Function at 0x1401c7ea0
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor edi, edi
mov qword [rbp - 0x48], 0x46
mov esi, 0x80004005
mov qword [rbp + 0x58], rdi
lea rbx, str.Windows.System.Profile.SystemId.dll
mov qword [rbp - 0x50], rdi
lea rdx, [rbp - 0x48]
mov qword [rbp - 0x28], rdi
mov r12d, esi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x40], rbx
mov r15, r8
mov r13, rcx
xor r14b, r14b
call fcn.1401776c0
mov r10, rax
test rax, rax
jne 0x1401c7f65
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x1401c7f65
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x1401c7f65
cmp dword [0x1402baf40], 0x3e
nop
jae 0x1401c7f58
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x1401c7f65
mov ebx, 0x8007007e
jmp 0x1401c84e9
lea r8, str.Windows.System.Profile.SystemIdentification
mov dword [rbp - 0x18], 1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x1401c7fa2
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x1401c7f9e
mov edx, ecx
shr rdx, 1
jmp 0x1401c7fe3
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x1401c7fd5
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x1401c7fc0
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
mov eax, 0x5a4d
mov dword [rbp - 0x14], edx
mov qword [rbp - 8], r8
cmp word [r10], ax
jne 0x1401c84e4
mov ecx, dword [r10 + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401c84e4
cmp dword [rcx + r10], 0x4550
jne 0x1401c84e4
lea rdx, [r10 + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401c84e4
cmp dword [rdx + 4], edi
je 0x1401c84e4
lea r8, [r10 + rax]
mov word [rsp + 0x20], di
lea r9, str.DllGetActivationFactory
mov rcx, r10
call fcn.140177a80
test rax, rax
je 0x1401c84e4
lea rdx, ds:[rbp - 0x48]
lea rcx, [rbp - 0x18]
call qword [case.0x14013b5a0.0]
mov ebx, eax
test eax, eax
js 0x1401c809a
mov rcx, qword [rbp - 0x48]
lea r8, [rbp + 0x58]
lea rdx, [0x14028be38]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14013b5a0.0]
mov rcx, qword [rbp - 0x48]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013b5a0.0]
nop word [rax + rax]
test ebx, ebx
js 0x1401c84e9
mov rbx, qword ds:[r13 + 0x10]
lea r8, [rbp - 0x50]
mov edi, dword [0x1402c825c]
mov rcx, rbx
mov edx, 0xe
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, 0xc0000022
jne 0x1401c80e5
cmp edi, 5
jne 0x1401c8104
lea r8, ds:[rbp - 0x50]
mov rcx, rbx
lea edx, [rdi + 9]
call fcn.140174e00
test eax, eax
js 0x1401c8104
mov rdx, qword [rbp - 0x50]
mov rcx, 0xfffffffffffffffe
call sym.SystemInformer.exe_QiImpersonateToken
mov r14d, eax
shr r14d, 0x1f
xor r14b, 1
mov rax, qword ds:[rbp + 0x58]
mov rbx, qword [rax]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, qword [rcx + 0x18]
mov rcx, qword [r8 + 0x10]
add r8, 0x10
cmp rcx, r8
je 0x1401c8165
mov rdx, qword [rcx + 0x30]
cmp rbx, rdx
jb 0x1401c815d
mov eax, dword [rcx + 0x40]
add rax, rdx
cmp rbx, rax
jb 0x1401c821c
mov rcx, qword [rcx]
cmp rcx, r8
jne 0x1401c8145
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov edi, esi
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x1401c819f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013b5a0.0]
mov qword [rbp + 0x58], 0
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1401c81e2
test r14b, r14b
je 0x1401c81d4
mov r9d, 8
mov qword [rbp - 0x48], 0
lea r8, [rbp - 0x48]
mov rcx, 0xfffffffffffffffe
lea edx, [r9 - 3]
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rbp - 0x50], 0
mov dl, 1
xor ecx, ecx
call fcn.1401c7c60
mov r13, qword [rbp + 0x48]
mov eax, esi
shr eax, 0x1c
and eax, 1
mov qword [r15], 0
mov qword [r13], 0
test r12d, r12d
jne 0x1401c83b3
mov rcx, qword [rbp - 0x28]
mov qword [r13], rcx
jmp 0x1401c844c
nop dword [rax]
test rcx, rcx
je 0x1401c8165
mov rax, qword gs:[0x30]
mov rbx, rdx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
test rbx, rbx
je 0x1401c817f
lea r9, [0x1401c7da0]
mov rcx, rbx
lea r8, [0x14028bb20]
lea rdx, str.api_ms_win_core_processthreads_l1_1_0.dll
call fcn.140178460
test eax, eax
js 0x1401c817f
lfence
lea r9, [0x1401c7e20]
mov rcx, rbx
lea r8, [0x14028bb50]
lea rdx, str.api_ms_win_core_processthreads_l1_1_0.dll
call fcn.140178460
test eax, eax
js 0x1401c817f
lfence
lea r9, [0x1401c7de0]
mov rcx, rbx
lea r8, str.GetCurrentThread
lea rdx, str.api_ms_win_core_processthreads_l1_1_0.dll
call fcn.140178460
nop dword [rax]
test eax, eax
js 0x1401c817f
lfence
lea r9, [0x1401c7e60]
mov rcx, rbx
lea r8, [0x14028bb78]
lea rdx, str.api_ms_win_core_processthreads_l1_1_0.dll
call fcn.140178460
test eax, eax
js 0x1401c817f
lfence
lea r9, [0x14018c930]
mov rcx, rbx
lea r8, [0x14028bb68]
lea rdx, str.api_ms_win_core_handle_l1_1_0.dll
call fcn.140178460
test eax, eax
js 0x1401c817f
mov dl, 1
mov rcx, r13
call fcn.1401c7c60
test rax, rax
je 0x1401c817f
mov rcx, qword ds:[rbp + 0x58]
lea rdx, [rbp - 0x38]
xor edi, edi
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
call qword [case.0x14013b5a0.0]
mov r12d, eax
test eax, eax
jne 0x1401c836b
mov rcx, qword [rbp - 0x38]
call fcn.1401c7b40
mov rcx, qword [rbp - 0x38]
mov qword [rbp - 0x28], rax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013b5a0.0]
mov rcx, qword ds:[rbp + 0x58]
lea r8, [rbp - 0x30]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x14013b5a0.0]
mov esi, eax
test eax, eax
jne 0x1401c8181
mov rcx, qword [rbp - 0x30]
call fcn.1401c7b40
mov rcx, qword [rbp - 0x30]
mov qword [rbp - 0x20], rax
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x14013b5a0.0]
jmp 0x1401c8181
mov r14d, eax
test eax, eax
je 0x1401c842e
mov ecx, r12d
call fcn.140174100
mov ebx, eax
cmp eax, 0xc0000022
je 0x1401c83f7
cmp eax, 0xc0000005
je 0x1401c83f7
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x1401c83ec
movzx eax, bx
jmp 0x1401c83ff
cmp eax, 0xb0000
jne 0x1401c8404
mov eax, ebx
jmp 0x1401c83ff
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
nop
test eax, eax
jne 0x1401c840d
mov ecx, ebx
call sym.SystemInformer.exe_QiGetNtMessage
jmp 0x1401c8414
mov ecx, eax
call sym.SystemInformer.exe_QiGetWin32Message
mov qword ds:[r13], rax
mov rcx, rax
test rax, rax
je 0x1401c842e
cmp qword [rcx], 0
mov eax, r14d
jne 0x1401c844c
movzx ecx, r12w
test ecx, ecx
jne 0x1401c843d
call sym.SystemInformer.exe_QiGetNtMessage
jmp 0x1401c8445
nop dword [rax]
call sym.SystemInformer.exe_QiGetWin32Message
mov qword [r13], rax
mov eax, r14d
test esi, esi
jne 0x1401c845e
mov rax, qword [rbp - 0x20]
mov qword [r15], rax
mov eax, edi
jmp 0x1401c84ee
nop
test eax, eax
je 0x1401c84b7
mov ecx, esi
call fcn.140174100
mov ebx, eax
cmp eax, 0xc0000022
je 0x1401c8497
cmp eax, 0xc0000005
je 0x1401c8497
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x1401c848c
movzx eax, bx
jmp 0x1401c849f
cmp eax, 0xb0000
jne 0x1401c84a4
mov eax, ebx
jmp 0x1401c849f
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
nop
test eax, eax
jne 0x1401c84ad
mov ecx, ebx
call sym.SystemInformer.exe_QiGetNtMessage
jmp 0x1401c84b4
mov ecx, eax
call sym.SystemInformer.exe_QiGetWin32Message
mov qword [r15], rax
mov rax, qword [r15]
test rax, rax
je 0x1401c84c5
cmp qword [rax], 0
jne 0x1401c84e0
movzx ecx, si
test ecx, ecx
jne 0x1401c84d8
call sym.SystemInformer.exe_QiGetNtMessage
mov qword [r15], rax
mov eax, edi
jmp 0x1401c84ee
call sym.SystemInformer.exe_QiGetWin32Message
mov qword [r15], rax
mov eax, edi
jmp 0x1401c84ee
mov ebx, 0x8007007f
lfence
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret