Function at 0x140040490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x100
mov rbx, qword [0x1400d91a8]
mov edi, 0xc8
mov r14, rcx
lea edx, [rdi + 0x12]
mov rcx, rbx
xor r8d, r8d
mov dword [rsp + 0x30], edi
call fcn.14001fbe0
lock add dword [rbx + 0x18], 1
mov dword [rax], 1
mov qword [rax + 8], 0xda
mov qword [rax + 0x10], rbx
lea rcx, [rax + 0x20]
xor r13d, r13d
or r15d, 0xffffffff
mov word [rcx + 2], di
lea rax, [rcx + 0x10]
lea ebp, [r13 + 0xa]
mov qword [rcx + 8], rax
mov word [rcx + 0xd8], r13w
mov qword [rsp + 0x38], rcx
mov word [rcx], r13w
mov rax, qword [rsp + 0x38]
mov word [rax + 0x10], r13w
mov rcx, qword [r14 + 0x48]
test rcx, rcx
je 0x1400405ef
lea edx, [rdi - 0x78]
call sym.ProcessHacker.exe_PhEllipsisString
mov rdi, rax
movzx ebx, word [rax]
lea rsi, [rax + 0x10]
test ebx, ebx
je 0x14004058c
mov rdx, qword [rsp + 0x38]
movzx eax, word [rdx]
add eax, ebx
cmp dword [rsp + 0x30], eax
jae 0x140040558
lea rcx, [rsp + 0x30]
mov edx, eax
call fcn.140002670
mov rdx, qword [rsp + 0x38]
test rsi, rsi
je 0x140040578
movzx eax, word [rdx]
mov r8, rbx
shr rax, 1
lea rcx, [rdx + rax*2 + 0x10]
mov rdx, rsi
call fcn.140094930
mov rdx, qword [rsp + 0x38]
add word [rdx], bx
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
lea rcx, [rdi - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x1400405a1
call fcn.14001fcd0
mov rdx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
movzx r8d, word [rdx]
lea rcx, [r8 + 2]
cmp rax, rcx
jae 0x1400405ca
lea edx, [r8 + 2]
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rdx, qword [rsp + 0x38]
movzx eax, word [rdx]
shr rax, 1
mov word [rdx + rax*2 + 0x10], bp
mov rax, qword [rsp + 0x38]
add word [rax], 2
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
mov rcx, qword [r14 + 0x40]
lea rdx, [r14 + 0x60]
lea r8, [0x1400b3628]
mov r9d, 0x4c
call sym.ProcessHacker.exe_PhFormatImageVersionInfo
mov rbx, rax
test rax, rax
je 0x140040739
cmp word [rax], r13w
je 0x140040724
mov r8, qword [rsp + 0x38]
movzx edx, word [r8]
add edx, 0xc
cmp dword [rsp + 0x30], edx
jae 0x140040640
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r8, qword [rsp + 0x38]
mov rax, qword [str.File:_n]
movzx ecx, word [r8]
lea rsi, [rbx + 0x10]
shr rcx, 1
mov qword [r8 + rcx*2 + 0x10], rax
mov eax, dword [0x1400b3640]
mov dword [r8 + rcx*2 + 0x18], eax
mov rax, qword [rsp + 0x38]
add word [rax], 0xc
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
movzx edi, word [rbx]
test edi, edi
je 0x1400406d6
mov rcx, qword [rsp + 0x38]
movzx edx, word [rcx]
add edx, edi
cmp dword [rsp + 0x30], edx
jae 0x1400406a2
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rcx, qword [rsp + 0x38]
test rsi, rsi
je 0x1400406c2
movzx eax, word [rcx]
mov r8, rdi
mov rdx, rsi
shr rax, 1
lea rcx, [rcx + rax*2 + 0x10]
call fcn.140094930
mov rcx, qword [rsp + 0x38]
add word [rcx], di
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
mov rdx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
movzx r8d, word [rdx]
lea rcx, [r8 + 2]
cmp rax, rcx
jae 0x1400406ff
lea edx, [r8 + 2]
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rdx, qword [rsp + 0x38]
movzx eax, word [rdx]
shr rax, 1
mov word [rdx + rax*2 + 0x10], bp
mov rax, qword [rsp + 0x38]
add word [rax], 2
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
lea rcx, [rbx - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x140040739
call fcn.14001fcd0
cmp qword [r14 + 0x48], r13
je 0x140040ef6
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x140040ef6
lea rdx, [rsp + 0x148]
call sym.ProcessHacker.exe_PhGetProcessKnownType
test eax, eax
js 0x140040ef6
mov ebx, dword [rsp + 0x148]
mov rcx, qword [r14 + 0x48]
lea r8, [rsp + 0x50]
mov edx, ebx
call sym.ProcessHacker.exe_PhaGetProcessKnownCommandLine
test al, al
je 0x140040ef6
sub ebx, 8
je 0x140040dbb
sub ebx, 1
je 0x140040c0a
cmp ebx, 1
jne 0x140040ef6
mov r8, qword [rsp + 0x38]
movzx edx, word [r8]
add edx, 0x18
cmp dword [rsp + 0x30], edx
jae 0x1400407c0
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r8, qword [rsp + 0x38]
movzx ecx, word [r8]
mov rax, qword [str.COM_target:_n]
shr rcx, 1
mov qword [r8 + rcx*2 + 0x10], rax
mov rax, qword [0x1400b36b8]
mov qword [r8 + rcx*2 + 0x18], rax
mov rax, qword [0x1400b36c0]
mov qword [r8 + rcx*2 + 0x20], rax
mov rax, qword [rsp + 0x38]
add word [rax], 0x18
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
cmp qword [rsp + 0x60], r13
je 0x14004090f
mov r8, qword [rsp + 0x38]
movzx edx, word [r8]
add edx, 8
cmp dword [rsp + 0x30], edx
jae 0x140040831
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r8, qword [rsp + 0x38]
movzx ecx, word [r8]
mov rax, qword [0x1400b3628]
shr rcx, 1
mov qword [r8 + rcx*2 + 0x10], rax
mov rax, qword [rsp + 0x38]
add word [rax], 8
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
mov rax, qword [rsp + 0x60]
movzx ebx, word [rax]
lea rdi, [rax + 0x10]
test ebx, ebx
je 0x1400408c1
mov rcx, qword [rsp + 0x38]
movzx edx, word [rcx]
add edx, ebx
cmp dword [rsp + 0x30], edx
jae 0x14004088d
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rcx, qword [rsp + 0x38]
test rdi, rdi
je 0x1400408ad
movzx eax, word [rcx]
mov r8, rbx
mov rdx, rdi
shr rax, 1
lea rcx, [rcx + rax*2 + 0x10]
call fcn.140094930
mov rcx, qword [rsp + 0x38]
add word [rcx], bx
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
mov rdx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
movzx r8d, word [rdx]
lea rcx, [r8 + 2]
cmp rax, rcx
jae 0x1400408ea
lea edx, [r8 + 2]
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rdx, qword [rsp + 0x38]
movzx eax, word [rdx]
shr rax, 1
mov word [rdx + rax*2 + 0x10], bp
mov rax, qword [rsp + 0x38]
add word [rax], 2
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlStringFromGUID]
test eax, eax
js 0x140040a5c
movzx edx, word [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call sym.ProcessHacker.exe_PhCreateStringEx
lea rcx, [rsp + 0x70]
mov rdi, rax
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test rdi, rdi
je 0x140040a5c
mov r8, qword [rsp + 0x38]
movzx edx, word [r8]
add edx, 8
cmp dword [rsp + 0x30], edx
jae 0x14004096e
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r8, qword [rsp + 0x38]
movzx ecx, word [r8]
mov rax, qword [0x1400b3628]
lea rsi, [rdi + 0x10]
shr rcx, 1
mov qword [r8 + rcx*2 + 0x10], rax
mov rax, qword [rsp + 0x38]
add word [rax], 8
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
movzx ebx, word [rdi]
test ebx, ebx
je 0x1400409f9
mov rcx, qword [rsp + 0x38]
movzx edx, word [rcx]
add edx, ebx
cmp dword [rsp + 0x30], edx
jae 0x1400409c5
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rcx, qword [rsp + 0x38]
test rsi, rsi
je 0x1400409e5
movzx eax, word [rcx]
mov r8, rbx
mov rdx, rsi
shr rax, 1
lea rcx, [rcx + rax*2 + 0x10]
call fcn.140094930
mov rcx, qword [rsp + 0x38]
add word [rcx], bx
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
lea rcx, [rdi - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x140040a0e
call fcn.14001fcd0
mov rdx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
movzx r8d, word [rdx]
lea rcx, [r8 + 2]
cmp rax, rcx
jae 0x140040a37
lea edx, [r8 + 2]
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rdx, qword [rsp + 0x38]
movzx eax, word [rdx]
shr rax, 1
mov word [rdx + rax*2 + 0x10], bp
mov rax, qword [rsp + 0x38]
add word [rax], 2
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x140040ef6
lea rcx, [rsp + 0xb0]
add rdx, 0x10
call sym.ProcessHacker.exe_PhInitializeImageVersionInfo
test al, al
je 0x140040ef6
mov rcx, qword [rsp + 0x68]
lea r8, [0x1400b3628]
lea rdx, [rsp + 0xb0]
mov r9d, 0x4c
call sym.ProcessHacker.exe_PhFormatImageVersionInfo
mov rbx, rax
test rax, rax
je 0x140040bf8
cmp word [rax], r13w
je 0x140040be3
mov r8, qword [rsp + 0x38]
movzx edx, word [r8]
add edx, 0x22
cmp dword [rsp + 0x30], edx
jae 0x140040ad9
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r8, qword [rsp + 0x38]
movzx ecx, word [r8]
mov rax, qword [str.COM_target_file:_n]
lea rsi, [rbx + 0x10]
shr rcx, 1
mov qword [r8 + rcx*2 + 0x10], rax
mov rax, qword [0x1400b36d8]
mov qword [r8 + rcx*2 + 0x18], rax
mov rax, qword [0x1400b36e0]
mov qword [r8 + rcx*2 + 0x20], rax
mov rax, qword [0x1400b36e8]
mov qword [r8 + rcx*2 + 0x28], rax
movzx eax, word [0x1400b36f0]
mov word [r8 + rcx*2 + 0x30], ax
mov rax, qword [rsp + 0x38]
add word [rax], 0x22
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
movzx edi, word [rbx]
test edi, edi
je 0x140040b95
mov rcx, qword [rsp + 0x38]
movzx edx, word [rcx]
add edx, edi
cmp dword [rsp + 0x30], edx
jae 0x140040b61
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rcx, qword [rsp + 0x38]
test rsi, rsi
je 0x140040b81
movzx eax, word [rcx]
mov r8, rdi
mov rdx, rsi
shr rax, 1
lea rcx, [rcx + rax*2 + 0x10]
call fcn.140094930
mov rcx, qword [rsp + 0x38]
add word [rcx], di
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
mov rdx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
movzx r8d, word [rdx]
lea rcx, [r8 + 2]
cmp rax, rcx
jae 0x140040bbe
lea edx, [r8 + 2]
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rdx, qword [rsp + 0x38]
movzx eax, word [rdx]
shr rax, 1
mov word [rdx + rax*2 + 0x10], bp
mov rax, qword [rsp + 0x38]
add word [rax], 2
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
lea rcx, [rbx - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x140040bf8
call fcn.14001fcd0
lea rcx, [rsp + 0xb0]
call sym.ProcessHacker.exe_PhDeleteImageVersionInfo
jmp 0x140040ef6
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0xd0]
add rdx, 0x10
call sym.ProcessHacker.exe_PhInitializeImageVersionInfo
test al, al
je 0x140040ef6
mov rcx, qword [rsp + 0x50]
lea r8, [0x1400b3628]
lea rdx, [rsp + 0xd0]
mov r9d, 0x4c
call sym.ProcessHacker.exe_PhFormatImageVersionInfo
mov rbx, rax
test rax, rax
je 0x140040da9
cmp word [rax], r13w
je 0x140040d94
mov r8, qword [rsp + 0x38]
movzx edx, word [r8]
add edx, 0x2a
cmp dword [rsp + 0x30], edx
jae 0x140040c7e
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r8, qword [rsp + 0x38]
movzx ecx, word [r8]
mov rax, qword [str.Run_DLL_target_file:_n]
lea rsi, [rbx + 0x10]
shr rcx, 1
mov qword [r8 + rcx*2 + 0x10], rax
mov rax, qword [0x1400b3688]
mov qword [r8 + rcx*2 + 0x18], rax
mov rax, qword [0x1400b3690]
mov qword [r8 + rcx*2 + 0x20], rax
mov rax, qword [0x1400b3698]
mov qword [r8 + rcx*2 + 0x28], rax
mov rax, qword [0x1400b36a0]
mov qword [r8 + rcx*2 + 0x30], rax
movzx eax, word [0x1400b36a8]
mov word [r8 + rcx*2 + 0x38], ax
mov rax, qword [rsp + 0x38]
add word [rax], 0x2a
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
movzx edi, word [rbx]
test edi, edi
je 0x140040d46
mov rcx, qword [rsp + 0x38]
movzx edx, word [rcx]
add edx, edi
cmp dword [rsp + 0x30], edx
jae 0x140040d12
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rcx, qword [rsp + 0x38]
test rsi, rsi
je 0x140040d32
movzx eax, word [rcx]
mov r8, rdi
mov rdx, rsi
shr rax, 1
lea rcx, [rcx + rax*2 + 0x10]
call fcn.140094930
mov rcx, qword [rsp + 0x38]
add word [rcx], di
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
mov rdx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
movzx r8d, word [rdx]
lea rcx, [r8 + 2]
cmp rax, rcx
jae 0x140040d6f
lea edx, [r8 + 2]
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rdx, qword [rsp + 0x38]
movzx eax, word [rdx]
shr rax, 1
mov word [rdx + rax*2 + 0x10], bp
mov rax, qword [rsp + 0x38]
add word [rax], 2
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
lea rcx, [rbx - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x140040da9
call fcn.14001fcd0
lea rcx, [rsp + 0xd0]
call sym.ProcessHacker.exe_PhDeleteImageVersionInfo
jmp 0x140040ef6
mov r8, qword [rsp + 0x38]
movzx edx, word [r8]
add edx, 0x30
cmp dword [rsp + 0x30], edx
jae 0x140040ddc
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r8, qword [rsp + 0x38]
movzx ecx, word [r8]
mov rax, qword [str.Service_group_name:_n]
shr rcx, 1
mov qword [r8 + rcx*2 + 0x10], rax
mov rax, qword [0x1400b3650]
mov qword [r8 + rcx*2 + 0x18], rax
mov rax, qword [0x1400b3658]
mov qword [r8 + rcx*2 + 0x20], rax
mov rax, qword [0x1400b3660]
mov qword [r8 + rcx*2 + 0x28], rax
mov rax, qword [0x1400b3668]
mov qword [r8 + rcx*2 + 0x30], rax
mov rax, qword [0x1400b3670]
mov qword [r8 + rcx*2 + 0x38], rax
mov rax, qword [rsp + 0x38]
add word [rax], 0x30
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
mov rax, qword [rsp + 0x50]
movzx ebx, word [rax]
lea rdi, [rax + 0x10]
test ebx, ebx
je 0x140040ea8
mov rcx, qword [rsp + 0x38]
movzx edx, word [rcx]
add edx, ebx
cmp dword [rsp + 0x30], edx
jae 0x140040e74
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rcx, qword [rsp + 0x38]
test rdi, rdi
je 0x140040e94
movzx eax, word [rcx]
mov r8, rbx
mov rdx, rdi
shr rax, 1
lea rcx, [rcx + rax*2 + 0x10]
call fcn.140094930
mov rcx, qword [rsp + 0x38]
add word [rcx], bx
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
mov rdx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
movzx r8d, word [rdx]
lea rcx, [r8 + 2]
cmp rax, rcx
jae 0x140040ed1
lea edx, [r8 + 2]
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rdx, qword [rsp + 0x38]
movzx eax, word [rdx]
shr rax, 1
mov word [rdx + rax*2 + 0x10], bp
mov rax, qword [rsp + 0x38]
add word [rax], 2
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
mov rax, qword [r14 + 0xd0]
mov qword [rsp + 0xf8], r12
test rax, rax
je 0x1400412a0
mov ecx, dword [rax]
test ecx, ecx
je 0x1400412a0
mov ebx, r13d
call sym.ProcessHacker.exe_PhCreateList
mov r8d, 5
mov rsi, rax
xor eax, eax
lock cmpxchg qword [r14 + 0xd8], r8
je 0x140040f42
lea rcx, [r14 + 0xd8]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rbp, r13
nop word [rax + rax]
mov rax, qword [r14 + 0xd0]
mov edx, dword [rax + 0xc]
cmp ebx, edx
jae 0x140040f8a
mov rax, qword [rax + 0x10]
lea rcx, [rax + rbp*8]
nop word [rax + rax]
mov rdi, qword [rcx]
inc ebx
inc rbp
add rcx, 8
test dil, 1
je 0x14004124c
cmp ebx, edx
jb 0x140040f70
mov eax, 5
lock cmpxchg qword [r14 + 0xd8], r13
je 0x140040fa6
lea rcx, [r14 + 0xd8]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
mov edx, dword [rsi]
mov rcx, qword [rsi + 8]
lea r9, [0x140040470]
mov r8d, 8
call fcn.140095e30
mov r11, qword [rsp + 0x38]
movzx edx, word [r11]
add edx, 0x14
cmp dword [rsp + 0x30], edx
jae 0x140040fdf
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r11, qword [rsp + 0x38]
movzx ecx, word [r11]
mov rax, qword [str.Services:_n]
shr rcx, 1
mov qword [r11 + rcx*2 + 0x10], rax
mov rax, qword [0x1400b3700]
mov qword [r11 + rcx*2 + 0x18], rax
mov eax, dword [0x1400b3708]
mov dword [r11 + rcx*2 + 0x20], eax
mov rax, qword [rsp + 0x38]
add word [rax], 0x14
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
cmp dword [rsi], r13d
jbe 0x1400411fe
xor r14d, r14d
mov r12, r14
mov r8, qword [rsp + 0x38]
mov rax, qword [rsi + 8]
movzx edx, word [r8]
mov rbp, qword [r12 + rax]
add edx, 8
cmp dword [rsp + 0x30], edx
jae 0x14004105b
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r8, qword [rsp + 0x38]
movzx ecx, word [r8]
mov rax, qword [0x1400b3628]
shr rcx, 1
mov qword [r8 + rcx*2 + 0x10], rax
mov rax, qword [rsp + 0x38]
add word [rax], 8
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r14w
mov rax, qword [rbp + 0x10]
movzx ebx, word [rax]
lea rdi, [rax + 0x10]
test ebx, ebx
je 0x1400410ea
mov rcx, qword [rsp + 0x38]
movzx edx, word [rcx]
add edx, ebx
cmp dword [rsp + 0x30], edx
jae 0x1400410b6
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rcx, qword [rsp + 0x38]
test rdi, rdi
je 0x1400410d6
movzx eax, word [rcx]
mov r8, rbx
mov rdx, rdi
shr rax, 1
lea rcx, [rcx + rax*2 + 0x10]
call fcn.140094930
mov rcx, qword [rsp + 0x38]
add word [rcx], bx
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r14w
mov r8, qword [rsp + 0x38]
movzx edx, word [r8]
add edx, 4
cmp dword [rsp + 0x30], edx
jae 0x14004110b
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r8, qword [rsp + 0x38]
movzx ecx, word [r8]
mov eax, dword [0x1400b3710]
shr rcx, 1
mov dword [r8 + rcx*2 + 0x10], eax
mov rax, qword [rsp + 0x38]
add word [rax], 4
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r14w
mov rax, qword [rbp + 0x18]
movzx ebx, word [rax]
lea rdi, [rax + 0x10]
test ebx, ebx
je 0x140041199
mov rcx, qword [rsp + 0x38]
movzx edx, word [rcx]
add edx, ebx
cmp dword [rsp + 0x30], edx
jae 0x140041165
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rcx, qword [rsp + 0x38]
test rdi, rdi
je 0x140041185
movzx eax, word [rcx]
mov r8, rbx
mov rdx, rdi
shr rax, 1
lea rcx, [rcx + rax*2 + 0x10]
call fcn.140094930
mov rcx, qword [rsp + 0x38]
add word [rcx], bx
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r14w
mov r8, qword [rsp + 0x38]
movzx edx, word [r8]
add edx, 4
cmp dword [rsp + 0x30], edx
jae 0x1400411ba
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r8, qword [rsp + 0x38]
movzx ecx, word [r8]
mov eax, dword [0x1400b3718]
inc r13d
shr rcx, 1
add r12, 8
mov dword [r8 + rcx*2 + 0x10], eax
mov rax, qword [rsp + 0x38]
add word [rax], 4
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r14w
cmp r13d, dword [rsi]
jb 0x140041032
mov r14, qword [rsp + 0x140]
mov eax, dword [rsi]
mov rbx, qword [rsi + 8]
test eax, eax
je 0x140041232
mov rdi, rax
nop dword [rax + rax]
mov rcx, qword [rbx]
mov eax, r15d
sub rcx, 0x20
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x140041228
call fcn.14001fcd0
add rbx, 8
sub rdi, 1
jne 0x140041210
lea rcx, [rsi - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x14004129d
call fcn.14001fcd0
xor r13d, r13d
jmp 0x1400412a0
lock add dword [rdi - 0x20], 1
mov eax, dword [rsi + 4]
cmp dword [rsi], eax
jne 0x140041280
mov r8, qword [rsi + 8]
mov rcx, qword [0x1400d8fb0]
add eax, eax
mov r9d, eax
xor edx, edx
mov dword [rsi + 4], eax
shl r9, 3
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
test rax, rax
je 0x140041291
mov qword [rsi + 8], rax
mov ecx, dword [rsi]
mov rax, qword [rsi + 8]
mov qword [rax + rcx*8], rdi
inc dword [rsi]
jmp 0x140040f50
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor r13d, r13d
cmp dword [0x1400d8fc0], 0x3c
mov ebp, 0x28
jb 0x14004146d
mov rcx, qword [r14 + 0x20]
lea rdx, str.taskeng.exe
add rcx, 0x10
call fcn.1400a6b10
test eax, eax
je 0x1400412e6
mov rcx, qword [r14 + 0x20]
lea rdx, str.taskhost.exe
add rcx, 0x10
call fcn.1400a6b10
test eax, eax
jne 0x14004146d
mov rbx, qword [0x1400d91a8]
xor r8d, r8d
mov dword [rsp + 0x80], ebp
lea edx, [r8 + 0x3a]
mov rcx, rbx
call fcn.14001fbe0
lock add dword [rbx + 0x18], 1
mov qword [rax + 0x10], rbx
lea rbx, [rax + 0x20]
mov dword [rax], 1
mov qword [rax + 8], 0x3a
mov word [rbx + 2], bp
lea rax, [rbx + 0x10]
mov qword [rbx + 8], rax
mov word [rbx + 0x38], r13w
xor edx, edx
mov word [rax], r13w
lea rax, [rsp + 0x158]
lea r9, [0x1400d17a0]
lea r8d, [rdx + 1]
lea rcx, [0x1400d1790]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x20], rax
mov word [rbx], r13w
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14004138a
lea r8, [rsp + 0x158]
lea rdx, [rsp + 0x80]
mov rcx, r14
call fcn.140041b30
mov rbx, qword [rsp + 0x88]
cmp word [rbx], 0
je 0x140041458
mov r8, qword [rsp + 0x38]
movzx edx, word [r8]
add edx, 0xe
cmp dword [rsp + 0x30], edx
jae 0x1400413b5
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r8, qword [rsp + 0x38]
mov rax, qword [str.Tasks:_n]
movzx ecx, word [r8]
lea rsi, [rbx + 0x10]
shr rcx, 1
mov qword [r8 + rcx*2 + 0x10], rax
mov eax, dword [0x1400b3760]
mov dword [r8 + rcx*2 + 0x18], eax
movzx eax, word [0x1400b3764]
mov word [r8 + rcx*2 + 0x1c], ax
mov rax, qword [rsp + 0x38]
add word [rax], 0xe
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
movzx edi, word [rbx]
test edi, edi
je 0x140041458
mov rcx, qword [rsp + 0x38]
movzx edx, word [rcx]
add edx, edi
cmp dword [rsp + 0x30], edx
jae 0x140041424
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rcx, qword [rsp + 0x38]
test rsi, rsi
je 0x140041444
movzx eax, word [rcx]
mov r8, rdi
mov rdx, rsi
shr rax, 1
lea rcx, [rcx + rax*2 + 0x10]
call fcn.140094930
mov rcx, qword [rsp + 0x38]
add word [rcx], di
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
lea rcx, [rbx - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x14004146d
call fcn.14001fcd0
cmp byte [0x1400d62f9], 0
je 0x14004149f
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x90]
lea rcx, [0x1400d6030]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x90], r14
call sym.ProcessHacker.exe_PhInvokeCallback
mov rbx, qword [0x1400d91a8]
xor r8d, r8d
mov dword [rsp + 0x40], ebp
lea edx, [r8 + 0x3a]
mov rcx, rbx
call fcn.14001fbe0
lock add dword [rbx + 0x18], 1
mov qword [rax + 0x10], rbx
mov dword [rax], 1
mov qword [rax + 8], 0x3a
lea rbx, [rax + 0x20]
mov qword [rsp + 0x48], rbx
mov word [rbx + 2], bp
lea rax, [rbx + 0x10]
mov qword [rbx + 8], rax
mov word [rbx + 0x38], r13w
mov word [rbx], r13w
mov word [rax], r13w
cmp qword [r14 + 0x40], 0
je 0x140041629
mov eax, dword [r14 + 0xa0]
cmp eax, 2
jne 0x140041597
mov r8, qword [r14 + 0xa8]
test r8, r8
je 0x14004153f
cmp word [r8], 0
je 0x14004153f
lea rdx, str.____Signer:__s_n
lea rcx, [rsp + 0x40]
add r8, 0x10
call sym.ProcessHacker.exe_PhAppendFormatStringBuilder
mov rbx, qword [rsp + 0x48]
jmp 0x140041629
movzx edx, word [rbx]
add edx, 0x18
cmp edx, ebp
jbe 0x140041558
lea rcx, [rsp + 0x40]
call fcn.140002670
mov rbx, qword [rsp + 0x48]
movzx ecx, word [rbx]
mov rax, qword [str.____Signed._n]
shr rcx, 1
mov qword [rbx + rcx*2 + 0x10], rax
mov rax, qword [0x1400b3790]
mov qword [rbx + rcx*2 + 0x18], rax
mov rax, qword [0x1400b3798]
mov qword [rbx + rcx*2 + 0x20], rax
add word [rbx], 0x18
movzx eax, word [rbx]
shr rax, 1
mov word [rbx + rax*2 + 0x10], r13w
jmp 0x140041629
test eax, eax
je 0x140041629
cmp eax, 1
je 0x140041629
movzx edx, word [rbx]
add edx, 0x2e
cmp edx, ebp
jbe 0x1400415c1
lea rcx, [rsp + 0x40]
call fcn.140002670
mov rbx, qword [rsp + 0x48]
movzx ecx, word [rbx]
mov rax, qword [str.____Signature_invalid._n]
shr rcx, 1
mov qword [rbx + rcx*2 + 0x10], rax
mov rax, qword [0x1400b37b0]
mov qword [rbx + rcx*2 + 0x18], rax
mov rax, qword [0x1400b37b8]
mov qword [rbx + rcx*2 + 0x20], rax
mov rax, qword [0x1400b37c0]
mov qword [rbx + rcx*2 + 0x28], rax
mov rax, qword [0x1400b37c8]
mov qword [rbx + rcx*2 + 0x30], rax
mov eax, dword [0x1400b37d0]
mov dword [rbx + rcx*2 + 0x38], eax
movzx eax, word [0x1400b37d4]
mov word [rbx + rcx*2 + 0x3c], ax
add word [rbx], 0x2e
movzx eax, word [rbx]
shr rax, 1
mov word [rbx + rax*2 + 0x10], r13w
test byte [r14 + 0xb8], 0x40
je 0x140041657
mov r9d, dword [r14 + 0xb4]
mov r8d, dword [r14 + 0xb0]
lea rdx, str.____Image_is_probably_packed___u_imports_over__u_modules_._n
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhAppendFormatStringBuilder
mov rbx, qword [rsp + 0x48]
mov rax, qword [r14 + 0x98]
test rax, rax
je 0x1400416b9
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], r13
call sym.ProcessHacker.exe_PhGetClientIdName
lea rdx, str.____Console_host:__s_n
lea rcx, [rsp + 0x40]
lea r8, [rax + 0x10]
mov rbx, rax
call sym.ProcessHacker.exe_PhAppendFormatStringBuilder
lea rcx, [rbx - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x1400416b4
call fcn.14001fcd0
mov rbx, qword [rsp + 0x48]
jmp 0x1400416b9
mov rbx, qword [rsp + 0x48]
test byte [r14 + 0xb8], 4
je 0x140041762
movzx edx, word [rbx]
add edx, 0x3e
cmp dword [rsp + 0x40], edx
jae 0x1400416e2
lea rcx, [rsp + 0x40]
call fcn.140002670
mov rbx, qword [rsp + 0x48]
movzx ecx, word [rbx]
mov rax, qword [str.____Process_is_managed__.NET_._n]
shr rcx, 1
mov qword [rbx + rcx*2 + 0x10], rax
mov rax, qword [0x1400b3898]
mov qword [rbx + rcx*2 + 0x18], rax
mov rax, qword [0x1400b38a0]
mov qword [rbx + rcx*2 + 0x20], rax
mov rax, qword [0x1400b38a8]
mov qword [rbx + rcx*2 + 0x28], rax
mov rax, qword [0x1400b38b0]
mov qword [rbx + rcx*2 + 0x30], rax
mov rax, qword [0x1400b38b8]
mov qword [rbx + rcx*2 + 0x38], rax
mov rax, qword [0x1400b38c0]
mov qword [rbx + rcx*2 + 0x40], rax
mov eax, dword [0x1400b38c8]
mov dword [rbx + rcx*2 + 0x48], eax
movzx eax, word [0x1400b38cc]
mov word [rbx + rcx*2 + 0x4c], ax
add word [rbx], 0x3e
movzx eax, word [rbx]
shr rax, 1
mov word [rbx + rax*2 + 0x10], r13w
test byte [r14 + 0xb8], 8
je 0x1400417f5
movzx edx, word [rbx]
add edx, 0x32
cmp dword [rsp + 0x40], edx
jae 0x14004178b
lea rcx, [rsp + 0x40]
call fcn.140002670
mov rbx, qword [rsp + 0x48]
movzx ecx, word [rbx]
mov rax, qword [str.____Process_is_elevated._n]
shr rcx, 1
mov qword [rbx + rcx*2 + 0x10], rax
mov rax, qword [0x1400b38d8]
mov qword [rbx + rcx*2 + 0x18], rax
mov rax, qword [0x1400b38e0]
mov qword [rbx + rcx*2 + 0x20], rax
mov rax, qword [0x1400b38e8]
mov qword [rbx + rcx*2 + 0x28], rax
mov rax, qword [0x1400b38f0]
mov qword [rbx + rcx*2 + 0x30], rax
mov rax, qword [0x1400b38f8]
mov qword [rbx + rcx*2 + 0x38], rax
movzx eax, word [0x1400b3900]
mov word [rbx + rcx*2 + 0x40], ax
add word [rbx], 0x32
movzx eax, word [rbx]
shr rax, 1
mov word [rbx + rax*2 + 0x10], r13w
test byte [r14 + 0xb8], 0x10
je 0x140041888
movzx edx, word [rbx]
add edx, 0x32
cmp dword [rsp + 0x40], edx
jae 0x14004181e
lea rcx, [rsp + 0x40]
call fcn.140002670
mov rbx, qword [rsp + 0x48]
movzx ecx, word [rbx]
mov rax, qword [str.____Process_is_in_a_job._n]
shr rcx, 1
mov qword [rbx + rcx*2 + 0x10], rax
mov rax, qword [0x1400b3910]
mov qword [rbx + rcx*2 + 0x18], rax
mov rax, qword [0x1400b3918]
mov qword [rbx + rcx*2 + 0x20], rax
mov rax, qword [0x1400b3920]
mov qword [rbx + rcx*2 + 0x28], rax
mov rax, qword [0x1400b3928]
mov qword [rbx + rcx*2 + 0x30], rax
mov rax, qword [0x1400b3930]
mov qword [rbx + rcx*2 + 0x38], rax
movzx eax, word [0x1400b3938]
mov word [rbx + rcx*2 + 0x40], ax
add word [rbx], 0x32
movzx eax, word [rbx]
shr rax, 1
mov word [rbx + rax*2 + 0x10], r13w
test byte [r14 + 0xb8], 0x80
je 0x140041909
movzx edx, word [rbx]
add edx, 0x2c
cmp dword [rsp + 0x40], edx
jae 0x1400418ad
lea rcx, [rsp + 0x40]
call fcn.140002670
mov rbx, qword [rsp + 0x48]
movzx ecx, word [rbx]
mov rax, qword [str.____Process_is_POSIX._n]
shr rcx, 1
mov qword [rbx + rcx*2 + 0x10], rax
mov rax, qword [0x1400b3948]
mov qword [rbx + rcx*2 + 0x18], rax
mov rax, qword [0x1400b3950]
mov qword [rbx + rcx*2 + 0x20], rax
mov rax, qword [0x1400b3958]
mov qword [rbx + rcx*2 + 0x28], rax
mov rax, qword [0x1400b3960]
mov qword [rbx + rcx*2 + 0x30], rax
mov eax, dword [0x1400b3968]
mov dword [rbx + rcx*2 + 0x38], eax
add word [rbx], 0x2c
movzx eax, word [rbx]
shr rax, 1
mov word [rbx + rax*2 + 0x10], r13w
bt dword [r14 + 0xb8], 9
jae 0x1400419b3
movzx edx, word [rbx]
add edx, 0x3e
cmp dword [rsp + 0x40], edx
jae 0x140041933
lea rcx, [rsp + 0x40]
call fcn.140002670
mov rbx, qword [rsp + 0x48]
movzx ecx, word [rbx]
mov rax, qword [str.____Process_is_32_bit__WOW64_._n]
shr rcx, 1
mov qword [rbx + rcx*2 + 0x10], rax
mov rax, qword [0x1400b3978]
mov qword [rbx + rcx*2 + 0x18], rax
mov rax, qword [0x1400b3980]
mov qword [rbx + rcx*2 + 0x20], rax
mov rax, qword [0x1400b3988]
mov qword [rbx + rcx*2 + 0x28], rax
mov rax, qword [0x1400b3990]
mov qword [rbx + rcx*2 + 0x30], rax
mov rax, qword [0x1400b3998]
mov qword [rbx + rcx*2 + 0x38], rax
mov rax, qword [0x1400b39a0]
mov qword [rbx + rcx*2 + 0x40], rax
mov eax, dword [0x1400b39a8]
mov dword [rbx + rcx*2 + 0x48], eax
movzx eax, word [0x1400b39ac]
mov word [rbx + rcx*2 + 0x4c], ax
add word [rbx], 0x3e
movzx eax, word [rbx]
shr rax, 1
mov word [rbx + rax*2 + 0x10], r13w
cmp word [rbx], 0
je 0x140041a81
mov r8, qword [rsp + 0x38]
movzx edx, word [r8]
add edx, 0xe
cmp dword [rsp + 0x30], edx
jae 0x1400419de
lea rcx, [rsp + 0x30]
call fcn.140002670
mov r8, qword [rsp + 0x38]
mov rax, qword [str.Notes:_n]
movzx ecx, word [r8]
lea rsi, [rbx + 0x10]
shr rcx, 1
mov qword [r8 + rcx*2 + 0x10], rax
mov eax, dword [0x1400b39b8]
mov dword [r8 + rcx*2 + 0x18], eax
movzx eax, word [0x1400b39bc]
mov word [r8 + rcx*2 + 0x1c], ax
mov rax, qword [rsp + 0x38]
add word [rax], 0xe
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
movzx edi, word [rbx]
test edi, edi
je 0x140041a81
mov rcx, qword [rsp + 0x38]
movzx edx, word [rcx]
add edx, edi
cmp dword [rsp + 0x30], edx
jae 0x140041a4d
lea rcx, [rsp + 0x30]
call fcn.140002670
mov rcx, qword [rsp + 0x38]
test rsi, rsi
je 0x140041a6d
movzx eax, word [rcx]
mov r8, rdi
mov rdx, rsi
shr rax, 1
lea rcx, [rcx + rax*2 + 0x10]
call fcn.140094930
mov rcx, qword [rsp + 0x38]
add word [rcx], di
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
lea rcx, [rbx - 0x20]
mov eax, r15d
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x140041a96
call fcn.14001fcd0
mov rbx, qword [rsp + 0x38]
mov dx, word [rbx]
test dx, dx
je 0x140041af1
movzx r9d, dx
movzx r8d, dx
shr r9d, 1
dec r9d
lea eax, [r9 + 1]
mov ecx, eax
add rax, rax
lea rdx, [rbx + rcx*2 + 0x10]
lea rcx, [rbx + r9*2 + 0x10]
sub r8, rax
call fcn.140094930
mov rax, qword [rsp + 0x38]
mov r11d, 0xfffe
add word [rax], r11w
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx]
shr rax, 1
mov word [rcx + rax*2 + 0x10], r13w
mov rbx, qword [rsp + 0x38]
lock add dword [rbx - 0x20], 1
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe0
lock xadd dword [rcx], r15d
add r15d, 0xffffffff
jne 0x140041b0f
call fcn.14001fcd0
mov rax, rbx
mov r12, qword [rsp + 0xf8]
add rsp, 0x100
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret