Function at 0x14003d400
Capabilities:
Map section object

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
push r13
lea rbp, [r11 - 0x68]
sub rsp, 0x148
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rsi, qword [rdx + 0x10]
mov r12, rdx
mov qword [rsp + 0x78], rcx
mov r13, rcx
test rsi, rsi
je 0x14003e2c1
mov rcx, qword ds:[rsi]
test rcx, rcx
je 0x14003e2c1
mov qword ds:[r11 + 0x18], rbx
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
cmp rcx, 8
jne 0x14003d51a
mov rsi, qword ds:[rsi + 8]
lea r14, [0x14026a2f0]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003d4b6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003d50b
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003d490
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14003d746
sub r14, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r15d, word [r14 + rsi]
cmp cx, r15w
je 0x14003d4f8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003d51a
add rsi, 2
sub rdi, 1
jne 0x14003d4d0
jmp 0x14003d746
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003d4bf
mov rsi, qword [r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 6
jne 0x14003d5da
mov rsi, qword ds:[rsi + 8]
lea r14, [0x14026a2e8]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003d576
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003d5cb
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003d550
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14003d746
sub r14, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r15d, word [r14 + rsi]
cmp cx, r15w
je 0x14003d5b8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003d5da
add rsi, 2
sub rdi, 1
jne 0x14003d590
jmp 0x14003d746
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003d57f
mov rsi, qword [r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 0x16
jne 0x14003d69a
mov rsi, qword ds:[rsi + 8]
lea r14, str.Mapped_file
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003d636
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003d68b
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003d610
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14003d746
sub r14, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003d678
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003d69a
add rsi, 2
sub rdi, 1
jne 0x14003d650
jmp 0x14003d746
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003d63f
mov rsi, qword [r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x14003d7bd
mov rsi, qword ds:[rsi + 8]
lea r14, str.Mapped_image
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003d6fa
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003d777
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003d6d0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14003d746
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003d73c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003d7bd
add rsi, 2
sub rdi, 1
jne 0x14003d710
mov r8, qword [r12 + 0x18]
mov rcx, r13
test r8, r8
je 0x14003d789
mov r8, qword [r8 + 8]
lea rax, str.Make_sure_the_Explorer_executable_file_is_present.
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea rdx, str.FileBrowseExecutable
call sym.SystemInformer.exe_QiShellExecuteUserString
jmp 0x14003e2a1
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003d703
lea rax, str.The_object_is_unnamed.
mov edx, 0x20
mov qword [rsp + 0x28], rax
lea r15, [0x140236d98]
lea r9, str.Unable_to_open_the_file_location.
mov qword [rsp + 0x20], r15
mov r8d, 0xfffe
call sym.SystemInformer.exe_QiShowMessage2
jmp 0x14003e2a1
mov rsi, qword [r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 6
jne 0x14003d8c5
mov rsi, qword [rsi + 8]
lea r14, [0x14026b760]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003d816
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003d87d
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003d7f0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14003d866
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003d858
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003d8c5
add rsi, 2
sub rdi, 1
jne 0x14003d830
mov rdx, qword [r12 + 0x18]
mov rcx, r13
test rdx, rdx
je 0x14003d88c
call sym.SystemInformer.exe_QiShellOpenKey2
jmp 0x14003e2a1
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003d81f
lea rax, str.The_object_is_unnamed.
mov edx, 0x20
mov qword [rsp + 0x28], rax
lea r15, [0x140236d98]
lea r9, str.Unable_to_open_key.
mov qword [rsp + 0x20], r15
mov r8d, 0xfffe
call sym.SystemInformer.exe_QiShowMessage2
nop dword [rax + rax]
jmp 0x14003e2a1
mov rsi, qword [r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14003daae
mov rsi, qword [rsi + 8]
lea r14, [0x14026a1f8]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003d91a
nop
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003d9cd
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003d8f0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14003d966
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003d95c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003daae
add rsi, 2
sub rdi, 1
jne 0x14003d930
xor edi, edi
mov edx, 0x1000
cmp dword [0x1402c825c], 3
jl 0x14003d9df
mov rax, qword [r12]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
call fcn.140174cc0
test eax, eax
js 0x14003e2a1
mov rdx, qword [r12 + 8]
lea r9, [rbp - 0x50]
mov rcx, qword [rsp + 0x78]
lea r8d, [rdi + 4]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x30
call fcn.140175600
mov rcx, qword [rsp + 0x78]
test eax, eax
cmovns rdi, qword [rbp - 0x30]
jmp 0x14003da22
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003d923
mov r9, qword [r12 + 8]
lea rcx, [rsp + 0x70]
mov r8, qword [r12]
call fcn.14003d2c0
test eax, eax
js 0x14003e2a1
mov rcx, qword [rsp + 0x70]
lea r8, [rbp - 0x20]
mov r9d, 0x30
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rcx, qword [rsp + 0x70]
test eax, eax
cmovns rdi, qword [rbp]
call qword [sym.imp.ntdll.dll_NtClose]
test rdi, rdi
je 0x14003e2a1
mov rcx, rdi
call sym.SystemInformer.exe_QiReferenceProcessItem
mov rbx, rax
test rax, rax
je 0x14003da77
xor edx, edx
mov r8, rax
lea ecx, [rdx + 1]
call sym.SystemInformer.exe_QiPluginInvokeWindowCallback
lea rcx, [rbx - 0x10]
mov r14, 0xffffffffffffffff
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x14003e2a1
call fcn.14013fb00
jmp 0x14003e2a1
lea rax, str.The_process_does_not_exist.
mov edx, 0x20
mov qword [rsp + 0x28], rax
lea r15, [0x140236d98]
lea r9, str.Unable_to_show_the_process_properties.
mov qword [rsp + 0x20], r15
mov r8d, 0xfffe
mov rcx, r13
call sym.SystemInformer.exe_QiShowMessage2
jmp 0x14003e2a1
mov rsi, qword ds:[r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14003e06e
mov rsi, qword ds:[rsi + 8]
lea r14, [0x14026b7a8]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003db1a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003dc85
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003daf0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14003db66
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003db5c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003e06e
add rsi, 2
sub rdi, 1
jne 0x14003db30
mov r9, qword ds:[r12 + 8]
lea rcx, [rbp - 0x80]
mov r8, qword [r12]
xor edi, edi
mov qword [rbp - 0x80], rdi
xor bl, bl
lea edx, [rdi + 7]
call fcn.14003d2c0
mov esi, eax
test eax, eax
jns 0x14003dba9
mov r9, qword ds:[r12 + 8]
lea edx, [rdi + 5]
mov r8, qword [r12]
lea rcx, [rbp - 0x80]
call fcn.14003d2c0
mov esi, eax
mov bl, 1
mov rdx, qword ds:[rbp - 0x80]
lea r15, [0x140236d98]
mov r14, 0xffffffffffffffff
test rdx, rdx
je 0x14003df94
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rdi
mov r8d, 0xffffffff
mov qword [rsp + 0x28], rdi
mov rcx, r14
mov qword [rsp + 0x20], rax
xor r12b, r12b
mov qword [rsp + 0x58], rdi
mov qword [rbp - 0x70], 0x2000000
mov qword [rbp - 0x78], rdi
call sym.SystemInformer.exe_QiGetHandleInformationEx
test eax, eax
js 0x14003dc4e
nop word [rax + rax]
cmp dword [rsp + 0x70], edi
jge 0x14003dc4e
lfence
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rdi
test rcx, rcx
je 0x14003dc4e
add rcx, 0xfffffffffffffff0
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003dc4e
call fcn.14013fb00
mov rcx, qword [rbp - 0x80]
lea r8, [rbp - 0x68]
mov r9d, 0x18
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQuerySection]
mov esi, eax
test eax, eax
js 0x14003df65
mov rax, qword [rbp - 0x58]
cmp rax, 0x2000000
jg 0x14003dc97
mov qword [rbp - 0x70], rax
jmp 0x14003dc9a
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003db23
mov r12b, 1
mov rcx, qword [rbp - 0x80]
lea r8, [rbp - 0x78]
movzx eax, bl
xor r9d, r9d
xor eax, 1
mov rdx, r14
lea eax, [rax*2 + 2]
mov dword [rsp + 0x48], eax
lea rax, [rbp - 0x70]
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov esi, eax
cmp eax, 0xc000004e
jne 0x14003dd2c
test bl, bl
jne 0x14003deb6
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x70]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x78]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], 2
mov rdx, r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov esi, eax
mov eax, esi
test esi, esi
js 0x14003dea8
mov rcx, qword [0x1402c5110]
mov edx, 4
lea r8d, [rdx + 0x34]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r13, rax
test r12b, r12b
je 0x14003dd6d
mov rcx, qword [rsp + 0x78]
lea r9, str.The_section_size_is_greater_than_32_MB._Only_the_first_32_MB_will_be_available.
mov r8, r15
mov edx, 0x30
call sym.SystemInformer.exe_QiShowMessage
xor eax, eax
xorps xmm0, xmm0
movups xmmword [r13], xmm0
movups xmmword [r13 + 0x10], xmm0
movups xmmword [r13 + 0x20], xmm0
mov qword [r13 + 0x30], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x40]
mov qword [r13 + 8], rcx
mov rax, qword [rbp - 0x78]
mov qword [r13 + 0x10], rax
mov rax, qword [rbp - 0x70]
mov qword [r13 + 0x18], rax
mov rax, qword [rsp + 0x58]
mov dword [r13 + 0x20], 0xffffffff
test rax, rax
je 0x14003ddd0
mov rdx, qword [rax + 8]
lea rcx, str.Section__
call sym.SystemInformer.exe_QiConcatStrings2
mov r12, rax
jmp 0x14003de85
lea rdx, [0x14026b7a8]
xorps xmm1, xmm1
mov rbx, rdx
mov rcx, rdx
and rbx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14003de0d
movdqu xmm0, xmmword ds:[rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x54], ecx
je 0x14003de09
mov ebx, ecx
shr rbx, 1
jmp 0x14003de4a
add rbx, 0x10
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x54], ecx
jne 0x14003de3c
movdqu xmm0, xmmword [rbx + 0x10]
add rbx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x54], ecx
je 0x14003de22
sub rbx, rdx
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x1402c4fb8]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov r8, rbx
lea rdx, [0x14026b7a8]
mov r12, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], di
mov rcx, qword [rax + 8]
call fcn.1402074d0
xor edx, edx
mov qword [r13 + 0x28], r12
mov r8, r13
mov dword [r13 + 0x30], 1
lea ecx, [rdx + 6]
call sym.SystemInformer.exe_QiPluginInvokeWindowCallback
mov r13, qword [rsp + 0x78]
jmp 0x14003df65
cmp eax, 0xc0000022
je 0x14003dede
cmp eax, 0xc0000005
je 0x14003dede
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14003decc
movzx eax, si
jmp 0x14003dee9
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14003deed
mov eax, esi
jmp 0x14003dee9
lfence
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14003def9
lfence
mov ecx, esi
call sym.SystemInformer.exe_QiGetNtMessage
jmp 0x14003df05
lfence
mov ecx, eax
call sym.SystemInformer.exe_QiGetWin32Message
lea r9, str.Unable_to_map_a_view_of_the_section.
mov rbx, rax
mov rcx, r13
test rax, rax
je 0x14003df56
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
mov qword [rsp + 0x20], r15
call sym.SystemInformer.exe_QiShowMessage2
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003df65
lfence
call fcn.14013fb00
jmp 0x14003df65
mov r8, r15
mov edx, 0x10
call sym.SystemInformer.exe_QiShowMessage
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14003df8a
lea rcx, ds:[rax - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003df8a
call fcn.14013fb00
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x14003e2a1
nop dword [rax]
cmp esi, 0xc0000022
je 0x14003dfd5
cmp esi, 0xc0000005
je 0x14003dfd5
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14003dfc3
movzx eax, si
jmp 0x14003dfe6
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14003dfea
mov eax, esi
jmp 0x14003dfe6
lfence
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14003dff6
lfence
mov ecx, esi
call sym.SystemInformer.exe_QiGetNtMessage
jmp 0x14003e005
lfence
mov ecx, eax
call sym.SystemInformer.exe_QiGetWin32Message
lea r9, str.Unable_to_query_the_section.
mov rbx, rax
mov rcx, r13
test rax, rax
je 0x14003e05c
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
mov qword [rsp + 0x20], r15
call sym.SystemInformer.exe_QiShowMessage2
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x14003e2a1
lfence
call fcn.14013fb00
jmp 0x14003e2a1
mov r8, r15
mov edx, 0x10
call sym.SystemInformer.exe_QiShowMessage
jmp 0x14003e2a1
mov rsi, qword ds:[r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 0xc
jne 0x14003e2a1
mov rsi, qword ds:[rsi + 8]
lea r14, str.Thread
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003e0da
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003e19b
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003e0b0
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14003e126
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003e11c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003e2a1
add rsi, 2
sub rdi, 1
jne 0x14003e0f0
cmp dword [0x1402c825c], 3
movaps xmmword [rsp + 0x120], xmm6
xorps xmm6, xmm6
jl 0x14003e1ad
mov rax, qword [r12]
lea r8, [rsp + 0x60]
xor edi, edi
mov qword [rsp + 0x60], rax
mov edx, 0x1000
mov qword [rsp + 0x68], rdi
lea rcx, [rsp + 0x78]
call fcn.140174cc0
nop
test eax, eax
js 0x14003e299
mov rdx, qword [r12 + 8]
lea r9, [rbp - 0x20]
mov rcx, qword [rsp + 0x78]
lea r8d, [rdi + 5]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x30
call fcn.140175600
test eax, eax
js 0x14003e194
movups xmm6, xmmword [rbp - 0x10]
mov rcx, qword [rsp + 0x78]
jmp 0x14003e1f6
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003e0e3
mov r9, qword [r12 + 8]
lea rcx, [rsp + 0x70]
mov r8, qword [r12]
mov edx, 0x800
call fcn.14003d2c0
test eax, eax
js 0x14003e299
mov rcx, qword [rsp + 0x70]
lea r8, [rbp - 0x50]
xor edi, edi
xor edx, edx
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14003e1f1
movups xmm6, xmmword [rbp - 0x40]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
movq rcx, xmm6
test rcx, rcx
je 0x14003e299
call sym.SystemInformer.exe_QiReferenceProcessItem
mov rbx, rax
test rax, rax
je 0x14003e267
mov rdx, rax
xor ecx, ecx
call sym.SystemInformer.exe_QiCreateProcessPropContext
mov rdi, rax
lea rcx, [rbx - 0x10]
mov r14, 0xffffffffffffffff
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x14003e245
nop
call fcn.14013fb00
psrldq xmm6, 8
lea r8, [0x14003d3c0]
mov rdx, rdi
movq qword [rdi + 0x78], xmm6
mov ecx, 0x10
call sym.SystemInformer.exe_QiPluginInvokeWindowCallback
jmp 0x14003e299
lea rax, str.The_process_does_not_exist.
mov edx, 0x20
mov qword [rsp + 0x28], rax
lea r15, [0x140236d98]
lea r9, str.Unable_to_show_the_process_properties.
mov qword [rsp + 0x20], r15
mov r8d, 0xfffe
mov rcx, r13
call sym.SystemInformer.exe_QiShowMessage2
movaps xmm6, xmmword [rsp + 0x120]
mov r14, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x180]
mov r15, qword [rsp + 0x130]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0x148
pop r13
pop r12
pop rsi
pop rbp
ret