Function at 0x140040240
Capabilities:
Check mutex on windows
Check processdebugflags
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1500]
mov eax, 0x1600
call fcn.1402033c0
sub rsp, rax
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rbp + 0x14f0], rax
mov rax, qword [rcx + 0x18]
lea rbx, [0x140231658]
mov rdi, rcx
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x14004029b
mov rdx, qword [rcx + 8]
jmp 0x14004029e
mov rdx, rbx
mov eax, dword [rdi + 0x80]
lea r9, [rbp + 0x4a0]
mov rcx, qword [rdi]
mov r15d, 1
mov qword [rbp + 0x4b8], rdx
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x4a0], r15d
mov dword [rbp + 0x4a8], r15d
mov dword [rbp + 0x4a4], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x1400402f0
mov rcx, qword [rcx + 8]
jmp 0x1400402f3
mov rcx, rbx
mov eax, dword [rdi + 0x84]
lea r9, [rbp + 0x440]
mov qword [rbp + 0x458], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x440], r15d
mov dword [rbp + 0x444], eax
mov dword [rbp + 0x448], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x18]
mov r12d, 0x30
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x14004039a
lea r8d, [r12 - 0x20]
mov dword [rbp + 0xea0], 0x780030
lea rdx, [rbp + 0xea4]
call fcn.1401e4a4c
mov eax, dword [rdi + 0x88]
lea r9, [rbp + 0x3e0]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x3e4], eax
mov edx, 0x104c
lea rax, [rbp + 0xea0]
mov dword [rbp + 0x3e0], r15d
mov qword [rbp + 0x3f8], rax
mov dword [rbp + 0x3e8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x1400403ad
mov rcx, qword [rcx + 8]
jmp 0x1400403b0
mov rcx, rbx
lea r8, ds:[rbp - 0x48]
lea rdx, [rbp + 0xa8]
call sym.SystemInformer.exe_PhGetAccessEntries
mov rcx, qword [rdi + 0x18]
test al, al
je 0x1400404ba
mov rbx, qword [rbp + 0xa8]
mov r8d, dword [rbp - 0x48]
mov rdx, rbx
mov ecx, dword [rcx + 0x24]
call sym.SystemInformer.exe_PhGetAccessString
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
cmp qword [rax], 0
je 0x140040442
mov rdx, qword [rdi + 0x18]
lea rcx, str.0x_x___s_
mov r8, qword [rax + 8]
mov edx, dword [rdx + 0x24]
call sym.SystemInformer.exe_PhFormatString
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov dword ds:[rbp + 0x500], r15d
lea r9, [rbp + 0x500]
mov dword [rbp + 0x504], 3
mov dword [rbp + 0x508], r15d
mov rcx, qword [rax + 8]
mov qword [rbp + 0x518], rcx
jmp 0x140040492
mov rax, qword [rdi + 0x18]
lea rdx, [rbp + 0xea4]
mov r8d, 0x10
mov ecx, dword [rax + 0x24]
mov dword [rbp + 0xea0], 0x780030
call fcn.1401e4a4c
lea rax, [rbp + 0xea0]
mov dword [rbp + 0x140], r15d
mov qword [rbp + 0x158], rax
lea r9, [rbp + 0x140]
mov dword [rbp + 0x144], 3
mov dword [rbp + 0x148], r15d
mov rcx, qword ds:[rdi]
xor r8d, r8d
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1402bfe50]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140040517
mov ecx, dword [rcx + 0x24]
lea rdx, [rbp + 0xea4]
mov r8d, 0x10
mov dword [rbp + 0xea0], 0x780030
call fcn.1401e4a4c
mov rcx, qword [rdi]
lea rax, [rbp + 0xea0]
lea r9, [rbp + 0x140]
mov qword [rbp + 0x158], rax
xor r8d, r8d
mov dword [rbp + 0x140], r15d
mov edx, 0x104c
mov dword [rbp + 0x144], 3
mov dword [rbp + 0x148], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14d, dword [0x1402c2f94]
mov ebx, 0x40
mov rax, qword [rdi + 0x10]
cmp r14d, 3
mov ecx, 0x1000
mov qword [rbp + 0x88], rax
cmovge ebx, ecx
xor esi, esi
mov qword [rbp + 0x90], rsi
cmp r14d, 3
jl 0x140040554
mov eax, ebx
and eax, 0x121410
cmp eax, ebx
je 0x1400405aa
xorps xmm0, xmm0
mov dword [rbp + 0xc0], r12d
lea r9, [rbp + 0x88]
mov qword [rbp + 0xc8], rsi
lea r8, [rbp + 0xc0]
mov dword [rbp + 0xd8], esi
mov edx, ebx
mov qword [rbp + 0xd0], rsi
lea rcx, [rbp + 0x870]
movdqu xmmword [rbp + 0xe0], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400405bf
nop
cmp r14d, 5
jne 0x140040795
lea r8, [rbp + 0x88]
mov edx, ebx
lea rcx, [rbp + 0x870]
call fcn.14016dca0
nop
test eax, eax
js 0x140040795
mov rax, qword [rdi + 0x18]
lea rcx, [rbp + 0x9f0]
mov qword [rsp + 0x48], rsi
xor r9d, r9d
mov qword [rsp + 0x40], rsi
mov r8d, 0xffffffff
mov qword [rsp + 0x38], rsi
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x44]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x870]
call sym.SystemInformer.exe_PhGetHandleInformationEx
test eax, eax
js 0x140040788
mov eax, dword ds:[rbp - 0x44]
test eax, eax
js 0x140040788
mov ecx, dword ds:[rbp + 0x9fc]
lea rdx, [rbp + 0xea0]
mov r8d, 0xa
call fcn.1401e4a70
mov rcx, qword ds:[rdi]
lea rax, [rbp + 0xea0]
lea r9, [rbp + 0x380]
mov qword [rbp + 0x398], rax
xor r8d, r8d
mov dword [rbp + 0x380], r15d
mov edx, 0x104c
mov dword [rbp + 0x384], 4
mov dword [rbp + 0x388], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0x9f8]
lea rdx, [rbp + 0xea0]
mov r8d, 0xa
call fcn.1401e4a70
mov rcx, qword [rdi]
lea rax, [rbp + 0xea0]
lea r9, [rbp + 0x2c0]
mov qword [rbp + 0x2d8], rax
xor r8d, r8d
mov dword [rbp + 0x2c0], r15d
mov edx, 0x104c
mov dword [rbp + 0x2c4], 5
mov dword [rbp + 0x2c8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0xa00]
lea rdx, [rbp + 0xea0]
mov r8d, 0xa
call fcn.1401e4a70
mov rcx, qword [rdi]
lea rax, [rbp + 0xea0]
lea r9, [rbp + 0x260]
mov qword [rbp + 0x278], rax
xor r8d, r8d
mov dword [rbp + 0x260], r15d
mov edx, 0x104c
mov dword [rbp + 0x264], 6
mov dword [rbp + 0x268], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0xa04]
lea rdx, [rbp + 0xea0]
mov r8d, 0xa
call fcn.1401e4a70
mov rcx, qword [rdi]
lea rax, [rbp + 0xea0]
lea r9, [rbp + 0xb00]
mov qword [rbp + 0xb18], rax
xor r8d, r8d
mov dword [rbp + 0xb00], r15d
mov edx, 0x104c
mov dword [rbp + 0xb04], 7
mov dword [rbp + 0xb08], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x870]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword ds:[rdi + 0x18]
mov r15, qword [rax + 0x30]
test r15, r15
je 0x140041d96
mov rcx, qword [r15]
test rcx, rcx
je 0x140041d96
cmp rcx, 0x12
jne 0x140041c9d
mov r15, qword [r15 + 8]
lea r12, str.ALPC_Port
mov r14, rcx
shr r14, 4
test r14, r14
je 0x14004080c
nop word [rax + rax]
movdqu xmm0, xmmword [r15]
movdqu xmm1, xmmword [r12]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140040fc2
add r15, 0x10
add r12, 0x10
sub r14, 1
jne 0x1400407e0
mov r14, rcx
shr r14, 1
and r14d, 7
test r14, r14
je 0x14004085a
sub r12, r15
nop
movzx eax, word [r12 + r15]
movzx ecx, word [r15]
mov word [rsp + 0x50], ax
cmp cx, ax
je 0x140040850
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, word [rsp + 0x50]
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140041c9d
add r15, 2
sub r14, 1
jne 0x140040820
cmp dword [0x1402c2f94], 3
mov qword [rbp + 0x818], rsi
jl 0x140041d96
mov rax, qword [rdi + 0x10]
lea r8, [rbp + 0x960]
mov edx, 0x1000
mov qword [rbp + 0x960], rax
lea rcx, [rbp + 0x818]
mov qword [rbp + 0x968], rsi
call fcn.14016dca0
nop dword [rax + rax]
test eax, eax
js 0x140041d96
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x878]
mov rcx, qword [rbp + 0x818]
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x20
mov rdx, qword [rdx + 0x10]
call fcn.14016ee60
mov qword [rsp + 0x78], 2
lea r12, [0x140236e40]
mov r14, 0xffffffffffffffff
test eax, eax
js 0x14004116b
mov eax, dword [rbp + 0x880]
mov r15d, 0x100
mov rdx, qword [0x1402bfcf8]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], r15
lea ecx, [r15 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + 0x100], si
mov qword [rax], rsi
mov rcx, qword [rax + 8]
mov word [rcx], si
mov ecx, dword [rbp + 0x880]
bt ecx, 0xc
jae 0x1400409a8
mov rax, qword [rax]
add rax, 0x14
cmp rax, r15
jbe 0x14004096f
lfence
mov rdx, qword [rbx]
lea rcx, [rsp + 0x58]
add rdx, 0x14
call fcn.140141740
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
movups xmm0, xmmword [str.LPC_mode_]
movups xmmword [rdx + rcx], xmm0
mov eax, dword [0x140267f98]
mov dword [rdx + rcx + 0x10], eax
add qword [rbx], 0x14
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
and dword [rsp + 0x50], 0xffffefff
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x880]
bt ecx, 0x10
jae 0x140040a36
mov rax, qword [rbx]
add rax, 0x2a
cmp r15, rax
jae 0x1400409e1
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x2a
call fcn.140141740
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.Allow_impersonation_]
mov rdx, qword [rbx]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x140267fb0]
movups xmmword [rdx + rcx + 0x10], xmm1
movsd xmm0, qword [0x140267fc0]
movsd qword [rdx + rcx + 0x20], xmm0
movzx eax, word [0x140267fc8]
mov word [rdx + rcx + 0x28], ax
add qword [rbx], 0x2a
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
and dword [rsp + 0x50], 0xfffeffff
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x880]
bt ecx, 0x11
jae 0x140040ab8
mov rax, qword [rbx]
add rax, 0x28
cmp r15, rax
jae 0x140040a6f
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x28
call fcn.140141740
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
movups xmm0, xmmword [str.Allow_LPC_requests_]
movups xmmword [rcx + rax], xmm0
movups xmm1, xmmword [0x140267fe0]
movups xmmword [rcx + rax + 0x10], xmm1
movsd xmm0, qword [0x140267ff0]
movsd qword [rcx + rax + 0x20], xmm0
add qword [rbx], 0x28
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
and dword [rsp + 0x50], 0xfffdffff
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x880]
bt ecx, 0x12
jae 0x140040b28
mov rax, qword [rbx]
add rax, 0x14
cmp r15, rax
jae 0x140040aef
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x14
call fcn.140141740
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
movups xmm0, xmmword [str.Waitable_]
movups xmmword [rdx + rcx], xmm0
mov eax, dword [0x140268010]
mov dword [rdx + rcx + 0x10], eax
add qword [rbx], 0x14
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
and dword [rsp + 0x50], 0xfffbffff
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x880]
bt ecx, 0x13
jae 0x140040bb2
mov rax, qword [rbx]
add rax, 0x34
cmp r15, rax
jae 0x140040b61
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x34
call fcn.140141740
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.Allow_object_duplication_]
mov rdx, qword [rbx]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x140268028]
movups xmmword [rdx + rcx + 0x10], xmm1
movups xmm0, xmmword [0x140268038]
movups xmmword [rdx + rcx + 0x20], xmm0
mov eax, dword [0x140268048]
mov dword [rdx + rcx + 0x30], eax
add qword [rbx], 0x34
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
and dword [rsp + 0x50], 0xfff7ffff
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x880]
bt ecx, 0x14
jae 0x140040c44
mov rax, qword [rbx]
add rax, 0x2a
cmp r15, rax
jae 0x140040bef
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x2a
call fcn.140141740
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.System_process_only_]
mov rdx, qword [rbx]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x140268060]
movups xmmword [rdx + rcx + 0x10], xmm1
movsd xmm0, qword [0x140268070]
movsd qword [rdx + rcx + 0x20], xmm0
movzx eax, word [0x140268078]
mov word [rdx + rcx + 0x28], ax
add qword [rbx], 0x2a
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
and dword [rsp + 0x50], 0xffefffff
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x880]
bt ecx, 0x15
jae 0x140040cc0
mov rax, qword [rbx]
add rax, 0x22
cmp r15, rax
jae 0x140040c79
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x22
call fcn.140141740
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
movups xmm0, xmmword [str.Wake_policy__1__]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x140268090]
movups xmmword [rdx + rcx + 0x10], xmm1
movzx eax, word [0x1402680a0]
mov word [rdx + rcx + 0x20], ax
add qword [rbx], 0x22
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
and dword [rsp + 0x50], 0xffdfffff
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x880]
bt ecx, 0x16
jae 0x140040d3c
mov rax, qword [rbx]
add rax, 0x22
cmp r15, rax
jae 0x140040cf5
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x22
call fcn.140141740
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
movups xmm0, xmmword [str.Wake_policy__2__]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x1402680b8]
movups xmmword [rdx + rcx + 0x10], xmm1
movzx eax, word [0x1402680c8]
mov word [rdx + rcx + 0x20], ax
add qword [rbx], 0x22
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
and dword [rsp + 0x50], 0xffbfffff
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x880]
bt ecx, 0x17
jae 0x140040db8
mov rax, qword [rbx]
add rax, 0x22
cmp r15, rax
jae 0x140040d71
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x22
call fcn.140141740
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
movups xmm0, xmmword [str.Wake_policy__3__]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x1402680e0]
movups xmmword [rdx + rcx + 0x10], xmm1
movzx eax, word [0x1402680f0]
mov word [rdx + rcx + 0x20], ax
add qword [rbx], 0x22
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
and dword [rsp + 0x50], 0xff7fffff
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x880]
bt ecx, 0x18
jae 0x140040e4a
mov rax, qword [rbx]
add rax, 0x38
cmp r15, rax
jae 0x140040df5
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x38
call fcn.140141740
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
movups xmm0, xmmword [str.No_shared_section__direct__]
movups xmmword [rcx + rax], xmm0
movups xmm1, xmmword [0x140268108]
movups xmmword [rcx + rax + 0x10], xmm1
movups xmm0, xmmword [0x140268118]
movups xmmword [rcx + rax + 0x20], xmm0
movsd xmm0, qword [0x140268128]
movsd qword [rcx + rax + 0x30], xmm0
add qword [rbx], 0x38
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
and dword [rsp + 0x50], 0xfeffffff
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x880]
bt ecx, 0x19
jae 0x140040ef3
mov rax, qword ds:[rbx]
add rax, 0x3e
cmp r15, rax
jae 0x140040e88
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x3e
call fcn.140141740
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.Allow_multi_handle_attributes_]
mov rdx, qword [rbx]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x140268150]
movups xmmword [rdx + rcx + 0x10], xmm1
movups xmm0, xmmword [0x140268160]
movups xmmword [rdx + rcx + 0x20], xmm0
movsd xmm0, qword [0x140268170]
movsd qword [rdx + rcx + 0x30], xmm0
mov eax, dword [0x140268178]
mov dword [rdx + rcx + 0x38], eax
movzx eax, word [0x14026817c]
mov word [rdx + rcx + 0x3c], ax
add qword [rbx], 0x3e
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
and dword [rsp + 0x50], 0xfdffffff
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x880]
mov r10, qword [rbx]
cmp r10, 4
jb 0x140040f62
mov r11, qword [rbx + 8]
mov r9, r12
mov r8d, 2
lea rdx, [r11 - 4]
add rdx, r10
sub r9, rdx
movzx eax, word [rdx]
cmp ax, word [r9 + rdx]
jne 0x140040f62
add rdx, 2
sub r8, 1
jne 0x140040f13
mov rcx, r10
shr rcx, 1
sub rcx, 2
lea rax, [rcx + rcx]
add rcx, 2
sub r10, rax
lea rdx, [r11 + rcx*2]
lea r8, [r10 - 4]
lea rcx, [rax + r11]
call fcn.1401e3aa0
add qword [rbx], 0xfffffffffffffffc
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x880]
test ecx, ecx
jne 0x140040fd4
mov rax, qword [rbx]
add rax, 0xa
cmp r15, rax
jae 0x140040f90
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0xa
call fcn.140141740
mov rbx, qword [rsp + 0x60]
mov rcx, qword ds:[rbx + 8]
mov rdx, qword [rbx]
movsd xmm0, qword [0x140268180]
movsd qword [rdx + rcx], xmm0
movzx eax, word [0x140268188]
mov word [rdx + rcx + 8], ax
add qword [rbx], 0xa
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
jmp 0x14004100d
shl r14, 4
and ecx, 0xf
add r14, rcx
shr r14, 1
jmp 0x140040816
mov r8d, 0x10
mov dword [rbp + 0xea0], 0x780030
lea rdx, [rbp + 0xea4]
call fcn.1401e4a4c
lea r8, [rbp + 0xea0]
lea rdx, str.___s_
lea rcx, [rsp + 0x58]
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov rbx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x140041050
mov ecx, eax
mov dword [rbp + 0xea0], 0x780030
mov r8d, 0x10
lea rdx, [rbp + 0xea4]
call fcn.1401e4a4c
lea r8, [rbp + 0xea0]
lea rdx, str.__UNKNOWN:__s_
lea rcx, [rsp + 0x58]
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rbx + 8]
lea r9, [rbp + 0x200]
mov eax, dword [rdi + 0xa0]
mov r15d, 1
mov qword [rbp + 0x218], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x200], r15d
mov dword [rbp + 0x204], eax
mov dword [rbp + 0x208], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, ds:[rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, r15d
jne 0x1400410aa
call fcn.14013d2a0
mov ecx, dword ds:[rbp + 0x884]
lea rdx, [rbp + 0xea0]
mov r8d, 0xa
call fcn.1401e4a70
mov eax, dword ds:[rdi + 0xa4]
lea r9, [rbp + 0x320]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x324], eax
mov edx, 0x104c
lea rax, [rbp + 0xea0]
mov dword [rbp + 0x320], r15d
mov qword [rbp + 0x338], rax
mov dword [rbp + 0x328], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x888]
lea rdx, [rbp + 0xea4]
mov r8d, 0x10
mov dword [rbp + 0xea0], 0x780030
call fcn.1401e4a4c
mov eax, dword [rdi + 0xa8]
lea r9, [rbp + 0x560]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x564], eax
mov edx, 0x104c
lea rax, [rbp + 0xea0]
mov dword [rbp + 0x560], r15d
mov qword [rbp + 0x578], rax
mov dword [rbp + 0x568], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140041171
mov r15d, 1
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x70]
mov rcx, qword [rbp + 0x818]
mov rdx, qword [rdx + 0x10]
call fcn.14016efa0
mov rdx, qword ds:[rdi + 0x18]
lea r9, [rbp + 0x900]
mov rbx, qword [rbp - 0x70]
test eax, eax
mov rcx, qword [rbp + 0x818]
mov r8d, r15d
cmovs rbx, rsi
mov qword [rsp + 0x28], rsi
mov rdx, qword [rdx + 0x10]
mov qword [rbp - 0x70], rbx
mov dword [rsp + 0x20], 0x60
call fcn.14016ee60
test eax, eax
js 0x140041545
mov rax, qword ds:[rbp + 0x900]
lea r13, [0x1402681b0]
test rax, rax
je 0x1400412f0
xor edx, edx
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x50], rsi
call fcn.14017d480
mov r15, rax
mov r12d, 1
test rbx, rbx
je 0x140041292
movzx eax, word [rbx]
test ax, ax
je 0x140041292
movups xmm0, xmmword [r15]
mov dword [rbp + 0xbc0], r12d
lea edx, [r12 + 2]
mov dword [rbp + 0xbe0], r12d
lea rcx, [rbp + 0xbc0]
movups xmmword [rbp + 0xbd0], xmm0
mov r8d, 0x104
mov qword [rbp + 0xbf0], 6
mov qword [rbp + 0xbf8], r13
mov dword [rbp + 0xc00], r12d
mov qword [rbp + 0xc10], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0xc18], rax
call sym.SystemInformer.exe_PhFormat
mov rbx, rax
mov ecx, r14d
lock xadd dword [r15 - 8], ecx
cmp ecx, r12d
jne 0x14004128f
lea rcx, [r15 - 0x10]
call fcn.14013d2a0
mov r15, rbx
mov rcx, qword [r15 + 8]
lea r9, [rbp + 0x1a0]
mov eax, dword [rdi + 0xdc]
xor r8d, r8d
mov qword [rbp + 0x1b8], rcx
mov edx, 0x104c
mov rcx, qword [rdi]
mov dword [rbp + 0x1a0], r12d
mov dword [rbp + 0x1a4], eax
mov dword [rbp + 0x1a8], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, ds:[r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400412ea
call fcn.14013d2a0
mov rbx, qword [rbp - 0x70]
jmp 0x1400412f6
mov r12d, 1
mov rax, qword ds:[rbp + 0x920]
test rax, rax
je 0x140041409
xor edx, edx
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x50], rsi
call fcn.14017d480
mov r15, rax
test rbx, rbx
je 0x1400413b1
movzx eax, word [rbx + 0x10]
test ax, ax
je 0x1400413b1
movups xmm0, xmmword [r15]
mov dword [rbp + 0xc20], r12d
lea rcx, [rbp + 0xc20]
mov dword [rbp + 0xc40], r12d
mov edx, 3
movups xmmword [rbp + 0xc30], xmm0
mov r8d, 0x104
mov qword [rbp + 0xc50], 6
mov qword [rbp + 0xc58], r13
mov dword [rbp + 0xc60], r12d
mov qword [rbp + 0xc70], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp + 0xc78], rax
call sym.SystemInformer.exe_PhFormat
mov rbx, rax
mov ecx, r14d
lock xadd dword [r15 - 8], ecx
cmp ecx, 1
jne 0x1400413ae
lea rcx, [r15 - 0x10]
call fcn.14013d2a0
mov r15, rbx
mov rcx, qword [r15 + 8]
lea r9, [rbp + 0x5c0]
mov eax, dword [rdi + 0xe0]
xor r8d, r8d
mov qword [rbp + 0x5d8], rcx
mov edx, 0x104c
mov rcx, qword [rdi]
mov dword [rbp + 0x5c0], r12d
mov dword [rbp + 0x5c4], eax
mov dword [rbp + 0x5c8], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140041405
nop
call fcn.14013d2a0
mov rbx, qword [rbp - 0x70]
mov rax, qword [rbp + 0x940]
test rax, rax
je 0x140041517
xor edx, edx
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x50], rsi
call fcn.14017d480
mov rsi, rax
test rbx, rbx
je 0x1400414c1
movzx eax, word ds:[rbx + 0x20]
test ax, ax
je 0x1400414c1
movups xmm0, xmmword ds:[rsi]
mov dword [rbp + 0xc80], r12d
lea rcx, [rbp + 0xc80]
mov dword [rbp + 0xca0], r12d
mov edx, 3
movups xmmword [rbp + 0xc90], xmm0
mov r8d, 0x104
mov qword [rbp + 0xcb0], 6
mov qword [rbp + 0xcb8], r13
mov dword [rbp + 0xcc0], r12d
mov qword [rbp + 0xcd0], rax
mov rax, qword [rbx + 0x28]
mov qword [rbp + 0xcd8], rax
call sym.SystemInformer.exe_PhFormat
mov rbx, rax
mov ecx, r14d
lock xadd dword [rsi - 8], ecx
cmp ecx, 1
jne 0x1400414be
lea rcx, [rsi - 0x10]
call fcn.14013d2a0
mov rsi, rbx
mov rcx, qword [rsi + 8]
lea r9, [rbp + 0xb00]
mov eax, dword [rdi + 0xe4]
xor r8d, r8d
mov qword [rbp + 0xb18], rcx
mov edx, 0x104c
mov rcx, qword [rdi]
mov dword [rbp + 0xb00], r12d
mov dword [rbp + 0xb04], eax
mov dword [rbp + 0xb08], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140041513
call fcn.14013d2a0
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x14004152e
mov rcx, qword [0x1402bfe50]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x818]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x140041d96
mov rax, qword [rdi + 0x10]
lea r9, [rbp + 0x98]
mov ebx, dword [0x1402c2f94]
lea r8, [rbp + 0x110]
mov qword [rbp + 0x98], rax
lea rcx, [rbp + 0x818]
mov eax, 0x30
mov qword [rbp + 0x868], rsi
xorps xmm0, xmm0
mov qword [rbp + 0xa0], rsi
mov dword [rbp + 0x110], eax
mov qword [rbp + 0x118], rsi
lea edx, [rax + 0x10]
mov dword [rbp + 0x128], esi
mov qword [rbp + 0x120], rsi
movdqu xmmword [rbp + 0x130], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400415d2
cmp ebx, 5
jne 0x140041d96
lea r8, [rbp + 0x98]
lea edx, [rbx + 0x3b]
lea rcx, [rbp + 0x818]
call fcn.14016dca0
test eax, eax
js 0x140041d96
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x868]
mov rcx, qword [rbp + 0x818]
mov r8, r14
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x20000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x818]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test ebx, ebx
js 0x140041d96
mov rcx, qword [rbp + 0x868]
test rcx, rcx
je 0x140041d96
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x840]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x140041c09
mov r15d, dword [rbp + 0x840]
lea rcx, [rbp + 0xb0]
xor r8d, r8d
mov qword [rsp + 0x68], 0x100
xor edx, edx
mov qword [rbp + 0xb8], rsi
mov qword [rbp + 0xb0], 0x100
call sym.SystemInformer.exe_PhCreateString3
mov rbx, rax
mov qword [rsp + 0x70], rax
mov qword [rax], rsi
mov rcx, qword [rax + 8]
mov word [rcx], si
mov ecx, dword [rbp + 0x840]
bt ecx, 0xc
jae 0x1400416d5
mov r8d, 0x14
lea rdx, str.LPC_mode_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_PhAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0xc
mov rbx, qword [rsp + 0x70]
bt ecx, 0x10
jae 0x140041702
mov r8d, 0x2a
lea rdx, str.Allow_impersonation_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_PhAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x10
mov rbx, qword [rsp + 0x70]
bt ecx, 0x11
jae 0x14004172f
mov r8d, 0x28
lea rdx, str.Allow_LPC_requests_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_PhAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x11
mov rbx, qword [rsp + 0x70]
bt ecx, 0x12
jae 0x14004175c
mov r8d, 0x14
lea rdx, str.Waitable_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_PhAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x12
mov rbx, qword [rsp + 0x70]
bt ecx, 0x13
jae 0x140041789
mov r8d, 0x34
lea rdx, str.Allow_object_duplication_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_PhAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x13
mov rbx, qword [rsp + 0x70]
bt ecx, 0x14
jae 0x1400417b6
mov r8d, 0x2a
lea rdx, str.System_process_only_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_PhAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x14
mov rbx, qword [rsp + 0x70]
bt ecx, 0x15
jae 0x1400417e3
mov r8d, 0x22
lea rdx, str.Wake_policy__1__
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_PhAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x15
mov rbx, qword [rsp + 0x70]
bt ecx, 0x16
jae 0x140041815
mov r8d, 0x22
lea rdx, str.Wake_policy__2__
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_PhAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x16
mov rbx, qword [rsp + 0x70]
bt ecx, 0x17
jae 0x14004188f
mov rax, qword [rbx]
add rax, 0x22
cmp qword [rsp + 0x68], rax
jae 0x14004184b
lfence
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
mov rdx, qword [rax]
add rdx, 0x22
call fcn.140141740
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
movups xmm0, xmmword [str.Wake_policy__3__]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x1402680e0]
movups xmmword [rdx + rcx + 0x10], xmm1
movzx eax, word [0x1402680f0]
mov word [rdx + rcx + 0x20], ax
add qword [rbx], 0x22
mov rcx, qword [rbx]
btr r15d, 0x17
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x840]
bt ecx, 0x18
jae 0x14004191c
mov rax, qword [rbx]
add rax, 0x38
cmp qword [rsp + 0x68], rax
jae 0x1400418ca
lfence
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
mov rdx, qword [rax]
add rdx, 0x38
call fcn.140141740
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
movups xmm0, xmmword [str.No_shared_section__direct__]
movups xmmword [rcx + rax], xmm0
movups xmm1, xmmword [0x140268108]
movups xmmword [rcx + rax + 0x10], xmm1
movups xmm0, xmmword [0x140268118]
movups xmmword [rcx + rax + 0x20], xmm0
movsd xmm0, qword [0x140268128]
movsd qword [rcx + rax + 0x30], xmm0
add qword [rbx], 0x38
mov rcx, qword [rbx]
btr r15d, 0x18
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x840]
bt ecx, 0x19
jae 0x1400419ba
mov rax, qword [rbx]
add rax, 0x3e
cmp qword [rsp + 0x68], rax
jae 0x140041952
lfence
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
mov rdx, qword [rax]
add rdx, 0x3e
call fcn.140141740
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.Allow_multi_handle_attributes_]
mov rdx, qword [rbx]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x140268150]
movups xmmword [rdx + rcx + 0x10], xmm1
movups xmm0, xmmword [0x140268160]
movups xmmword [rdx + rcx + 0x20], xmm0
movsd xmm0, qword [0x140268170]
movsd qword [rdx + rcx + 0x30], xmm0
mov eax, dword [0x140268178]
mov dword [rdx + rcx + 0x38], eax
movzx eax, word [0x14026817c]
mov word [rdx + rcx + 0x3c], ax
add qword [rbx], 0x3e
mov rcx, qword [rbx]
btr r15d, 0x19
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x840]
mov r8, qword ds:[rbx]
cmp r8, 4
jb 0x140041a33
mov r9, qword [rbx + 8]
lea rdx, [r9 - 4]
add rdx, r8
sub rdx, r12
nop dword [rax + rax]
movzx eax, word [rdx + r12]
cmp ax, word [r12]
jne 0x140041a33
add r12, 2
sub qword [rsp + 0x78], 1
jne 0x1400419e0
mov rcx, r8
shr rcx, 1
sub rcx, 2
lea rax, [rcx + rcx]
add rcx, 2
sub r8, rax
sub r8, 4
lea rdx, [r9 + rcx*2]
lea rcx, [rax + r9]
call fcn.1401e3aa0
add qword [rbx], 0xfffffffffffffffc
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x840]
test ecx, ecx
jne 0x140041a9b
mov rax, qword ds:[rbx]
add rax, 0xa
cmp qword [rsp + 0x68], rax
jae 0x140041a6a
lfence
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
mov rdx, qword [rax]
add rdx, 0xa
call fcn.140141740
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
movsd xmm0, qword [0x140268180]
movsd qword [rdx + rcx], xmm0
movzx eax, word [0x140268188]
mov word [rdx + rcx + 8], ax
add qword [rbx], 0xa
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
jmp 0x140041ad4
mov r8d, 0x10
mov dword [rbp + 0xea0], 0x780030
lea rdx, [rbp + 0xea4]
call fcn.1401e4a4c
lea r8, [rbp + 0xea0]
lea rdx, str.___s_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov rbx, qword [rsp + 0x70]
test r15d, r15d
je 0x140041b15
mov ecx, r15d
lea rdx, [rbp + 0xea4]
mov r8d, 0x10
mov dword [rbp + 0xea0], 0x780030
call fcn.1401e4a4c
lea r8, [rbp + 0xea0]
lea rdx, str.__UNKNOWN:__s_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov rbx, qword [rsp + 0x70]
mov r9, qword [rbx + 8]
mov r15d, 1
mov edx, dword [rdi + 0xa0]
mov r8d, r15d
mov rcx, qword [rdi]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea rcx, ds:[rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, r15d
jne 0x140041b4a
call fcn.14013d2a0
mov ecx, dword ds:[rbp + 0x844]
lea rdx, [rbp + 0xea0]
mov r8d, 0xa
call fcn.1401e4a70
mov eax, dword ds:[rdi + 0xa4]
lea r9, [rbp + 0x620]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x624], eax
mov edx, 0x104c
lea rax, [rbp + 0xea0]
mov dword [rbp + 0x620], r15d
mov qword [rbp + 0x638], rax
mov dword [rbp + 0x628], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x848]
lea rdx, [rbp + 0xea4]
mov r8d, 0x10
mov dword [rbp + 0xea0], 0x780030
call fcn.1401e4a4c
mov eax, dword [rdi + 0xa8]
lea r9, [rbp + 0x680]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x684], eax
mov edx, 0x104c
lea rax, [rbp + 0xea0]
mov dword [rbp + 0x680], r15d
mov qword [rbp + 0x698], rax
mov dword [rbp + 0x688], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402b5e88], 0x6c
jb 0x140041c8b
mov rcx, qword [rbp + 0x868]
lea r8, [rbp + 0x8a0]
mov r9d, 8
mov qword [rsp + 0x20], rsi
lea edx, [r9 + 4]
call qword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x140041c8b
mov eax, dword [rbp + 0x8a4]
lea rcx, [rbp + 0x960]
mov qword [rbp + 0x960], rax
mov qword [rbp + 0x968], rsi
call sym.SystemInformer.exe_PhGetClientIdName
mov edx, dword [rdi + 0xd8]
mov r8d, r15d
mov rcx, qword [rdi]
mov rbx, rax
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea rcx, ds:[rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140041c8b
call fcn.14013d2a0
mov rcx, qword [rbp + 0x868]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140041d96
mov rax, qword [rdi + 0x18]
mov r15, qword [rax + 0x30]
mov rcx, qword [r15]
cmp rcx, 0x1e
jne 0x140041dd8
mov r15, qword [r15 + 8]
lea r12, str.EtwRegistration
mov r14, rcx
shr r14, 4
test r14, r14
je 0x140041cfc
nop dword [rax]
movdqu xmm0, xmmword [r15]
movdqu xmm1, xmmword [r12]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140041dc6
add r15, 0x10
add r12, 0x10
sub r14, 1
jne 0x140041cd0
mov r14, rcx
shr r14, 1
and r14d, 7
test r14, r14
je 0x140041d53
sub r12, r15
nop
movzx eax, word ds:[r12 + r15]
movzx ecx, word [r15]
mov word [rsp + 0x50], ax
cmp cx, ax
je 0x140041d49
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, word [rsp + 0x50]
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
nop dword [rax]
cmp bx, ax
jne 0x140041dd8
add r15, 2
sub r14, 1
jne 0x140041d10
mov rax, qword ds:[rdi + 0x18]
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x140041d69
mov rsi, qword [rcx + 8]
mov eax, dword [rdi + 0xf8]
mov ecx, 1
mov dword [rbp + 0x20], ecx
mov dword [rbp + 0x28], ecx
mov qword [rbp + 0x38], rsi
mov rcx, qword [rdi]
lea r9, [rbp + 0x20]
xor r8d, r8d
mov dword [rbp + 0x24], eax
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x14f0]
xor rcx, rsp
call fcn.1401dd6a0
lea r11, [rsp + 0x1600]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shl r14, 4
and ecx, 0xf
add r14, rcx
shr r14, 1
jmp 0x140041d06
lea rax, [rdi + 0x18]
mov rax, qword [rdi + 0x18]
lea rbx, [0x140266130]
mov r15, qword [rax + 0x30]
mov rcx, qword [r15]
cmp rcx, 8
jne 0x140042b3a
mov r15, qword [r15 + 8]
mov r14, rcx
shr r14, 4
mov r12, rbx
test r14, r14
je 0x140041e3c
nop dword [rax + rax]
movdqu xmm0, xmmword [r15]
movdqu xmm1, xmmword [r12]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140041f42
add r15, 0x10
add r12, 0x10
sub r14, 1
jne 0x140041e10
mov r14, rcx
shr r14, 1
and r14d, 7
test r14, r14
je 0x140041e9a
sub r12, r15
nop
movzx eax, word ds:[r12 + r15]
movzx ecx, word [r15]
mov word [rsp + 0x50], ax
cmp cx, ax
je 0x140041e89
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, word [rsp + 0x50]
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
nop dword [rax]
cmp bx, ax
jne 0x140042b3a
add r15, 2
sub r14, 1
jne 0x140041e50
lea rbx, [0x140266130]
mov r14d, dword [0x1402c2f94]
cmp r14d, 3
jl 0x1400425c5
mov rax, qword [rdi + 0x10]
lea r8, [rbp + 0xad8]
mov edx, 0x1000
mov qword [rbp + 0xad8], rax
lea rcx, [rbp + 0x808]
mov qword [rbp + 0xae0], rsi
call fcn.14016dca0
test eax, eax
js 0x1400425be
mov rdx, qword [rdi + 0x18]
lea rax, [rbp + 0xa68]
mov rcx, qword [rbp + 0x808]
lea r9, [rbp + 0x998]
mov byte [rsp + 0x50], sil
xor r12b, r12b
mov qword [rsp + 0x28], rax
mov rdx, qword [rdx + 0x10]
call fcn.14016f180
test eax, eax
js 0x140041fd8
mov eax, dword ds:[rbp + 0x998]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x140041f40.6
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x43d68]
mov ecx, dword [rdx + rax*4 + 0x43d54]
add rcx, rdx
jmp rcx
shl r14, 4
and ecx, 0xf
add r14, rcx
shr r14, 1
jmp 0x140041e46
mov eax, dword [rdi + 0xac]
mov dword [rbp - 0x3c], eax
lea rax, str.Pipe
jmp 0x140041fb4
mov eax, dword [rdi + 0xac]
mov dword [rbp - 0x3c], eax
lea rax, str.Network
jmp 0x140041fb4
mov eax, dword [rdi + 0xac]
mov dword [rbp - 0x3c], eax
lea rax, str.File_or_directory
mov byte [rsp + 0x50], 1
jmp 0x140041fb4
mov eax, dword [rdi + 0xac]
mov r12b, 1
mov dword [rbp - 0x3c], eax
lea rax, str.Console
jmp 0x140041fb4
mov eax, dword [rdi + 0xac]
mov dword [rbp - 0x3c], eax
lea rax, [0x140268210]
mov ecx, 1
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x40], ecx
lea r9, [rbp - 0x40]
mov dword [rbp - 0x38], ecx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword ds:[rdi + 0x18]
lea r9, [rbp + 0x974]
mov rcx, qword [rbp + 0x808]
mov r8d, 0x10
mov dword [rsp + 0x20], 4
mov rdx, qword [rdx + 0x10]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
lea r15, [0x140266cd4]
mov r14, 0xffffffffffffffff
test eax, eax
js 0x14004215a
mov eax, dword ds:[rbp + 0x974]
lea r8d, [r14 + 7]
mov edx, eax
mov ecx, eax
btr edx, 0x18
bts ecx, 0x18
test al, 0x30
cmovne ecx, edx
lea rdx, str.FILE_FLAG_OVERLAPPED
call sym.SystemInformer.exe_PhGetAccessString
mov edx, 1
mov qword [rbp + 0xd70], 4
lea rcx, [0x140260390]
mov dword [rbp + 0xd60], edx
mov qword [rbp + 0xd78], rcx
lea r8, [rbp + 0x10d0]
mov ecx, dword [rbp + 0x974]
mov r9d, 0x208
mov dword [rbp + 0xd90], ecx
lea rcx, [rbp + 0xd60]
mov dword [rbp + 0xda0], edx
mov dword [rbp + 0xd80], 0x108
mov byte [rbp + 0xd8a], 0x10
mov qword [rbp + 0xdb0], 4
mov qword [rbp + 0xdb8], r15
movups xmm0, xmmword [rax]
mov qword [rbp + 0x8a0], rax
lea rax, [0x14026821c]
mov dword [rbp + 0xdc0], edx
mov dword [rbp + 0xde0], edx
lea edx, [r14 + 6]
movups xmmword [rbp + 0xdd0], xmm0
mov qword [rbp + 0xdf0], 2
mov qword [rbp + 0xdf8], rax
mov qword [rsp + 0x20], rsi
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x14004213d
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0xf10]
mov ecx, 1
mov dword [rbp + 0xf14], eax
mov dword [rbp + 0xf10], ecx
lea rax, [rbp + 0x10d0]
mov dword [rbp + 0xf18], ecx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov qword [rbp + 0xf28], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x8a0]
mov eax, r14d
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14004215a
call fcn.14013d2a0
nop word [rax + rax]
test r12b, r12b
jne 0x1400423ee
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x8c8]
mov rcx, qword [rbp + 0x808]
mov r8d, 5
mov dword [rsp + 0x20], 0x18
mov rdx, qword [rdx + 0x10]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
mov r12d, 1
test eax, eax
js 0x140042256
mov rax, qword ds:[rbp + 0x8d0]
lea r9d, [r12 + 0x63]
lea r8, [rbp + 0x1060]
mov qword [rbp + 0xb90], rax
mov edx, r12d
mov dword [rbp + 0xb80], 0xc
lea rcx, [rbp + 0xb80]
mov qword [rsp + 0x20], rsi
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x140042229
mov eax, dword [rdi + 0xb8]
lea r9, [rbp + 0x6e0]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x6e4], eax
mov edx, 0x104c
lea rax, [rbp + 0x1060]
mov dword [rbp + 0x6e0], r12d
mov qword [rbp + 0x6f8], rax
mov dword [rbp + 0x6e8], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rsp + 0x50], sil
je 0x140042256
cmp byte [rbp + 0x8dd], sil
lea rax, [0x140268220]
mov edx, dword [rdi + 0xac]
mov r8d, r12d
mov rcx, qword [rdi]
cmovne rbx, rax
mov r9, rbx
call sym.SystemInformer.exe_PhSetListViewSubItem
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x990]
mov rcx, qword [rbp + 0x808]
mov r8d, 0xe
mov dword [rsp + 0x20], 8
mov rdx, qword [rdx + 0x10]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
nop
test eax, eax
js 0x1400423ee
mov rax, qword [rbp + 0x990]
test rax, rax
je 0x1400423ee
mov rcx, qword [rbp + 0x8d0]
mov r9d, 0x64
mov qword [rsp + 0x20], rsi
test rcx, rcx
je 0x140042383
xorps xmm1, xmm1
mov qword [rbp + 0xcf0], rax
cvtsi2sd xmm1, rax
mov dword [rbp + 0xce0], 0x10009
lea rax, [0x140268234]
mov dword [rbp + 0xd00], r12d
lea r8, [rbp + 0xf80]
mov qword [rbp + 0xd10], 4
lea edx, [r9 - 0x60]
mov qword [rbp + 0xd18], r15
xorps xmm0, xmm0
mov dword [rbp + 0xd20], 0x4b
cvtsi2sd xmm0, rcx
lea rcx, [rbp + 0xce0]
mov word [rbp + 0xd24], r12w
mov dword [rbp + 0xd40], r12d
mov qword [rbp + 0xd50], 4
mov qword [rbp + 0xd58], rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x140288b20]
movsd qword [rbp + 0xd30], xmm1
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x1400423ee
mov eax, dword [rdi + 0xb4]
lea r9, [rbp + 0x740]
mov dword [rbp + 0x744], eax
lea rax, [rbp + 0xf80]
mov qword [rbp + 0x758], rax
mov dword [rbp + 0x740], r12d
mov dword [rbp + 0x748], r12d
jmp 0x1400423dd
lea r8, [rbp + 0xff0]
mov dword [rbp + 0xba0], 0x10009
mov edx, r12d
mov qword [rbp + 0xbb0], rax
lea rcx, [rbp + 0xba0]
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x1400423ee
mov eax, dword [rdi + 0xb4]
lea r9, [rbp + 0x7a0]
mov dword [rbp + 0x7a4], eax
lea rax, [rbp + 0xff0]
mov qword [rbp + 0x7b8], rax
mov dword [rbp + 0x7a0], r12d
mov dword [rbp + 0x7a8], r12d
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x898]
mov rcx, qword [rbp + 0x808]
mov r8d, 8
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 8
mov rdx, qword [rdx + 0x10]
call fcn.14016e5e0
nop dword [rax]
test eax, eax
js 0x1400425ac
mov rcx, qword [rbp + 0x898]
lea rdx, [rbp + 0x80]
call fcn.14015aa20
test eax, eax
js 0x14004247e
mov rbx, qword [rbp + 0x80]
test rbx, rbx
je 0x140042451
mov r9, qword [rbx + 8]
jmp 0x140042454
mov r9, rsi
mov edx, dword [rdi + 0xbc]
mov r8d, 1
mov rcx, qword [rdi]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14004247e
call fcn.14013d2a0
mov rbx, qword ds:[rbp + 0x898]
lea rax, [rbp - 0x80]
xor r9d, r9d
mov dword [rbp - 0x80], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea edx, [r9 + 3]
call fcn.14016e860
mov r8d, dword [rbp - 0x80]
mov edx, 4
mov rcx, qword [0x1402bfe50]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r9d, dword [rbp - 0x80]
mov edx, 3
mov r15, rax
mov rcx, rbx
lea rax, [rbp - 0x80]
mov r8, r15
mov qword [rsp + 0x20], rax
call fcn.14016e860
lfence
test eax, eax
js 0x14004258d
movzx eax, word [r15]
test ax, ax
jne 0x1400424fb
call sym.SystemInformer.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x140042539
mov rdx, qword [0x1402bfcf8]
lea rcx, [rax + 0x12]
mov r13, qword [r15 + 8]
mov r12, rax
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
mov qword [rax], r12
add rax, 0x10
mov qword [rbx + 8], rax
mov word [r12 + rax], si
test r13, r13
je 0x140042539
mov rcx, qword [rbx + 8]
mov r8, r12
mov rdx, r13
call fcn.1401e3aa0
mov rcx, qword [0x1402bfe50]
mov r8, r15
xor edx, edx
mov qword [rbp + 0x80], rbx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test rbx, rbx
je 0x14004255b
mov rsi, qword [rbx + 8]
mov edx, dword [rdi + 0xc0]
mov r9, rsi
mov rcx, qword [rdi]
mov r8d, 1
call sym.SystemInformer.exe_PhSetListViewSubItem
lea rcx, ds:[rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x14004259f
call fcn.14013d2a0
jmp 0x14004259f
mov rcx, qword [0x1402bfe50]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x808]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140041d96
mov r14d, dword [0x1402c2f94]
mov rax, qword [rdi + 0x10]
lea r9, [rbp + 0x960]
mov qword [rbp + 0x960], rax
lea r8, [rbp - 0x40]
mov eax, 0x30
mov qword [rbp + 0x800], rsi
xorps xmm0, xmm0
mov qword [rbp + 0x968], rsi
lea rcx, [rbp + 0x808]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
lea edx, [rax + 0x10]
mov dword [rbp - 0x28], esi
mov qword [rbp - 0x30], rsi
movdqu xmmword [rbp - 0x20], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140042645
nop dword [rax + rax]
cmp r14d, 5
jne 0x140041d96
lea r8, ds:[rbp + 0x960]
lea edx, [r14 + 0x3b]
lea rcx, [rbp + 0x808]
call fcn.14016dca0
test eax, eax
js 0x140041d96
mov rdx, qword ds:[rdi + 0x18]
lea r9, [rbp + 0x800]
mov rcx, qword [rbp + 0x808]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x2000000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x808]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140041d96
mov rcx, qword [rbp + 0x800]
test rcx, rcx
je 0x140041d96
lea r9d, [r14 + 9]
mov dword [rsp + 0x20], 4
lea r8, [rbp + 0x978]
xor r12b, r12b
lea rdx, [rbp + 0xa58]
xor bl, bl
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x1400427ce
mov eax, dword [rbp + 0x978]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x140042705.6
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x43dcc]
mov ecx, dword [rdx + rax*4 + 0x43db8]
add rcx, rdx
jmp rcx
mov eax, dword [rdi + 0xac]
mov r13d, 1
mov dword [rbp + 0xf14], eax
lea rax, str.Pipe
mov dword [rbp + 0xf10], r13d
mov dword [rbp + 0xf18], r13d
jmp 0x1400427af
mov eax, dword [rdi + 0xac]
mov r13d, 1
mov dword [rbp + 0xf14], eax
lea rax, str.Network
mov dword [rbp + 0xf10], r13d
mov dword [rbp + 0xf18], r13d
jmp 0x1400427af
mov eax, dword [rdi + 0xac]
mov r12b, 1
mov dword [rbp + 0xf14], eax
lea rax, str.File_or_directory
jmp 0x14004279e
mov eax, dword [rdi + 0xac]
mov bl, 1
mov dword [rbp + 0xf14], eax
lea rax, str.Console
jmp 0x14004279e
mov eax, dword [rdi + 0xac]
mov dword [rbp + 0xf14], eax
lea rax, [0x140268210]
mov ecx, 1
mov dword [rbp + 0xf10], ecx
mov dword [rbp + 0xf18], ecx
mov rcx, qword [rdi]
lea r9, [rbp + 0xf10]
xor r8d, r8d
mov qword [rbp + 0xf28], rax
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x800]
lea r8, [rbp + 0x850]
mov r9d, 4
lea edx, [r9 + 0xc]
call fcn.140180a20
lea r15, [0x140266cd4]
test eax, eax
js 0x140042925
mov eax, dword ds:[rbp + 0x850]
mov r8d, 6
mov edx, eax
mov ecx, eax
btr edx, 0x18
bts ecx, 0x18
test al, 0x30
cmovne ecx, edx
lea rdx, str.FILE_FLAG_OVERLAPPED
call sym.SystemInformer.exe_PhGetAccessString
mov r13, rax
mov qword [rbp + 0xe10], 4
mov eax, 1
mov dword [rbp + 0xe20], 0x108
lea rcx, [0x140260390]
mov dword [rbp + 0xe00], eax
mov qword [rbp + 0xe18], rcx
lea r8, [rbp + 0x12e0]
mov ecx, dword [rbp + 0x850]
mov r9d, 0x208
mov dword [rbp + 0xe30], ecx
mov edx, 5
mov dword [rbp + 0xe40], eax
lea rcx, [rbp + 0xe00]
mov byte [rbp + 0xe2a], 0x10
mov qword [rbp + 0xe50], 4
mov qword [rbp + 0xe58], r15
movups xmm0, xmmword [r13]
mov dword [rbp + 0xe60], eax
mov dword [rbp + 0xe80], eax
lea rax, [0x14026821c]
movups xmmword [rbp + 0xe70], xmm0
mov qword [rbp + 0xe98], rax
mov qword [rbp + 0xe90], 2
mov qword [rsp + 0x20], rsi
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x14004290d
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0x20]
mov ecx, 1
mov dword [rbp + 0x24], eax
mov dword [rbp + 0x20], ecx
lea rax, [rbp + 0x12e0]
mov dword [rbp + 0x28], ecx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov qword [rbp + 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [r13 - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140042925
nop dword [rax]
call fcn.14013d2a0
test bl, bl
jne 0x140042b28
mov rcx, qword [rbp + 0x800]
lea r8, [rbp + 0x8a8]
mov r9d, 0x18
lea edx, [r9 - 0x13]
call fcn.140180a20
mov ebx, 1
test eax, eax
js 0x1400429f5
mov rax, qword [rbp + 0x8b0]
lea r9d, [rbx + 0x63]
lea r8, [rbp + 0xf10]
mov qword [rbp + 0xae8], rax
mov edx, ebx
mov dword [rbp + 0xad8], 0xc
lea rcx, [rbp + 0xad8]
mov qword [rsp + 0x20], rsi
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x1400429c6
mov eax, dword ds:[rdi + 0xb8]
lea r9, [rbp + 0x20]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x24], eax
mov edx, 0x104c
lea rax, [rbp + 0xf10]
mov dword [rbp + 0x20], ebx
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x28], ebx
call qword [sym.imp.USER32.dll_SendMessageW]
test r12b, r12b
je 0x1400429f5
cmp byte [rbp + 0x8bd], sil
lea rax, [0x140268220]
mov edx, dword [rdi + 0xac]
lea r9, [0x140266130]
mov rcx, qword [rdi]
cmovne r9, rax
mov r8d, ebx
call sym.SystemInformer.exe_PhSetListViewSubItem
mov rcx, qword [rbp + 0x800]
lea r8, [rbp + 0x980]
mov r9d, 8
lea edx, [r9 + 6]
call fcn.140180a20
test eax, eax
js 0x140042b28
mov rax, qword [rbp + 0x980]
test rax, rax
je 0x140042b28
mov rcx, qword [rbp + 0x8b0]
lea r8, [rbp + 0xf10]
mov qword [rsp + 0x20], rsi
mov r9d, 0x64
test rcx, rcx
je 0x140042ad6
xorps xmm1, xmm1
mov qword [rbp + 0xb10], rax
cvtsi2sd xmm1, rax
mov dword [rbp + 0xb00], 0x10009
lea rax, [0x140268234]
mov dword [rbp + 0xb20], ebx
lea edx, [r9 - 0x60]
mov qword [rbp + 0xb30], 4
mov qword [rbp + 0xb38], r15
xorps xmm0, xmm0
mov dword [rbp + 0xb40], 0x4b
cvtsi2sd xmm0, rcx
mov word [rbp + 0xb44], bx
lea rcx, [rbp + 0xb00]
mov dword [rbp + 0xb60], ebx
mov qword [rbp + 0xb70], 4
mov qword [rbp + 0xb78], rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x140288b20]
movsd qword [rbp + 0xb50], xmm1
jmp 0x140042af0
mov dword [rbp + 0xad8], 0x10009
lea rcx, [rbp + 0xad8]
mov qword [rbp + 0xae8], rax
mov edx, ebx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x140042b28
mov eax, dword [rdi + 0xb4]
lea r9, [rbp + 0x20]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x24], eax
mov edx, 0x104c
lea rax, [rbp + 0xf10]
mov dword [rbp + 0x20], ebx
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x28], ebx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x800]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140041d96
mov rax, qword [rdi + 0x18]
mov r15, qword [rax + 0x30]
mov rcx, qword [r15]
cmp rcx, 0xe
je 0x140042b52
xor al, al
jmp 0x140042bf5
mov r15, qword [r15 + 8]
lea r12, [0x1402675e8]
mov r14, rcx
shr r14, 4
test r14, r14
je 0x140042b9c
nop dword [rax]
movdqu xmm0, xmmword [r15]
movdqu xmm1, xmmword [r12]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140042d4d
add r15, 0x10
add r12, 0x10
sub r14, 1
jne 0x140042b70
mov r14, rcx
shr r14, 1
and r14d, 7
test r14, r14
je 0x140042bf3
sub r12, r15
nop
movzx eax, word ds:[r12 + r15]
movzx ecx, word [r15]
mov word [rsp + 0x50], ax
cmp cx, ax
je 0x140042be9
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, word [rsp + 0x50]
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
nop dword [rax]
cmp bx, ax
jne 0x140042b4b
add r15, 2
sub r14, 1
jne 0x140042bb0
mov al, 1
test al, al
je 0x140043033
mov ebx, dword [0x1402c2f94]
mov r14, 0xffffffffffffffff
mov qword [rbp - 0x78], rsi
cmp ebx, 3
jl 0x140042d9a
mov rax, qword ds:[rdi + 0x10]
lea r8, [rbp + 0xad8]
mov edx, 0x1000
mov qword [rbp + 0xad8], rax
lea rcx, [rbp + 0x820]
mov qword [rbp + 0xae0], rsi
call fcn.14016dca0
test eax, eax
js 0x140042d94
mov rcx, qword [0x1402bfe50]
lea edx, [r14 + 5]
mov r8d, 0x100
mov dword [rbp + 0x830], esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x8e0]
mov rcx, qword [rbp + 0x820]
lea r8d, [r14 + 0xf]
mov qword [rsp + 0x28], rsi
mov r15, rax
mov dword [rsp + 0x20], 0x18
mov rdx, qword [rdx + 0x10]
call fcn.14016e5e0
mov rdx, qword [rdi + 0x18]
lea r8d, [r14 + 0x10]
mov rcx, qword [rbp + 0x820]
mov r12d, eax
lea rax, [rbp + 0x830]
mov r9, r15
mov qword [rsp + 0x28], rax
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x100
call fcn.14016e5e0
cmp eax, 0x80000005
jne 0x140042d38
cmp dword [rbp + 0x830], esi
jbe 0x140042d76
mov rcx, qword [0x1402bfe50]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, dword [rbp + 0x830]
lea edx, [r14 + 5]
mov rcx, qword [0x1402bfe50]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rdi + 0x18]
lea r8d, [r14 + 0x10]
mov rcx, qword [rbp + 0x820]
mov r15, rax
lea rax, [rbp + 0x830]
mov r9, r15
mov qword [rsp + 0x28], rax
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], ebx
call fcn.14016e5e0
test eax, eax
js 0x140042d76
nop dword [rax]
cmp word [r15], si
jne 0x140042d5f
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x140042d6f
shl r14, 4
and ecx, 0xf
add r14, rcx
shr r14, 1
jmp 0x140042ba6
lfence
movzx edx, word [r15]
mov rcx, qword [r15 + 8]
call sym.SystemInformer.exe_PhCreateStringEx
mov rsi, rax
mov qword [rbp - 0x78], rax
mov rcx, qword [0x1402bfe50]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x820]
jmp 0x140042ee3
mov ebx, dword [0x1402c2f94]
mov rax, qword [rdi + 0x10]
lea r9, [rbp + 0x960]
mov qword [rbp + 0x960], rax
lea r8, [rbp - 0x40]
mov eax, 0x30
mov qword [rbp + 0x800], rsi
xorps xmm0, xmm0
mov qword [rbp + 0x968], rsi
lea rcx, [rbp + 0x820]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
lea edx, [rax + 0x10]
mov dword [rbp - 0x28], esi
mov qword [rbp - 0x30], rsi
movdqu xmmword [rbp - 0x20], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140042e0f
cmp ebx, 5
jne 0x140041d96
lea r8, [rbp + 0x960]
lea edx, [rbx + 0x3b]
lea rcx, [rbp + 0x820]
call fcn.14016dca0
test eax, eax
js 0x140041d96
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x800]
mov rcx, qword [rbp + 0x820]
mov r8, r14
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov ebx, eax
test eax, eax
jns 0x140042e7d
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x800]
mov rcx, qword [rbp + 0x820]
mov r8, r14
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 1
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov ebx, eax
mov rcx, qword [rbp + 0x820]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140041d96
mov rcx, qword [rbp + 0x800]
test rcx, rcx
je 0x140042ef2
mov r9d, 0x18
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x8e0]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQuerySection]
mov rcx, qword [rbp + 0x800]
lea rdx, [rbp - 0x78]
mov r12d, eax
call fcn.14017d3e0
mov rcx, qword [rbp - 0x78]
test eax, eax
cmovs rcx, rsi
mov rsi, rcx
mov qword [rbp - 0x78], rcx
mov rcx, qword [rbp + 0x800]
call qword [sym.imp.ntdll.dll_NtClose]
test r12d, r12d
js 0x140041d96
mov eax, dword [rbp + 0x8e8]
lea rbx, [0x1402360b8]
bt eax, 0x1b
jae 0x140042f0e
lea r15, [0x140268240]
jmp 0x140042f3b
bt eax, 0x17
jae 0x140042f1d
lea r15, [0x140266130]
jmp 0x140042f3b
bt eax, 0x18
jae 0x140042f2c
lea r15, [0x140268250]
jmp 0x140042f3b
bt eax, 0x1a
lea r15, str.Reserve
cmovae r15, rbx
movzx eax, byte [0x1402bcf8c]
lea rcx, [rbp + 0xf0]
xor r8d, r8d
mov byte [rbp + 0xfa], al
mov rax, qword [rbp + 0x8f0]
mov dword [rbp + 0xf0], 0x10c
mov qword [rbp + 0x100], rax
lea edx, [r8 + 1]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r13, rax
test rsi, rsi
je 0x140042fb9
mov rcx, rsi
call sym.SystemInformer.exe_PhResolveDevicePrefix
mov r12, rax
test rax, rax
je 0x140042fae
lea rcx, ds:[rsi - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140042fab
call fcn.14013d2a0
mov rsi, r12
test rsi, rsi
je 0x140042fb9
mov rcx, qword [rsi + 8]
jmp 0x140042fc0
lea rcx, [0x140268270]
mov eax, dword [rdi + 0xc8]
lea r9, [rbp + 0x20]
mov esi, 1
mov qword [rbp + 0x38], rcx
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x20], esi
mov dword [rbp + 0x28], esi
mov dword [rbp + 0x24], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rdi + 0xc4]
lea r9, [rbp + 0x20]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x24], eax
mov dword [rbp + 0x20], esi
mov dword [rbp + 0x28], esi
mov qword [rbp + 0x38], r15
call qword [sym.imp.USER32.dll_SendMessageW]
test r13, r13
je 0x14004301e
mov rbx, qword [r13 + 8]
mov eax, dword [rdi + 0xcc]
mov dword [rbp + 0x20], esi
mov dword [rbp + 0x28], esi
mov qword [rbp + 0x38], rbx
jmp 0x140041d7e
mov rax, qword ds:[rdi + 0x18]
mov r15, qword [rax + 0x30]
mov rcx, qword [r15]
cmp rcx, 0xc
jne 0x1400432f7
mov r15, qword ds:[r15 + 8]
lea r12, [0x140267e88]
mov r14, rcx
shr r14, 4
test r14, r14
je 0x14004309c
nop word [rax + rax]
movdqu xmm0, xmmword [r15]
movdqu xmm1, xmmword [r12]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1400432e5
add r15, 0x10
add r12, 0x10
sub r14, 1
jne 0x140043070
mov r14, rcx
shr r14, 1
and r14d, 7
test r14, r14
je 0x1400430f3
sub r12, r15
nop
movzx eax, word ds:[r12 + r15]
movzx ecx, word [r15]
mov word [rsp + 0x50], ax
cmp cx, ax
je 0x1400430e9
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, word [rsp + 0x50]
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
nop dword [rax]
cmp bx, ax
jne 0x1400432f7
add r15, 2
sub r14, 1
jne 0x1400430b0
mov rax, qword [rdi + 0x10]
lea r9, [rbp + 0x960]
mov ebx, dword [0x1402c2f94]
lea r8, [rbp - 0x40]
mov qword [rbp + 0x960], rax
lea rcx, [rbp + 0x850]
mov eax, 0x30
mov qword [rbp + 0x800], rsi
xorps xmm0, xmm0
mov qword [rbp + 0x968], rsi
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
lea edx, [rax + 0x10]
mov dword [rbp - 0x28], esi
mov qword [rbp - 0x30], rsi
movdqu xmmword [rbp - 0x20], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x14004316e
cmp ebx, 5
jne 0x140041d96
lea r8, [rbp + 0x960]
lea edx, [rbx + 0x3b]
lea rcx, [rbp + 0x850]
call fcn.14016dca0
test eax, eax
js 0x140041d96
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x800]
mov rcx, qword [rbp + 0x850]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r15d, 1
mov dword [rsp + 0x28], esi
mov r8, r14
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x850]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop
test ebx, ebx
js 0x140041d96
mov rcx, qword [rbp + 0x800]
test rcx, rcx
je 0x140041d96
lea r9d, [r15 + 7]
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x978]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x140043265
movsxd rax, dword [rbp + 0x978]
lea rcx, [rbp + 0x8a8]
xor r8d, r8d
mov qword [rbp + 0x8b8], rax
mov edx, r15d
mov dword [rbp + 0x8a8], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov edx, dword [rdi + 0xd0]
mov r8d, r15d
mov rcx, qword [rdi]
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [rbp + 0x97d], sil
lea rax, str.True
mov edx, dword [rdi + 0xd4]
lea r9, str.False
mov rcx, qword [rdi]
cmovne r9, rax
mov r8d, r15d
call sym.SystemInformer.exe_PhSetListViewSubItem
mov rcx, qword [rbp + 0x800]
lea r8, [rbp + 0xad8]
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
mov edx, r15d
call qword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x1400432d1
cmp qword [rbp + 0xad8], rsi
je 0x1400432d1
lea rcx, ds:[rbp + 0xad8]
call sym.SystemInformer.exe_PhGetClientIdName
mov edx, dword [rdi + 0xd8]
mov r8d, r15d
mov rcx, qword [rdi]
mov rbx, rax
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, r15d
jne 0x1400432d1
call fcn.14013d2a0
mov rcx, qword [rbp + 0x800]
call qword [sym.imp.ntdll.dll_NtClose]
nop
jmp 0x140041d96
shl r14, 4
and ecx, 0xf
add r14, rcx
shr r14, 1
jmp 0x1400430a6
mov rax, qword [rdi + 0x18]
mov r15, qword [rax + 0x30]
mov rcx, qword [r15]
cmp rcx, 0xe
je 0x14004330f
xor al, al
jmp 0x1400433b5
mov r15, qword [r15 + 8]
lea r12, [0x140266038]
mov r14, rcx
shr r14, 4
test r14, r14
je 0x14004335c
nop word [rax + rax]
movdqu xmm0, xmmword [r15]
movdqu xmm1, xmmword [r12]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140043542
add r15, 0x10
add r12, 0x10
sub r14, 1
jne 0x140043330
mov r14, rcx
shr r14, 1
and r14d, 7
test r14, r14
je 0x1400433b3
sub r12, r15
nop
movzx eax, word ds:[r15 + r12]
movzx ecx, word [r15]
mov word [rsp + 0x50], ax
cmp cx, ax
je 0x1400433a9
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, word [rsp + 0x50]
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
nop dword [rax]
cmp bx, ax
jne 0x140043308
add r15, 2
sub r14, 1
jne 0x140043370
mov al, 1
test al, al
je 0x140043854
cmp dword [0x1402c2f94], 3
mov r15d, 0x103
mov r12, rsi
mov qword [rbp - 0x68], rsi
jl 0x1400435bb
mov r8, qword [rdi + 0x10]
lea rcx, [rbp + 0x838]
mov edx, 0x1000
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x1400435bb
mov rcx, qword [0x1402bfe50]
lea r8d, [r15 - 3]
mov edx, 4
mov dword [rbp + 0x834], esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0xa28]
mov rcx, qword [rbp + 0x838]
mov r8d, 4
mov qword [rsp + 0x28], rsi
mov r14, rax
mov qword [rbp - 0x78], rax
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x30
call fcn.14016e5e0
mov rdx, qword ds:[rdi + 0x18]
lea r9, [rbp + 0x9b0]
mov rcx, qword [rbp + 0x838]
test eax, eax
mov ebx, r15d
mov qword [rsp + 0x28], rsi
cmovns ebx, dword [rbp + 0xa28]
mov r8d, 9
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x20], 0x20
call fcn.14016e5e0
mov rdx, qword [rdi + 0x18]
mov esi, eax
mov rcx, qword [rbp + 0x838]
lea rax, [rbp + 0x834]
mov qword [rsp + 0x28], rax
mov r9, r14
mov r8d, 0xb
shr esi, 0x1f
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x100
call fcn.14016e5e0
mov r14, 0xffffffffffffffff
cmp eax, 0xc0000023
jne 0x140043554
cmp dword [rbp + 0x834], r12d
jbe 0x1400435a9
mov r8, qword [rbp - 0x78]
xor edx, edx
mov rcx, qword [0x1402bfe50]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, dword [rbp + 0x834]
lea edx, [r14 + 5]
mov rcx, qword [0x1402bfe50]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rdi + 0x18]
lea r8d, [r14 + 0xc]
mov rcx, qword [rbp + 0x838]
mov qword [rbp - 0x78], rax
lea rax, [rbp + 0x834]
mov r13, qword [rbp - 0x78]
mov rdx, qword [rdx + 0x10]
mov r9, r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call fcn.14016e5e0
mov ebx, dword ds:[rsp + 0x50]
jmp 0x140043558
shl r14, 4
and ecx, 0xf
add r14, rcx
shr r14, 1
jmp 0x140043366
mov r13, qword [rbp - 0x78]
test eax, eax
js 0x1400435a9
nop dword [rax]
cmp word [r13], r12w
jne 0x14004356e
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x14004357f
lfence
movzx edx, word [r13]
mov rcx, qword [r13 + 8]
call sym.SystemInformer.exe_PhCreateStringEx
mov rcx, rax
mov r13, rax
call sym.SystemInformer.exe_PhGetFileName
mov r12, rax
lea rcx, [r13 - 0x10]
mov edx, r14d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400435a5
nop
call fcn.14013d2a0
mov qword [rbp - 0x68], r12
mov rcx, qword [rbp + 0x838]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x1400436e0
mov r8, qword [rdi + 0x10]
lea rcx, [rbp + 0x838]
mov edx, 0x40
mov qword [rbp + 0x860], rsi
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x140041d96
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x860]
mov rcx, qword [rbp + 0x838]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword ds:[rbp + 0x838]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140041d96
mov rcx, qword [rbp + 0x860]
test rcx, rcx
je 0x140041d96
lea rdx, [rbp - 0x68]
call sym.SystemInformer.exe_PhGetProcessImageFileName
test eax, eax
js 0x140043676
mov rbx, qword [rbp - 0x68]
mov rcx, rbx
call sym.SystemInformer.exe_PhGetFileName
mov r12, rax
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140043670
call fcn.14013d2a0
mov qword [rbp - 0x68], r12
jmp 0x14004367a
mov r12, qword [rbp - 0x68]
mov rcx, qword [rbp + 0x860]
lea r8, [rbp + 0xa28]
mov r9d, 0x30
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rcx, qword [rbp + 0x860]
lea r8, [rbp + 0x9b0]
mov r9d, 0x20
mov qword [rsp + 0x20], rsi
test eax, eax
mov ebx, r15d
cmovns ebx, dword [rbp + 0xa28]
lea edx, [r9 - 0x1c]
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rcx, qword [rbp + 0x860]
mov esi, eax
call qword [sym.imp.ntdll.dll_NtClose]
shr esi, 0x1f
xor sil, 1
mov r13d, 1
test r12, r12
je 0x14004371c
mov r9, qword [r12 + 8]
mov r8d, r13d
mov edx, dword [rdi + 0xe8]
mov rcx, qword [rdi]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea rcx, [r12 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, r13d
jne 0x14004371c
call fcn.14013d2a0
nop dword [rax]
test sil, sil
je 0x1400437b0
lea rdx, [rbp + 0x9b0]
lea rcx, [rbp + 0x9a0]
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea rcx, [rbp + 0x9a0]
call sym.SystemInformer.exe_PhFormatDateTime
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov edx, dword [rdi + 0xec]
mov r8d, r13d
mov rcx, qword [rdi]
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp ebx, r15d
je 0x140041d96
lea rdx, ds:[rbp + 0x9b8]
lea rcx, [rbp + 0x9a0]
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea rcx, [rbp + 0x9a0]
call sym.SystemInformer.exe_PhFormatDateTime
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov edx, dword [rdi + 0xf0]
mov r8d, r13d
mov rcx, qword [rdi]
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_PhSetListViewSubItem
jmp 0x1400437b9
cmp ebx, r15d
je 0x140041d96
xor edx, edx
mov ecx, ebx
call sym.SystemInformer.exe_PhGetStatusMessage
mov rsi, rax
test rax, rax
je 0x1400437d3
mov rbx, qword [rax + 8]
jmp 0x1400437da
lea rbx, [0x1402360b8]
mov edx, dword [rsp + 0x50]
lea rcx, str.0x_x___s_
mov r8, rbx
call sym.SystemInformer.exe_PhFormatString
mov rbx, rax
test rax, rax
je 0x1400437fb
mov r9, qword [rax + 8]
jmp 0x140043802
lea r9, [0x140231658]
mov edx, dword [rdi + 0xf4]
mov r8d, r13d
mov rcx, qword [rdi]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea rcx, ds:[rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14004382a
call fcn.14013d2a0
test rsi, rsi
je 0x140041d96
lea rcx, ds:[rsi - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140041d96
call fcn.14013d2a0
jmp 0x140041d96
mov rax, qword ds:[rdi + 0x18]
lea rcx, str.Thread
mov qword [rbp + 0xae0], rcx
lea rdx, [rbp + 0xad8]
mov r8b, 1
mov qword [rbp + 0xad8], 0xc
mov rcx, qword [rax + 0x30]
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x140041d96
cmp dword [0x1402c2f94], 3
mov r12, rsi
mov byte [rsp + 0x50], sil
mov r15d, 0x103
mov qword [rbp - 0x60], rsi
mov r14, 0xffffffffffffffff
jl 0x140043a9d
mov r8, qword [rdi + 0x10]
lea rcx, [rbp + 0x828]
mov edx, 0x1000
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x140043a9d
mov rcx, qword [0x1402bfe50]
lea edx, [r14 + 5]
lea r8d, [r15 - 3]
mov dword [rbp + 0x810], esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rdi + 0x18]
lea r8d, [r14 + 0xd]
mov rcx, qword [rbp + 0x828]
mov rbx, rax
lea rax, [rbp + 0x810]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x100
call fcn.14016e5e0
nop dword [rax]
cmp eax, 0xc0000023
jne 0x14004399f
cmp dword [rbp + 0x810], esi
jbe 0x1400439c6
mov rcx, qword [0x1402bfe50]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, dword ds:[rbp + 0x810]
lea edx, [r14 + 5]
mov rcx, qword [0x1402bfe50]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rdi + 0x18]
lea r8d, [r14 + 0xd]
mov rcx, qword [rbp + 0x828]
mov qword [rbp + 0x980], rax
lea rax, [rbp + 0x810]
mov qword [rsp + 0x28], rax
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], ebx
mov rbx, qword [rbp + 0x980]
mov r9, rbx
call fcn.14016e5e0
nop
test eax, eax
js 0x1400439c6
cmp word [rbx], si
jne 0x1400439b0
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x1400439bf
lfence
movzx edx, word [rbx]
mov rcx, qword [rbx + 8]
call sym.SystemInformer.exe_PhCreateStringEx
mov r12, rax
mov qword [rbp - 0x60], rax
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x988]
mov rcx, qword [rbp + 0x828]
mov r8d, 0xd
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 4
mov rdx, qword [rdx + 0x10]
call fcn.14016e5e0
test eax, eax
js 0x140043a41
mov eax, dword [rbp + 0x988]
test eax, eax
setne byte [rsp + 0x50]
test eax, eax
je 0x140043a41
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0xa78]
mov rcx, qword [rbp + 0x828]
mov r8d, 5
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x30
mov rdx, qword [rdx + 0x10]
call fcn.14016e5e0
test eax, eax
cmovns r15d, dword [rbp + 0xa78]
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x9d0]
mov rcx, qword [rbp + 0x828]
mov r8d, 0xa
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x20
mov rdx, qword [rdx + 0x10]
call fcn.14016e5e0
mov rcx, qword [0x1402bfe50]
mov r8, rbx
xor edx, edx
mov r13d, eax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x828]
call qword [sym.imp.ntdll.dll_NtClose]
mov ebx, 1
jmp 0x140043bea
mov r8, qword [rdi + 0x10]
lea rcx, [rbp + 0x828]
mov edx, 0x40
mov qword [rbp + 0x858], rsi
call sym.SystemInformer.exe_PhOpenProcess
nop dword [rax]
test eax, eax
js 0x140041d96
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x858]
mov rcx, qword [rbp + 0x828]
mov r8, r14
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x800
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x828]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140041d96
mov rcx, qword [rbp + 0x858]
test rcx, rcx
je 0x140043cc9
lea rdx, [rbp - 0x60]
call fcn.140164480
test eax, eax
js 0x140043b4a
mov rcx, qword ds:[rbp - 0x60]
mov eax, r14d
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140043b4a
call fcn.14013d2a0
mov rcx, qword [rbp + 0x858]
lea r8, [rbp + 0x970]
mov r9d, 4
mov qword [rsp + 0x20], rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x140043bb0
mov eax, dword ds:[rbp + 0x970]
test eax, eax
setne byte [rsp + 0x50]
test eax, eax
je 0x140043bb0
mov rcx, qword ds:[rbp + 0x858]
lea r8, [rbp + 0xaa8]
mov r9d, 0x30
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
cmovns r15d, dword [rbp + 0xaa8]
mov rcx, qword [rbp + 0x858]
lea r8, [rbp + 0x9d0]
mov ebx, 1
mov qword [rsp + 0x20], rsi
mov edx, ebx
mov r9d, 0x20
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov rcx, qword [rbp + 0x858]
mov r13d, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov r12, qword [rbp - 0x60]
test r12, r12
je 0x140043c1c
mov r9, qword [r12 + 8]
mov r8d, ebx
mov edx, dword [rdi + 0xe8]
mov rcx, qword [rdi]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea rcx, [r12 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140043c1c
call fcn.14013d2a0
movzx r12d, byte [rsp + 0x50]
test r12b, r12b
je 0x140043cba
xor edx, edx
mov ecx, r15d
call sym.SystemInformer.exe_PhGetStatusMessage
mov rsi, rax
test rax, rax
je 0x140043c43
mov rbx, qword [rax + 8]
jmp 0x140043c4a
lea rbx, [0x1402360b8]
mov r8, rbx
lea rcx, str.0x_x___s_
mov edx, r15d
call sym.SystemInformer.exe_PhFormatString
mov rbx, rax
test rax, rax
je 0x140043c6b
mov r9, qword [rax + 8]
jmp 0x140043c72
lea r9, [0x140231658]
mov edx, dword [rdi + 0xf4]
mov r8d, 1
mov rcx, qword [rdi]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140043c9c
call fcn.14013d2a0
nop dword [rax]
test rsi, rsi
je 0x140043cba
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140043cba
call fcn.14013d2a0
nop word [rax + rax]
test r13d, r13d
js 0x140041d96
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp + 0x960]
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea rcx, [rbp + 0x960]
call sym.SystemInformer.exe_PhFormatDateTime
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov edx, dword [rdi + 0xec]
mov ebx, 1
mov rcx, qword [rdi]
mov r8d, ebx
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_PhSetListViewSubItem
test r12b, r12b
je 0x140041d96
lea rdx, [rbp + 0x9d8]
lea rcx, [rbp + 0x960]
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea rcx, [rbp + 0x960]
call sym.SystemInformer.exe_PhFormatDateTime
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov edx, dword [rdi + 0xf0]
mov r8d, ebx
mov rcx, qword [rdi]
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_PhSetListViewSubItem
jmp 0x140041d96