Function at 0x7ff7c00859e0
Capabilities:
Parse pe header
Reference sql statements

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
xor ebx, ebx
mov r12, r8
mov r15d, ebx
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x51], rbx
mov r14, rdx
mov qword [rbp - 0x59], rbx
mov rsi, rcx
mov qword [rbp - 0x61], rbx
mov dword [rbp + 0x7f], ebx
call fcn.7ff7c0085320
mov rcx, rax
test rax, rax
jne 0x7ff7c0085a2f
lea eax, [rbx + 0x7e]
jmp 0x7ff7c0085dc4
mov eax, 0x5a4d
mov qword [rsp + 0x120], rdi
cmp word [rcx], ax
jne 0x7ff7c0085af4
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c0085af4
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c0085af4
lea r8, [rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c0085af4
cmp dword [r8 + 4], ebx
je 0x7ff7c0085af4
lea r9, [rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c0188710]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c0085af4
lea r8, [rbp - 0x41]
lea rdx, [0x7ff7c0147ac0]
lea rcx, [0x7ff7c0147980]
call qword [case.0x7ff7c00c1f48.0]
mov edi, eax
test eax, eax
js 0x7ff7c0085aec
mov rcx, qword [rbp - 0x41]
lea r9, [rbp - 0x49]
lea r8, [0x7ff7c0147990]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x7ff7c00c1f48.0]
mov rcx, qword [rbp - 0x41]
mov edi, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x7ff7c00c1f48.0]
test edi, edi
js 0x7ff7c0085d6a
mov rcx, qword [rbp - 0x49]
lea rdx, [rbp - 0x51]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov rdx, qword [rsi + 8]
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov rax, qword [rcx]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov rax, qword [rax + 0x18]
call qword [case.0x7ff7c00c1f48.0]
mov edi, eax
test eax, eax
js 0x7ff7c0085d6a
mov rdx, qword [r14 + 8]
lea rcx, [0x7ff7c0184c80]
mov qword [rsp + 0x128], r13
call sym.ProcessHacker.exe_PhFormatString
mov rcx, qword ds:[rbp - 0x51]
lea rdx, [rbp - 0x59]
mov r13, rax
mov qword [rsp + 0x28], rdx
mov r9d, 0x30
mov qword [rsp + 0x20], rbx
lea rdx, [0x7ff7c0184c38]
mov rax, qword [rcx]
mov r8, qword [r13 + 8]
mov rax, qword [rax + 0xa0]
call qword [case.0x7ff7c00c1f48.0]
mov edi, eax
mov esi, 0xffffffff
test eax, eax
js 0x7ff7c0085d4a
mov rcx, qword [rbp - 0x59]
lea rdx, [rbp + 0x7f]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x61]
lea r8d, [rsi + 2]
mov edx, esi
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x7ff7c00c1f48.0]
mov edi, eax
test eax, eax
js 0x7ff7c0085d4a
mov rcx, qword [rbp - 0x61]
lea r9, [rbp - 0x19]
mov qword [rsp + 0x28], rbx
lea rdx, [0x7ff7c0184ce8]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x7ff7c00c1f48.0]
test eax, eax
js 0x7ff7c0085c12
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x7ff7c0085c08
nop
call sym.ProcessHacker.exe_PhCreateString
mov r15, rax
lea rcx, [rbp - 0x19]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword ds:[rbp - 0x61]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x7ff7c00c1f48.0]
test r15, r15
je 0x7ff7c0085d4a
mov r8, qword [r15 + 8]
lea rax, [0x7ff7c0174328]
lea r9, [0x7ff7c015286c]
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff7c0174360]
mov ecx, 4
call sym.ProcessHacker.exe_PhConcatStrings
mov r14, rax
movzx eax, word [rax]
mov word [rbp - 0x29], ax
add ax, 2
cmp qword [r14], 0xfffe
mov word [rbp - 0x27], ax
mov rax, qword [r14 + 8]
mov qword [rbp - 0x21], rax
jbe 0x7ff7c0085c85
mov edi, 0xd0000106
jmp 0x7ff7c0085d1f
xor r8d, r8d
lea rax, [rbp - 0x31]
lea r9, [rbp - 1]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x29]
lea rcx, [r8 - 7]
call fcn.7ff7c00e0390
mov edi, eax
test eax, eax
js 0x7ff7c0085ccf
lea r8, [rbp - 1]
mov edx, 0x20019
lea rcx, [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rbp - 0x31]
mov edi, eax
test rcx, rcx
je 0x7ff7c0085ccf
call qword [sym.imp.ntdll.dll_NtClose]
or edi, 0x10000000
jl 0x7ff7c0085d1f
mov rcx, qword ds:[rbp - 0x39]
xor edx, edx
call sym.ProcessHacker.exe_PhQueryRegistryString
mov rbx, rax
test rax, rax
je 0x7ff7c0085d15
mov rcx, rax
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
test rax, rax
je 0x7ff7c0085d15
mov rcx, rbx
mov rbx, rax
add rcx, 0xfffffffffffffff0
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c0085d15
call fcn.7ff7c00c6290
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [r14 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c0085d34
call fcn.7ff7c00c6290
lea rcx, ds:[r15 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c0085d4a
call fcn.7ff7c00c6290
lea rcx, ds:[r13 - 0x10]
lock xadd dword [rcx + 8], esi
mov r13, qword [rsp + 0x128]
cmp esi, 1
jne 0x7ff7c0085d6a
call fcn.7ff7c00c6290
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x7ff7c0085d86
mov rax, qword ds:[rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x7ff7c0085d9c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x7ff7c0085db2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x7ff7c00c1f48.0]
test edi, edi
js 0x7ff7c0085dba
mov qword [r12], rbx
mov eax, edi
mov rdi, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret