Function at 0x14003f480
Capabilities:
Map section object

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
push r13
lea rbp, [r11 - 0x48]
sub rsp, 0x128
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, qword [rdx + 0x10]
mov r12, rdx
mov qword [rbp - 0x80], rcx
mov r13, rcx
test rsi, rsi
je 0x140040361
mov rcx, qword ds:[rsi]
test rcx, rcx
je 0x140040361
mov qword ds:[r11 + 0x18], rbx
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
cmp rcx, 8
jne 0x14003f59a
mov rsi, qword ds:[rsi + 8]
lea r14, [0x14026e9c0]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003f536
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003f58b
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003f510
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14003f7c6
sub r14, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003f578
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003f59a
add rsi, 2
sub rdi, 1
jne 0x14003f550
jmp 0x14003f7c6
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003f53f
mov rsi, qword [r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 6
jne 0x14003f65a
mov rsi, qword ds:[rsi + 8]
lea r14, [0x14026e9b8]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003f5f6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003f64b
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003f5d0
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14003f7c6
sub r14, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003f638
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003f65a
add rsi, 2
sub rdi, 1
jne 0x14003f610
jmp 0x14003f7c6
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003f5ff
mov rsi, qword [r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 0x16
jne 0x14003f71a
mov rsi, qword ds:[rsi + 8]
lea r14, str.Mapped_file
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003f6b6
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003f70b
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003f690
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14003f7c6
sub r14, rsi
nop dword [rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003f6f8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003f71a
add rsi, 2
sub rdi, 1
jne 0x14003f6d0
jmp 0x14003f7c6
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003f6bf
mov rsi, qword [r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 0x18
jne 0x14003f83d
mov rsi, qword ds:[rsi + 8]
lea r14, str.Mapped_image
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003f77a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003f7f7
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003f750
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14003f7c6
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003f7bc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003f83d
add rsi, 2
sub rdi, 1
jne 0x14003f790
mov r8, qword [r12 + 0x18]
mov rcx, r13
test r8, r8
je 0x14003f809
mov r8, qword [r8 + 8]
lea rax, str.Make_sure_the_Explorer_executable_file_is_present.
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea rdx, str.FileBrowseExecutable
call sym.SystemInformer.exe_PhShellExecuteUserString
jmp 0x140040341
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003f783
lea rax, str.The_object_is_unnamed.
mov edx, 0x20
mov qword [rsp + 0x28], rax
lea r15, [0x14023b2dc]
lea r9, str.Unable_to_open_the_file_location.
mov qword [rsp + 0x20], r15
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
jmp 0x140040341
mov rsi, qword [r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 6
jne 0x14003f945
mov rsi, qword [rsi + 8]
lea r14, [0x14026fe20]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003f896
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003f8fd
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003f870
mov rdi, rcx
shr rdi, 1
and edi, 7
nop
test rdi, rdi
je 0x14003f8e6
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003f8d8
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003f945
add rsi, 2
sub rdi, 1
jne 0x14003f8b0
mov rdx, qword [r12 + 0x18]
mov rcx, r13
test rdx, rdx
je 0x14003f90c
call sym.SystemInformer.exe_PhShellOpenKey2
jmp 0x140040341
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003f89f
lea rax, str.The_object_is_unnamed.
mov edx, 0x20
mov qword [rsp + 0x28], rax
lea r15, [0x14023b2dc]
lea r9, str.Unable_to_open_key.
mov qword [rsp + 0x20], r15
mov r8d, 0xfffe
call sym.SystemInformer.exe_PhShowMessage2
nop dword [rax + rax]
jmp 0x140040341
mov rsi, qword [r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14003fb30
mov rsi, qword [rsi + 8]
lea r14, [0x14026e8c8]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003f99a
nop
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003fa4c
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003f970
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14003f9e6
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003f9dc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14003fb30
add rsi, 2
sub rdi, 1
jne 0x14003f9b0
xor edi, edi
mov edx, 0x1000
cmp dword [0x1402ced08], 3
jl 0x14003fa5e
mov rax, qword [r12]
lea r8, [rbp - 0x80]
lea rcx, [rsp + 0x70]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdi
call fcn.1401783e0
test eax, eax
js 0x140040341
mov rdx, qword [r12 + 8]
lea r9, [rbp - 0x70]
mov rcx, qword [rsp + 0x70]
mov r8d, 4
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x30
call fcn.140178d20
mov rcx, qword [rsp + 0x70]
test eax, eax
cmovns rdi, qword [rbp - 0x50]
jmp 0x14003faa1
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003f9a3
mov r9, qword [r12 + 8]
lea rcx, [rsp + 0x68]
mov r8, qword [r12]
call fcn.14003f340
test eax, eax
js 0x140040341
mov rcx, qword [rsp + 0x68]
lea r8, [rbp - 0x40]
mov r9d, 0x30
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rcx, qword [rsp + 0x68]
test eax, eax
cmovns rdi, qword [rbp - 0x20]
call qword [sym.imp.ntdll.dll_NtClose]
test rdi, rdi
je 0x140040341
mov rcx, rdi
call sym.SystemInformer.exe_PhReferenceProcessItem
mov rbx, rax
test rax, rax
je 0x14003faf9
mov r8, rax
xor edx, edx
mov ecx, 1
call sym.SystemInformer.exe_PhPluginInvokeWindowCallback
lea rcx, [rbx - 0x10]
mov r14, 0xffffffffffffffff
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140040341
call fcn.140142200
jmp 0x140040341
lea rax, str.The_process_does_not_exist.
mov edx, 0x20
mov qword [rsp + 0x28], rax
lea r15, [0x14023b2dc]
lea r9, str.Unable_to_show_the_process_properties.
mov qword [rsp + 0x20], r15
mov r8d, 0xfffe
mov rcx, r13
call sym.SystemInformer.exe_PhShowMessage2
jmp 0x140040341
mov rsi, qword ds:[r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 0xe
jne 0x14004010e
mov rsi, qword ds:[rsi + 8]
lea r14, [0x14026fe68]
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14003fb9a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003fd0f
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x14003fb70
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x14003fbe6
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x14003fbdc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x14004010e
add rsi, 2
sub rdi, 1
jne 0x14003fbb0
mov r9, qword [r12 + 8]
lea rcx, [rsp + 0x60]
mov r8, qword [r12]
xor edi, edi
mov edx, 7
mov qword [rsp + 0x60], rdi
xor bl, bl
call fcn.14003f340
mov esi, eax
test eax, eax
jns 0x14003fc29
mov r9, qword [r12 + 8]
lea rcx, [rsp + 0x60]
mov r8, qword [r12]
mov edx, 5
call fcn.14003f340
mov esi, eax
mov bl, 1
mov rdx, qword ds:[rsp + 0x60]
lea r15, [0x14023b2dc]
mov r14, 0xffffffffffffffff
test rdx, rdx
je 0x140040035
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rdi
mov r8d, 0xffffffff
mov qword [rsp + 0x28], rdi
mov rcx, r14
mov qword [rsp + 0x20], rax
xor r12b, r12b
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], 0x2000000
mov qword [rsp + 0x70], rdi
call sym.SystemInformer.exe_PhGetHandleInformationEx
test eax, eax
js 0x14003fcce
nop dword [rax]
cmp dword [rsp + 0x50], edi
jge 0x14003fcce
lfence
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rdi
test rcx, rcx
je 0x14003fcce
add rcx, 0xfffffffffffffff0
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003fcce
call fcn.140142200
mov rcx, qword [rsp + 0x60]
lea r8, [rbp - 0x70]
mov r9d, 0x18
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQuerySection]
mov esi, eax
test eax, eax
js 0x140040005
mov rax, qword ds:[rbp - 0x60]
cmp rax, 0x2000000
jg 0x14003fd25
mov qword [rsp + 0x68], rax
jmp 0x14003fd28
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x14003fba3
mov r12b, 1
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
movzx eax, bl
xor r9d, r9d
xor eax, 1
mov rdx, r14
lea eax, [rax*2 + 2]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov esi, eax
cmp eax, 0xc000004e
jne 0x14003fdc8
nop dword [rax + rax]
test bl, bl
jne 0x14003ff53
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x70]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], 2
mov rdx, r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov esi, eax
mov eax, esi
test esi, esi
js 0x14003ff45
mov rcx, qword [0x1402cba10]
mov edx, 4
mov r8d, 0x38
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r13, rax
test r12b, r12b
je 0x14003fe0a
mov rcx, qword [rbp - 0x80]
lea r9, str.The_section_size_is_greater_than_32_MB._Only_the_first_32_MB_will_be_available.
mov r8, r15
mov edx, 0x30
call sym.SystemInformer.exe_PhShowMessage
xor eax, eax
xorps xmm0, xmm0
movups xmmword [r13], xmm0
movups xmmword [r13 + 0x10], xmm0
movups xmmword [r13 + 0x20], xmm0
mov qword [r13 + 0x30], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x40]
mov qword [r13 + 8], rcx
mov rax, qword [rsp + 0x70]
mov qword [r13 + 0x10], rax
mov rax, qword [rsp + 0x68]
mov qword [r13 + 0x18], rax
mov rax, qword [rsp + 0x58]
mov dword [r13 + 0x20], 0xffffffff
test rax, rax
je 0x14003fe6f
mov rdx, qword [rax + 8]
lea rcx, str.Section__
call sym.SystemInformer.exe_PhConcatStrings2
mov r12, rax
jmp 0x14003ff1f
lea rdx, [0x14026fe68]
xorps xmm1, xmm1
mov rbx, rdx
mov rcx, rdx
and rbx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14003fea6
pcmpeqw xmm0, xmmword [rbx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x50], ecx
je 0x14003fea2
mov ebx, ecx
shr rbx, 1
jmp 0x14003fee7
add rbx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rbx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x50], ecx
jne 0x14003fed9
nop word [rax + rax]
add rbx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rbx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x50], ecx
je 0x14003fec0
sub rbx, rdx
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x1402cb8c0]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov r8, rbx
lea rdx, [0x14026fe68]
mov r12, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rbx + rcx], di
mov rcx, qword [rax + 8]
call fcn.14020be40
mov r8, r13
mov qword [r13 + 0x28], r12
xor edx, edx
mov dword [r13 + 0x30], 1
mov ecx, 6
call sym.SystemInformer.exe_PhPluginInvokeWindowCallback
mov r13, qword ds:[rbp - 0x80]
jmp 0x140040005
cmp eax, 0xc0000022
je 0x14003ff7e
cmp eax, 0xc0000005
je 0x14003ff7e
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14003ff6c
movzx eax, si
jmp 0x14003ff89
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14003ff8d
mov eax, esi
jmp 0x14003ff89
lfence
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14003ff99
lfence
mov ecx, esi
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14003ffa5
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r9, str.Unable_to_map_a_view_of_the_section.
mov rbx, rax
mov rcx, r13
test rax, rax
je 0x14003fff6
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
mov qword [rsp + 0x20], r15
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140040005
lfence
call fcn.140142200
jmp 0x140040005
mov r8, r15
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14004002a
lea rcx, ds:[rax - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14004002a
call fcn.140142200
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x140040341
nop dword [rax]
cmp esi, 0xc0000022
je 0x140040075
cmp esi, 0xc0000005
je 0x140040075
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140040063
movzx eax, si
jmp 0x140040086
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14004008a
mov eax, esi
jmp 0x140040086
lfence
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x140040096
lfence
mov ecx, esi
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x1400400a5
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
lea r9, str.Unable_to_query_the_section.
mov rbx, rax
mov rcx, r13
test rax, rax
je 0x1400400fc
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
mov qword [rsp + 0x20], r15
call sym.SystemInformer.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140040341
lfence
call fcn.140142200
jmp 0x140040341
mov r8, r15
mov edx, 0x10
call sym.SystemInformer.exe_PhShowMessage
jmp 0x140040341
mov rsi, qword ds:[r12 + 0x10]
mov rcx, qword [rsi]
cmp rcx, 0xc
jne 0x140040341
mov rsi, qword ds:[rsi + 8]
lea r14, str.Thread
mov rdi, rcx
shr rdi, 4
test rdi, rdi
je 0x14004017a
nop word [rax + rax]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [r14]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14004023b
add rsi, 0x10
add r14, 0x10
sub rdi, 1
jne 0x140040150
mov rdi, rcx
shr rdi, 1
and edi, 7
test rdi, rdi
je 0x1400401c6
sub r14, rsi
nop dword [rax + rax]
movzx ecx, word [rsi]
movzx r15d, word [rsi + r14]
cmp cx, r15w
je 0x1400401bc
nop
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, r15w
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp bx, ax
jne 0x140040341
add rsi, 2
sub rdi, 1
jne 0x140040190
cmp dword [0x1402ced08], 3
movaps xmmword [rsp + 0x100], xmm6
xorps xmm6, xmm6
jl 0x14004024d
mov rax, qword [r12]
lea r8, [rsp + 0x70]
xor edi, edi
mov qword [rsp + 0x70], rax
mov edx, 0x1000
mov qword [rsp + 0x78], rdi
lea rcx, [rbp - 0x80]
call fcn.1401783e0
nop dword [rax]
test eax, eax
js 0x140040339
mov rdx, qword [r12 + 8]
lea r9, [rbp - 0x40]
mov rcx, qword [rbp - 0x80]
mov r8d, 5
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x30
call fcn.140178d20
test eax, eax
js 0x140040235
movups xmm6, xmmword [rbp - 0x30]
mov rcx, qword [rbp - 0x80]
jmp 0x140040298
shl rdi, 4
and ecx, 0xf
add rdi, rcx
shr rdi, 1
jmp 0x140040183
mov r9, qword [r12 + 8]
lea rcx, [rsp + 0x70]
mov r8, qword [r12]
mov edx, 0x800
call fcn.14003f340
test eax, eax
js 0x140040339
mov rcx, qword [rsp + 0x70]
lea r8, [rbp - 0x70]
xor edi, edi
mov r9d, 0x30
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x140040293
movups xmm6, xmmword [rbp - 0x60]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
movq rcx, xmm6
test rcx, rcx
je 0x140040339
call sym.SystemInformer.exe_PhReferenceProcessItem
mov rbx, rax
test rax, rax
je 0x140040307
mov rdx, rax
xor ecx, ecx
call sym.SystemInformer.exe_PhCreateProcessPropContext
mov rdi, rax
lea rcx, [rbx - 0x10]
mov r14, 0xffffffffffffffff
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x1400402e5
nop
call fcn.140142200
psrldq xmm6, 8
lea r8, [0x14003f440]
mov rdx, rdi
movq qword [rdi + 0x78], xmm6
mov ecx, 0xf
call sym.SystemInformer.exe_PhPluginInvokeWindowCallback
jmp 0x140040339
lea rax, str.The_process_does_not_exist.
mov edx, 0x20
mov qword [rsp + 0x28], rax
lea r15, [0x14023b2dc]
lea r9, str.Unable_to_show_the_process_properties.
mov qword [rsp + 0x20], r15
mov r8d, 0xfffe
mov rcx, r13
call sym.SystemInformer.exe_PhShowMessage2
movaps xmm6, xmmword [rsp + 0x100]
mov r14, qword [rsp + 0x118]
mov rdi, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x160]
mov r15, qword [rsp + 0x110]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401e5e20
add rsp, 0x128
pop r13
pop r12
pop rsi
pop rbp
ret