Function at 0x14001ef10
Capabilities:
Access peb ldr_data
Delete registry value
Get number of processors
Map section object
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rbx, rdx
mov qword [rsp + 0x50], 8
mov rdi, rcx
lea rax, [0x14015a9d0]
mov r8b, 1
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 0x10]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
jne 0x14001f9a4
mov rcx, qword [rbx + 0x10]
lea rax, [0x14015a9c8]
mov r8b, 1
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 6
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
jne 0x14001f9a4
mov rcx, qword [rbx + 0x10]
lea rax, str.Mapped_file
mov r8b, 1
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0x16
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
jne 0x14001f9a4
mov rcx, qword [rbx + 0x10]
lea rax, str.Mapped_image
mov r8b, 1
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0x18
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
jne 0x14001f9a4
mov rcx, qword [rbx + 0x10]
lea rax, [0x14015b488]
mov r8b, 1
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 6
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x14001f03e
mov rdx, qword [rbx + 0x18]
mov rcx, rdi
test rdx, rdx
je 0x14001f023
add rsp, 0x140
pop rdi
pop rbx
pop rbp
jmp fcn.14000fd10
lea r8, str.Unable_to_open_key_because_the_object_is_unnamed.
mov edx, 0x10
add rsp, 0x140
pop rdi
pop rbx
pop rbp
jmp sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
mov rcx, qword [rbx + 0x10]
lea rax, [0x14015a6a8]
mov qword [rsp + 0x160], rsi
lea rdx, [rsp + 0x50]
mov r8b, 1
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x128], r14
mov qword [rsp + 0x50], 0xe
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x14001f245
xor esi, esi
cmp qword [0x14018d910], rsi
je 0x14001f18c
cmp byte [0x1401910b4], sil
mov rax, qword [rbx]
mov r14d, dword [sym.4yUlCM3HuVsHzW5CaCX.exe_ProcessQueryAccess]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rsi
je 0x14001f0b5
mov eax, r14d
and eax, 0x1410
cmp eax, r14d
je 0x14001f0f9
xorps xmm0, xmm0
mov dword [rbp - 0x58], 0x30
lea r9, [rsp + 0x50]
mov qword [rbp - 0x50], rsi
lea r8, [rbp - 0x58]
mov dword [rbp - 0x40], esi
mov edx, r14d
mov qword [rbp - 0x48], rsi
lea rcx, [rbp + 0x70]
movdqu xmmword [rbp - 0x38], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x14001f10a
cmp byte [0x1401910b4], sil
je 0x14001f973
lea r8, [rsp + 0x50]
mov edx, r14d
lea rcx, [rbp + 0x70]
call fcn.1400ecc50
test eax, eax
js 0x14001f973
mov rax, qword [rbp + 0x70]
xor r9d, r9d
mov rcx, qword [rbx + 8]
xor r8d, r8d
mov dword [rsp + 0x48], esi
xor edx, edx
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rsi
mov qword [rbp - 0x70], rax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x38], 0x30
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rbp - 0x80], rcx
mov rcx, qword [0x14018d910]
mov dword [rsp + 0x28], 0x9999225f
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x78], 4
mov dword [rbp - 0x68], 0x30
mov qword [rbp - 0x60], rsi
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov rcx, qword [rbp + 0x70]
test eax, eax
cmovns rsi, qword [rbp - 8]
jmp 0x14001f1d0
mov r9, qword [rbx + 8]
lea rcx, [rbp + 0x68]
mov r8, qword [rbx]
mov edx, dword [sym.4yUlCM3HuVsHzW5CaCX.exe_ProcessQueryAccess]
call fcn.14001edc0
test eax, eax
js 0x14001f973
mov rcx, qword [rbp + 0x68]
lea r8, [rbp - 0x58]
mov r9d, 0x30
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rcx, qword [rbp + 0x68]
test eax, eax
cmovns rsi, qword [rbp - 0x38]
call qword [sym.imp.ntdll.dll_NtClose]
test rsi, rsi
je 0x14001f973
mov rcx, rsi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhReferenceProcessItem
mov rbx, rax
test rax, rax
je 0x14001f22c
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov r9, rax
xor r8d, r8d
mov edx, 0x8078
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
mov r14, 0xffffffffffffffff
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x14001f973
call fcn.1400d9400
jmp 0x14001f973
lea r8, str.The_process_does_not_exist.
mov edx, 0x10
mov rcx, rdi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
jmp 0x14001f973
mov rcx, qword [rbx + 0x10]
lea rax, [0x14015b4d0]
mov r8b, 1
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0xe
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x14001f764
mov r9, qword [rbx + 8]
lea rcx, [rbp + 0x70]
mov r8, qword [rbx]
xor esi, esi
mov qword [rsp + 0x120], r15
mov edx, 7
mov qword [rbp + 0x70], rsi
xor r15b, r15b
call fcn.14001edc0
test eax, eax
jns 0x14001f2b5
mov r9, qword [rbx + 8]
lea rcx, [rbp + 0x70]
mov r8, qword [rbx]
mov edx, 5
call fcn.14001edc0
mov r15b, 1
mov rdx, qword [rbp + 0x70]
test rdx, rdx
je 0x14001f757
mov qword [rsp + 0x48], rsi
lea rax, [rbp + 0x78]
mov qword [rsp + 0x40], rax
mov r14, 0xffffffffffffffff
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0x68]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8d, 0xffffffff
mov qword [rsp + 0x138], r12
mov rcx, r14
mov qword [rsp + 0x20], rax
xor r12b, r12b
mov qword [rbp + 0x78], rsi
mov qword [rsp + 0x60], 0x2000000
mov qword [rsp + 0x68], rsi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetHandleInformationEx
test eax, eax
js 0x14001f349
cmp dword [rbp + 0x68], esi
jge 0x14001f349
mov rcx, qword [rbp + 0x78]
mov qword [rbp + 0x78], rsi
test rcx, rcx
je 0x14001f349
add rcx, 0xfffffffffffffff0
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001f349
call fcn.1400d9400
mov rcx, qword [rbp + 0x70]
lea r8, [rsp + 0x78]
mov r9d, 0x18
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQuerySection]
test eax, eax
js 0x14001f727
mov rax, qword [rbp - 0x78]
cmp rax, 0x2000000
jg 0x14001f380
mov qword [rsp + 0x60], rax
jmp 0x14001f383
mov r12b, 1
mov rcx, qword [rbp + 0x70]
lea r8, [rsp + 0x68]
movzx eax, r15b
xor r9d, r9d
xor eax, 1
mov rdx, r14
lea eax, [rax*2 + 2]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov ebx, eax
cmp eax, 0xc000004e
jne 0x14001f41b
test r15b, r15b
jne 0x14001f6a8
mov rcx, qword [rbp + 0x70]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x68]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov rdx, r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov ebx, eax
mov eax, ebx
test ebx, ebx
js 0x14001f69a
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x30
mov qword [rsp + 0x130], r13
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r15, rax
test r12b, r12b
je 0x14001f461
lea r8, str.The_section_size_is_greater_than_32_MB._Only_the_first_32_MB_will_be_available_for_editing.
mov edx, 0x30
mov rcx, rdi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
xorps xmm0, xmm0
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm0
movups xmmword [r15 + 0x20], xmm0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x40]
mov qword [r15], rcx
mov rax, qword [rsp + 0x68]
mov qword [r15 + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [r15 + 0x10], rax
mov rax, qword [rbp + 0x78]
mov dword [r15 + 0x18], 0xffffffff
test rax, rax
je 0x14001f61e
movzx r8d, byte [0x14018dbaa]
lea r9, str.Section__
mov r12, qword [rax + 8]
cmp r8b, 1
jb 0x14001f538
mov rdx, r9
mov rcx, r9
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x14001f4f1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
sar eax, cl
bsf ecx, eax
mov dword [rbp + 0x68], ecx
je 0x14001f4ed
mov edx, ecx
shr rdx, 1
jmp 0x14001f53d
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x68], ecx
jne 0x14001f528
nop dword [rax]
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x68], ecx
je 0x14001f510
sub rdx, r9
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
jmp 0x14001f53d
mov edx, 0xa
add rdx, rdx
mov qword [rsp + 0x50], rdx
cmp r8b, 1
jb 0x14001f5b8
mov rdi, r12
mov ecx, r12d
and rdi, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x14001f57d
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
sar eax, cl
bsf ecx, eax
mov dword [rbp + 0x68], ecx
je 0x14001f579
mov edi, ecx
shr rdi, 1
jmp 0x14001f5ca
add rdi, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x68], ecx
jne 0x14001f5a8
add rdi, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdi]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x68], ecx
je 0x14001f590
sub rdi, r12
mov eax, ecx
sar rdi, 1
shr rax, 1
add rdi, rax
jmp 0x14001f5ca
mov rdi, r14
nop dword [rax + rax]
inc rdi
cmp word [r12 + rdi*2], si
jne 0x14001f5c0
add rdi, rdi
lea rbx, [rdi + rdx]
mov rdx, qword [0x140191180]
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov r8, qword [rsp + 0x50]
lea rdx, str.Section__
mov r13, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], si
mov rcx, qword [rax + 8]
call fcn.1401317c0
mov rcx, qword [r13 + 8]
mov r8, rdi
add rcx, qword [rsp + 0x50]
mov rdx, r12
call fcn.1401317c0
jmp 0x14001f669
mov rdx, qword [0x140191180]
mov ecx, 0x20
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov r13, rax
mov qword [rax], 0xe
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + 0xe], si
mov rdx, qword [rax + 8]
movsd xmm0, qword [0x14015b4d0]
movsd qword [rdx], xmm0
mov ecx, dword [0x14015b4d8]
mov dword [rdx + 8], ecx
movzx ecx, word [0x14015b4dc]
mov word [rdx + 0xc], cx
mov qword [r15 + 0x20], r13
mov r9, r15
mov dword [r15 + 0x28], 1
xor r8d, r8d
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov edx, 0x8080
call qword [sym.imp.USER32.dll_PostMessageW]
mov r13, qword [rsp + 0x130]
jmp 0x14001f727
cmp eax, 0xc0000022
je 0x14001f6bb
cmp eax, 0xc0000005
je 0x14001f6bb
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14001f6c7
movzx eax, bx
jmp 0x14001f6c3
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x14001f6d0
mov ecx, ebx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetNtMessage
jmp 0x14001f6d7
mov ecx, eax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetWin32Message
lea r9, str.Unable_to_map_a_view_of_the_section
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x14001f6fc
lea r8, [0x140166310]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
jmp 0x14001f727
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001f727
call fcn.1400d9400
mov rax, qword [rbp + 0x78]
mov r12, qword [rsp + 0x138]
test rax, rax
je 0x14001f74d
lea rcx, [rax - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x14001f74d
call fcn.1400d9400
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
mov r15, qword [rsp + 0x120]
jmp 0x14001f973
mov rcx, qword [rbx + 0x10]
lea rax, [0x14015b508]
mov r8b, 1
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0xc
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEqualStringRef
test al, al
je 0x14001f973
cmp qword [0x14018d910], 0
movaps xmmword [rsp + 0x110], xmm6
xorps xmm6, xmm6
je 0x14001f8af
mov rax, qword [rbx]
xor esi, esi
cmp byte [0x1401910b4], sil
mov r14d, dword [sym.4yUlCM3HuVsHzW5CaCX.exe_ProcessQueryAccess]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rsi
je 0x14001f7d7
mov eax, r14d
and eax, 0x1410
cmp eax, r14d
je 0x14001f81b
xorps xmm0, xmm0
mov dword [rbp - 0x58], 0x30
lea r9, [rsp + 0x50]
mov qword [rbp - 0x50], rsi
lea r8, [rbp - 0x58]
mov dword [rbp - 0x40], esi
mov edx, r14d
mov qword [rbp - 0x48], rsi
lea rcx, [rbp + 0x70]
movdqu xmmword [rbp - 0x38], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x14001f82c
cmp byte [0x1401910b4], sil
je 0x14001f96b
lea r8, [rsp + 0x50]
mov edx, r14d
lea rcx, [rbp + 0x70]
call fcn.1400ecc50
test eax, eax
js 0x14001f96b
mov rax, qword [rbp + 0x70]
xor r9d, r9d
mov rcx, qword [rbx + 8]
xor r8d, r8d
mov dword [rsp + 0x48], esi
xor edx, edx
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rsi
mov qword [rbp - 0x70], rax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x38], 0x30
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rbp - 0x80], rcx
mov rcx, qword [0x14018d910]
mov dword [rsp + 0x28], 0x9999225f
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x78], 5
mov dword [rbp - 0x68], 0x30
mov qword [rbp - 0x60], rsi
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x14001f8a9
movups xmm6, xmmword [rbp - 0x18]
mov rcx, qword [rbp + 0x70]
jmp 0x14001f8f6
mov r9, qword [rbx + 8]
lea rcx, [rbp + 0x68]
mov r8, qword [rbx]
mov edx, dword [sym.4yUlCM3HuVsHzW5CaCX.exe_ThreadQueryAccess]
call fcn.14001edc0
test eax, eax
js 0x14001f96b
mov rcx, qword [rbp + 0x68]
lea r8, [rbp - 0x58]
xor esi, esi
mov r9d, 0x30
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14001f8f2
movups xmm6, xmmword [rbp - 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
movq rcx, xmm6
test rcx, rcx
je 0x14001f96b
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhReferenceProcessItem
mov rbx, rax
test rax, rax
je 0x14001f98e
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov rdx, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateProcessPropContext
mov rdi, rax
lea rcx, [rbx - 0x10]
mov r14, 0xffffffffffffffff
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x14001f941
call fcn.1400d9400
psrldq xmm6, 8
lea r9, [0x14001eea0]
movq qword [rdi + 0x90], xmm6
mov r8, rdi
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov edx, 0x808a
call qword [sym.imp.USER32.dll_PostMessageW]
movaps xmm6, xmmword [rsp + 0x110]
mov rsi, qword [rsp + 0x160]
mov r14, qword [rsp + 0x128]
add rsp, 0x140
pop rdi
pop rbx
pop rbp
ret
lea r8, str.The_process_does_not_exist.
mov edx, 0x10
mov rcx, rdi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
jmp 0x14001f96b
mov rdx, qword [rbx + 0x18]
mov rcx, rdi
test rdx, rdx
je 0x14001f9c3
mov rdx, qword [rdx + 8]
add rsp, 0x140
pop rdi
pop rbx
pop rbp
jmp sym.4yUlCM3HuVsHzW5CaCX.exe_PhShellExploreFile
lea r8, str.Unable_to_open_file_location_because_the_object_is_unnamed.
mov edx, 0x10
add rsp, 0x140
pop rdi
pop rbx
pop rbp
jmp sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage