]
lea r9, [rbp + 0xe0]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0xe4], eax
mov edx, 0x104c
lea rax, [rbp + 0xb00]
mov dword [rbp + 0xe0], r15d
mov qword [rbp + 0xf8], rax
mov dword [rbp + 0xe8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rsp + 0x50], sil
je 0x140027e4b
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0x200]
cmp byte [rbp + 0x815], sil
mov edx, 0x104c
mov rcx, qword [rdi]
mov dword [rbp + 0x204], eax
lea rax, [0x1401b7bf8]
cmovne r12, rax
mov dword [rbp + 0x200], r15d
xor r8d, r8d
mov qword [rbp + 0x218], r12
mov dword [rbp + 0x208], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140213cd0]
mov r8, r13
mov rbx, qword [rsp + 0x58]
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rbp + 0x840]
mov qword [rbp + 0x840], 0xffffffffff676980
mov r14, rax
mov rdx, r14
mov dword [rax], 3
mov dword [rax + 4], 0xc0000001
mov qword [rax + 8], rbx
mov dword [rax + 0x10], 0xe
lea rax, [rbp + 0x820]
mov qword [r14 + 0x18], rax
mov dword [r14 + 0x20], 8
call fcn.14012c7c0
mov ebx, eax
test eax, eax
js 0x140027eb8
mov ebx, dword [r14 + 4]
mov rcx, qword [0x140213cd0]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop word [rax + rax]
test ebx, ebx
js 0x140028002
mov rax, qword [rbp + 0x820]
test rax, rax
je 0x140028002
mov rcx, qword [rbp + 0x808]
lea r8, [rbp + 0xa90]
mov qword [rsp + 0x20], rsi
mov r9d, 0x64
test rcx, rcx
je 0x140027f9e
xorps xmm1, xmm1
mov qword [rbp + 0x910], rax
cvtsi2sd xmm1, rax
mov dword [rbp + 0x900], 0x10009
lea rdx, [0x1401b6954]
mov qword [rbp + 0x938], rdx
lea rax, [0x1401b7c0c]
mov dword [rbp + 0x920], r15d
lea edx, [r9 - 0x60]
mov qword [rbp + 0x930], 4
xorps xmm0, xmm0
mov dword [rbp + 0x940], 0x4b
cvtsi2sd xmm0, rcx
mov word [rbp + 0x944], r15w
lea rcx, [rbp + 0x900]
mov dword [rbp + 0x960], r15d
mov qword [rbp + 0x970], 4
mov qword [rbp + 0x978], rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x1401e94f0]
movsd qword [rbp + 0x950], xmm1
jmp 0x140027fb9
mov dword [rbp + 0x140], 0x10009
lea rcx, [rbp + 0x140]
mov qword [rbp + 0x150], rax
mov edx, r15d
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
je 0x140028002
mov eax, dword [rdi + 0xb8]
lea r9, [rbp + 0x180]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x184], eax
mov edx, 0x104c
lea rax, [rbp + 0xa90]
mov dword [rbp + 0x180], r15d
mov qword [rbp + 0x198], rax
mov dword [rbp + 0x188], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x58]
jmp 0x14002900f
mov rax, qword [rdi + 0x10]
lea rcx, [0x1401b7218]
mov qword [rbp + 0x848], rcx
lea rdx, [rbp + 0x840]
movzx r8d, r15b
mov qword [rbp + 0x840], 0xe
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140028360
mov rax, qword [rdi + 8]
lea r9, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x28]
mov qword [rbp - 0x78], rsi
mov edx, 0x40
mov dword [rbp - 0x28], r14d
lea rcx, [rsp + 0x58]
mov qword [rbp - 0x20], rsi
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp - 0x10], esi
mov qword [rbp - 0x18], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400280a9
cmp byte [0x1402130ef], sil
nop
je 0x140029016
lea r8, [rbp - 0x80]
mov edx, 0x40
lea rcx, [rsp + 0x58]
call fcn.140123530
nop dword [rax]
test eax, eax
js 0x140029016
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov ebx, eax
test eax, eax
jns 0x14002811e
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax]
test ebx, ebx
js 0x140029016
mov rcx, qword [rsp + 0x70]
lea r15, [0x1401b6740]
mov r9d, 0x18
mov qword [rbp - 0x50], rsi
lea r8, [rbp + 0x800]
mov qword [rsp + 0x20], rsi
xor edx, edx
mov r12, r15
mov r13, rsi
call qword [sym.imp.ntdll.dll_NtQuerySection]
nop dword [rax + rax]
test eax, eax
js 0x140028200
mov eax, dword [rbp + 0x808]
bt eax, 0x1b
jae 0x14002818d
lea r12, [0x1401b7c18]
jmp 0x1400281ba
bt eax, 0x17
jae 0x14002819c
lea r12, [0x1401b5d98]
jmp 0x1400281ba
bt eax, 0x18
jae 0x1400281ab
lea r12, [0x1401b7c28]
jmp 0x1400281ba
bt eax, 0x1a
lea r12, str.Reserve
cmovae r12, r15
movzx eax, byte [0x140211968]
lea rcx, ds:[rbp + 0x1e0]
xor r8d, r8d
mov byte [rbp + 0x1ea], al
mov rax, qword [rbp + 0x810]
mov dword [rbp + 0x1e0], 0x10c
mov qword [rbp + 0x1f0], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov r13, rax
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x820]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x70]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov rdx, r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov qword [rbp + 0x820], 1
mov qword [rbp - 0x70], rsi
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop
test eax, eax
js 0x1400282a0
mov rdx, qword [rbp - 0x70]
lea r8, [rbp - 0x50]
mov rcx, r14
call sym.ProcessHacker.exe_PhGetProcessMappedFileName
mov rdx, qword ds:[rbp - 0x70]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov rsi, qword [rbp - 0x50]
test ebx, ebx
js 0x1400282a0
mov rcx, rsi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, rsi
call sym.ProcessHacker.exe_PhResolveDevicePrefix
nop
test rax, rax
je 0x1400282a0
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rsi, rax
mov eax, dword ds:[rdi + 0xc0]
lea r9, [rbp + 0x30]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x34], eax
mov dword [rbp + 0x30], 1
mov dword [rbp + 0x38], 1
mov qword [rbp + 0x48], r12
call qword [sym.imp.USER32.dll_SendMessageW]
test rsi, rsi
je 0x1400282e1
mov rcx, qword [rsi + 8]
jmp 0x1400282e8
lea rcx, [0x1401b7c48]
mov eax, dword [rdi + 0xc4]
lea r9, [rbp + 0x30]
mov qword [rbp + 0x48], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x30], 1
mov dword [rbp + 0x34], eax
mov dword [rbp + 0x38], 1
call qword [sym.imp.USER32.dll_SendMessageW]
test r13, r13
je 0x140028321
mov r15, qword [r13 + 8]
mov eax, dword ds:[rdi + 0xc8]
lea r9, [rbp + 0x30]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x34], eax
mov dword [rbp + 0x30], 1
mov dword [rbp + 0x38], 1
mov qword [rbp + 0x48], r15
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x70]
jmp 0x14002900f
mov rax, qword ds:[rdi + 0x10]
lea rcx, [0x1401b7a78]
mov qword [rbp + 0x858], rcx
lea rdx, [rbp + 0x850]
movzx r8d, r15b
mov qword [rbp + 0x850], 0xc
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1400285ae
mov rax, qword [rdi + 8]
lea r9, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x28]
mov qword [rbp - 0x78], rsi
mov edx, 0x40
mov dword [rbp - 0x28], r14d
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x20], rsi
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp - 0x10], esi
mov qword [rbp - 0x18], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400283fd
cmp byte [0x1402130ef], sil
je 0x140029016
lea r8, [rbp - 0x80]
mov edx, 0x40
lea rcx, [rbp - 0x70]
call fcn.140123530
test eax, eax
js 0x140029016
mov rdx, qword ds:[rdi + 0x10]
lea r9, [rsp + 0x58]
mov rcx, qword [rbp - 0x70]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp - 0x70]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140029016
mov rcx, qword [rsp + 0x58]
lea r9d, [r14 + 9]
lea r8, [rbp - 0x58]
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x14002851a
movsxd rax, dword ds:[rbp - 0x58]
lea rcx, [rbp + 0x800]
xor r8d, r8d
mov qword [rbp + 0x810], rax
mov edx, r15d
mov dword [rbp + 0x800], 0x10009
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [rdi]
lea r9, [rbp + 0x30]
xor r8d, r8d
mov dword [rbp + 0x30], r15d
mov dword [rbp + 0x38], r15d
mov rdx, qword [rax + 8]
mov eax, dword [rdi + 0xcc]
mov qword [rbp + 0x48], rdx
mov edx, 0x104c
mov dword [rbp + 0x34], eax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rbp - 0x53], sil
lea rax, str.True
lea rcx, str.False
mov dword [rbp + 0xe0], r15d
cmovne rcx, rax
mov dword [rbp + 0xe8], r15d
mov eax, dword [rdi + 0xd0]
lea r9, [rbp + 0xe0]
mov qword [rbp + 0xf8], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0xe4], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x58]
lea r8, [rbp + 0x820]
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
mov edx, r15d
call qword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x140028002
cmp qword [rbp + 0x820], rsi
je 0x140028002
lea rcx, [rbp + 0x820]
call sym.ProcessHacker.exe_PhStdGetClientIdName
mov edx, dword [rdi + 0xd4]
lea r9, [rbp + 0x30]
mov rcx, qword [rdi]
mov rbx, rax
mov dword [rbp + 0x34], edx
mov edx, 0x104c
mov r8, qword [rax + 8]
mov qword [rbp + 0x48], r8
xor r8d, r8d
mov dword [rbp + 0x30], r15d
mov dword [rbp + 0x38], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, r15d
jne 0x140028002
call fcn.140106290
mov rcx, qword [rsp + 0x58]
jmp 0x14002900f
mov rax, qword [rdi + 0x10]
lea rcx, [0x1401b5cd0]
mov qword [rbp - 0x68], rcx
lea rdx, [rbp - 0x70]
movzx r8d, r15b
mov qword [rbp - 0x70], 0xe
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140028af5
mov rax, qword [rdi + 8]
lea r9, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x28]
mov qword [rbp - 0x78], rsi
mov edx, 0x40
mov dword [rbp - 0x28], r14d
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x20], rsi
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp - 0x10], esi
mov qword [rbp - 0x18], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140028640
cmp byte [0x1402130ef], sil
je 0x140029016
lea r8, [rbp - 0x80]
mov edx, 0x40
lea rcx, [rsp + 0x78]
call fcn.140123530
test eax, eax
js 0x140029016
mov rdx, qword [rdi + 0x10]
lea r9, [rbp - 0x30]
mov rcx, qword [rsp + 0x78]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140029016
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0x820]
call sym.ProcessHacker.exe_PhGetProcessImageFileName
test eax, eax
js 0x14002873a
mov rbx, qword [rbp + 0x820]
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetFileName
mov r15, rax
test rbx, rbx
je 0x1400286d5
lea rcx, [rbx - 0x10]
mov edx, r14d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400286d5
nop
call fcn.140106290
test r15, r15
je 0x1400286e0
mov rcx, qword [r15 + 8]
jmp 0x1400286e3
mov rcx, r13
mov eax, dword [rdi + 0xd8]
lea r9, [rbp + 0x5f0]
mov qword [rbp + 0x608], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x5f0], 1
mov dword [rbp + 0x5f4], eax
mov dword [rbp + 0x5f8], 1
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, ds:[r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002873a
call fcn.140106290
mov rcx, qword [rbp - 0x30]
lea r8, [rbp + 0x7d0]
mov r9d, 0x30
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rcx, qword [rbp - 0x30]
lea r8, [rbp + 0x880]
mov r9d, 0x20
mov qword [rsp + 0x20], rsi
test eax, eax
mov r12d, 0x103
cmovns r12d, dword [rbp + 0x7d0]
lea edx, [r9 - 0x1c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
nop dword [rax + rax]
test eax, eax
js 0x1400289da
mov ebx, 0x7ffe0024
mov esi, 0x7ffe0020
lea r15d, [rbx + 4]
nop word [rax + rax]
mov ecx, dword [rbx]
mov eax, dword [rsi]
mov dword [rsp + 0x68], eax
mov eax, dword [r15]
mov dword [rsp + 0x6c], ecx
cmp ecx, eax
jne 0x1400287b0
mov eax, dword [rbp + 0x880]
lea rdx, [rbp + 0x870]
mov dword [rbp - 0x40], eax
lea rcx, [rbp - 0x40]
mov eax, dword [rbp + 0x884]
mov dword [rbp - 0x3c], eax
mov rax, qword [rsp + 0x68]
sub qword [rbp - 0x40], rax
call qword [sym.imp.ntdll.dll_RtlTimeToTimeFields]
movzx eax, word [rbp + 0x870]
lea rcx, [rbp + 0x830]
mov word [rbp + 0x830], ax
movzx eax, word [rbp + 0x872]
mov word [rbp + 0x832], ax
movzx eax, word [rbp + 0x874]
mov word [rbp + 0x836], ax
movzx eax, word [rbp + 0x876]
mov word [rbp + 0x838], ax
movzx eax, word [rbp + 0x878]
mov word [rbp + 0x83a], ax
movzx eax, word [rbp + 0x87a]
mov word [rbp + 0x83c], ax
movzx eax, word [rbp + 0x87c]
mov word [rbp + 0x83e], ax
movzx eax, word [rbp + 0x87e]
mov word [rbp + 0x834], ax
call sym.ProcessHacker.exe_PhFormatDateTime
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [rdi]
lea r9, [rbp + 0x590]
xor r8d, r8d
mov dword [rbp + 0x590], 1
mov dword [rbp + 0x598], 1
mov rdx, qword [rax + 8]
mov eax, dword [rdi + 0xdc]
mov qword [rbp + 0x5a8], rdx
mov edx, 0x104c
mov dword [rbp + 0x594], eax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp r12d, 0x103
je 0x140028aea
nop word [rax + rax]
mov ecx, dword [rbx]
mov eax, dword [rsi]
mov dword [rsp + 0x68], eax
mov eax, dword [r15]
mov dword [rsp + 0x6c], ecx
cmp ecx, eax
jne 0x1400288d0
mov eax, dword [rbp + 0x888]
lea rdx, [rbp + 0x860]
mov dword [rbp - 0x38], eax
lea rcx, [rbp - 0x38]
mov eax, dword [rbp + 0x88c]
mov dword [rbp - 0x34], eax
mov rax, qword [rsp + 0x68]
sub qword [rbp - 0x38], rax
call qword [sym.imp.ntdll.dll_RtlTimeToTimeFields]
movzx eax, word [rbp + 0x860]
lea rcx, [rbp + 0x830]
mov word [rbp + 0x830], ax
movzx eax, word [rbp + 0x862]
mov word [rbp + 0x832], ax
movzx eax, word [rbp + 0x864]
mov word [rbp + 0x836], ax
movzx eax, word [rbp + 0x866]
mov word [rbp + 0x838], ax
movzx eax, word [rbp + 0x868]
mov word [rbp + 0x83a], ax
movzx eax, word [rbp + 0x86a]
mov word [rbp + 0x83c], ax
movzx eax, word [rbp + 0x86c]
mov word [rbp + 0x83e], ax
movzx eax, word [rbp + 0x86e]
mov word [rbp + 0x834], ax
call sym.ProcessHacker.exe_PhFormatDateTime
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [rdi]
lea r9, [rbp + 0x650]
xor r8d, r8d
mov dword [rbp + 0x650], 1
mov dword [rbp + 0x658], 1
mov rdx, qword [rax + 8]
mov eax, dword [rdi + 0xe0]
mov qword [rbp + 0x668], rdx
mov edx, 0x104c
mov dword [rbp + 0x654], eax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400289e7
cmp r12d, 0x103
je 0x140028aea
nop word [rax + rax]
cmp r12d, 0xc0000022
je 0x140028a1d
cmp r12d, 0xc0000005
je 0x140028a1d
mov eax, r12d
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140028a2a
movzx eax, r12w
jmp 0x140028a26
mov ecx, r12d
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140028a37
mov ecx, r12d
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140028a3e
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
test rax, rax
je 0x140028a4c
mov r15, qword [rax + 8]
jmp 0x140028a53
lea r15, [0x1401b6740]
mov r8, r15
lea rcx, str.0x_x___s_
mov edx, r12d
call sym.ProcessHacker.exe_PhFormatString
mov rsi, rax
test rax, rax
je 0x140028a71
mov r13, qword [rax + 8]
mov eax, dword ds:[rdi + 0xe4]
lea r9, [rbp + 0x6b0]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x6b4], eax
mov dword [rbp + 0x6b0], 1
mov dword [rbp + 0x6b8], 1
mov qword [rbp + 0x6c8], r13
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsi - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140028acc
call fcn.140106290
nop dword [rax]
test rbx, rbx
je 0x140028aea
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140028aea
call fcn.140106290
mov rcx, qword ds:[rbp - 0x30]
jmp 0x14002900f
mov rax, qword [rdi + 0x10]
lea rcx, str.Thread
mov qword [rsp + 0x60], rcx
lea rdx, [rsp + 0x58]
movzx r8d, r15b
mov qword [rsp + 0x58], 0xc
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140029016
mov rax, qword [rdi + 8]
lea r9, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x28]
mov qword [rbp - 0x78], rsi
mov edx, 0x40
mov dword [rbp - 0x28], r14d
lea rcx, [rbp + 0x10]
mov qword [rbp - 0x20], rsi
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp - 0x10], esi
mov qword [rbp - 0x18], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140028b88
cmp byte [0x1402130ef], sil
je 0x140029016
lea r8, [rbp - 0x80]
mov edx, 0x40
lea rcx, [rbp + 0x10]
call fcn.140123530
nop dword [rax + rax]
test eax, eax
js 0x140029016
mov rdx, qword [rdi + 0x10]
lea r9, [rbp - 0x48]
mov rcx, qword [rbp + 0x10]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x800
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword ds:[rbp + 0x10]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140029016
mov rcx, qword ds:[rbp - 0x48]
lea rdx, [rbp + 0x820]
xor r12b, r12b
call fcn.1401226e0
test eax, eax
js 0x140028c5d
mov rbx, qword [rbp + 0x820]
test rbx, rbx
je 0x140028c0b
mov rcx, qword [rbx + 8]
jmp 0x140028c0e
mov rcx, r13
mov eax, dword [rdi + 0xd8]
lea r9, [rbp + 0x710]
mov qword [rbp + 0x728], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x710], r15d
mov dword [rbp + 0x714], eax
mov dword [rbp + 0x718], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, r15d
jne 0x140028c5d
call fcn.140106290
mov rcx, qword [rbp - 0x48]
lea r8, [rbp - 0x60]
mov r9d, 4
mov qword [rsp + 0x20], rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x140028dbb
mov eax, dword ds:[rbp - 0x60]
test eax, eax
setne r12b
test eax, eax
je 0x140028dbb
mov rcx, qword [rbp - 0x48]
lea r8, [rbp + 0x2c0]
mov r9d, 0x30
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x140028dbb
mov ebx, dword [rbp + 0x2c0]
cmp ebx, 0xc0000022
je 0x140028ceb
nop dword [rax]
cmp ebx, 0xc0000005
je 0x140028ceb
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140028cfa
movzx eax, bx
jmp 0x140028cf6
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140028d03
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140028d0a
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
test rax, rax
je 0x140028d1b
mov r15, qword [rax + 8]
jmp 0x140028d22
lea r15, [0x1401b6740]
mov edx, dword [rbp + 0x2c0]
lea rcx, str.0x_x___s_
mov r8, r15
call sym.ProcessHacker.exe_PhFormatString
mov r15, rax
test rax, rax
je 0x140028d43
mov r13, qword [rax + 8]
mov eax, dword [rdi + 0xe4]
lea r9, [rbp + 0x770]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x774], eax
mov dword [rbp + 0x770], 1
mov dword [rbp + 0x778], 1
mov qword [rbp + 0x788], r13
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, ds:[r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140028d9a
call fcn.140106290
test rbx, rbx
je 0x140028db5
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140028db5
nop
call fcn.140106290
mov r15d, 1
mov rcx, qword [rbp - 0x48]
lea r8, [rbp + 0x8a0]
mov r9d, 0x20
mov qword [rsp + 0x20], rsi
mov edx, r15d
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14002900b
mov ebx, 0x7ffe0024
mov esi, 0x7ffe0020
lea r15d, [rbx + 4]
mov ecx, dword [rbx]
mov eax, dword [rsi]
mov dword [rsp + 0x78], eax
mov eax, dword [r15]
mov dword [rsp + 0x7c], ecx
cmp ecx, eax
jne 0x140028df0
mov eax, dword ds:[rbp + 0x8a0]
lea rdx, [rbp + 0x840]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x58]
mov eax, dword [rbp + 0x8a4]
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x78]
sub qword [rsp + 0x58], rax
call qword [sym.imp.ntdll.dll_RtlTimeToTimeFields]
movzx eax, word ds:[rbp + 0x840]
lea rcx, [rbp + 0x820]
mov word [rbp + 0x820], ax
movzx eax, word [rbp + 0x842]
mov word [rbp + 0x822], ax
movzx eax, word [rbp + 0x844]
mov word [rbp + 0x826], ax
movzx eax, word [rbp + 0x846]
mov word [rbp + 0x828], ax
movzx eax, word [rbp + 0x848]
mov word [rbp + 0x82a], ax
movzx eax, word [rbp + 0x84a]
mov word [rbp + 0x82c], ax
movzx eax, word [rbp + 0x84c]
mov word [rbp + 0x82e], ax
movzx eax, word [rbp + 0x84e]
mov word [rbp + 0x824], ax
call sym.ProcessHacker.exe_PhFormatDateTime
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, ds:[rbp + 0x30]
mov dword [rbp + 0x30], 1
xor r8d, r8d
mov dword [rbp + 0x38], 1
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov eax, dword [rdi + 0xdc]
mov qword [rbp + 0x48], rcx
mov rcx, qword [rdi]
mov dword [rbp + 0x34], eax
call qword [sym.imp.USER32.dll_SendMessageW]
test r12b, r12b
je 0x14002900b
nop
mov ecx, dword ds:[rbx]
mov eax, dword [rsi]
mov dword [rsp + 0x78], eax
mov eax, dword [r15]
mov dword [rsp + 0x7c], ecx
cmp ecx, eax
jne 0x140028f00
mov eax, dword [rbp + 0x8a8]
lea rdx, [rbp + 0x850]
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x70]
mov eax, dword [rbp + 0x8ac]
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x78]
sub qword [rsp + 0x70], rax
call qword [sym.imp.ntdll.dll_RtlTimeToTimeFields]
movzx eax, word [rbp + 0x850]
lea rcx, [rbp + 0x820]
mov word [rbp + 0x820], ax
movzx eax, word [rbp + 0x852]
mov word [rbp + 0x822], ax
movzx eax, word [rbp + 0x854]
mov word [rbp + 0x826], ax
movzx eax, word [rbp + 0x856]
mov word [rbp + 0x828], ax
movzx eax, word [rbp + 0x858]
mov word [rbp + 0x82a], ax
movzx eax, word [rbp + 0x85a]
mov word [rbp + 0x82c], ax
movzx eax, word [rbp + 0x85c]
mov word [rbp + 0x82e], ax
movzx eax, word [rbp + 0x85e]
mov word [rbp + 0x824], ax
call sym.ProcessHacker.exe_PhFormatDateTime
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rbp + 0xe0]
mov dword [rbp + 0xe0], 1
xor r8d, r8d
mov dword [rbp + 0xe8], 1
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov eax, dword [rdi + 0xe0]
mov qword [rbp + 0xf8], rcx
mov rcx, qword [rdi]
mov dword [rbp + 0xe4], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp - 0x48]
nop
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, qword [rsp + 0xec8]
mov rcx, qword [rbp + 0xd80]
xor rcx, rsp
call fcn.140161390
lea r11, [rsp + 0xe90]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret