Function at 0x1400366e0
Capabilities:
Check for peb beingdebugged flag
Create directory

Disassembly:
mov qword ss:[rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rdx, rcx
call fcn.14006d860
test eax, eax
js 0x14003722d
mov esi, 4
lea r8, [rbp - 0x40]
mov r15, 0xffffffffffffffff
xor r14d, r14d
mov r9d, esi
mov qword [rsp + 0x20], r14
mov rcx, r15
mov edx, 0xc
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14003677d
mov eax, dword [rbp - 0x40]
lea r8, [rbp - 0x48]
and eax, 0xffff7ffc
mov r9d, esi
mov edx, 0xc
mov dword [rbp - 0x40], eax
mov rcx, r15
mov dword [rbp - 0x48], eax
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
lea rcx, [0x140037280]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [rbp - 0x20], 1
lea rax, str.SiViewerMutant_
mov qword [rbp - 8], rax
lea r8, [rbp + 0xe0]
mov qword [rbp - 0x10], 0x1e
mov r9d, 0x66
mov rax, qword gs:[0x30]
mov edx, 2
mov ecx, dword [rax + 0x40]
lea rax, [rbp - 0x48]
mov dword [rbp + 0x10], ecx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov dword [rbp], 8
call fcn.14007d980
nop
test al, al
je 0x140037229
mov rcx, qword [rbp - 0x48]
add rcx, 0xfffffffffffffffe
mov word [rbp - 0x30], cx
lea eax, [rcx + 2]
mov word [rbp - 0x2e], ax
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x28], rax
cmp rcx, 0xfffe
ja 0x140037229
test byte [0x140156d00], 1
mov r12d, 0x40
mov dword [rbp - 0x78], 0x30
mov r13d, 0x80
jne 0x140036973
lock bts qword [0x140156d00], 0x1f
setb al
test al, al
jne 0x140036848
mov al, 1
jmp 0x14003685f
test byte [0x140156d00], 1
jne 0x14003685d
lea rcx, [0x140156d00]
call fcn.1400949c0
xor al, al
nop
test al, al
je 0x140036973
call fcn.1400b2440
mov edx, 1
lea rcx, [rbp + 0x30]
mov rdi, rax
movzx ebx, byte [rax + 1]
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
lea edx, [rbx*4 + 0x4c]
mov r8d, 2
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
lea r9, [0x140116588]
mov edx, 2
mov r8d, 0xf000f
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
mov r9, rdi
lea rcx, [rbp + 0x58]
mov edx, 2
mov r8d, 0xf000f
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea r9, [0x140116598]
mov edx, 2
mov r8d, 7
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
xor r9d, r9d
lea r8, [rbp + 0x58]
mov dl, 1
lea rcx, [rbp + 0x30]
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
cmp dword [0x140155b08], 0x64
lea rax, str.BaseNamedObjectsSystemInformer
mov qword [rbp - 0x38], rax
lea r8, [rsp + 0x50]
mov eax, 0x1080
mov dword [rbp - 0x40], 0x420040
cmovb eax, r13d
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x68], eax
lea rcx, [0x140159738]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rax
mov edx, 0x2000000
lea rax, [rbp + 0x30]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], rax
call qword [sym.imp.ntdll.dll_NtCreateDirectoryObject]
lea rcx, [0x140156d00]
call fcn.140094940
mov rax, qword [0x140159738]
lea r8, [rbp - 0x78]
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x80]
lea rax, [rbp - 0x30]
mov dword [rbp - 0x60], r12d
xorps xmm0, xmm0
mov qword [rbp - 0x68], rax
mov r9b, 1
mov edx, 1
movdqu xmmword [rbp - 0x58], xmm0
call qword [sym.imp.ntdll.dll_NtCreateMutant]
call fcn.140055c00
mov r9d, 0x200
lea r8, [0x1400678a0]
lea rdx, [0x140067820]
mov ecx, 0x30
call fcn.140062860
mov rdx, qword [0x140159188]
mov ecx, 0x10
mov qword [0x140159cb0], rax
call fcn.1400601a0
mov rcx, qword [0x140159238]
mov r8d, 0x20
mov edx, esi
mov rbx, rax
mov dword [rax], r14d
mov dword [rax + 4], esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 8], rax
mov qword [0x140159ca8], rbx
call fcn.14004fd40
mov rdx, qword [0x140159140]
mov rcx, r12
call fcn.1400601a0
mov edx, 1
mov word [rax], r14w
lock xadd dword [0x1401590e4], edx
movzx r8d, dl
lea rbx, [0x140159cc0]
lea rdx, [0x140046940]
mov byte [rax + 2], r8b
mov qword [rax + 8], rdx
mov rcx, r12
lea rdx, str.PvPropContext
mov dword [rax + 4], r14d
mov qword [rax + 0x10], rdx
mov rdx, qword [0x140159140]
mov qword [rbx + r8*8], rax
mov qword [0x14015a4c0], rax
call fcn.1400601a0
mov ecx, 1
mov word [rax], r14w
lock xadd dword [0x1401590e4], ecx
movzx edx, cl
xorps xmm0, xmm0
mov byte [rax + 2], dl
lea rcx, [0x140047980]
mov qword [rax + 8], rcx
xor r9d, r9d
mov dword [rax + 4], r14d
lea rcx, str.PvPropPageContext
mov qword [rax + 0x10], rcx
mov r8d, 2
mov qword [rbx + rdx*8], rax
xor ecx, ecx
mov qword [0x14015a4c8], rax
mov edx, 0x7f00
lea rax, [0x1400894a0]
mov dword [rsp + 0x28], 0x8000
mov qword [rbp - 0x18], rax
mov rax, qword [0x140159210]
mov qword [rbp - 8], rax
mov qword [rbp], r14
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x28], r14
mov dword [rbp - 0x20], 0x50
mov dword [rbp - 0x1c], 0x4088
mov dword [rbp - 0x10], r14d
mov dword [rbp - 0xc], 8
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [rbp + 8], rax
lea rcx, [rbp - 0x20]
lea rax, [0x14010ff48]
mov qword [rbp + 0x20], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
call fcn.140005000
call fcn.140036580
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x20]
lea rcx, [rbp - 0x30]
movzx eax, word [rdx + 0x70]
mov qword [rbp - 0x30], rax
mov rax, qword [rdx + 0x78]
mov qword [rbp - 0x28], rax
call fcn.140072860
mov rcx, qword [0x1401590d8]
test rcx, rcx
jne 0x140036d89
mov edx, 6
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14003722d
lea r9, [rbp - 0x80]
lea r8, [0x1400e90f0]
lea rdx, [0x1400e9100]
lea rcx, str.comdlg32.dll
call fcn.140073880
test eax, eax
js 0x140036bea
mov rcx, qword [0x140159238]
mov r8d, 0x10
mov rdi, qword [rbp - 0x80]
mov edx, esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
mov byte [rax + 1], r14b
test rdi, rdi
je 0x140036bde
mov byte [rax], 1
mov qword [rax + 8], rdi
jmp 0x140036bed
mov ecx, 0xc000000d
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rbx, r14
mov rcx, qword [rbx + 8]
cmp byte [rbx], r14b
je 0x140036c4a
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
mov rax, qword [rax + 0x50]
call qword [case.0x140071b98.0]
test eax, eax
js 0x140036c71
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x140036c2a
and eax, 0xffffc7ff
bts eax, 0x1c
and eax, 0xdfefffd9
bts eax, 8
btr eax, 0x19
jmp 0x140036c2f
mov eax, 0x10000100
mov rcx, qword [rbx + 8]
mov dword [rbp - 0x40], eax
mov rdx, qword [rcx]
mov r8, qword [rdx + 0x48]
mov edx, eax
mov rax, r8
call qword [case.0x140071b98.0]
jmp 0x140036c71
mov eax, dword [rcx + 0x60]
test eax, eax
je 0x140036c69
and eax, 0xffffc7ff
bts eax, 0x1c
and eax, 0xffeffffd
bts eax, 8
btr eax, 0x19
jmp 0x140036c6e
mov eax, 0x10000100
mov dword [rcx + 0x60], eax
lea rdx, str.Supported_files__.exe_.dll_.com_.ocx_.sys_.scr_.cpl_.ax_.acm_.lib_.winmd_.mui_.mun_.efi_.pdb_
mov rcx, rbx
call fcn.140071b60
mov rdx, rbx
xor ecx, ecx
call fcn.140071ac0
test al, al
je 0x140036d6a
mov rcx, rbx
call fcn.140071ee0
mov qword [0x1401590d8], rax
test rax, rax
je 0x140036d6a
call fcn.140070e20
mov rdi, rax
test rax, rax
je 0x140036d6a
mov r8, qword [0x1401590d8]
lea r9, [0x140113d18]
lea rdx, [0x140113d18]
mov ecx, 3
mov r8, qword [r8 + 8]
call fcn.140061a00
mov rcx, qword [0x1401590d8]
mov qword [0x1401590d8], rax
test rcx, rcx
je 0x140036d15
add rcx, 0xfffffffffffffff0
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140036d15
call fcn.1400602c0
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov r8, qword [0x1401590d8]
xor ecx, ecx
mov rdx, qword [rdi + 8]
mov dword [rsp + 0x20], 1
mov r8, qword [r8 + 8]
call fcn.140071880
test eax, eax
js 0x140036d52
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
lea rcx, ds:[rdi - 0x10]
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140036d6a
call fcn.1400602c0
mov rcx, rbx
call fcn.140071a20
mov rcx, qword [0x1401590d8]
nop dword [rax]
test rcx, rcx
je 0x14003722d
cmp qword [rcx], r14
je 0x14003722d
call fcn.140075ae0
mov rcx, qword [0x1401590d8]
mov qword [0x1401590d8], rax
test rcx, rcx
je 0x140036dc5
add rcx, 0xfffffffffffffff0
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140036dc5
nop dword [rax + rax]
call fcn.1400602c0
mov rax, qword [0x1401590d8]
mov rcx, qword [rax]
cmp rcx, 8
jb 0x140036e5b
mov rdi, qword [rax + 8]
lea r13, str..lnk
add rdi, 0xfffffffffffffff8
mov r12, rsi
add rdi, rcx
sub r13, rdi
movzx ecx, word [rdi]
movzx r14d, word [rdi + r13]
cmp cx, r14w
je 0x140036e18
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140036e5b
add rdi, 2
sub r12, 1
jne 0x140036df1
call fcn.140037320
test rax, rax
je 0x140036e5b
mov rcx, qword [0x1401590d8]
mov qword [0x1401590d8], rax
nop
test rcx, rcx
je 0x140036e5b
add rcx, 0xfffffffffffffff0
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140036e5b
call fcn.1400602c0
mov rax, qword [0x1401590d8]
mov rcx, qword [rax]
cmp rcx, 8
jb 0x140036ed0
mov rdi, qword [rax + 8]
lea r13, str..lib
add rdi, 0xfffffffffffffff8
mov r12, rsi
add rdi, rcx
sub r13, rdi
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdi]
movzx r14d, word [rdi + r13]
cmp cx, r14w
je 0x140036eb8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140036ed0
add rdi, 2
sub r12, 1
jne 0x140036e90
call fcn.140035520
jmp 0x140037212
mov rax, qword [0x1401590d8]
mov rcx, qword ds:[rax]
cmp rcx, 8
jb 0x140036f3f
mov rdi, qword [rax + 8]
lea r12, str..pdb
add rdi, 0xfffffffffffffff8
add rdi, rcx
sub r12, rdi
nop dword [rax + rax]
movzx ecx, word [rdi]
movzx r14d, word [r12 + rdi]
cmp cx, r14w
je 0x140036f2b
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r14w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140036f3f
add rdi, 2
sub rsi, 1
jne 0x140036f00
call fcn.14003cea0
jmp 0x140037212
mov rax, qword [0x1401590d8]
xor r14d, r14d
test rax, rax
je 0x140036f54
mov rdx, qword [rax + 8]
jmp 0x140036f57
mov rdx, r14
mov dword [rsp + 0x38], 0x60
lea rcx, [rbp - 0x40]
mov dword [rsp + 0x30], 1
mov r8d, 0x100081
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], 0x80
call fcn.140076e00
mov edi, eax
cmp eax, 0xc0000279
jne 0x14003700b
call fcn.140037520
test rax, rax
je 0x140036fc5
mov rcx, qword [0x1401590d8]
mov qword [0x1401590d8], rax
test rcx, rcx
je 0x140036fcc
add rcx, 0xfffffffffffffff0
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140036fc5
nop dword [rax]
call fcn.1400602c0
mov rax, qword [0x1401590d8]
test rax, rax
je 0x140036fd7
mov rdx, qword [rax + 8]
jmp 0x140036fda
mov rdx, r14
mov dword [rsp + 0x38], 0x60
lea rcx, [rbp - 0x40]
mov dword [rsp + 0x30], 1
mov r8d, 0x100081
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], 0x80
call fcn.140076e00
mov edi, eax
test edi, edi
js 0x140037117
mov rdx, qword [rbp - 0x40]
lea r8, [0x14015a500]
xor ecx, ecx
call fcn.140059520
mov rcx, qword [rbp - 0x40]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x140037117
movzx eax, word [0x14015a500]
cmp eax, 0x457f
je 0x1400370ee
cmp eax, 0x5a4d
je 0x14003705c
mov edi, 0xc00001a3
jmp 0x1400370f3
lea rax, str.EnableLegacyPropertiesDialog
mov qword [rbp - 0x30], 0x38
mov qword [rbp - 0x28], rax
mov r12d, 5
xor eax, eax
lock cmpxchg qword [0x1401591a0], r12
je 0x14003708e
lea rcx, [0x1401591a0]
call fcn.140087fe0
lea rcx, [rbp - 0x30]
call fcn.140067da0
mov rbx, rax
test rax, rax
je 0x1400370a9
cmp dword [rax], 1
jne 0x1400370a9
mov esi, dword [rax + 0x28]
jmp 0x1400370af
mov esi, dword [rbp - 0x48]
mov rbx, r14
mov rax, r12
lock cmpxchg qword [0x1401591a0], r14
je 0x1400370c9
lea rcx, [0x1401591a0]
call fcn.140088180
test rbx, rbx
jne 0x1400370da
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test esi, esi
je 0x1400370e7
nop
call fcn.14003f5e0
jmp 0x1400370f3
call fcn.14001dee0
jmp 0x1400370f3
call fcn.140010000
mov rdx, qword [0x14015a508]
test rdx, rdx
je 0x14003710f
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov qword [0x14015a508], r14
test edi, edi
jns 0x140037212
cmp edi, 0xc00001a3
jne 0x140037155
lea rax, str.PE_Viewer_does_not_support_this_image_type.
mov edx, 0x20
lea r8, [0x14013b8a8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, str.Unable_to_load_the_file.
mov r8d, 0xfffe
xor ecx, ecx
call fcn.14006eba0
jmp 0x140037212
cmp edi, 0xc0000022
je 0x14003718d
nop dword [rax]
cmp edi, 0xc0000005
je 0x14003718d
mov eax, edi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14003717b
movzx eax, di
jmp 0x140037198
mov eax, edi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14003719c
mov eax, edi
jmp 0x140037198
lfence
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x1400371a8
lfence
mov ecx, edi
call fcn.14006e580
jmp 0x1400371b2
lfence
mov ecx, eax
call fcn.14006e860
xor ecx, ecx
lea r8, [0x14013b8a8]
lea r9, str.Unable_to_load_the_file.
mov rbx, rax
test rax, rax
je 0x140037208
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call fcn.14006eba0
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x140037212
lfence
call fcn.1400602c0
jmp 0x140037212
mov edx, 0x10
call fcn.14006eb20
mov rax, qword [0x140159530]
test rax, rax
je 0x140037229
cmp qword [rax], 0
je 0x140037229
call fcn.140068920
xor eax, eax
jmp 0x140037232
mov eax, 1
mov rcx, qword ds:[rbp + 0x150]
xor rcx, rsp
call fcn.1400c6a20
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret