Function at 0x1400a1120
Capabilities:
Check processdebugport

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push r12
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
cmp qword [rcx + 0x20], 0
mov r15, rcx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x28], rsi
mov qword [rax - 0x30], rdi
mov qword [rax - 0x38], r13
mov rax, qword [rdx + 0x58]
mov qword [rcx + 0x28], rax
mov eax, dword [rdx + 0x64]
mov dword [rcx + 0x38], eax
mov rax, qword [rdx + 0x20]
mov qword [rcx + 0x40], rax
je 0x1400a11c7
movzx eax, word [rdx + 0x38]
xor r12d, r12d
test ax, ax
jne 0x1400a1185
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x1400a121f
mov rsi, qword [rdx + 0x40]
lea rcx, [rax + 0x12]
mov rdx, qword [0x140213b58]
mov rdi, rax
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], r12w
test rsi, rsi
je 0x1400a121f
mov rcx, qword ds:[rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.140165120
jmp 0x1400a121f
mov rdx, qword [0x140213b58]
mov ecx, 0x38
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], 0x26
add rax, 0x10
mov qword [rbx + 8], rax
xor r12d, r12d
mov word [rax + 0x26], r12w
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.System_Idle_Process]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401b48e0]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x1401b48f0]
mov dword [rcx + 0x20], eax
movzx eax, word [0x1401b48f4]
mov word [rcx + 0x24], ax
mov qword [r15 + 0x30], rbx
mov rax, qword [r15 + 0x20]
test rax, rax
jle 0x1400a1368
lea rdx, ds:[r15 + 0xf8]
mov r8d, 0xa
mov ecx, eax
call fcn.1401659e8
mov ecx, dword [r15 + 0x28]
lea rdx, [r15 + 0x112]
mov r8d, 0xa
call fcn.1401659e8
mov ecx, dword [r15 + 0x38]
lea rdx, [r15 + 0x12c]
mov r8d, 0xa
call fcn.1401659e8
mov rax, qword [r15 + 0x20]
test rax, rax
jle 0x1400a1368
cmp byte [0x1402130ef], 0
lea rcx, [r15 + 0x48]
mov qword [rbp - 0x39], rax
mov edx, 0x400
mov qword [rbp - 0x31], r12
jne 0x1400a12df
xorps xmm0, xmm0
mov dword [rbp - 0x29], 0x30
lea r9, [rbp - 0x39]
mov qword [rbp - 0x21], r12
lea r8, [rbp - 0x29]
mov dword [rbp - 0x11], r12d
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp - 0x19], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400a12e8
cmp byte [0x1402130ef], 0
je 0x1400a12f7
mov edx, 0x400
lea rcx, [r15 + 0x48]
lea r8, [rbp - 0x39]
call fcn.140123530
test eax, eax
js 0x1400a12f7
or dword [r15 + 0xd0], 0x80
cmp qword [r15 + 0x48], 0
jne 0x1400a1368
cmp byte [0x1402130ef], 0
mov rax, qword [r15 + 0x20]
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], r12
jne 0x1400a1356
xorps xmm0, xmm0
mov dword [rbp - 0x29], 0x30
lea r9, [rbp - 0x39]
mov qword [rbp - 0x21], r12
lea r8, [rbp - 0x29]
mov dword [rbp - 0x11], r12d
mov edx, 0x1000
mov qword [rbp - 0x19], r12
lea rcx, [r15 + 0x48]
movdqu xmmword [rbp - 9], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400a1368
cmp byte [0x1402130ef], 0
je 0x1400a1368
lea r8, [rbp - 0x39]
mov edx, 0x1000
lea rcx, [r15 + 0x48]
call fcn.140123530
mov rcx, qword [r15 + 0x48]
test rcx, rcx
je 0x1400a13be
mov r9d, 0x40
mov qword [rbp - 0x29], 0x40
lea r8, [rbp - 0x29]
mov qword [rsp + 0x20], r12
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400a13be
mov eax, dword [rbp + 0xf]
mov ecx, eax
and dword [r15 + 0xd0], 0xfffe3dff
and ecx, 1
shl ecx, 6
and eax, 0x182
or ecx, eax
or ecx, 8
shl ecx, 8
or dword [r15 + 0xd0], ecx
mov rcx, qword [r15 + 0x20]
mov r13d, 4
mov qword [rsp + 0x88], r14
cmp rcx, r13
je 0x1400a153f
nop dword [rax]
test rcx, rcx
jle 0x1400a155a
lea rdx, [rbp + 0x67]
mov qword [rbp + 0x67], r12
call sym.ProcessHacker.exe_PhGetProcessImageFileNameByProcessId
test eax, eax
js 0x1400a1402
mov rax, qword [rbp + 0x67]
mov qword [r15 + 0x58], rax
mov rbx, qword [r15 + 0x48]
test rbx, rbx
je 0x1400a1534
test dword ds:[r15 + 0xd0], 0x10000
nop
jne 0x1400a1534
xor r9d, r9d
mov dword [rbp + 0x67], r12d
lea rax, [rbp + 0x67]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x2b]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, 0x80000005
je 0x1400a146e
cmp eax, 0xc0000023
je 0x1400a146e
cmp eax, 0xc0000004
je 0x1400a146e
nop dword [rax + rax]
test eax, eax
js 0x1400a1534
mov rdi, qword [rbp + 0x6f]
jmp 0x1400a14af
mov r8d, dword ds:[rbp + 0x67]
mov edx, r13d
mov rcx, qword [0x140213cd0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r9d, dword [rbp + 0x67]
mov edx, 0x2b
mov rdi, rax
mov rcx, rbx
lea rax, [rbp + 0x67]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400a1522
movzx eax, word [rdi]
test ax, ax
jne 0x1400a14c2
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x1400a1505
mov rdx, qword [0x140213b58]
lea rcx, [rax + 0x12]
mov r14, qword [rdi + 8]
mov rsi, rax
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rsi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rsi], r12w
test r14, r14
je 0x1400a1505
mov rcx, qword ds:[rbx + 8]
mov r8, rsi
mov rdx, r14
call fcn.140165120
mov rcx, qword [0x140213cd0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test rbx, rbx
je 0x1400a1534
mov qword [r15 + 0x50], rbx
jmp 0x1400a155a
mov rcx, qword [0x140213cd0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [r15 + 0x58]
test rcx, rcx
je 0x1400a155a
jmp 0x1400a1551
nop
call sym.ProcessHacker.exe_PhGetKernelFileName
test rax, rax
je 0x1400a155a
mov qword [r15 + 0x58], rax
mov rcx, rax
call sym.ProcessHacker.exe_PhGetFileName
mov qword [r15 + 0x50], rax
mov rbx, qword [r15 + 0x48]
mov esi, 8
test rbx, rbx
je 0x1400a1705
cmp qword [r15 + 0x20], r13
je 0x1400a1705
cmp byte [0x1402130ef], 0
lea r8, [rbp + 0x7f]
mov edx, esi
mov rcx, rbx
jne 0x1400a15af
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, 0xc0000022
jne 0x1400a15b4
cmp byte [0x1402130ef], 0
nop dword [rax]
je 0x1400a176c
lea r8, [rbp + 0x7f]
mov edx, esi
mov rcx, rbx
call fcn.140123650
test eax, eax
js 0x1400a176c
mov rcx, qword [rbp + 0x7f]
lea r8, [rbp + 0x77]
mov edx, 1
call fcn.14011a800
test eax, eax
js 0x1400a1635
mov r14, qword [rbp + 0x77]
mov rcx, qword [r14]
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [0x140213cd0]
mov edx, r13d
mov rsi, qword [r14]
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.140165120
mov qword [r15 + 0x98], rbx
mov rcx, qword [r14]
call fcn.1400a0660
mov rcx, qword [0x140213cd0]
mov r8, r14
xor edx, edx
mov qword [r15 + 0x368], rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, 8
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x77]
mov r9d, r13d
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x67]
mov edx, 0x12
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x1400a167a
and dword [r15 + 0xd0], 0xfffffff7
mov eax, r12d
mov ecx, dword [rbp + 0x67]
cmp ecx, 2
mov dword [r15 + 0xa0], ecx
cmove eax, esi
or dword [r15 + 0xd0], eax
mov rcx, qword [rbp + 0x7f]
lea r8, [rbp - 0x39]
lea rdx, [rbp + 0x77]
call sym.ProcessHacker.exe_PhGetTokenIntegrityLevelRID
test eax, eax
js 0x1400a16f5
mov eax, dword [rbp + 0x77]
cmp eax, 0x3000
jg 0x1400a16cf
je 0x1400a16c7
nop
test eax, eax
je 0x1400a16c2
cmp eax, 0x1000
je 0x1400a16ba
cmp eax, 0x2000
jne 0x1400a16f5
mov r13d, 2
jmp 0x1400a16e3
mov r13d, 1
jmp 0x1400a16e3
mov r13d, r12d
jmp 0x1400a16e3
mov r13d, 3
jmp 0x1400a16e3
cmp eax, 0x4000
je 0x1400a16e3
cmp eax, 0x5000
jne 0x1400a16f5
mov r13d, 5
mov rax, qword [rbp - 0x39]
mov qword [r15 + 0xa8], rax
mov dword [r15 + 0xa4], r13d
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtClose]
nop
jmp 0x1400a176c
mov rax, qword [r15 + 0x20]
test rax, rax
je 0x1400a1713
cmp rax, r13
jne 0x1400a176c
lea rcx, [0x14020ae28]
nop word [rax + rax]
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [0x140213cd0]
mov edx, r13d
mov r8d, eax
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, edi
lea rdx, [0x14020ae28]
mov rcx, rax
mov rbx, rax
call fcn.140165120
lea rcx, [0x14020ae28]
mov qword ds:[r15 + 0x98], rbx
call fcn.1400a0660
mov qword [r15 + 0x368], rax
mov rdx, qword [r15 + 0x50]
mov rcx, qword [r15 + 0x20]
call sym.ProcessHacker.exe_PhGetProcessKnownTypeEx
mov rcx, qword [r15 + 0x48]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa8]
mov dword [r15 + 0x378], eax
test rcx, rcx
je 0x1400a17fb
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
jb 0x1400a17dc
mov r9d, 1
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x67]
lea edx, [r9 + 0x3c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400a1803
movzx eax, byte [rbp + 0x67]
mov byte [r15 + 0x37c], al
jmp 0x1400a1803
test dword [r15 + 0xd0], 0x4000
je 0x1400a1803
and byte [r15 + 0x37c], 0xfa
or byte [r15 + 0x37c], 2
jmp 0x1400a1803
mov byte [r15 + 0x37c], 0xff
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
jb 0x1400a1855
mov rcx, qword [r15 + 0x48]
test rcx, rcx
je 0x1400a1855
mov r9d, esi
mov dword [rbp + 0x67], 7
lea r8, [rbp + 0x67]
mov qword [rsp + 0x20], r12
mov edx, 0x34
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400a1855
movzx eax, byte [rbp + 0x6b]
and dword [r15 + 0xd0], 0xfffdffff
and al, 1
movzx eax, al
shl eax, 0x11
or dword [r15 + 0xd0], eax
mov rax, qword [rbp + 0x6f]
mov rsi, qword [rsp + 0xa0]
cmp dword [rax + 4], 0
jne 0x1400a187a
mov rcx, qword [r15 + 0x48]
test rcx, rcx
je 0x1400a187a
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [r15 + 0x48], r12
add rsp, 0xb0
pop r15
pop r12
pop rbp
ret