Function at 0x14000f130
Capabilities:
Get file system object information

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x408]
sub rsp, 0x508
mov rsi, qword [rdx + 0x98]
mov r13, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rsi
mov edx, 5
lea rcx, [rsp + 0x48]
call sym.ProcessHacker.exe_PhEnumProcessesEx
mov ebx, eax
test eax, eax
jns 0x14000f227
cmp eax, 0xc0000022
je 0x14000f196
cmp eax, 0xc0000005
je 0x14000f196
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x14000f1a2
movzx eax, bx
jmp 0x14000f19e
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x14000f1ab
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x14000f1b2
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_enumerate_processes
mov rbx, rax
mov rcx, rdi
test rax, rax
jne 0x14000f1e2
lea r8, [0x1401689f8]
lea edx, [rax + 0x10]
add rsp, 0x508
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
jmp sym.ProcessHacker.exe_PhShowMessage
mov rax, qword [rbx + 8]
mov edx, 0x20
mov r8d, 0xfffe
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
or r12, 0xffffffffffffffff
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x14000f824
add rsp, 0x508
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
jmp fcn.1400c8bc0
mov qword [rsp + 0x540], r14
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x500], r15
mov edx, 0x845c
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [r13 + 0x90]
or r12, 0xffffffffffffffff
mov edx, r12d
call qword [sym.imp.COMCTL32.dll_ImageList_Remove]
mov r15, qword [rsp + 0x48]
xor edi, edi
nop word [rax + rax]
cmp qword [r15 + 0x50], 0
mov r14, rdi
mov qword [rbp + 0x458], rdi
je 0x14000f2f0
movzx eax, word [r15 + 0x38]
test ax, ax
jne 0x14000f2a8
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x14000f344
mov rdx, qword [0x140196800]
mov rsi, qword [r15 + 0x40]
movzx edi, ax
lea rcx, [rdi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
xor ecx, ecx
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], cx
test rsi, rsi
je 0x14000f2e7
mov rcx, qword [rbx + 8]
mov r8d, edi
mov rdx, rsi
call fcn.14010e700
mov rsi, qword [rsp + 0x40]
xor edi, edi
jmp 0x14000f344
mov rdx, qword [0x140196800]
mov ecx, 0x38
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], 0x26
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + 0x26], di
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.System_Idle_Process]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140159730]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x140159740]
mov dword [rcx + 0x20], eax
movzx eax, word [0x140159744]
mov word [rcx + 0x24], ax
mov rcx, qword [r15 + 0x50]
lea r9, [rbp - 0x40]
mov rax, qword [rbx + 8]
xor r8d, r8d
mov qword [rbp - 0x18], rcx
mov edx, 0x104d
mov rcx, rsi
mov dword [rbp - 0x40], 5
mov qword [rbp - 0x3c], 0x7fffffff
mov qword [rbp - 0x28], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
mov edx, r12d
mov rsi, rax
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14000f391
call fcn.1400c8bc0
cmp byte [0x1401937ba], 0
mov rcx, qword [r15 + 0x50]
mov ebx, dword [sym.ProcessHacker.exe_ProcessQueryAccess]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
je 0x14000f3b9
mov eax, ebx
and eax, 0x121410
cmp eax, ebx
je 0x14000f400
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x30
lea r9, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
lea r8, [rsp + 0x70]
mov dword [rbp - 0x78], edi
mov edx, ebx
mov qword [rbp - 0x80], rdi
lea rcx, [rsp + 0x38]
movdqu xmmword [rbp - 0x70], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x14000f411
cmp byte [0x1401937ba], 0
je 0x14000f4b5
lea r8, [rsp + 0x50]
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.1400dcab0
test eax, eax
js 0x14000f4b5
cmp byte [0x1401937ba], 0
lea r8, [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov edx, 8
mov rcx, rbx
jne 0x14000f457
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, 0xc0000022
jne 0x14000f45c
cmp byte [0x1401937ba], 0
je 0x14000f4aa
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rbx
call fcn.1400dcbd0
test eax, eax
js 0x14000f4aa
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x60]
mov edx, 1
call fcn.1400d55f0
test eax, eax
js 0x14000f49f
mov rbx, qword [rsp + 0x60]
xor r8d, r8d
mov dl, 1
mov rcx, qword [rbx]
call sym.ProcessHacker.exe_PhGetSidFullName
mov rcx, qword [0x140196670]
mov r8, rbx
xor edx, edx
mov r14, rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [r15 + 0x50]
mov rcx, rax
test rax, rax
jne 0x14000f4dd
test r14, r14
jne 0x14000f4dd
mov rdx, qword [0x140192540]
test rdx, rdx
je 0x14000f4dd
mov r14, rdx
lock inc dword [rdx - 8]
mov rcx, qword [r15 + 0x50]
cmp rcx, 4
jne 0x14000f531
lea rcx, [rsp + 0x68]
mov rbx, rdi
call sym.ProcessHacker.exe_PhEnumKernelModules
test eax, eax
js 0x14000f528
mov rdi, qword [rsp + 0x68]
cmp dword [rdi], 1
jb 0x14000f516
lea rcx, [rdi + 0x30]
mov rdx, r12
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14000f505
call sym.ProcessHacker.exe_PhConvertMultiByteToUtf16Ex
mov rbx, rax
mov rcx, qword [0x140196670]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov qword [rbp + 0x458], rbx
jmp 0x14000f544
lea rdx, [rbp + 0x458]
call sym.ProcessHacker.exe_PhGetProcessImageFileNameByProcessId
mov rbx, qword [rbp + 0x458]
test rbx, rbx
je 0x14000f58e
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetFileName
mov rcx, rbx
mov qword [rbp + 0x458], rax
mov rdi, rax
mov rbx, rax
test rcx, rcx
je 0x14000f583
add rcx, 0xfffffffffffffff0
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14000f57c
call fcn.1400c8bc0
mov rbx, qword [rbp + 0x458]
test rdi, rdi
je 0x14000f58e
mov rdi, qword [rdi + 8]
jmp 0x14000f592
xor eax, eax
mov edi, eax
lea rdx, str..exe
lea rcx, str..exe
call fcn.14010f5a0
xor ecx, ecx
mov qword [rbp + 0x450], rcx
test eax, eax
jne 0x14000f60e
test rdi, rdi
je 0x14000f5d8
lea r8, [rbp + 0x450]
xor edx, edx
mov rcx, rdi
call fcn.1400c8600
mov r8, qword [rbp + 0x450]
test r8, r8
jne 0x14000f691
xor edx, edx
lea rcx, [rbp + 0x450]
call sym.ProcessHacker.exe_PhGetStockApplicationIcon
mov r8, qword [rbp + 0x450]
test r8, r8
je 0x14000f691
mov rcx, r8
call qword [sym.imp.USER32.dll_CopyIcon]
mov r8, rax
mov qword [rbp + 0x450], rax
jmp 0x14000f691
test rdi, rdi
je 0x14000f651
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x101
lea r8, [rbp + 0x140]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r8, qword [rbp + 0x450]
test rax, rax
cmovne r8, qword [rbp + 0x140]
mov qword [rbp + 0x450], r8
test r8, r8
jne 0x14000f691
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x111
lea r8, [rbp + 0x140]
mov edx, 0x80
lea rcx, str..exe
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r8, qword [rbp + 0x450]
test rax, rax
cmovne r8, qword [rbp + 0x140]
mov qword [rbp + 0x450], r8
mov rax, r8
mov rdi, r8
test rax, rax
je 0x14000f6e0
mov rcx, qword [r13 + 0x90]
mov edx, r12d
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
xor ecx, ecx
mov dword [rbp + 0x20], 2
mov dword [rbp + 0x28], ecx
lea r9, [rbp + 0x20]
mov rcx, qword [r13 + 0x98]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x24], esi
mov dword [rbp + 0x44], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call qword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [r15 + 0x50]
lea rdx, [rbp - 0x60]
mov r8d, 0xa
call fcn.14010ffa8
mov rcx, qword [r13 + 0x98]
lea rax, [rbp - 0x60]
lea r9, [rbp + 0x80]
mov qword [rbp + 0x98], rax
xor r8d, r8d
mov dword [rbp + 0x80], 1
mov edx, 0x104c
mov dword [rbp + 0x84], esi
mov dword [rbp + 0x88], 1
call qword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test r14, r14
je 0x14000f741
mov rax, qword [r14 + 8]
jmp 0x14000f744
mov rax, rdi
mov rcx, qword [r13 + 0x98]
lea r9, [rbp + 0xe0]
xor r8d, r8d
mov dword [rbp + 0xe0], 1
mov edx, 0x104c
mov dword [rbp + 0xe4], esi
mov dword [rbp + 0xe8], 2
mov qword [rbp + 0xf8], rax
call qword [sym.imp.USER32.dll_SendMessageW]
test r14, r14
je 0x14000f7a3
lea rcx, [r14 - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000f79c
call fcn.1400c8bc0
mov rbx, qword [rbp + 0x458]
test rbx, rbx
je 0x14000f7be
lea rcx, [rbx - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000f7be
call fcn.1400c8bc0
mov eax, dword [r15]
test eax, eax
je 0x14000f7d3
mov rsi, qword [rsp + 0x40]
add r15, rax
jne 0x14000f280
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, qword [0x140196670]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x844d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x845c
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15, qword [rsp + 0x500]
mov r14, qword [rsp + 0x540]
add rsp, 0x508
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret