Function at 0x1400401a0
Capabilities:
Check mutex on windows
Check processdebugflags
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1500]
mov eax, 0x1600
call fcn.1402063e0
sub rsp, rax
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rbp + 0x14f0], rax
mov rax, qword [rcx + 0x18]
lea rbx, [0x1402332cc]
mov rdi, rcx
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x1400401fb
mov rdx, qword [rcx + 8]
jmp 0x1400401fe
mov rdx, rbx
mov eax, dword [rdi + 0x80]
lea r9, [rbp + 0x4a0]
mov rcx, qword [rdi]
mov r15d, 1
mov qword [rbp + 0x4b8], rdx
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x4a0], r15d
mov dword [rbp + 0x4a8], r15d
mov dword [rbp + 0x4a4], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x140040250
mov rcx, qword [rcx + 8]
jmp 0x140040253
mov rcx, rbx
mov eax, dword [rdi + 0x84]
lea r9, [rbp + 0x440]
mov qword [rbp + 0x458], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x440], r15d
mov dword [rbp + 0x444], eax
mov dword [rbp + 0x448], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x18]
mov r12d, 0x30
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400402fa
lea r8d, [r12 - 0x20]
mov dword [rbp + 0xea0], 0x780030
lea rdx, [rbp + 0xea4]
call fcn.1401e7aec
mov eax, dword [rdi + 0x88]
lea r9, [rbp + 0x3e0]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x3e4], eax
mov edx, 0x104c
lea rax, [rbp + 0xea0]
mov dword [rbp + 0x3e0], r15d
mov qword [rbp + 0x3f8], rax
mov dword [rbp + 0x3e8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x14004030d
mov rcx, qword [rcx + 8]
jmp 0x140040310
mov rcx, rbx
lea r8, ds:[rbp - 0x50]
lea rdx, [rbp + 0xa8]
call sym.SystemInformer.exe_QiGetAccessEntries
mov rcx, qword [rdi + 0x18]
test al, al
je 0x14004041a
mov rbx, qword [rbp + 0xa8]
mov r8d, dword [rbp - 0x50]
mov rdx, rbx
mov ecx, dword [rcx + 0x24]
call sym.SystemInformer.exe_QiGetAccessString
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
cmp qword [rax], 0
je 0x1400403a2
mov rdx, qword [rdi + 0x18]
lea rcx, str.0x_x___s_
mov r8, qword [rax + 8]
mov edx, dword [rdx + 0x24]
call sym.SystemInformer.exe_QiFormatString
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov dword ds:[rbp + 0x500], r15d
lea r9, [rbp + 0x500]
mov dword [rbp + 0x504], 3
mov dword [rbp + 0x508], r15d
mov rcx, qword [rax + 8]
mov qword [rbp + 0x518], rcx
jmp 0x1400403f2
mov rax, qword [rdi + 0x18]
lea rdx, [rbp + 0xea4]
mov r8d, 0x10
mov ecx, dword [rax + 0x24]
mov dword [rbp + 0xea0], 0x780030
call fcn.1401e7aec
lea rax, [rbp + 0xea0]
mov dword [rbp + 0x140], r15d
mov qword [rbp + 0x158], rax
lea r9, [rbp + 0x140]
mov dword [rbp + 0x144], 3
mov dword [rbp + 0x148], r15d
mov rcx, qword ds:[rdi]
xor r8d, r8d
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1402c5110]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140040477
mov ecx, dword [rcx + 0x24]
lea rdx, [rbp + 0xea4]
mov r8d, 0x10
mov dword [rbp + 0xea0], 0x780030
call fcn.1401e7aec
mov rcx, qword [rdi]
lea rax, [rbp + 0xea0]
lea r9, [rbp + 0x140]
mov qword [rbp + 0x158], rax
xor r8d, r8d
mov dword [rbp + 0x140], r15d
mov edx, 0x104c
mov dword [rbp + 0x144], 3
mov dword [rbp + 0x148], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14d, dword [0x1402c825c]
mov ebx, 0x40
mov rax, qword [rdi + 0x10]
cmp r14d, 3
mov r13d, 0x1000
mov qword [rbp + 0x88], rax
cmovge ebx, r13d
xor esi, esi
mov qword [rbp + 0x90], rsi
cmp r14d, 3
jl 0x1400404b6
mov eax, ebx
and eax, 0x121410
cmp eax, ebx
je 0x140040511
xorps xmm0, xmm0
mov dword [rbp + 0xc0], r12d
lea r9, [rbp + 0x88]
mov qword [rbp + 0xc8], rsi
lea r8, [rbp + 0xc0]
mov dword [rbp + 0xd8], esi
mov edx, ebx
mov qword [rbp + 0xd0], rsi
lea rcx, [rbp + 0x870]
movdqu xmmword [rbp + 0xe0], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
nop dword [rax]
cmp eax, 0xc0000022
jne 0x140040526
cmp r14d, 5
jne 0x1400406f5
lea r8, [rbp + 0x88]
mov edx, ebx
lea rcx, [rbp + 0x870]
call fcn.140174cc0
test eax, eax
js 0x1400406f5
mov rax, qword [rdi + 0x18]
lea rcx, [rbp + 0x9f8]
mov qword [rsp + 0x48], rsi
xor r9d, r9d
mov qword [rsp + 0x40], rsi
mov r8d, 0xffffffff
mov qword [rsp + 0x38], rsi
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x4c]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x870]
call sym.SystemInformer.exe_QiGetHandleInformationEx
test eax, eax
js 0x1400406e8
mov eax, dword ds:[rbp - 0x4c]
test eax, eax
js 0x1400406e8
mov ecx, dword ds:[rbp + 0xa04]
lea rdx, [rbp + 0xea0]
mov r8d, 0xa
call fcn.1401e7b10
mov rcx, qword ds:[rdi]
lea rax, [rbp + 0xea0]
lea r9, [rbp + 0x380]
mov qword [rbp + 0x398], rax
xor r8d, r8d
mov dword [rbp + 0x380], r15d
mov edx, 0x104c
mov dword [rbp + 0x384], 4
mov dword [rbp + 0x388], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0xa00]
lea rdx, [rbp + 0xea0]
mov r8d, 0xa
call fcn.1401e7b10
mov rcx, qword [rdi]
lea rax, [rbp + 0xea0]
lea r9, [rbp + 0x2c0]
mov qword [rbp + 0x2d8], rax
xor r8d, r8d
mov dword [rbp + 0x2c0], r15d
mov edx, 0x104c
mov dword [rbp + 0x2c4], 5
mov dword [rbp + 0x2c8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0xa08]
lea rdx, [rbp + 0xea0]
mov r8d, 0xa
call fcn.1401e7b10
mov rcx, qword [rdi]
lea rax, [rbp + 0xea0]
lea r9, [rbp + 0x260]
mov qword [rbp + 0x278], rax
xor r8d, r8d
mov dword [rbp + 0x260], r15d
mov edx, 0x104c
mov dword [rbp + 0x264], 6
mov dword [rbp + 0x268], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0xa0c]
lea rdx, [rbp + 0xea0]
mov r8d, 0xa
call fcn.1401e7b10
mov rcx, qword [rdi]
lea rax, [rbp + 0xea0]
lea r9, [rbp + 0xb00]
mov qword [rbp + 0xb18], rax
xor r8d, r8d
mov dword [rbp + 0xb00], r15d
mov edx, 0x104c
mov dword [rbp + 0xb04], 7
mov dword [rbp + 0xb08], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x870]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword ds:[rdi + 0x18]
mov r15, qword [rax + 0x30]
test r15, r15
je 0x140041cc6
mov rcx, qword [r15]
test rcx, rcx
je 0x140041cc6
cmp rcx, 0x12
jne 0x140041bdd
mov r15, qword [r15 + 8]
lea r12, str.ALPC_Port
mov r14, rcx
shr r14, 4
test r14, r14
je 0x14004076c
nop word [rax + rax]
movdqu xmm0, xmmword [r15]
movdqu xmm1, xmmword [r12]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140040f03
add r15, 0x10
add r12, 0x10
sub r14, 1
jne 0x140040740
mov r14, rcx
shr r14, 1
and r14d, 7
test r14, r14
je 0x1400407bf
sub r12, r15
nop
movzx ecx, word [r15]
movzx r13d, word [r12 + r15]
cmp cx, r13w
je 0x1400407af
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r13w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140041bdd
add r15, 2
sub r14, 1
jne 0x140040780
mov r13d, 0x1000
cmp dword [0x1402c825c], 3
mov qword [rbp + 0x818], rsi
jl 0x140041cc6
mov rax, qword [rdi + 0x10]
lea r8, [rbp + 0x968]
mov edx, r13d
mov qword [rbp + 0x968], rax
lea rcx, [rbp + 0x818]
mov qword [rbp + 0x970], rsi
call fcn.140174cc0
nop dword [rax + rax]
test eax, eax
js 0x140041cc6
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x878]
mov rcx, qword [rbp + 0x818]
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x20
mov rdx, qword [rdx + 0x10]
call fcn.140175ee0
lea r12, [0x14023af80]
mov r13d, 2
lea r14, [r13 - 3]
test eax, eax
js 0x1400410b1
mov rdx, qword [0x1402c4fb8]
mov r15d, 0x100
mov r13d, dword [rbp + 0x880]
mov qword [rsp + 0x58], r15
lea ecx, [r15 + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rbx, rax
mov qword [rsp + 0x60], rax
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + 0x100], si
mov qword [rax], rsi
mov rcx, qword [rax + 8]
mov word [rcx], si
mov edx, dword [rbp + 0x880]
bt edx, 0xc
jae 0x1400408fb
mov rax, qword [rax]
add rax, 0x14
cmp rax, r15
jbe 0x1400408c5
lfence
mov rdx, qword [rbx]
lea rcx, [rsp + 0x58]
add rdx, 0x14
call fcn.140144000
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.LPC_mode_]
movups xmmword [rdx + rcx], xmm0
mov eax, dword [0x14026c158]
mov dword [rdx + rcx + 0x10], eax
add qword [rbx], 0x14
mov rcx, qword [rbx]
btr r13d, 0xc
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov edx, dword [rbp + 0x880]
bt edx, 0x10
jae 0x140040987
mov rax, qword [rbx]
add rax, 0x2a
cmp r15, rax
jae 0x140040935
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x2a
call fcn.140144000
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.Allow_impersonation_]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x14026c170]
movups xmmword [rdx + rcx + 0x10], xmm1
movsd xmm0, qword [0x14026c180]
movsd qword [rdx + rcx + 0x20], xmm0
movzx eax, word [0x14026c188]
mov word [rdx + rcx + 0x28], ax
add qword [rbx], 0x2a
mov rcx, qword [rbx]
btr r13d, 0x10
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov edx, dword [rbp + 0x880]
bt edx, 0x11
jae 0x140040a02
mov rax, qword [rbx]
add rax, 0x28
cmp r15, rax
jae 0x1400409bc
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x28
call fcn.140144000
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
movups xmm0, xmmword [str.Allow_LPC_requests_]
movups xmmword [rcx + rax], xmm0
movups xmm1, xmmword [0x14026c1a0]
movups xmmword [rcx + rax + 0x10], xmm1
movsd xmm0, qword [0x14026c1b0]
movsd qword [rcx + rax + 0x20], xmm0
add qword [rbx], 0x28
mov rcx, qword [rbx]
btr r13d, 0x11
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov edx, dword [rbp + 0x880]
bt edx, 0x12
jae 0x140040a6d
mov rax, qword [rbx]
add rax, 0x14
cmp r15, rax
jae 0x140040a37
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x14
call fcn.140144000
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.Waitable_]
movups xmmword [rdx + rcx], xmm0
mov eax, dword [0x14026c1d0]
mov dword [rdx + rcx + 0x10], eax
add qword [rbx], 0x14
mov rcx, qword [rbx]
btr r13d, 0x12
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov edx, dword [rbp + 0x880]
bt edx, 0x13
jae 0x140040af6
mov rax, qword ds:[rbx]
add rax, 0x34
cmp r15, rax
jae 0x140040aa8
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x34
call fcn.140144000
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.Allow_object_duplication_]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x14026c1e8]
movups xmmword [rdx + rcx + 0x10], xmm1
movups xmm0, xmmword [0x14026c1f8]
movups xmmword [rdx + rcx + 0x20], xmm0
mov eax, dword [0x14026c208]
mov dword [rdx + rcx + 0x30], eax
add qword [rbx], 0x34
mov rcx, qword [rbx]
btr r13d, 0x13
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov edx, dword [rbp + 0x880]
bt edx, 0x14
jae 0x140040b87
mov rax, qword [rbx]
add rax, 0x2a
cmp r15, rax
jae 0x140040b35
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x2a
call fcn.140144000
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.System_process_only_]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x14026c220]
movups xmmword [rdx + rcx + 0x10], xmm1
movsd xmm0, qword [0x14026c230]
movsd qword [rdx + rcx + 0x20], xmm0
movzx eax, word [0x14026c238]
mov word [rdx + rcx + 0x28], ax
add qword [rbx], 0x2a
mov rcx, qword [rbx]
btr r13d, 0x14
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov edx, dword [rbp + 0x880]
bt edx, 0x15
jae 0x140040c00
mov rax, qword [rbx]
add rax, 0x22
cmp r15, rax
jae 0x140040bbc
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x22
call fcn.140144000
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.Wake_policy__1__]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x14026c250]
movups xmmword [rdx + rcx + 0x10], xmm1
movzx eax, word [0x14026c260]
mov word [rdx + rcx + 0x20], ax
add qword [rbx], 0x22
mov rcx, qword [rbx]
btr r13d, 0x15
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov edx, dword [rbp + 0x880]
bt edx, 0x16
jae 0x140040c79
mov rax, qword [rbx]
add rax, 0x22
cmp r15, rax
jae 0x140040c35
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x22
call fcn.140144000
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.Wake_policy__2__]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x14026c278]
movups xmmword [rdx + rcx + 0x10], xmm1
movzx eax, word [0x14026c288]
mov word [rdx + rcx + 0x20], ax
add qword [rbx], 0x22
mov rcx, qword [rbx]
btr r13d, 0x16
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov edx, dword [rbp + 0x880]
bt edx, 0x17
jae 0x140040cf3
mov rax, qword [rbx]
add rax, 0x22
cmp r15, rax
jae 0x140040caf
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x22
call fcn.140144000
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.Wake_policy__3__]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x14026c2a0]
movups xmmword [rdx + rcx + 0x10], xmm1
movzx eax, word [0x14026c2b0]
mov word [rdx + rcx + 0x20], ax
add qword [rbx], 0x22
mov rcx, qword [rbx]
btr r13d, 0x17
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov edx, dword [rbp + 0x880]
bt edx, 0x18
jae 0x140040d81
mov rax, qword [rbx]
add rax, 0x38
cmp r15, rax
jae 0x140040d2f
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x38
call fcn.140144000
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
movups xmm0, xmmword [str.No_shared_section__direct__]
movups xmmword [rcx + rax], xmm0
movups xmm1, xmmword [0x14026c2c8]
movups xmmword [rcx + rax + 0x10], xmm1
movups xmm0, xmmword [0x14026c2d8]
movups xmmword [rcx + rax + 0x20], xmm0
movsd xmm0, qword [0x14026c2e8]
movsd qword [rcx + rax + 0x30], xmm0
add qword [rbx], 0x38
mov rcx, qword [rbx]
btr r13d, 0x18
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov edx, dword [rbp + 0x880]
bt edx, 0x19
jae 0x140040e22
mov rax, qword [rbx]
add rax, 0x3e
cmp r15, rax
jae 0x140040dba
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0x3e
call fcn.140144000
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.Allow_multi_handle_attributes_]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x14026c310]
movups xmmword [rdx + rcx + 0x10], xmm1
movups xmm0, xmmword [0x14026c320]
movups xmmword [rdx + rcx + 0x20], xmm0
movsd xmm0, qword [0x14026c330]
movsd qword [rdx + rcx + 0x30], xmm0
mov eax, dword [0x14026c338]
mov dword [rdx + rcx + 0x38], eax
movzx eax, word [0x14026c33c]
mov word [rdx + rcx + 0x3c], ax
add qword [rbx], 0x3e
mov rcx, qword [rbx]
btr r13d, 0x19
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov edx, dword [rbp + 0x880]
mov rcx, qword [rbx]
cmp rcx, 4
jb 0x140040e9a
add rcx, 0xfffffffffffffffc
mov r9, r12
add rcx, qword [rbx + 8]
mov r8d, 2
sub r9, rcx
movzx eax, word [rcx]
cmp ax, word [r9 + rcx]
jne 0x140040e9a
add rcx, 2
sub r8, 1
jne 0x140040e43
mov r8, qword ds:[rbx]
mov rax, qword [rbx + 8]
mov rdx, r8
shr rdx, 1
sub rdx, 2
lea rcx, [rdx + rdx]
add rdx, 2
sub r8, rcx
add rcx, rax
sub r8, 4
lea rdx, [rax + rdx*2]
call fcn.1402074d0
add qword [rbx], 0xfffffffffffffffc
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov edx, dword [rbp + 0x880]
nop word [rax + rax]
test edx, edx
jne 0x140040f15
mov rax, qword [rbx]
add rax, 0xa
cmp r15, rax
jae 0x140040ed2
lfence
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, qword [rax]
add rdx, 0xa
call fcn.140144000
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
movsd xmm0, qword [0x14026c340]
movsd qword [rdx + rcx], xmm0
movzx eax, word [0x14026c348]
mov word [rdx + rcx + 8], ax
add qword [rbx], 0xa
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
jmp 0x140040f50
shl r14, 4
and ecx, 0xf
add r14, rcx
shr r14, 1
jmp 0x140040776
mov ecx, edx
mov r8d, 0x10
lea rdx, [rbp + 0xea4]
mov dword [rbp + 0xea0], 0x780030
call fcn.1401e7aec
lea r8, [rbp + 0xea0]
lea rdx, str.___s_
lea rcx, [rsp + 0x58]
call sym.SystemInformer.exe_QiAppendFormatStringBuilder
mov rbx, qword [rsp + 0x60]
test r13d, r13d
je 0x140040f91
mov ecx, r13d
lea rdx, [rbp + 0xea4]
mov r8d, 0x10
mov dword [rbp + 0xea0], 0x780030
call fcn.1401e7aec
lea r8, [rbp + 0xea0]
lea rdx, str.__UNKNOWN:__s_
lea rcx, [rsp + 0x58]
call sym.SystemInformer.exe_QiAppendFormatStringBuilder
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rbx + 8]
lea r9, [rbp + 0x200]
mov eax, dword [rdi + 0xa0]
mov r15d, 1
mov qword [rbp + 0x218], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x200], r15d
mov dword [rbp + 0x204], eax
mov dword [rbp + 0x208], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, r15d
jne 0x140040fea
call fcn.14013fb00
mov ecx, dword ds:[rbp + 0x884]
lea rdx, [rbp + 0xea0]
mov r8d, 0xa
call fcn.1401e7b10
mov eax, dword ds:[rdi + 0xa4]
lea r9, [rbp + 0x320]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x324], eax
mov edx, 0x104c
lea rax, [rbp + 0xea0]
mov dword [rbp + 0x320], r15d
mov qword [rbp + 0x338], rax
mov dword [rbp + 0x328], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x888]
lea rdx, [rbp + 0xea4]
mov r8d, 0x10
mov dword [rbp + 0xea0], 0x780030
call fcn.1401e7aec
mov eax, dword [rdi + 0xa8]
lea r9, [rbp + 0x560]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x564], eax
mov edx, 0x104c
lea rax, [rbp + 0xea0]
mov dword [rbp + 0x560], r15d
mov qword [rbp + 0x578], rax
mov dword [rbp + 0x568], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov r13d, 2
jmp 0x1400410b7
mov r15d, 1
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x80]
mov rcx, qword [rbp + 0x818]
mov rdx, qword [rdx + 0x10]
call fcn.140176040
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x900]
mov rbx, qword [rbp - 0x80]
test eax, eax
mov rcx, qword [rbp + 0x818]
mov r8d, r15d
cmovs rbx, rsi
mov qword [rsp + 0x28], rsi
mov rdx, qword [rdx + 0x10]
mov qword [rbp - 0x80], rbx
mov dword [rsp + 0x20], 0x60
call fcn.140175ee0
test eax, eax
js 0x140041485
mov rax, qword ds:[rbp + 0x900]
lea r13, [0x14026c370]
test rax, rax
je 0x140041230
xor edx, edx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x58], rsi
call fcn.140180640
mov r15, rax
mov r12d, 1
test rbx, rbx
je 0x1400411d2
movzx eax, word [rbx]
test ax, ax
je 0x1400411d2
movups xmm0, xmmword [r15]
mov dword [rbp + 0xbc0], r12d
lea edx, [r12 + 2]
mov dword [rbp + 0xbe0], r12d
lea rcx, [rbp + 0xbc0]
movups xmmword [rbp + 0xbd0], xmm0
mov r8d, 0x104
mov qword [rbp + 0xbf0], 6
mov qword [rbp + 0xbf8], r13
mov dword [rbp + 0xc00], r12d
mov qword [rbp + 0xc10], rax
mov rax, qword [rbx + 8]
mov qword [rbp + 0xc18], rax
call sym.SystemInformer.exe_QiFormat
mov rbx, rax
mov ecx, r14d
lock xadd dword [r15 - 8], ecx
cmp ecx, r12d
jne 0x1400411cf
lea rcx, [r15 - 0x10]
call fcn.14013fb00
mov r15, rbx
mov rcx, qword [r15 + 8]
lea r9, [rbp + 0x1a0]
mov eax, dword [rdi + 0xdc]
xor r8d, r8d
mov qword [rbp + 0x1b8], rcx
mov edx, 0x104c
mov rcx, qword [rdi]
mov dword [rbp + 0x1a0], r12d
mov dword [rbp + 0x1a4], eax
mov dword [rbp + 0x1a8], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, ds:[r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14004122a
call fcn.14013fb00
mov rbx, qword [rbp - 0x80]
jmp 0x140041236
mov r12d, 1
mov rax, qword ds:[rbp + 0x920]
test rax, rax
je 0x140041349
xor edx, edx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x58], rsi
call fcn.140180640
mov r15, rax
test rbx, rbx
je 0x1400412f1
movzx eax, word [rbx + 0x10]
test ax, ax
je 0x1400412f1
movups xmm0, xmmword [r15]
mov dword [rbp + 0xc20], r12d
lea rcx, [rbp + 0xc20]
mov dword [rbp + 0xc40], r12d
mov edx, 3
movups xmmword [rbp + 0xc30], xmm0
mov r8d, 0x104
mov qword [rbp + 0xc50], 6
mov qword [rbp + 0xc58], r13
mov dword [rbp + 0xc60], r12d
mov qword [rbp + 0xc70], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp + 0xc78], rax
call sym.SystemInformer.exe_QiFormat
mov rbx, rax
mov ecx, r14d
lock xadd dword [r15 - 8], ecx
cmp ecx, 1
jne 0x1400412ee
lea rcx, [r15 - 0x10]
call fcn.14013fb00
mov r15, rbx
mov rcx, qword [r15 + 8]
lea r9, [rbp + 0x5c0]
mov eax, dword [rdi + 0xe0]
xor r8d, r8d
mov qword [rbp + 0x5d8], rcx
mov edx, 0x104c
mov rcx, qword [rdi]
mov dword [rbp + 0x5c0], r12d
mov dword [rbp + 0x5c4], eax
mov dword [rbp + 0x5c8], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140041345
nop
call fcn.14013fb00
mov rbx, qword [rbp - 0x80]
mov rax, qword [rbp + 0x940]
test rax, rax
je 0x140041457
xor edx, edx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x58], rsi
call fcn.140180640
mov rsi, rax
test rbx, rbx
je 0x140041401
movzx eax, word ds:[rbx + 0x20]
test ax, ax
je 0x140041401
movups xmm0, xmmword ds:[rsi]
mov dword [rbp + 0xc80], r12d
lea rcx, [rbp + 0xc80]
mov dword [rbp + 0xca0], r12d
mov edx, 3
movups xmmword [rbp + 0xc90], xmm0
mov r8d, 0x104
mov qword [rbp + 0xcb0], 6
mov qword [rbp + 0xcb8], r13
mov dword [rbp + 0xcc0], r12d
mov qword [rbp + 0xcd0], rax
mov rax, qword [rbx + 0x28]
mov qword [rbp + 0xcd8], rax
call sym.SystemInformer.exe_QiFormat
mov rbx, rax
mov ecx, r14d
lock xadd dword [rsi - 8], ecx
cmp ecx, 1
jne 0x1400413fe
lea rcx, [rsi - 0x10]
call fcn.14013fb00
mov rsi, rbx
mov rcx, qword [rsi + 8]
lea r9, [rbp + 0xb00]
mov eax, dword [rdi + 0xe4]
xor r8d, r8d
mov qword [rbp + 0xb18], rcx
mov edx, 0x104c
mov rcx, qword [rdi]
mov dword [rbp + 0xb00], r12d
mov dword [rbp + 0xb04], eax
mov dword [rbp + 0xb08], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140041453
call fcn.14013fb00
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x14004146e
mov rcx, qword [0x1402c5110]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x818]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x140041cc6
mov rax, qword [rdi + 0x10]
lea r9, [rbp + 0x98]
mov ebx, dword [0x1402c825c]
lea r8, [rbp + 0x110]
mov qword [rbp + 0x98], rax
lea rcx, [rbp + 0x818]
mov eax, 0x30
mov qword [rbp + 0x868], rsi
xorps xmm0, xmm0
mov qword [rbp + 0xa0], rsi
mov dword [rbp + 0x110], eax
mov qword [rbp + 0x118], rsi
lea edx, [rax + 0x10]
mov dword [rbp + 0x128], esi
mov qword [rbp + 0x120], rsi
movdqu xmmword [rbp + 0x130], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140041512
cmp ebx, 5
jne 0x140041cc6
lea r8, [rbp + 0x98]
lea edx, [rbx + 0x3b]
lea rcx, [rbp + 0x818]
call fcn.140174cc0
test eax, eax
js 0x140041cc6
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x868]
mov rcx, qword [rbp + 0x818]
mov r8, r14
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x20000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x818]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test ebx, ebx
js 0x140041cc6
mov rcx, qword [rbp + 0x868]
test rcx, rcx
je 0x140041cc6
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x840]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x140041b49
mov r15d, dword [rbp + 0x840]
lea rcx, [rbp + 0xb0]
xor r8d, r8d
mov qword [rsp + 0x68], 0x100
xor edx, edx
mov qword [rbp + 0xb8], rsi
mov qword [rbp + 0xb0], 0x100
call sym.SystemInformer.exe_QiCreateString3
mov rbx, rax
mov qword [rsp + 0x70], rax
mov qword [rax], rsi
mov rcx, qword [rax + 8]
mov word [rcx], si
mov ecx, dword [rbp + 0x840]
bt ecx, 0xc
jae 0x140041615
mov r8d, 0x14
lea rdx, str.LPC_mode_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_QiAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0xc
mov rbx, qword [rsp + 0x70]
bt ecx, 0x10
jae 0x140041642
mov r8d, 0x2a
lea rdx, str.Allow_impersonation_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_QiAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x10
mov rbx, qword [rsp + 0x70]
bt ecx, 0x11
jae 0x14004166f
mov r8d, 0x28
lea rdx, str.Allow_LPC_requests_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_QiAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x11
mov rbx, qword [rsp + 0x70]
bt ecx, 0x12
jae 0x14004169c
mov r8d, 0x14
lea rdx, str.Waitable_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_QiAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x12
mov rbx, qword [rsp + 0x70]
bt ecx, 0x13
jae 0x1400416c9
mov r8d, 0x34
lea rdx, str.Allow_object_duplication_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_QiAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x13
mov rbx, qword [rsp + 0x70]
bt ecx, 0x14
jae 0x1400416f6
mov r8d, 0x2a
lea rdx, str.System_process_only_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_QiAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x14
mov rbx, qword [rsp + 0x70]
bt ecx, 0x15
jae 0x140041723
mov r8d, 0x22
lea rdx, str.Wake_policy__1__
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_QiAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x15
mov rbx, qword [rsp + 0x70]
bt ecx, 0x16
jae 0x140041755
mov r8d, 0x22
lea rdx, str.Wake_policy__2__
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_QiAppendStringBuilderEx
mov ecx, dword [rbp + 0x840]
btr r15d, 0x16
mov rbx, qword [rsp + 0x70]
bt ecx, 0x17
jae 0x1400417cf
mov rax, qword [rbx]
add rax, 0x22
cmp qword [rsp + 0x68], rax
jae 0x14004178b
lfence
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
mov rdx, qword [rax]
add rdx, 0x22
call fcn.140144000
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
movups xmm0, xmmword [str.Wake_policy__3__]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x14026c2a0]
movups xmmword [rdx + rcx + 0x10], xmm1
movzx eax, word [0x14026c2b0]
mov word [rdx + rcx + 0x20], ax
add qword [rbx], 0x22
mov rcx, qword [rbx]
btr r15d, 0x17
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x840]
bt ecx, 0x18
jae 0x14004185c
mov rax, qword [rbx]
add rax, 0x38
cmp qword [rsp + 0x68], rax
jae 0x14004180a
lfence
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
mov rdx, qword [rax]
add rdx, 0x38
call fcn.140144000
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
movups xmm0, xmmword [str.No_shared_section__direct__]
movups xmmword [rcx + rax], xmm0
movups xmm1, xmmword [0x14026c2c8]
movups xmmword [rcx + rax + 0x10], xmm1
movups xmm0, xmmword [0x14026c2d8]
movups xmmword [rcx + rax + 0x20], xmm0
movsd xmm0, qword [0x14026c2e8]
movsd qword [rcx + rax + 0x30], xmm0
add qword [rbx], 0x38
mov rcx, qword [rbx]
btr r15d, 0x18
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x840]
bt ecx, 0x19
jae 0x1400418fa
mov rax, qword [rbx]
add rax, 0x3e
cmp qword [rsp + 0x68], rax
jae 0x140041892
lfence
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
mov rdx, qword [rax]
add rdx, 0x3e
call fcn.140144000
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.Allow_multi_handle_attributes_]
mov rdx, qword [rbx]
movups xmmword [rdx + rcx], xmm0
movups xmm1, xmmword [0x14026c310]
movups xmmword [rdx + rcx + 0x10], xmm1
movups xmm0, xmmword [0x14026c320]
movups xmmword [rdx + rcx + 0x20], xmm0
movsd xmm0, qword [0x14026c330]
movsd qword [rdx + rcx + 0x30], xmm0
mov eax, dword [0x14026c338]
mov dword [rdx + rcx + 0x38], eax
movzx eax, word [0x14026c33c]
mov word [rdx + rcx + 0x3c], ax
add qword [rbx], 0x3e
mov rcx, qword [rbx]
btr r15d, 0x19
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x840]
mov rdx, qword ds:[rbx]
cmp rdx, 4
jb 0x14004197a
add rdx, 0xfffffffffffffffc
add rdx, qword [rbx + 8]
sub rdx, r12
nop word [rax + rax]
movzx eax, word [rdx + r12]
cmp ax, word [r12]
jne 0x14004197a
add r12, 2
sub r13, 1
jne 0x140041920
mov r8, qword ds:[rbx]
mov rax, qword [rbx + 8]
mov rdx, r8
shr rdx, 1
sub rdx, 2
lea rcx, [rdx + rdx]
add rdx, 2
sub r8, rcx
add rcx, rax
sub r8, 4
lea rdx, [rax + rdx*2]
call fcn.1402074d0
add qword [rbx], 0xfffffffffffffffc
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
mov ecx, dword [rbp + 0x840]
test ecx, ecx
jne 0x1400419db
mov rax, qword [rbx]
add rax, 0xa
cmp qword [rsp + 0x68], rax
jae 0x1400419aa
lfence
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
mov rdx, qword [rax]
add rdx, 0xa
call fcn.140144000
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
movsd xmm0, qword [0x14026c340]
movsd qword [rdx + rcx], xmm0
movzx eax, word [0x14026c348]
mov word [rdx + rcx + 8], ax
add qword [rbx], 0xa
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov word [rcx + rax], si
jmp 0x140041a14
mov r8d, 0x10
mov dword [rbp + 0xea0], 0x780030
lea rdx, [rbp + 0xea4]
call fcn.1401e7aec
lea r8, [rbp + 0xea0]
lea rdx, str.___s_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_QiAppendFormatStringBuilder
mov rbx, qword [rsp + 0x70]
test r15d, r15d
je 0x140041a55
mov ecx, r15d
lea rdx, [rbp + 0xea4]
mov r8d, 0x10
mov dword [rbp + 0xea0], 0x780030
call fcn.1401e7aec
lea r8, [rbp + 0xea0]
lea rdx, str.__UNKNOWN:__s_
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_QiAppendFormatStringBuilder
mov rbx, qword [rsp + 0x70]
mov r9, qword [rbx + 8]
mov r15d, 1
mov edx, dword [rdi + 0xa0]
mov r8d, r15d
mov rcx, qword [rdi]
call sym.SystemInformer.exe_QiSetListViewSubItem
lea rcx, ds:[rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, r15d
jne 0x140041a8a
call fcn.14013fb00
mov ecx, dword ds:[rbp + 0x844]
lea rdx, [rbp + 0xea0]
mov r8d, 0xa
call fcn.1401e7b10
mov eax, dword ds:[rdi + 0xa4]
lea r9, [rbp + 0x620]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x624], eax
mov edx, 0x104c
lea rax, [rbp + 0xea0]
mov dword [rbp + 0x620], r15d
mov qword [rbp + 0x638], rax
mov dword [rbp + 0x628], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x848]
lea rdx, [rbp + 0xea4]
mov r8d, 0x10
mov dword [rbp + 0xea0], 0x780030
call fcn.1401e7aec
mov eax, dword [rdi + 0xa8]
lea r9, [rbp + 0x680]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x684], eax
mov edx, 0x104c
lea rax, [rbp + 0xea0]
mov dword [rbp + 0x680], r15d
mov qword [rbp + 0x698], rax
mov dword [rbp + 0x688], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402baf40], 0x6c
jb 0x140041bcb
mov rcx, qword [rbp + 0x868]
lea r8, [rbp + 0x8a0]
mov r9d, 8
mov qword [rsp + 0x20], rsi
lea edx, [r9 + 4]
call qword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x140041bcb
mov eax, dword [rbp + 0x8a4]
lea rcx, [rbp + 0x968]
mov qword [rbp + 0x968], rax
mov qword [rbp + 0x970], rsi
call sym.SystemInformer.exe_QiGetClientIdName
mov edx, dword [rdi + 0xd8]
mov r8d, r15d
mov rcx, qword [rdi]
mov rbx, rax
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_QiSetListViewSubItem
lea rcx, ds:[rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140041bcb
call fcn.14013fb00
mov rcx, qword [rbp + 0x868]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140041cc6
mov rax, qword [rdi + 0x18]
mov r15, qword [rax + 0x30]
mov rcx, qword [r15]
cmp rcx, 0x1e
jne 0x140041d08
mov r15, qword [r15 + 8]
lea r12, str.EtwRegistration
mov r14, rcx
shr r14, 4
test r14, r14
je 0x140041c3c
nop dword [rax]
movdqu xmm0, xmmword [r15]
movdqu xmm1, xmmword [r12]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140041cf6
add r15, 0x10
add r12, 0x10
sub r14, 1
jne 0x140041c10
mov r14, rcx
shr r14, 1
and r14d, 7
test r14, r14
je 0x140041c86
sub r12, r15
nop
movzx ecx, word [r15]
movzx r13d, word [r12 + r15]
cmp cx, r13w
je 0x140041c7c
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r13w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140041d08
add r15, 2
sub r14, 1
jne 0x140041c50
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x140041c97
mov rsi, qword [rcx + 8]
mov eax, dword [rdi + 0xf8]
mov ecx, 1
mov dword [rbp + 0x20], ecx
mov dword [rbp + 0x28], ecx
mov qword [rbp + 0x38], rsi
mov rcx, qword ds:[rdi]
lea r9, [rbp + 0x20]
xor r8d, r8d
mov dword [rbp + 0x24], eax
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x14f0]
xor rcx, rsp
call fcn.1401e0100
lea r11, [rsp + 0x1600]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shl r14, 4
and ecx, 0xf
add r14, rcx
shr r14, 1
jmp 0x140041c46
mov rax, qword ds:[rdi + 0x18]
lea r13, [0x14026a2f0]
mov r15, qword [rax + 0x30]
mov rcx, qword [r15]
cmp rcx, 8
jne 0x140042a3f
mov r15, qword [r15 + 8]
mov r14, rcx
shr r14, 4
mov r12, r13
test r14, r14
je 0x140041d6c
nop dword [rax]
movdqu xmm0, xmmword [r15]
movdqu xmm1, xmmword [r12]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140041e66
add r15, 0x10
add r12, 0x10
sub r14, 1
jne 0x140041d40
mov r14, rcx
shr r14, 1
and r14d, 7
test r14, r14
je 0x140041dc0
sub r12, r15
nop
movzx ecx, word [r15]
movzx r13d, word [r12 + r15]
cmp cx, r13w
je 0x140041daf
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r13w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140042a3f
add r15, 2
sub r14, 1
jne 0x140041d80
lea r13, [0x14026a2f0]
mov ebx, dword [0x1402c825c]
cmp ebx, 3
jl 0x1400424e4
mov rax, qword [rdi + 0x10]
lea r8, [rbp + 0xae0]
mov edx, 0x1000
mov qword [rbp + 0xae0], rax
lea rcx, [rbp + 0x808]
mov qword [rbp + 0xae8], rsi
call fcn.140174cc0
nop dword [rax]
test eax, eax
js 0x1400424de
mov rdx, qword [rdi + 0x18]
lea rax, [rbp + 0xa70]
mov rcx, qword [rbp + 0x808]
lea r9, [rbp + 0x9a0]
xor r12b, r12b
mov qword [rsp + 0x28], rax
xor r15b, r15b
mov rdx, qword [rdx + 0x10]
call fcn.140176220
test eax, eax
js 0x140041efa
mov eax, dword [rbp + 0x9a0]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x140041e64.6
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x43c4c]
mov ecx, dword [rdx + rax*4 + 0x43c38]
add rcx, rdx
jmp rcx
shl r14, 4
and ecx, 0xf
add r14, rcx
shr r14, 1
jmp 0x140041d76
mov eax, dword [rdi + 0xac]
mov dword [rbp - 0x3c], eax
lea rax, str.Pipe
jmp 0x140041ed6
mov eax, dword [rdi + 0xac]
mov dword [rbp - 0x3c], eax
lea rax, str.Network
jmp 0x140041ed6
mov eax, dword [rdi + 0xac]
mov r12b, 1
mov dword [rbp - 0x3c], eax
lea rax, str.File_or_directory
jmp 0x140041ed6
mov eax, dword [rdi + 0xac]
mov r15b, 1
mov dword [rbp - 0x3c], eax
lea rax, str.Console
jmp 0x140041ed6
mov eax, dword [rdi + 0xac]
mov dword [rbp - 0x3c], eax
lea rax, [0x14026c3d0]
mov ecx, 1
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x40], ecx
lea r9, [rbp - 0x40]
mov dword [rbp - 0x38], ecx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword ds:[rdi + 0x18]
lea r9, [rbp + 0x978]
mov rcx, qword [rbp + 0x808]
mov r8d, 0x10
mov dword [rsp + 0x20], 4
mov rdx, qword [rdx + 0x10]
call sym.SystemInformer.exe_QiCallKphQueryFileInformationWithTimeout
lea rbx, [0x14026ae94]
mov r14, 0xffffffffffffffff
test eax, eax
js 0x14004207b
mov eax, dword ds:[rbp + 0x978]
lea r8d, [r14 + 7]
mov edx, eax
mov ecx, eax
btr edx, 0x18
bts ecx, 0x18
test al, 0x30
cmovne ecx, edx
lea rdx, str.FILE_FLAG_OVERLAPPED
call sym.SystemInformer.exe_QiGetAccessString
mov edx, 1
mov qword [rbp + 0x8a0], rax
lea rcx, [0x140264550]
mov dword [rbp + 0xd60], edx
mov qword [rbp + 0xd78], rcx
lea r8, [rbp + 0x10d0]
mov ecx, dword [rbp + 0x978]
mov r9d, 0x208
mov dword [rbp + 0xd90], ecx
lea rcx, [rbp + 0xd60]
mov dword [rbp + 0xda0], edx
mov qword [rbp + 0xd70], 4
mov dword [rbp + 0xd80], 0x108
mov byte [rbp + 0xd8a], 0x10
mov qword [rbp + 0xdb0], 4
mov qword [rbp + 0xdb8], rbx
movups xmm0, xmmword [rax]
mov eax, 2
mov dword [rbp + 0xdc0], edx
mov qword [rbp + 0xdf0], rax
lea rax, [0x14026c3dc]
mov dword [rbp + 0xde0], edx
lea edx, [r14 + 6]
mov qword [rbp + 0xdf8], rax
movups xmmword [rbp + 0xdd0], xmm0
mov qword [rsp + 0x20], rsi
call sym.SystemInformer.exe_QiFormatToBuffer
test al, al
je 0x14004205e
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0xf10]
mov ecx, 1
mov dword [rbp + 0xf14], eax
mov dword [rbp + 0xf10], ecx
lea rax, [rbp + 0x10d0]
mov dword [rbp + 0xf18], ecx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov qword [rbp + 0xf28], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x8a0]
mov eax, r14d
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14004207b
call fcn.14013fb00
nop dword [rax + rax]
test r15b, r15b
jne 0x14004230e
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x8c8]
mov rcx, qword [rbp + 0x808]
mov r8d, 5
mov dword [rsp + 0x20], 0x18
mov rdx, qword [rdx + 0x10]
call sym.SystemInformer.exe_QiCallKphQueryFileInformationWithTimeout
mov r15d, 1
test eax, eax
js 0x140042171
mov rax, qword [rbp + 0x8d0]
lea r9d, [r15 + 0x63]
lea r8, [rbp + 0x1060]
mov qword [rbp + 0xb90], rax
mov edx, r15d
mov dword [rbp + 0xb80], 0xc
lea rcx, [rbp + 0xb80]
mov qword [rsp + 0x20], rsi
call sym.SystemInformer.exe_QiFormatToBuffer
nop
test al, al
je 0x140042146
mov eax, dword ds:[rdi + 0xb8]
lea r9, [rbp + 0x6e0]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x6e4], eax
mov edx, 0x104c
lea rax, [rbp + 0x1060]
mov dword [rbp + 0x6e0], r15d
mov qword [rbp + 0x6f8], rax
mov dword [rbp + 0x6e8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
test r12b, r12b
je 0x140042171
cmp byte [rbp + 0x8dd], sil
lea rax, [0x14026c3e0]
mov edx, dword [rdi + 0xac]
mov r8d, r15d
mov rcx, qword [rdi]
cmovne r13, rax
mov r9, r13
call sym.SystemInformer.exe_QiSetListViewSubItem
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x990]
mov rcx, qword [rbp + 0x808]
mov r8d, 0xe
mov dword [rsp + 0x20], 8
mov rdx, qword [rdx + 0x10]
call sym.SystemInformer.exe_QiCallKphQueryFileInformationWithTimeout
nop word [rax + rax]
test eax, eax
js 0x14004230e
mov rax, qword [rbp + 0x990]
test rax, rax
je 0x14004230e
mov rcx, qword [rbp + 0x8d0]
mov r9d, 0x64
mov qword [rsp + 0x20], rsi
test rcx, rcx
je 0x1400422a3
xorps xmm1, xmm1
mov qword [rbp + 0xcf0], rax
cvtsi2sd xmm1, rax
mov dword [rbp + 0xce0], 0x10009
lea rax, [0x14026c3f4]
mov dword [rbp + 0xd00], r15d
lea r8, [rbp + 0xf80]
mov qword [rbp + 0xd10], 4
lea edx, [r9 - 0x60]
mov qword [rbp + 0xd18], rbx
xorps xmm0, xmm0
mov dword [rbp + 0xd20], 0x4b
cvtsi2sd xmm0, rcx
lea rcx, [rbp + 0xce0]
mov word [rbp + 0xd24], r15w
mov dword [rbp + 0xd40], r15d
mov qword [rbp + 0xd50], 4
mov qword [rbp + 0xd58], rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x14028d340]
movsd qword [rbp + 0xd30], xmm1
call sym.SystemInformer.exe_QiFormatToBuffer
test al, al
je 0x14004230e
mov eax, dword [rdi + 0xb4]
lea r9, [rbp + 0x740]
mov dword [rbp + 0x744], eax
lea rax, [rbp + 0xf80]
mov qword [rbp + 0x758], rax
mov dword [rbp + 0x740], r15d
mov dword [rbp + 0x748], r15d
jmp 0x1400422fd
lea r8, [rbp + 0xff0]
mov dword [rbp + 0xba0], 0x10009
mov edx, r15d
mov qword [rbp + 0xbb0], rax
lea rcx, [rbp + 0xba0]
call sym.SystemInformer.exe_QiFormatToBuffer
test al, al
je 0x14004230e
mov eax, dword [rdi + 0xb4]
lea r9, [rbp + 0x7a0]
mov dword [rbp + 0x7a4], eax
lea rax, [rbp + 0xff0]
mov qword [rbp + 0x7b8], rax
mov dword [rbp + 0x7a0], r15d
mov dword [rbp + 0x7a8], r15d
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x898]
mov rcx, qword [rbp + 0x808]
mov r8d, 8
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 8
mov rdx, qword [rdx + 0x10]
call fcn.140175600
nop dword [rax]
test eax, eax
js 0x1400424cc
mov rcx, qword [rbp + 0x898]
lea rdx, [rbp + 0x80]
call fcn.1401615c0
test eax, eax
js 0x14004239e
mov rbx, qword [rbp + 0x80]
test rbx, rbx
je 0x140042371
mov r9, qword [rbx + 8]
jmp 0x140042374
mov r9, rsi
mov edx, dword [rdi + 0xbc]
mov r8d, 1
mov rcx, qword [rdi]
call sym.SystemInformer.exe_QiSetListViewSubItem
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14004239e
call fcn.14013fb00
mov rbx, qword [rbp + 0x898]
lea rax, [rsp + 0x78]
xor r9d, r9d
mov dword [rsp + 0x78], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea edx, [r9 + 3]
call fcn.1401758a0
mov r8d, dword [rsp + 0x78]
mov edx, 4
mov rcx, qword [0x1402c5110]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r9d, dword [rsp + 0x78]
mov edx, 3
mov r15, rax
mov rcx, rbx
lea rax, [rsp + 0x78]
mov r8, r15
mov qword [rsp + 0x20], rax
call fcn.1401758a0
lfence
test eax, eax
js 0x1400424ad
movzx eax, word [r15]
test ax, ax
jne 0x14004241c
call sym.SystemInformer.exe_QiReferenceEmptyString
mov rbx, rax
jmp 0x14004245a
mov rdx, qword [0x1402c4fb8]
lea rcx, [rax + 0x12]
mov r13, qword [r15 + 8]
mov r12, rax
call sym.SystemInformer.exe_QiCreateObject
mov rbx, rax
mov qword [rax], r12
add rax, 0x10
mov qword [rbx + 8], rax
mov word [r12 + rax], si
test r13, r13
je 0x14004245a
mov rcx, qword [rbx + 8]
mov r8, r12
mov rdx, r13
call fcn.1402074d0
mov rcx, qword [0x1402c5110]
mov r8, r15
xor edx, edx
mov qword [rbp + 0x80], rbx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test rbx, rbx
je 0x14004247c
mov rsi, qword [rbx + 8]
mov edx, dword [rdi + 0xc0]
mov r9, rsi
mov rcx, qword [rdi]
mov r8d, 1
call sym.SystemInformer.exe_QiSetListViewSubItem
lea rcx, ds:[rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x1400424bf
call fcn.14013fb00
jmp 0x1400424bf
mov rcx, qword [0x1402c5110]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x808]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140041cc6
mov ebx, dword [0x1402c825c]
mov rax, qword [rdi + 0x10]
lea r9, [rbp + 0x968]
mov qword [rbp + 0x968], rax
lea r8, [rbp - 0x40]
mov eax, 0x30
mov qword [rbp + 0x800], rsi
xorps xmm0, xmm0
mov qword [rbp + 0x970], rsi
lea rcx, [rbp + 0x808]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
lea edx, [rax + 0x10]
mov dword [rbp - 0x28], esi
mov qword [rbp - 0x30], rsi
movdqu xmmword [rbp - 0x20], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x14004255f
nop word [rax + rax]
cmp ebx, 5
jne 0x140041cc6
lea r8, [rbp + 0x968]
lea edx, [rbx + 0x3b]
lea rcx, [rbp + 0x808]
call fcn.140174cc0
nop
test eax, eax
js 0x140041cc6
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x800]
mov rcx, qword [rbp + 0x808]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x2000000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x808]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140041cc6
mov rcx, qword ds:[rbp + 0x800]
test rcx, rcx
je 0x140041cc6
lea r9d, [r14 + 9]
mov dword [rsp + 0x20], 4
lea r8, [rbp + 0x980]
xor r12b, r12b
lea rdx, [rbp + 0xa60]
xor r15b, r15b
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x1400426c6
mov eax, dword [rbp + 0x980]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x140042622.6
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x43cb0]
mov ecx, dword [rdx + rax*4 + 0x43c9c]
add rcx, rdx
jmp rcx
mov eax, dword [rdi + 0xac]
mov dword [rbp + 0xf14], eax
lea rax, str.Pipe
jmp 0x140042691
mov eax, dword [rdi + 0xac]
mov dword [rbp + 0xf14], eax
lea rax, str.Network
jmp 0x140042691
mov eax, dword [rdi + 0xac]
mov r12b, 1
mov dword [rbp + 0xf14], eax
lea rax, str.File_or_directory
jmp 0x140042691
mov eax, dword [rdi + 0xac]
mov r15b, 1
mov dword [rbp + 0xf14], eax
lea rax, str.Console
jmp 0x140042691
mov eax, dword [rdi + 0xac]
mov dword [rbp + 0xf14], eax
lea rax, [0x14026c3d0]
mov ecx, 1
mov qword [rbp + 0xf28], rax
mov dword [rbp + 0xf10], ecx
lea r9, [rbp + 0xf10]
mov dword [rbp + 0xf18], ecx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword ds:[rbp + 0x800]
lea r8, [rbp + 0x850]
mov r9d, 4
lea edx, [r9 + 0xc]
call fcn.140183b80
lea rbx, [0x14026ae94]
test eax, eax
js 0x140042825
mov eax, dword [rbp + 0x850]
mov r8d, 6
mov edx, eax
mov ecx, eax
btr edx, 0x18
bts ecx, 0x18
test al, 0x30
cmovne ecx, edx
lea rdx, str.FILE_FLAG_OVERLAPPED
call sym.SystemInformer.exe_QiGetAccessString
mov edx, 1
mov qword [rbp + 0x990], rax
lea rcx, [0x140264550]
mov dword [rbp + 0xe00], edx
mov qword [rbp + 0xe18], rcx
lea r8, [rbp + 0x12e0]
mov ecx, dword [rbp + 0x850]
mov r9d, 0x208
mov dword [rbp + 0xe30], ecx
lea rcx, [rbp + 0xe00]
mov dword [rbp + 0xe40], edx
mov qword [rbp + 0xe10], 4
mov dword [rbp + 0xe20], 0x108
mov byte [rbp + 0xe2a], 0x10
mov qword [rbp + 0xe50], 4
mov qword [rbp + 0xe58], rbx
movups xmm0, xmmword [rax]
mov eax, 2
mov dword [rbp + 0xe60], edx
mov qword [rbp + 0xe90], rax
lea rax, [0x14026c3dc]
mov dword [rbp + 0xe80], edx
mov edx, 5
mov qword [rbp + 0xe98], rax
movups xmmword [rbp + 0xe70], xmm0
mov qword [rsp + 0x20], rsi
call sym.SystemInformer.exe_QiFormatToBuffer
test al, al
je 0x140042808
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0x20]
mov ecx, 1
mov dword [rbp + 0x24], eax
mov dword [rbp + 0x20], ecx
lea rax, [rbp + 0x12e0]
mov dword [rbp + 0x28], ecx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov qword [rbp + 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x990]
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140042825
nop
call fcn.14013fb00
test r15b, r15b
jne 0x140042a2d
mov rcx, qword [rbp + 0x800]
lea r8, [rbp + 0x8a8]
mov r9d, 0x18
lea edx, [r9 - 0x13]
call fcn.140183b80
mov r14d, 1
test eax, eax
js 0x1400428f1
mov rax, qword [rbp + 0x8b0]
lea r9d, [r14 + 0x63]
lea r8, [rbp + 0xf10]
mov qword [rbp + 0xaf0], rax
mov edx, r14d
mov dword [rbp + 0xae0], 0xc
lea rcx, [rbp + 0xae0]
mov qword [rsp + 0x20], rsi
call sym.SystemInformer.exe_QiFormatToBuffer
test al, al
je 0x1400428c6
mov eax, dword ds:[rdi + 0xb8]
lea r9, [rbp + 0x20]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x24], eax
mov edx, 0x104c
lea rax, [rbp + 0xf10]
mov dword [rbp + 0x20], r14d
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x28], r14d
call qword [sym.imp.USER32.dll_SendMessageW]
test r12b, r12b
je 0x1400428f1
cmp byte [rbp + 0x8bd], sil
lea rax, [0x14026c3e0]
mov edx, dword [rdi + 0xac]
mov r8d, r14d
mov rcx, qword [rdi]
cmovne r13, rax
mov r9, r13
call sym.SystemInformer.exe_QiSetListViewSubItem
mov rcx, qword [rbp + 0x800]
lea r8, [rbp + 0x988]
mov r9d, 8
lea edx, [r9 + 6]
call fcn.140183b80
test eax, eax
js 0x140042a2d
mov rax, qword ds:[rbp + 0x988]
test rax, rax
je 0x140042a2d
mov rcx, qword [rbp + 0x8b0]
lea r8, [rbp + 0xf10]
mov qword [rsp + 0x20], rsi
mov r9d, 0x64
test rcx, rcx
je 0x1400429d8
xorps xmm1, xmm1
mov qword [rbp + 0xb10], rax
cvtsi2sd xmm1, rax
mov dword [rbp + 0xb00], 0x10009
lea rax, [0x14026c3f4]
mov dword [rbp + 0xb20], r14d
lea edx, [r9 - 0x60]
mov qword [rbp + 0xb30], 4
mov qword [rbp + 0xb38], rbx
xorps xmm0, xmm0
mov dword [rbp + 0xb40], 0x4b
cvtsi2sd xmm0, rcx
mov word [rbp + 0xb44], r14w
lea rcx, [rbp + 0xb00]
mov dword [rbp + 0xb60], r14d
mov qword [rbp + 0xb70], 4
mov qword [rbp + 0xb78], rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x14028d340]
movsd qword [rbp + 0xb50], xmm1
jmp 0x1400429f3
mov dword [rbp + 0xae0], 0x10009
lea rcx, [rbp + 0xae0]
mov qword [rbp + 0xaf0], rax
mov edx, r14d
call sym.SystemInformer.exe_QiFormatToBuffer
test al, al
je 0x140042a2d
mov eax, dword [rdi + 0xb4]
lea r9, [rbp + 0x20]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x24], eax
mov edx, 0x104c
lea rax, [rbp + 0xf10]
mov dword [rbp + 0x20], r14d
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x28], r14d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x800]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140041cc6
mov rax, qword [rdi + 0x18]
mov r15, qword [rax + 0x30]
mov rcx, qword [r15]
cmp rcx, 0xe
je 0x140042a57
xor al, al
jmp 0x140042ae8
mov r15, qword [r15 + 8]
lea r12, [0x14026b7a8]
mov r14, rcx
shr r14, 4
test r14, r14
je 0x140042a9c
nop
movdqu xmm0, xmmword [r15]
movdqu xmm1, xmmword [r12]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140042c47
add r15, 0x10
add r12, 0x10
sub r14, 1
jne 0x140042a70
mov r14, rcx
shr r14, 1
and r14d, 7
test r14, r14
je 0x140042ae6
sub r12, r15
nop
movzx ecx, word [r15]
movzx r13d, word [r12 + r15]
cmp cx, r13w
je 0x140042adc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r13w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140042a50
add r15, 2
sub r14, 1
jne 0x140042ab0
mov al, 1
test al, al
je 0x140042f33
mov ebx, dword [0x1402c825c]
mov r14, 0xffffffffffffffff
mov qword [rbp - 0x68], rsi
cmp ebx, 3
jl 0x140042c98
mov rax, qword [rdi + 0x10]
lea r8, [rbp + 0xae0]
mov edx, 0x1000
mov qword [rbp + 0xae0], rax
lea rcx, [rbp + 0x820]
mov qword [rbp + 0xae8], rsi
call fcn.140174cc0
test eax, eax
js 0x140042c92
mov rcx, qword [0x1402c5110]
lea edx, [r14 + 5]
mov r8d, 0x100
mov dword [rbp + 0x830], esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x8e0]
mov rcx, qword [rbp + 0x820]
lea r8d, [r14 + 0xf]
mov qword [rsp + 0x28], rsi
mov r15, rax
mov dword [rsp + 0x20], 0x18
mov rdx, qword [rdx + 0x10]
call fcn.140175600
mov rdx, qword [rdi + 0x18]
lea r8d, [r14 + 0x10]
mov rcx, qword [rbp + 0x820]
mov r12d, eax
lea rax, [rbp + 0x830]
mov r9, r15
mov qword [rsp + 0x28], rax
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x100
call fcn.140175600
nop word [rax + rax]
cmp eax, 0x80000005
jne 0x140042c34
cmp dword [rbp + 0x830], esi
jbe 0x140042c70
mov rcx, qword [0x1402c5110]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, dword ds:[rbp + 0x830]
lea edx, [r14 + 5]
mov rcx, qword [0x1402c5110]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rdi + 0x18]
lea r8d, [r14 + 0x10]
mov rcx, qword [rbp + 0x820]
mov r15, rax
lea rax, [rbp + 0x830]
mov r9, r15
mov qword [rsp + 0x28], rax
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], ebx
call fcn.140175600
test eax, eax
js 0x140042c70
cmp word [r15], si
jne 0x140042c59
nop
call sym.SystemInformer.exe_QiReferenceEmptyString
jmp 0x140042c69
shl r14, 4
and ecx, 0xf
add r14, rcx
shr r14, 1
jmp 0x140042aa6
lfence
movzx edx, word [r15]
mov rcx, qword [r15 + 8]
call sym.SystemInformer.exe_QiCreateStringEx
mov rsi, rax
mov qword [rbp - 0x68], rax
mov rcx, qword [0x1402c5110]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x820]
jmp 0x140042de3
mov ebx, dword [0x1402c825c]
mov rax, qword [rdi + 0x10]
lea r9, [rbp + 0x968]
mov qword [rbp + 0x968], rax
lea r8, [rbp - 0x40]
mov eax, 0x30
mov qword [rbp + 0x800], rsi
xorps xmm0, xmm0
mov qword [rbp + 0x970], rsi
lea rcx, [rbp + 0x820]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
lea edx, [rax + 0x10]
mov dword [rbp - 0x28], esi
mov qword [rbp - 0x30], rsi
movdqu xmmword [rbp - 0x20], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140042d0d
cmp ebx, 5
jne 0x140041cc6
lea r8, [rbp + 0x968]
lea edx, [rbx + 0x3b]
lea rcx, [rbp + 0x820]
call fcn.140174cc0
test eax, eax
js 0x140041cc6
mov rdx, qword ds:[rdi + 0x18]
lea r9, [rbp + 0x800]
mov rcx, qword [rbp + 0x820]
mov r8, r14
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov ebx, eax
test eax, eax
jns 0x140042d7d
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x800]
mov rcx, qword [rbp + 0x820]
mov r8, r14
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 1
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov ebx, eax
mov rcx, qword [rbp + 0x820]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140041cc6
mov rcx, qword [rbp + 0x800]
test rcx, rcx
je 0x140042df2
mov r9d, 0x18
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x8e0]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQuerySection]
mov rcx, qword [rbp + 0x800]
lea rdx, [rbp - 0x68]
mov r12d, eax
call fcn.1401805a0
mov rcx, qword [rbp - 0x68]
test eax, eax
cmovs rcx, rsi
mov rsi, rcx
mov qword [rbp - 0x68], rcx
mov rcx, qword [rbp + 0x800]
call qword [sym.imp.ntdll.dll_NtClose]
test r12d, r12d
js 0x140041cc6
mov eax, dword [rbp + 0x8e8]
lea rbx, [0x14023a1f8]
bt eax, 0x1b
jae 0x140042e0e
lea r15, [0x14026c400]
jmp 0x140042e3b
bt eax, 0x17
jae 0x140042e1d
lea r15, [0x14026a2f0]
jmp 0x140042e3b
bt eax, 0x18
jae 0x140042e2c
lea r15, [0x14026c410]
jmp 0x140042e3b
bt eax, 0x1a
lea r15, str.Reserve
cmovae r15, rbx
movzx eax, byte [0x1402c222c]
lea rcx, [rbp + 0xf0]
xor r8d, r8d
mov byte [rbp + 0xfa], al
mov rax, qword [rbp + 0x8f0]
mov dword [rbp + 0xf0], 0x10c
mov qword [rbp + 0x100], rax
lea edx, [r8 + 1]
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov r13, rax
test rsi, rsi
je 0x140042eb9
mov rcx, rsi
call sym.SystemInformer.exe_QiResolveDevicePrefix
mov r12, rax
test rax, rax
je 0x140042eae
lea rcx, ds:[rsi - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140042eab
call fcn.14013fb00
mov rsi, r12
test rsi, rsi
je 0x140042eb9
mov rcx, qword [rsi + 8]
jmp 0x140042ec0
lea rcx, [0x14026c430]
mov eax, dword [rdi + 0xc8]
lea r9, [rbp + 0x20]
mov esi, 1
mov qword [rbp + 0x38], rcx
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x20], esi
mov dword [rbp + 0x28], esi
mov dword [rbp + 0x24], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rdi + 0xc4]
lea r9, [rbp + 0x20]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x24], eax
mov dword [rbp + 0x20], esi
mov dword [rbp + 0x28], esi
mov qword [rbp + 0x38], r15
call qword [sym.imp.USER32.dll_SendMessageW]
test r13, r13
je 0x140042f1e
mov rbx, qword [r13 + 8]
mov eax, dword [rdi + 0xcc]
mov dword [rbp + 0x20], esi
mov dword [rbp + 0x28], esi
mov qword [rbp + 0x38], rbx
jmp 0x140041cac
mov rax, qword ds:[rdi + 0x18]
mov r15, qword [rax + 0x30]
mov rcx, qword [r15]
cmp rcx, 0xc
jne 0x1400431ee
mov r15, qword ds:[r15 + 8]
lea r12, [0x14026c048]
mov r14, rcx
shr r14, 4
test r14, r14
je 0x140042f9c
nop word [rax + rax]
movdqu xmm0, xmmword [r15]
movdqu xmm1, xmmword [r12]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1400431dc
add r15, 0x10
add r12, 0x10
sub r14, 1
jne 0x140042f70
mov r14, rcx
shr r14, 1
and r14d, 7
test r14, r14
je 0x140042fe6
sub r12, r15
nop
movzx ecx, word [r15]
movzx r13d, word [r12 + r15]
cmp cx, r13w
je 0x140042fdc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r13w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1400431ee
add r15, 2
sub r14, 1
jne 0x140042fb0
mov rax, qword [rdi + 0x10]
lea r9, [rbp + 0x968]
mov ebx, dword [0x1402c825c]
lea r8, [rbp - 0x40]
mov qword [rbp + 0x968], rax
lea rcx, [rbp + 0x850]
mov eax, 0x30
mov qword [rbp + 0x800], rsi
xorps xmm0, xmm0
mov qword [rbp + 0x970], rsi
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rsi
lea edx, [rax + 0x10]
mov dword [rbp - 0x28], esi
mov qword [rbp - 0x30], rsi
movdqu xmmword [rbp - 0x20], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
nop dword [rax + rax]
cmp eax, 0xc0000022
jne 0x140043066
cmp ebx, 5
jne 0x140041cc6
lea r8, [rbp + 0x968]
lea edx, [rbx + 0x3b]
lea rcx, [rbp + 0x850]
call fcn.140174cc0
test eax, eax
js 0x140041cc6
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x800]
mov rcx, qword [rbp + 0x850]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r15d, 1
mov dword [rsp + 0x28], esi
mov r8, r14
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x850]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140041cc6
mov rcx, qword [rbp + 0x800]
test rcx, rcx
je 0x140041cc6
lea r9d, [r15 + 7]
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x980]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x14004315b
movsxd rax, dword [rbp + 0x980]
lea rcx, [rbp + 0x8a8]
xor r8d, r8d
mov qword [rbp + 0x8b8], rax
mov edx, r15d
mov dword [rbp + 0x8a8], 0x10009
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov edx, dword [rdi + 0xd0]
mov r8d, r15d
mov rcx, qword [rdi]
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_QiSetListViewSubItem
cmp byte [rbp + 0x985], sil
lea rax, str.True
mov edx, dword [rdi + 0xd4]
lea r9, str.False
mov rcx, qword [rdi]
cmovne r9, rax
mov r8d, r15d
call sym.SystemInformer.exe_QiSetListViewSubItem
mov rcx, qword [rbp + 0x800]
lea r8, [rbp + 0xae0]
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
mov edx, r15d
call qword [sym.imp.ntdll.dll_NtQueryMutant]
nop dword [rax]
test eax, eax
js 0x1400431ca
cmp qword [rbp + 0xae0], rsi
je 0x1400431ca
lea rcx, [rbp + 0xae0]
call sym.SystemInformer.exe_QiGetClientIdName
mov edx, dword [rdi + 0xd8]
mov r8d, r15d
mov rcx, qword [rdi]
mov rbx, rax
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_QiSetListViewSubItem
lea rcx, ds:[rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, r15d
jne 0x1400431ca
call fcn.14013fb00
mov rcx, qword [rbp + 0x800]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140041cc6
shl r14, 4
and ecx, 0xf
add r14, rcx
shr r14, 1
jmp 0x140042fa6
mov rax, qword [rdi + 0x18]
mov r15, qword [rax + 0x30]
mov rcx, qword [r15]
cmp rcx, 0xe
je 0x140043206
xor al, al
jmp 0x14004329b
mov r15, qword [r15 + 8]
lea r12, [0x14026a1f8]
mov r14, rcx
shr r14, 4
test r14, r14
je 0x14004324c
nop dword [rax]
movdqu xmm0, xmmword [r15]
movdqu xmm1, xmmword [r12]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140043447
add r15, 0x10
add r12, 0x10
sub r14, 1
jne 0x140043220
mov r14, rcx
shr r14, 1
and r14d, 7
test r14, r14
je 0x140043299
sub r12, r15
nop
movzx ecx, word [r15]
movzx r13d, word [r15 + r12]
cmp cx, r13w
je 0x14004328f
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r13w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x1400431ff
add r15, 2
sub r14, 1
jne 0x140043260
mov al, 1
nop dword [rax + rax]
test al, al
je 0x140043735
cmp dword [0x1402c825c], 3
mov r15d, 0x103
mov r13, rsi
mov qword [rbp - 0x78], rsi
jl 0x1400434a5
mov r8, qword [rdi + 0x10]
lea rcx, [rbp + 0x838]
mov edx, 0x1000
call sym.SystemInformer.exe_QiOpenProcess
nop dword [rax + rax]
test eax, eax
js 0x1400434a5
mov rcx, qword [0x1402c5110]
lea r8d, ds:[r15 - 3]
mov edx, 4
mov dword [rbp + 0x834], esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0xa30]
mov rcx, qword [rbp + 0x838]
mov r8d, 4
mov qword [rsp + 0x28], rsi
mov rbx, rax
mov dword [rsp + 0x20], 0x30
mov rdx, qword [rdx + 0x10]
call fcn.140175600
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x9b8]
mov rcx, qword [rbp + 0x838]
test eax, eax
mov r12d, r15d
mov qword [rsp + 0x28], rsi
cmovns r12d, dword [rbp + 0xa30]
mov r8d, 9
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x20
call fcn.140175600
mov rdx, qword [rdi + 0x18]
mov esi, eax
mov rcx, qword [rbp + 0x838]
lea rax, [rbp + 0x834]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov r8d, 0xb
shr esi, 0x1f
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x100
call fcn.140175600
mov r14, 0xffffffffffffffff
cmp eax, 0xc0000023
jne 0x140043432
nop word [rax + rax]
cmp dword [rbp + 0x834], r13d
jbe 0x140043490
mov rcx, qword [0x1402c5110]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, dword [rbp + 0x834]
lea edx, [r14 + 5]
mov rcx, qword [0x1402c5110]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rdi + 0x18]
lea r8d, [r14 + 0xc]
mov rcx, qword [rbp + 0x838]
mov qword [rbp + 0x988], rax
lea rax, [rbp + 0x834]
mov qword [rsp + 0x28], rax
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], ebx
mov rbx, qword [rbp + 0x988]
mov r9, rbx
call fcn.140175600
test eax, eax
js 0x140043490
cmp word [rbx], r13w
jne 0x140043459
nop dword [rax]
call sym.SystemInformer.exe_QiReferenceEmptyString
jmp 0x140043468
shl r14, 4
and ecx, 0xf
add r14, rcx
shr r14, 1
jmp 0x140043256
lfence
movzx edx, word [rbx]
mov rcx, qword [rbx + 8]
call sym.SystemInformer.exe_QiCreateStringEx
mov rcx, rax
mov rbx, rax
call sym.SystemInformer.exe_QiGetFileName
mov r13, rax
lea rcx, [rbx - 0x10]
mov edx, r14d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14004348c
call fcn.14013fb00
mov qword [rbp - 0x78], r13
mov rcx, qword [rbp + 0x838]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax]
jmp 0x1400435cc
mov r8, qword ds:[rdi + 0x10]
lea rcx, [rbp + 0x838]
mov edx, 0x40
mov qword [rbp + 0x860], rsi
call sym.SystemInformer.exe_QiOpenProcess
test eax, eax
js 0x140041cc6
mov rdx, qword ds:[rdi + 0x18]
lea r9, [rbp + 0x860]
mov rcx, qword [rbp + 0x838]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x838]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140041cc6
mov rcx, qword [rbp + 0x860]
test rcx, rcx
je 0x140041cc6
lea rdx, [rbp - 0x78]
call sym.SystemInformer.exe_QiGetProcessImageFileName
test eax, eax
js 0x140043565
mov rbx, qword [rbp - 0x78]
mov rcx, rbx
call sym.SystemInformer.exe_QiGetFileName
mov r13, rax
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14004355f
call fcn.14013fb00
mov qword [rbp - 0x78], r13
jmp 0x140043569
mov r13, qword [rbp - 0x78]
mov rcx, qword [rbp + 0x860]
lea r8, [rbp + 0xa30]
mov r9d, 0x30
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rcx, qword [rbp + 0x860]
lea r8, [rbp + 0x9b8]
mov r9d, 0x20
mov qword [rsp + 0x20], rsi
test eax, eax
mov r12d, r15d
cmovns r12d, dword [rbp + 0xa30]
lea edx, [r9 - 0x1c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rcx, qword [rbp + 0x860]
mov esi, eax
call qword [sym.imp.ntdll.dll_NtClose]
shr esi, 0x1f
xor sil, 1
mov ebx, 1
test r13, r13
je 0x140043605
mov r9, qword [r13 + 8]
mov r8d, ebx
mov edx, dword [rdi + 0xe8]
mov rcx, qword [rdi]
call sym.SystemInformer.exe_QiSetListViewSubItem
lea rcx, [r13 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, ebx
jne 0x140043605
nop
call fcn.14013fb00
test sil, sil
je 0x140043695
lea rdx, ds:[rbp + 0x9b8]
lea rcx, [rbp + 0x9a8]
call sym.SystemInformer.exe_QiLargeIntegerToLocalSystemTime
lea rcx, [rbp + 0x9a8]
call sym.SystemInformer.exe_QiFormatDateTime
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov edx, dword [rdi + 0xec]
mov r8d, ebx
mov rcx, qword [rdi]
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_QiSetListViewSubItem
cmp r12d, r15d
je 0x140041cc6
lea rdx, [rbp + 0x9c0]
lea rcx, [rbp + 0x9a8]
call sym.SystemInformer.exe_QiLargeIntegerToLocalSystemTime
lea rcx, [rbp + 0x9a8]
call sym.SystemInformer.exe_QiFormatDateTime
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov edx, dword [rdi + 0xf0]
mov r8d, ebx
mov rcx, qword [rdi]
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_QiSetListViewSubItem
jmp 0x14004369e
cmp r12d, r15d
je 0x140041cc6
xor edx, edx
mov ecx, r12d
call sym.SystemInformer.exe_QiGetStatusMessage
mov rsi, rax
test rax, rax
je 0x1400436b6
mov rbx, qword [rax + 8]
jmp 0x1400436bd
lea rbx, [0x14023a1f8]
mov r8, rbx
lea rcx, str.0x_x___s_
mov edx, r12d
call sym.SystemInformer.exe_QiFormatString
mov rbx, rax
test rax, rax
je 0x1400436dd
mov r9, qword [rax + 8]
jmp 0x1400436e4
lea r9, [0x1402332cc]
mov edx, dword [rdi + 0xf4]
mov r8d, 1
mov rcx, qword [rdi]
call sym.SystemInformer.exe_QiSetListViewSubItem
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14004370e
call fcn.14013fb00
test rsi, rsi
je 0x140041cc6
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140041cc6
call fcn.14013fb00
jmp 0x140041cc6
mov rax, qword [rdi + 0x18]
lea rcx, str.Thread
mov qword [rbp + 0xae8], rcx
lea rdx, [rbp + 0xae0]
mov r8b, 1
mov qword [rbp + 0xae0], 0xc
mov rcx, qword [rax + 0x30]
call sym.SystemInformer.exe_QiEqualStringRef
test al, al
je 0x140041cc6
xor bl, bl
mov qword [rbp - 0x70], rsi
cmp dword [0x1402c825c], 3
mov r13, rsi
mov byte [rsp + 0x54], bl
mov r15d, 0x103
mov r14, 0xffffffffffffffff
jl 0x140043989
mov r8, qword [rdi + 0x10]
lea rcx, [rbp + 0x828]
mov edx, 0x1000
call sym.SystemInformer.exe_QiOpenProcess
test eax, eax
js 0x140043989
mov rcx, qword [0x1402c5110]
lea edx, [r14 + 5]
lea r8d, [r15 - 3]
mov dword [rbp + 0x810], esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rdi + 0x18]
lea r8d, [r14 + 0xd]
mov rcx, qword [rbp + 0x828]
mov r12, rax
lea rax, [rbp + 0x810]
mov r9, r12
mov qword [rsp + 0x28], rax
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x100
call fcn.140175600
nop
cmp eax, 0xc0000023
jne 0x140043876
cmp dword [rbp + 0x810], esi
jbe 0x1400438ac
mov rcx, qword [0x1402c5110]
mov r8, r12
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, dword ds:[rbp + 0x810]
lea edx, [r14 + 5]
mov rcx, qword [0x1402c5110]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [rdi + 0x18]
lea r8d, [r14 + 0xd]
mov rcx, qword [rbp + 0x828]
mov r12, rax
lea rax, [rbp + 0x810]
mov r9, r12
mov qword [rsp + 0x28], rax
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], ebx
call fcn.140175600
xor bl, bl
test eax, eax
js 0x1400438ac
nop word [rax + rax]
cmp word [r12], si
jne 0x14004388e
call sym.SystemInformer.exe_QiReferenceEmptyString
jmp 0x1400438a5
lfence
movzx edx, word [r12]
mov rcx, qword [r12 + 8]
call sym.SystemInformer.exe_QiCreateStringEx
mov r13, rax
mov qword [rbp - 0x70], rax
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x998]
mov rcx, qword [rbp + 0x828]
mov r8d, 0xd
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 4
mov rdx, qword [rdx + 0x10]
call fcn.140175600
test eax, eax
js 0x140043929
mov eax, dword [rbp + 0x998]
test eax, eax
setne bl
mov byte [rsp + 0x54], bl
test eax, eax
je 0x140043929
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0xa80]
mov rcx, qword [rbp + 0x828]
mov r8d, 5
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x30
mov rdx, qword [rdx + 0x10]
call fcn.140175600
test eax, eax
cmovns r15d, dword [rbp + 0xa80]
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x9d8]
mov rcx, qword [rbp + 0x828]
mov r8d, 0xa
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x20
mov rdx, qword [rdx + 0x10]
call fcn.140175600
mov rcx, qword [0x1402c5110]
mov r8, r12
xor edx, edx
mov dword [rsp + 0x50], eax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x828]
call qword [sym.imp.ntdll.dll_NtClose]
mov r12d, dword [rsp + 0x50]
mov esi, 1
jmp 0x140043ad3
mov r8, qword [rdi + 0x10]
lea rcx, [rbp + 0x828]
mov edx, 0x40
mov qword [rbp + 0x858], rsi
call sym.SystemInformer.exe_QiOpenProcess
test eax, eax
js 0x140041cc6
mov rdx, qword [rdi + 0x18]
lea r9, [rbp + 0x858]
mov rcx, qword [rbp + 0x828]
mov r8, r14
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x800
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x828]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140041cc6
mov rcx, qword ds:[rbp + 0x858]
test rcx, rcx
je 0x140043ba9
lea rdx, [rbp - 0x70]
call fcn.14016b520
test eax, eax
js 0x140043a30
mov rcx, qword [rbp - 0x70]
mov eax, r14d
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140043a30
call fcn.14013fb00
mov rcx, qword [rbp + 0x858]
lea r8, [rbp + 0x960]
mov r9d, 4
mov qword [rsp + 0x20], rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x140043a97
mov eax, dword [rbp + 0x960]
test eax, eax
setne bl
mov byte [rsp + 0x54], bl
test eax, eax
je 0x140043a99
mov rcx, qword [rbp + 0x858]
lea r8, [rbp + 0xab0]
mov r9d, 0x30
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
cmovns r15d, dword [rbp + 0xab0]
jmp 0x140043a99
xor bl, bl
mov rcx, qword [rbp + 0x858]
lea r8, [rbp + 0x9d8]
mov qword [rsp + 0x20], rsi
mov r9d, 0x20
mov esi, 1
mov edx, esi
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov rcx, qword [rbp + 0x858]
mov r12d, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov r13, qword [rbp - 0x70]
test r13, r13
je 0x140043b05
mov r9, qword [r13 + 8]
mov r8d, esi
mov edx, dword [rdi + 0xe8]
mov rcx, qword [rdi]
call sym.SystemInformer.exe_QiSetListViewSubItem
lea rcx, [r13 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140043b05
nop
call fcn.14013fb00
test bl, bl
je 0x140043b9a
xor edx, edx
mov ecx, r15d
call sym.SystemInformer.exe_QiGetStatusMessage
mov rsi, rax
test rax, rax
je 0x140043b25
mov rbx, qword [rax + 8]
jmp 0x140043b2c
lea rbx, [0x14023a1f8]
mov r8, rbx
lea rcx, str.0x_x___s_
mov edx, r15d
call sym.SystemInformer.exe_QiFormatString
mov rbx, rax
test rax, rax
je 0x140043b4c
mov r9, qword [rax + 8]
jmp 0x140043b53
lea r9, [0x1402332cc]
mov edx, dword [rdi + 0xf4]
mov r8d, 1
mov rcx, qword [rdi]
call sym.SystemInformer.exe_QiSetListViewSubItem
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140043b7d
call fcn.14013fb00
nop dword [rax]
test rsi, rsi
je 0x140043b9a
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140043b9a
call fcn.14013fb00
nop word [rax + rax]
test r12d, r12d
js 0x140041cc6
lea rdx, [rbp + 0x9d8]
lea rcx, [rbp + 0x968]
call sym.SystemInformer.exe_QiLargeIntegerToLocalSystemTime
lea rcx, [rbp + 0x968]
call sym.SystemInformer.exe_QiFormatDateTime
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov edx, dword [rdi + 0xec]
mov ebx, 1
mov rcx, qword [rdi]
mov r8d, ebx
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_QiSetListViewSubItem
cmp byte [rsp + 0x54], 0
je 0x140041cc6
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0x968]
call sym.SystemInformer.exe_QiLargeIntegerToLocalSystemTime
lea rcx, [rbp + 0x968]
call sym.SystemInformer.exe_QiFormatDateTime
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov edx, dword [rdi + 0xf0]
mov r8d, ebx
mov rcx, qword [rdi]
mov r9, qword [rax + 8]
call sym.SystemInformer.exe_QiSetListViewSubItem
jmp 0x140041cc6