Function at 0x140011ab0
Capabilities:
Get file system object information

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x318]
sub rsp, 0x418
mov rsi, qword [rdx + 0x98]
mov r13, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rsi
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [r13 + 0x90]
mov r12d, 0xffffffff
mov edx, r12d
call qword [sym.imp.COMCTL32.dll_ImageList_Remove]
mov edx, 5
lea rcx, [rsp + 0x48]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEnumProcessesEx
mov ebx, eax
test eax, eax
jns 0x140011bcb
cmp eax, 0xc0000022
je 0x140011b40
cmp eax, 0xc0000005
je 0x140011b40
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x140011b4c
movzx eax, bx
jmp 0x140011b48
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140011b55
mov ecx, ebx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetNtMessage
jmp 0x140011b5c
mov ecx, eax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetWin32Message
lea r9, str.Unable_to_enumerate_processes
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140011b8e
lea r8, [0x140166310]
add rsp, 0x418
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
jmp sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x14001216e
add rsp, 0x418
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
jmp fcn.1400d9400
mov qword [rsp + 0x450], r14
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x410], r15
mov edx, 0x845c
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14, qword [rsp + 0x48]
xor edi, edi
nop word [rax + rax]
cmp qword [r14 + 0x50], 0
mov r15, rdi
mov rdx, qword [0x140191180]
mov qword [rbp + 0x368], rdi
je 0x140011c5b
movzx edi, word [r14 + 0x38]
mov rsi, qword [r14 + 0x40]
lea rcx, [rdi + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rbx, rax
lea rcx, [rax + 0x10]
mov qword [rax], rdi
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rdi], ax
test rsi, rsi
je 0x140011c52
mov rcx, qword [rbx + 8]
mov r8d, edi
mov rdx, rsi
call fcn.1401317c0
mov rsi, qword [rsp + 0x40]
xor edi, edi
jmp 0x140011ca8
mov ecx, 0x38
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rbx, rax
mov qword [rax], 0x26
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + 0x26], di
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.System_Idle_Process]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140159290]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x1401592a0]
mov dword [rcx + 0x20], eax
movzx eax, word [0x1401592a4]
mov word [rcx + 0x24], ax
mov rcx, qword [r14 + 0x50]
lea r9, [rbp - 0x30]
mov rax, qword [rbx + 8]
xor r8d, r8d
mov qword [rbp - 8], rcx
mov edx, 0x104d
mov rcx, rsi
mov dword [rbp - 0x30], 5
mov qword [rbp - 0x2c], 0x7fffffff
mov qword [rbp - 0x18], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
mov edx, r12d
mov rsi, rax
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140011cf5
call fcn.1400d9400
cmp byte [0x1401910b4], 0
mov rcx, qword [r14 + 0x50]
mov ebx, dword [sym.4yUlCM3HuVsHzW5CaCX.exe_ProcessQueryAccess]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
je 0x140011d1d
mov eax, ebx
and eax, 0x1410
cmp eax, ebx
je 0x140011d61
xorps xmm0, xmm0
mov dword [rbp - 0x30], 0x30
lea r9, [rsp + 0x50]
mov qword [rbp - 0x28], rdi
lea r8, [rbp - 0x30]
mov dword [rbp - 0x18], edi
mov edx, ebx
mov qword [rbp - 0x20], rdi
lea rcx, [rsp + 0x30]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140011d72
cmp byte [0x1401910b4], 0
je 0x140011e37
lea r8, [rsp + 0x50]
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1400ecc50
test eax, eax
js 0x140011e37
cmp dword [sym.4yUlCM3HuVsHzW5CaCX.exe_WindowsVersion], 0x3c
jae 0x140011d9b
cmp qword [r14 + 0x50], 4
je 0x140011d9b
mov rcx, qword [rsp + 0x30]
lea rdx, [rbp + 0x368]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetProcessImageFileName
cmp byte [0x1401910b4], 0
lea r8, [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov edx, 8
mov rcx, rbx
jne 0x140011dd9
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, 0xc0000022
jne 0x140011dde
cmp byte [0x1401910b4], 0
je 0x140011e2c
lea r8, [rsp + 0x38]
mov edx, 8
mov rcx, rbx
call fcn.1400ecde0
test eax, eax
js 0x140011e2c
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x60]
mov edx, 1
call fcn.1400e69c0
test eax, eax
js 0x140011e21
mov rbx, qword [rsp + 0x60]
xor r8d, r8d
mov dl, 1
mov rcx, qword [rbx]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetSidFullName
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8, rbx
xor edx, edx
mov r15, rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [r14 + 0x50]
mov rcx, rax
test rax, rax
jne 0x140011e5f
test r15, r15
jne 0x140011e5f
mov rdx, qword [0x14018cd80]
test rdx, rdx
je 0x140011e5f
mov r15, rdx
lock inc dword [rdx - 8]
mov rcx, qword [r14 + 0x50]
cmp dword [sym.4yUlCM3HuVsHzW5CaCX.exe_WindowsVersion], 0x3c
jb 0x140011e7a
cmp rcx, 4
je 0x140011e7a
lea rdx, [rbp + 0x368]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetProcessImageFileNameByProcessId
cmp qword [r14 + 0x50], 4
jne 0x140011e92
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetKernelFileName
mov rdi, rax
mov qword [rbp + 0x368], rax
jmp 0x140011e99
mov rdi, qword [rbp + 0x368]
test rdi, rdi
je 0x140011ee0
mov rcx, rdi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetFileName
mov rcx, rdi
mov qword [rbp + 0x368], rax
mov rdi, rax
test rcx, rcx
je 0x140011ed5
add rcx, 0xfffffffffffffff0
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140011ece
call fcn.1400d9400
mov rdi, qword [rbp + 0x368]
test rdi, rdi
je 0x140011ee0
mov rbx, qword [rdi + 8]
jmp 0x140011ee4
xor eax, eax
mov ebx, eax
lea rdx, str..exe
lea rcx, str..exe
call fcn.14011341c
mov qword [rbp + 0x360], 0
test eax, eax
jne 0x140011f6d
test rbx, rbx
je 0x140011f38
lea r9, [rbp + 0x360]
mov dword [rsp + 0x20], 1
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov rbx, qword [rbp + 0x360]
test rbx, rbx
jne 0x140011fef
xor edx, edx
lea rcx, [rbp + 0x360]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetStockApplicationIcon
mov rbx, qword [rbp + 0x360]
test rbx, rbx
je 0x14001203c
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
mov rbx, rax
mov qword [rbp + 0x360], rax
jmp 0x140011fea
test rbx, rbx
je 0x140011fad
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x101
lea r8, [rbp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x140011fa1
mov rbx, qword [rbp + 0x50]
mov qword [rbp + 0x360], rbx
jmp 0x140011fa8
mov rbx, qword [rbp + 0x360]
test rbx, rbx
jne 0x140011fef
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x111
lea r8, [rbp + 0x50]
mov edx, 0x80
lea rcx, str..exe
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x140011fe3
mov rbx, qword [rbp + 0x50]
mov qword [rbp + 0x360], rbx
jmp 0x140011fea
mov rbx, qword [rbp + 0x360]
test rbx, rbx
je 0x14001203c
mov rcx, qword [r13 + 0x90]
mov r8, rbx
mov edx, r12d
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov rcx, qword [r13 + 0x98]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov dword [rbp - 0x6c], eax
mov edx, 0x104c
mov dword [rsp + 0x70], 2
mov dword [rsp + 0x74], esi
mov dword [rsp + 0x78], 0
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [r14 + 0x50]
lea rdx, [rbp + 0x30]
mov r8d, 0xa
call fcn.140113e70
mov rcx, qword [r13 + 0x98]
lea rax, [rbp + 0x30]
lea r9, [rsp + 0x70]
mov qword [rbp - 0x78], rax
xor r8d, r8d
mov dword [rsp + 0x70], 1
mov edx, 0x104c
mov dword [rsp + 0x74], esi
mov dword [rsp + 0x78], 1
call qword [sym.imp.USER32.dll_SendMessageW]
test r15, r15
je 0x140012090
mov rax, qword [r15 + 8]
jmp 0x140012092
xor eax, eax
mov rcx, qword [r13 + 0x98]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x70], 1
mov edx, 0x104c
mov dword [rsp + 0x74], esi
mov dword [rsp + 0x78], 2
mov qword [rbp - 0x78], rax
call qword [sym.imp.USER32.dll_SendMessageW]
test r15, r15
je 0x1400120e6
lea rcx, [r15 - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400120df
call fcn.1400d9400
mov rdi, qword [rbp + 0x368]
test rdi, rdi
je 0x140012101
lea rcx, [rdi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140012101
call fcn.1400d9400
mov eax, dword [r14]
test eax, eax
je 0x14001211b
mov rsi, qword [rsp + 0x40]
mov edi, 0
add r14, rax
jne 0x140011c00
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x844d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x845c
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15, qword [rsp + 0x410]
mov r14, qword [rsp + 0x450]
add rsp, 0x418
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret