Function at 0x7ff7c0061120
Capabilities:
Check processdebugport

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push r12
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
cmp qword [rcx + 0x20], 0
mov r15, rcx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x28], rsi
mov qword [rax - 0x30], rdi
mov qword [rax - 0x38], r13
mov rax, qword [rdx + 0x58]
mov qword [rcx + 0x28], rax
mov eax, dword [rdx + 0x64]
mov dword [rcx + 0x38], eax
mov rax, qword [rdx + 0x20]
mov qword [rcx + 0x40], rax
je 0x7ff7c00611c7
movzx eax, word [rdx + 0x38]
xor r12d, r12d
test ax, ax
jne 0x7ff7c0061185
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x7ff7c006121f
mov rsi, qword [rdx + 0x40]
lea rcx, [rax + 0x12]
mov rdx, qword [0x7ff7c01d3b58]
mov rdi, rax
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], r12w
test rsi, rsi
je 0x7ff7c006121f
mov rcx, qword ds:[rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.7ff7c0125120
jmp 0x7ff7c006121f
mov rdx, qword [0x7ff7c01d3b58]
mov ecx, 0x38
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], 0x26
add rax, 0x10
mov qword [rbx + 8], rax
xor r12d, r12d
mov word [rax + 0x26], r12w
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [0x7ff7c01748d0]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x7ff7c01748e0]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x7ff7c01748f0]
mov dword [rcx + 0x20], eax
movzx eax, word [0x7ff7c01748f4]
mov word [rcx + 0x24], ax
mov qword [r15 + 0x30], rbx
mov rax, qword [r15 + 0x20]
test rax, rax
jle 0x7ff7c0061368
lea rdx, ds:[r15 + 0xf8]
mov r8d, 0xa
mov ecx, eax
call fcn.7ff7c01259e8
mov ecx, dword [r15 + 0x28]
lea rdx, [r15 + 0x112]
mov r8d, 0xa
call fcn.7ff7c01259e8
mov ecx, dword [r15 + 0x38]
lea rdx, [r15 + 0x12c]
mov r8d, 0xa
call fcn.7ff7c01259e8
mov rax, qword [r15 + 0x20]
test rax, rax
jle 0x7ff7c0061368
cmp byte [0x7ff7c01d30ef], 0
lea rcx, [r15 + 0x48]
mov qword [rbp - 0x39], rax
mov edx, 0x400
mov qword [rbp - 0x31], r12
jne 0x7ff7c00612df
xorps xmm0, xmm0
mov dword [rbp - 0x29], 0x30
lea r9, [rbp - 0x39]
mov qword [rbp - 0x21], r12
lea r8, [rbp - 0x29]
mov dword [rbp - 0x11], r12d
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp - 0x19], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x7ff7c00612e8
cmp byte [0x7ff7c01d30ef], 0
je 0x7ff7c00612f7
mov edx, 0x400
lea rcx, [r15 + 0x48]
lea r8, [rbp - 0x39]
call fcn.7ff7c00e3530
test eax, eax
js 0x7ff7c00612f7
or dword [r15 + 0xd0], 0x80
cmp qword [r15 + 0x48], 0
jne 0x7ff7c0061368
cmp byte [0x7ff7c01d30ef], 0
mov rax, qword [r15 + 0x20]
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], r12
jne 0x7ff7c0061356
xorps xmm0, xmm0
mov dword [rbp - 0x29], 0x30
lea r9, [rbp - 0x39]
mov qword [rbp - 0x21], r12
lea r8, [rbp - 0x29]
mov dword [rbp - 0x11], r12d
mov edx, 0x1000
mov qword [rbp - 0x19], r12
lea rcx, [r15 + 0x48]
movdqu xmmword [rbp - 9], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x7ff7c0061368
cmp byte [0x7ff7c01d30ef], 0
je 0x7ff7c0061368
lea r8, [rbp - 0x39]
mov edx, 0x1000
lea rcx, [r15 + 0x48]
call fcn.7ff7c00e3530
mov rcx, qword [r15 + 0x48]
test rcx, rcx
je 0x7ff7c00613be
mov r9d, 0x40
mov qword [rbp - 0x29], 0x40
lea r8, [rbp - 0x29]
mov qword [rsp + 0x20], r12
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x7ff7c00613be
mov eax, dword [rbp + 0xf]
mov ecx, eax
and dword [r15 + 0xd0], 0xfffe3dff
and ecx, 1
shl ecx, 6
and eax, 0x182
or ecx, eax
or ecx, 8
shl ecx, 8
or dword [r15 + 0xd0], ecx
mov rcx, qword [r15 + 0x20]
mov r13d, 4
mov qword [rsp + 0x88], r14
cmp rcx, r13
je 0x7ff7c006153f
nop dword [rax]
test rcx, rcx
jle 0x7ff7c006155a
lea rdx, [rbp + 0x67]
mov qword [rbp + 0x67], r12
call sym.ProcessHacker.exe_PhGetProcessImageFileNameByProcessId
test eax, eax
js 0x7ff7c0061402
mov rax, qword [rbp + 0x67]
mov qword [r15 + 0x58], rax
mov rbx, qword [r15 + 0x48]
test rbx, rbx
je 0x7ff7c0061534
test dword ds:[r15 + 0xd0], 0x10000
nop
jne 0x7ff7c0061534
xor r9d, r9d
mov dword [rbp + 0x67], r12d
lea rax, [rbp + 0x67]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x2b]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, 0x80000005
je 0x7ff7c006146e
cmp eax, 0xc0000023
je 0x7ff7c006146e
cmp eax, 0xc0000004
je 0x7ff7c006146e
nop dword [rax + rax]
test eax, eax
js 0x7ff7c0061534
mov rdi, qword [rbp + 0x6f]
jmp 0x7ff7c00614af
mov r8d, dword ds:[rbp + 0x67]
mov edx, r13d
mov rcx, qword [0x7ff7c01d3cd0]
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov r9d, dword [rbp + 0x67]
mov edx, 0x2b
mov rdi, rax
mov rcx, rbx
lea rax, [rbp + 0x67]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x7ff7c0061522
movzx eax, word [rdi]
test ax, ax
jne 0x7ff7c00614c2
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x7ff7c0061505
mov rdx, qword [0x7ff7c01d3b58]
lea rcx, [rax + 0x12]
mov r14, qword [rdi + 8]
mov rsi, rax
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rsi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rsi], r12w
test r14, r14
je 0x7ff7c0061505
mov rcx, qword ds:[rbx + 8]
mov r8, rsi
mov rdx, r14
call fcn.7ff7c0125120
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test rbx, rbx
je 0x7ff7c0061534
mov qword [r15 + 0x50], rbx
jmp 0x7ff7c006155a
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [r15 + 0x58]
test rcx, rcx
je 0x7ff7c006155a
jmp 0x7ff7c0061551
nop
call sym.ProcessHacker.exe_PhGetKernelFileName
test rax, rax
je 0x7ff7c006155a
mov qword [r15 + 0x58], rax
mov rcx, rax
call sym.ProcessHacker.exe_PhGetFileName
mov qword [r15 + 0x50], rax
mov rbx, qword [r15 + 0x48]
mov esi, 8
test rbx, rbx
je 0x7ff7c0061705
cmp qword [r15 + 0x20], r13
je 0x7ff7c0061705
cmp byte [0x7ff7c01d30ef], 0
lea r8, [rbp + 0x7f]
mov edx, esi
mov rcx, rbx
jne 0x7ff7c00615af
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, 0xc0000022
jne 0x7ff7c00615b4
cmp byte [0x7ff7c01d30ef], 0
nop dword [rax]
je 0x7ff7c006176c
lea r8, [rbp + 0x7f]
mov edx, esi
mov rcx, rbx
call fcn.7ff7c00e3650
test eax, eax
js 0x7ff7c006176c
mov rcx, qword [rbp + 0x7f]
lea r8, [rbp + 0x77]
mov edx, 1
call fcn.7ff7c00da800
test eax, eax
js 0x7ff7c0061635
mov r14, qword [rbp + 0x77]
mov rcx, qword [r14]
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [0x7ff7c01d3cd0]
mov edx, r13d
mov rsi, qword [r14]
mov r8d, eax
mov edi, eax
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.7ff7c0125120
mov qword [r15 + 0x98], rbx
mov rcx, qword [r14]
call fcn.7ff7c0060660
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, r14
xor edx, edx
mov qword [r15 + 0x368], rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, 8
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x77]
mov r9d, r13d
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x67]
mov edx, 0x12
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x7ff7c006167a
and dword [r15 + 0xd0], 0xfffffff7
mov eax, r12d
mov ecx, dword [rbp + 0x67]
cmp ecx, 2
mov dword [r15 + 0xa0], ecx
cmove eax, esi
or dword [r15 + 0xd0], eax
mov rcx, qword [rbp + 0x7f]
lea r8, [rbp - 0x39]
lea rdx, [rbp + 0x77]
call sym.ProcessHacker.exe_PhGetTokenIntegrityLevelRID
test eax, eax
js 0x7ff7c00616f5
mov eax, dword [rbp + 0x77]
cmp eax, 0x3000
jg 0x7ff7c00616cf
je 0x7ff7c00616c7
nop
test eax, eax
je 0x7ff7c00616c2
cmp eax, 0x1000
je 0x7ff7c00616ba
cmp eax, 0x2000
jne 0x7ff7c00616f5
mov r13d, 2
jmp 0x7ff7c00616e3
mov r13d, 1
jmp 0x7ff7c00616e3
mov r13d, r12d
jmp 0x7ff7c00616e3
mov r13d, 3
jmp 0x7ff7c00616e3
cmp eax, 0x4000
je 0x7ff7c00616e3
cmp eax, 0x5000
jne 0x7ff7c00616f5
mov r13d, 5
mov rax, qword [rbp - 0x39]
mov qword [r15 + 0xa8], rax
mov dword [r15 + 0xa4], r13d
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtClose]
nop
jmp 0x7ff7c006176c
mov rax, qword [r15 + 0x20]
test rax, rax
je 0x7ff7c0061713
cmp rax, r13
jne 0x7ff7c006176c
lea rcx, [0x7ff7c01cae28]
nop word [rax + rax]
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [0x7ff7c01d3cd0]
mov edx, r13d
mov r8d, eax
mov edi, eax
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
mov r8d, edi
lea rdx, [0x7ff7c01cae28]
mov rcx, rax
mov rbx, rax
call fcn.7ff7c0125120
lea rcx, [0x7ff7c01cae28]
mov qword ds:[r15 + 0x98], rbx
call fcn.7ff7c0060660
mov qword [r15 + 0x368], rax
mov rdx, qword [r15 + 0x50]
mov rcx, qword [r15 + 0x20]
call sym.ProcessHacker.exe_PhGetProcessKnownTypeEx
mov rcx, qword [r15 + 0x48]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa8]
mov dword [r15 + 0x378], eax
test rcx, rcx
je 0x7ff7c00617fb
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
jb 0x7ff7c00617dc
mov r9d, 1
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x67]
lea edx, [r9 + 0x3c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x7ff7c0061803
movzx eax, byte [rbp + 0x67]
mov byte [r15 + 0x37c], al
jmp 0x7ff7c0061803
test dword [r15 + 0xd0], 0x4000
je 0x7ff7c0061803
and byte [r15 + 0x37c], 0xfa
or byte [r15 + 0x37c], 2
jmp 0x7ff7c0061803
mov byte [r15 + 0x37c], 0xff
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
jb 0x7ff7c0061855
mov rcx, qword [r15 + 0x48]
test rcx, rcx
je 0x7ff7c0061855
mov r9d, esi
mov dword [rbp + 0x67], 7
lea r8, [rbp + 0x67]
mov qword [rsp + 0x20], r12
mov edx, 0x34
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x7ff7c0061855
movzx eax, byte [rbp + 0x6b]
and dword [r15 + 0xd0], 0xfffdffff
and al, 1
movzx eax, al
shl eax, 0x11
or dword [r15 + 0xd0], eax
mov rax, qword [rbp + 0x6f]
mov rsi, qword [rsp + 0xa0]
cmp dword [rax + 4], 0
jne 0x7ff7c006187a
mov rcx, qword [r15 + 0x48]
test rcx, rcx
je 0x7ff7c006187a
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [r15 + 0x48], r12
add rsp, 0xb0
pop r15
pop r12
pop rbp
ret