Function at 0x140056be0
Capabilities:
Get explorer pid

Disassembly:
push rbp
push rsi
lea rbp, [rsp - 0xe8]
sub rsp, 0x1e8
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rdx, rcx
mov dword [rsp + 0x60], r9d
call fcn.14014b980
test eax, eax
js 0x140057896
call fcn.1400582e0
nop dword [rax]
test al, al
je 0x140057896
xor esi, esi
lea r8, [rsp + 0x68]
mov r9d, 4
mov dword [rsp + 0x68], esi
mov edx, 0xc
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
lea rcx, [0x1400587a0]
call qword [sym.imp.ntdll.dll_RtlSetUnhandledExceptionFilter]
mov dword [rbp - 0x40], 1
lea rax, str.SiMutant_
mov qword [rbp - 0x28], rax
lea r8, [rbp + 0x40]
mov qword [rbp - 0x30], 0x12
mov r9d, 0x66
mov rax, qword gs:[0x30]
mov edx, 2
mov ecx, dword [rax + 0x40]
lea rax, [rsp + 0x70]
mov dword [rbp - 0x10], ecx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x20], 8
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x140057896
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffffe
mov word [rsp + 0x78], cx
lea eax, [rcx + 2]
mov word [rsp + 0x7a], ax
lea rax, [rbp + 0x40]
mov qword [rbp - 0x80], rax
cmp rcx, 0xfffe
ja 0x140057896
mov qword [rsp + 0x200], rbx
mov dword [rbp - 0x70], 0x30
call fcn.1401422e0
mov qword ds:[rbp - 0x68], rax
lea r8, [rbp - 0x70]
lea rax, [rsp + 0x78]
mov dword [rbp - 0x58], 0x40
xorps xmm0, xmm0
mov qword [rbp - 0x60], rax
mov r9b, 1
lea rcx, [rsp + 0x68]
mov edx, 1
movdqu xmmword [rbp - 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtCreateMutant]
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.140059e20
mov ebx, dword [0x1402c8fac]
lea r8, [rsp + 0x70]
mov edx, 0x20
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, 0xc0000022
jne 0x140056d7f
nop dword [rax]
cmp ebx, 5
jne 0x140056eb7
lea r8, [rsp + 0x70]
mov edx, 0x20
mov rcx, 0xffffffffffffffff
call fcn.140178f00
nop
test eax, eax
js 0x140056eb7
mov rcx, qword [rsp + 0x70]
lea r8, [rbp - 0x40]
mov qword [rbp + 0x4c], 0xe
xor r9d, r9d
mov qword [rbp + 0x7c], 0x11
xor edx, edx
mov qword [rbp + 0xac], 8
mov qword [rbp + 0x40], 0x14
mov dword [rbp + 0x48], 2
movaps xmm0, xmmword [rbp + 0x40]
movups xmmword [rbp - 0x3c], xmm0
mov dword [rbp + 0x54], 2
mov qword [rbp + 0x58], 0x21
movaps xmm1, xmmword [rbp + 0x50]
movups xmmword [rbp - 0x2c], xmm1
mov dword [rbp + 0x60], 2
mov qword [rbp + 0x64], 0xa
mov dword [rbp + 0x6c], 2
movaps xmm0, xmmword [rbp + 0x60]
movups xmmword [rbp - 0x1c], xmm0
mov qword [rbp + 0x70], 0xd
mov dword [rbp + 0x78], 2
movaps xmm1, xmmword [rbp + 0x70]
movups xmmword [rbp - 0xc], xmm1
mov dword [rbp + 0x84], 2
mov qword [rbp + 0x88], 0x12
movaps xmm0, xmmword [rbp + 0x80]
movups xmmword [rbp + 4], xmm0
mov dword [rbp + 0x90], 2
mov qword [rbp + 0x94], 0x13
mov dword [rbp + 0x9c], 2
movaps xmm1, xmmword [rbp + 0x90]
movups xmmword [rbp + 0x14], xmm1
mov qword [rbp + 0xa0], 9
mov dword [rbp + 0xa8], 2
movaps xmm0, xmmword [rbp + 0xa0]
mov dword [rbp + 0xb4], 2
movsd xmm1, qword [rbp + 0xb0]
mov qword [rsp + 0x28], rsi
movups xmmword [rbp + 0x24], xmm0
mov dword [rbp - 0x40], 0xa
movsd qword [rbp + 0x34], xmm1
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtAdjustPrivilegesToken]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [0x1402c4f50]
nop
test rcx, rcx
je 0x140056ed3
call fcn.1400eec00
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
call fcn.140150860
call fcn.140058d40
lea rax, str.AllowOnlyOneInstance
mov qword [rsp + 0x78], 0x28
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x80], rax
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x140056f25
test dword [0x1402c4f40], 0x3160
jne 0x140056f25
call fcn.1401422e0
mov r8, rax
lea rdx, [0x140057e20]
mov rcx, rax
call sym.SystemInformer.exe_Ordinal_1489
lea rax, str.EnableStartAsAdmin
mov qword [rsp + 0x208], rdi
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x78], 0x24
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x1400570d2
mov eax, dword [0x1402c4f40]
nop dword [rax]
test eax, 0x120
jne 0x1400570d8
test al, 0x40
jne 0x1400570d8
lea rcx, [rsp + 0x78]
call sym.SystemInformer.exe_Ordinal_1518
test byte [rax + 8], 1
je 0x14005770e
lea rax, str.EnableStartAsAdminAlwaysOnTop
mov qword [rsp + 0x78], 0x3a
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x80], rax
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x1400570d2
lea rcx, [rsp + 0x78]
call sym.SystemInformer.exe_Ordinal_1518
test byte ds:[rax + 8], 1
je 0x1400570d2
lea rcx, [rsp + 0x78]
call sym.SystemInformer.exe_Ordinal_1518
lea rcx, [rsp + 0x70]
mov r9d, 4
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x68]
mov edx, 0x1a
mov rcx, qword [rax]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x1400570d2
cmp dword [rsp + 0x68], esi
setne al
test al, al
jne 0x1400570d2
call sym.SystemInformer.exe_Ordinal_1639
mov rbx, rax
test rax, rax
je 0x1400570d2
nop dword [rax + rax]
cmp qword [rax], rsi
je 0x1400570d2
call qword [sym.imp.USER32.dll_GetShellWindow]
mov rcx, rax
lea rdx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop dword [rax]
test eax, eax
je 0x1400570d2
mov edi, dword [rsp + 0x68]
lea r8, [rsp + 0x70]
mov r9d, 4
mov qword [rsp + 0x20], rsi
mov edx, 0x18
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400570d2
mov eax, dword [rsp + 0x70]
xor r9d, r9d
mov rdx, qword [rbx + 8]
xor r8d, r8d
mov byte [rsp + 0x50], 1
xor ecx, ecx
mov byte [rsp + 0x48], sil
mov byte [rsp + 0x40], 1
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 2
call sym.SystemInformer.exe_Ordinal_1028
mov edi, eax
lea rcx, [rbx - 0x10]
mov edx, 0xffffffff
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400570ca
call fcn.140143da0
test edi, edi
jns 0x14005773f
mov eax, dword [0x1402c4f40]
cmp byte [0x1402cad41], sil
mov qword ss:[rsp + 0x210], r12
mov qword [rsp + 0x1e0], r13
mov qword [rsp + 0x1d8], r14
mov qword [rsp + 0x1d0], r15
je 0x14005710b
test al, 0x20
jne 0x14005710b
call fcn.140053ba0
lea rcx, [0x1402c65d0]
call sym.SystemInformer.exe_Ordinal_1250
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 8
mov dword [rsp + 0x74], 0xc42f
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea rax, [0x1401a0a20]
mov dword [rsp + 0x28], 0x8000
mov qword [rbp - 0x38], rax
xorps xmm0, xmm0
mov rax, qword [0x1402c6000]
xor r9d, r9d
mov edx, 0x7f00
mov qword [rbp - 0x28], rax
xor ecx, ecx
mov qword [rbp - 0x20], rsi
mov r8d, 2
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp + 8], rsi
mov dword [rbp - 0x40], 0x50
mov dword [rbp - 0x3c], 0x4088
mov dword [rbp - 0x30], esi
mov dword [rbp - 0x2c], 8
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x40]
lea rax, [0x14026a2c0]
mov qword [rbp], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
lea rax, [0x14019fae0]
mov dword [rsp + 0x28], 0x8000
mov qword [rbp - 0x38], rax
xorps xmm0, xmm0
mov rax, qword [0x1402c6000]
xor r9d, r9d
mov edx, 0x7f00
mov qword [rbp - 0x28], rax
xor ecx, ecx
mov qword [rbp - 0x20], rsi
mov r8d, 2
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp + 8], rsi
mov dword [rbp - 0x40], 0x50
mov dword [rbp - 0x3c], 0x4088
mov dword [rbp - 0x30], esi
mov dword [rbp - 0x2c], 8
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword ds:[rbp - 0x18], rax
lea rcx, [rbp - 0x40]
lea rax, str.PhGraph
mov qword [rbp], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
lea rax, str.PhHexEdit
mov dword [rsp + 0x28], 0x8000
mov qword [rbp], rax
xorps xmm0, xmm0
mov rax, qword [0x1402c6000]
xor r9d, r9d
mov qword [rbp - 0x28], rax
mov edx, 0x7f00
lea rax, [0x14019b7e0]
mov dword [rbp - 0x30], esi
xor ecx, ecx
mov qword [rbp - 0x38], rax
mov r8d, 2
mov qword [rbp - 0x20], rsi
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp + 8], rsi
mov dword [rbp - 0x40], 0x50
mov dword [rbp - 0x3c], 0x4000
mov dword [rbp - 0x2c], 8
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_LoadImageW]
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x18], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
xorps xmm0, xmm0
mov dword [rbp - 0x30], esi
mov qword [rbp - 0x20], rsi
lea rax, [0x14019b3c0]
mov dword [rsp + 0x28], 0x8000
mov qword [rbp - 0x38], rax
xor r9d, r9d
mov rax, qword [0x1402c6000]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x28], rax
mov r8d, 2
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp + 8], rsi
mov dword [rbp - 0x40], 0x50
mov dword [rbp - 0x3c], 0x4080
mov dword [rbp - 0x2c], 8
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x40]
lea rax, [0x140291558]
mov qword [rbp], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
call fcn.14002c080
nop dword [rax]
call fcn.1400b4420
test al, al
je 0x140057349
call fcn.140103720
test al, al
je 0x140057349
call fcn.14008e520
test al, al
je 0x140057349
lea rax, [sym.SystemInformer.exe_Ordinal_1037]
xchg qword [0x1402c1be0], rax
lea rax, [0x1402c7000]
mov edx, 5
lea r8, [0x1402c6fd0]
lea r9, [0x1402c6ff0]
lea r10, [0x1402c7010]
lea r11, [0x1402c7030]
lea rbx, [0x1402c7050]
lea rdi, [0x1402c7070]
lea rsi, [0x1402c7090]
lea r14, [0x1402c70b0]
lea r15, [0x1402c70d0]
lea r12, [0x1402c70f0]
lea r13, [0x1402c7110]
mov qword ds:[rax - 0x28], r8
lea rcx, [rax - 0x30]
mov qword [rcx], rcx
add r8, 0x160
xor ecx, ecx
mov qword [rax - 0x20], rcx
mov qword [rax - 0x18], rcx
lea rcx, [rax - 0x10]
mov qword [rax - 8], r9
add r9, 0x160
mov qword [rcx], rcx
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
lea rcx, [rax + 0x10]
mov qword [rax + 0x18], r10
add r10, 0x160
mov qword [rcx], rcx
xor ecx, ecx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
lea rcx, [rax + 0x30]
mov qword [rax + 0x38], r11
add r11, 0x160
mov qword [rcx], rcx
xor ecx, ecx
mov qword [rax + 0x40], rcx
mov qword [rax + 0x48], rcx
lea rcx, [rax + 0x50]
mov qword [rax + 0x58], rbx
add rbx, 0x160
mov qword [rcx], rcx
xor ecx, ecx
mov qword [rax + 0x60], rcx
mov qword [rax + 0x68], rcx
lea rcx, [rax + 0x70]
mov qword [rax + 0x78], rdi
add rdi, 0x160
mov qword [rcx], rcx
xor ecx, ecx
mov qword [rax + 0x80], rcx
mov qword [rax + 0x88], rcx
lea rcx, [rax + 0x90]
mov qword [rax + 0x98], rsi
add rsi, 0x160
mov qword [rcx], rcx
xor ecx, ecx
mov qword [rax + 0xa0], rcx
mov qword [rax + 0xa8], rcx
lea rcx, [rax + 0xb0]
mov qword [rax + 0xb8], r14
add r14, 0x160
mov qword [rcx], rcx
xor ecx, ecx
mov qword [rax + 0xc0], rcx
mov qword [rax + 0xc8], rcx
lea rcx, [rax + 0xd0]
mov qword [rax + 0xd8], r15
add r15, 0x160
mov qword [rcx], rcx
xor ecx, ecx
mov qword [rax + 0xe0], rcx
mov qword [rax + 0xe8], rcx
lea rcx, [rax + 0xf0]
mov qword [rax + 0xf8], r12
add r12, 0x160
mov qword [rcx], rcx
xor ecx, ecx
mov qword [rax + 0x100], rcx
mov qword [rax + 0x108], rcx
lea rcx, [rax + 0x110]
mov qword [rax + 0x118], r13
lea rax, [rax + 0x160]
mov qword [rcx], rcx
add r13, 0x160
xor ecx, ecx
mov qword [rax - 0x40], rcx
mov qword [rax - 0x38], rcx
sub rdx, 1
jne 0x1400573a2
mov r15, qword [rsp + 0x1d0]
lea rax, [0x1402c4cb0]
mov r14, qword [rsp + 0x1d8]
mov r13, qword [rsp + 0x1e0]
mov r12, qword [rsp + 0x210]
mov qword [0x1402c4cb8], rax
mov qword [0x1402c4cb0], rax
lea rax, [0x1402c4cd0]
mov qword [0x1402c4cd8], rax
mov qword [0x1402c4cd0], rax
lea rax, [0x1402c4cf0]
mov qword [0x1402c4cf8], rax
mov qword [0x1402c4cf0], rax
lea rax, [0x1402c4d10]
mov qword [0x1402c4d18], rax
mov qword [0x1402c4d10], rax
lea rax, [0x1402c4d30]
mov qword [0x1402c4d38], rax
mov qword [0x1402c4d30], rax
lea rax, [0x1402c4d50]
mov qword [0x1402c4d58], rax
mov qword [0x1402c4d50], rax
lea rax, [0x1402c4d70]
mov qword [0x1402c4d78], rax
mov qword [0x1402c4d70], rax
lea rax, [0x1402c4d90]
mov qword [0x1402c4d98], rax
mov qword [0x1402c4d90], rax
lea rax, [0x1402c4db0]
mov qword [0x1402c4db8], rax
mov qword [0x1402c4db0], rax
lea rax, [0x1402c4dd0]
mov qword [0x1402c4dd8], rax
mov qword [0x1402c4dd0], rax
lea rax, [0x1402c4df0]
mov qword [0x1402c4df8], rax
mov qword [0x1402c4df0], rax
lea rax, [0x1402c4e10]
mov qword [0x1402c4e18], rax
mov qword [0x1402c4e10], rax
lea rax, [0x1402c4e30]
mov qword [0x1402c4e38], rax
mov qword [0x1402c4e30], rax
lea rax, [0x1402c4e50]
mov qword [0x1402c4e58], rax
mov qword [0x1402c4e50], rax
lea rax, [0x1402c4e70]
mov qword [0x1402c4e78], rax
mov qword [0x1402c4e70], rax
lea rax, [0x1402c4e90]
mov qword [0x1402c4e98], rax
mov qword [0x1402c4e90], rax
lea rax, [0x1402c4eb0]
mov qword [0x1402c4eb8], rax
mov qword [0x1402c4eb0], rax
lea rax, [0x1402c4ed0]
mov qword [0x1402c4ed8], rax
mov qword [0x1402c4ed0], rax
lea rax, [0x1402c4ef0]
mov qword [0x1402c4ef8], rax
mov qword [0x1402c4ef0], rax
lea rax, [0x1402c4f10]
mov qword [0x1402c4f18], rax
mov qword [0x1402c4f10], rax
mov eax, dword [0x1402c4f40]
test al, 0x20
je 0x14005774e
mov rcx, qword [0x1402c4f58]
nop
call fcn.14009a020
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
lea rax, str.SystemInformerTaskAdmin
mov qword [rsp + 0x78], 0x2e
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x80], rax
call fcn.1400140c0
test eax, eax
js 0x1400570d2
nop
call fcn.1400582b0
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
cmp byte [0x1402c4c74], cl
je 0x140057765
test al, al
js 0x140057765
call fcn.1400aba00
mov eax, dword [0x1402c4f40]
cmp dword [0x1402bbf68], 0x64
jb 0x1400577a1
mov r9d, 8
mov dword [rsp + 0x70], 8
lea r8, [rsp + 0x70]
mov dword [rsp + 0x74], 1
mov edx, 0x34
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov eax, dword [0x1402c4f40]
test al, 0x40
je 0x1400577d9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
lea rcx, [rbp - 0x70]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
xor edx, edx
xor ecx, ecx
call fcn.1400aab00
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
mov al, 3
mov rcx, 0xffffffffffffffff
movzx edx, al
mov eax, dword [0x1402c4f6c]
test eax, eax
movzx r8d, al
cmovne edx, r8d
call sym.SystemInformer.exe_Ordinal_1591
cmp byte [0x1402cad41], 0
je 0x140057808
call fcn.1400510e0
mov ecx, dword [rsp + 0x60]
call fcn.14005a1e0
test al, al
jne 0x14005785d
lea r9, str.Unable_to_initialize_the_main_window.
mov edx, 0x10
lea r8, [0x14023c43c]
xor ecx, ecx
call sym.SystemInformer.exe_Ordinal_1698
mov rdi, qword [rsp + 0x208]
mov eax, 1
mov rbx, qword [rsp + 0x200]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x1e8
pop rsi
pop rbp
ret
mov cl, 1
call fcn.140058b80
lea rcx, [0x1402c65d0]
call sym.SystemInformer.exe_Ordinal_1247
call fcn.1400578a0
xor ecx, ecx
mov ebx, eax
call fcn.140058b80
cmp byte [0x1402cad41], 0
je 0x14005788d
call fcn.140053fe0
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
mov eax, 1
jmp 0x140057844