Function at 0x7ff7c0085470
Capabilities:
Parse pe header
Reference sql statements

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push r12
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xb8
xor ebx, ebx
mov r12, r8
mov qword [rbp - 9], rbx
mov r14, rdx
mov qword [rbp - 0x11], rbx
mov qword [rbp - 0x19], rbx
call fcn.7ff7c0085320
mov rcx, rax
test rax, rax
jne 0x7ff7c00854b9
lea eax, [rbx + 0x7e]
add rsp, 0xb8
pop r14
pop r12
pop rbx
pop rbp
ret
mov eax, 0x5a4d
mov qword [rsp + 0xa8], r13
cmp word [rcx], ax
jne 0x7ff7c0085581
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0xffffffe
ja 0x7ff7c0085581
cmp dword [rdx + rcx], 0x4550
jne 0x7ff7c0085581
lea r8, [rcx + 0x88]
add r8, rdx
mov eax, dword [r8]
test eax, eax
je 0x7ff7c0085581
cmp dword [r8 + 4], ebx
je 0x7ff7c0085581
lea r9, [rcx + rax]
mov word [rsp + 0x28], bx
lea rax, [0x7ff7c0188710]
mov qword [rsp + 0x20], rax
call fcn.7ff7c00c4bd0
test rax, rax
je 0x7ff7c0085581
lea r8, [rbp + 0x17]
lea rdx, [0x7ff7c0147ac0]
lea rcx, [0x7ff7c0147980]
call qword [case.0x7ff7c00c1f48.0]
mov r13d, eax
test eax, eax
js 0x7ff7c0085578
mov rcx, qword [rbp + 0x17]
lea r9, [rbp - 9]
lea r8, [0x7ff7c0147990]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x7ff7c00c1f48.0]
mov rcx, qword [rbp + 0x17]
mov r13d, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x7ff7c00c1f48.0]
test r13d, r13d
js 0x7ff7c008597b
mov rcx, qword [rbp - 9]
lea rdx, [rbp - 0x11]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
lea rdx, [0x7ff7c0184b68]
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rax, qword [rcx]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov rax, qword [rax + 0x18]
call qword [case.0x7ff7c00c1f48.0]
mov r13d, eax
test eax, eax
js 0x7ff7c008597b
mov qword [rsp + 0xe8], rsi
lea rcx, [0x7ff7c0184b80]
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xa0], r15
call sym.ProcessHacker.exe_PhCountStringZ
mov rsi, rax
mov rcx, r14
add rsi, rsi
call sym.ProcessHacker.exe_PhCountStringZ
mov rdx, qword [0x7ff7c01d3b58]
mov rdi, rax
add rdi, rdi
lea rbx, [rdi + rsi]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor edx, edx
mov qword [rbp + 0x1f], rax
mov r8, rsi
mov r15, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], dx
lea rdx, [0x7ff7c0184b80]
mov rcx, qword [rax + 8]
call fcn.7ff7c0125120
mov rcx, qword ds:[r15 + 8]
mov r8, rdi
add rcx, rsi
mov rdx, r14
call fcn.7ff7c0125120
mov rcx, qword [rbp - 0x11]
lea rdx, [rbp - 0x19]
mov r8, qword [r15 + 8]
xor ebx, ebx
mov qword [rsp + 0x28], rdx
lea rdx, [0x7ff7c0184c38]
mov qword [rsp + 0x20], rbx
mov rax, qword [rcx]
lea r9d, [rbx + 0x30]
mov rax, qword [rax + 0xa0]
call qword [case.0x7ff7c00c1f48.0]
lea esi, ds:[rbx - 1]
mov r13d, eax
test eax, eax
js 0x7ff7c0085950
mov rcx, qword [rbp - 0x19]
lea rdx, [rbp + 0x7f]
mov dword [rbp + 0x7f], ebx
lea r9, [rbp - 0x21]
mov qword [rsp + 0x20], rdx
lea r8d, [rbx + 1]
mov edx, esi
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x7ff7c00c1f48.0]
test eax, eax
js 0x7ff7c0085950
nop word [rax + rax]
cmp dword [rbp + 0x7f], 0
je 0x7ff7c008594c
mov rcx, qword [rbp - 0x21]
lea r9, [rbp - 1]
mov qword [rsp + 0x28], rbx
lea rdx, [0x7ff7c0184c40]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov r15, rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x7ff7c00c1f48.0]
test eax, eax
js 0x7ff7c0085722
mov rcx, qword ds:[rbp + 7]
call sym.ProcessHacker.exe_PhCreateString
lea rcx, [rbp - 1]
mov r15, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x21]
lea r9, [rbp - 1]
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov r14, rbx
mov qword [rsp + 0x20], rbx
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
lea rdx, [0x7ff7c0184c58]
call qword [case.0x7ff7c00c1f48.0]
nop
test eax, eax
js 0x7ff7c008576a
mov rcx, qword [rbp + 7]
call sym.ProcessHacker.exe_PhCreateString
lea rcx, [rbp - 1]
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x21]
lea r9, [rbp - 1]
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov rdi, rbx
mov qword [rsp + 0x20], rbx
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
lea rdx, [0x7ff7c0183338]
call qword [case.0x7ff7c00c1f48.0]
test eax, eax
js 0x7ff7c00857b6
mov rcx, qword [rbp + 7]
call sym.ProcessHacker.exe_PhCreateString
lea rcx, ds:[rbp - 1]
mov rdi, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x21]
lea r9, [rbp - 1]
xor r8d, r8d
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
xor edx, edx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
lea rdx, [0x7ff7c0184c70]
call qword [case.0x7ff7c00c1f48.0]
test eax, eax
js 0x7ff7c00857fb
mov rcx, qword [rbp + 7]
call sym.ProcessHacker.exe_PhCreateString
lea rcx, [rbp - 1]
mov rbx, rax
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test r15, r15
je 0x7ff7c008589f
test r14, r14
je 0x7ff7c008589f
nop dword [rax]
test rdi, rdi
je 0x7ff7c008589f
test rbx, rbx
je 0x7ff7c00858bf
mov rcx, qword ds:[r12 + 8]
xor r8d, r8d
mov rdx, r15
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7c00858a4
mov rcx, qword [r12]
xor r8d, r8d
mov rdx, r14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7c00858a4
mov rcx, qword [r12 + 0x18]
xor r8d, r8d
mov rdx, rdi
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7c00858a4
mov rdx, qword [rbp - 0x21]
xor r8d, r8d
mov rcx, qword [rbp - 0x11]
xor r9d, r9d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
mov rax, qword [rcx]
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x20], r8
mov r8, qword [rbp + 0x67]
mov rax, qword [rax + 0xc0]
call qword [case.0x7ff7c00c1f48.0]
mov r13d, eax
jmp 0x7ff7c00858a4
test rbx, rbx
je 0x7ff7c00858ba
lea rcx, ds:[rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c00858ba
call fcn.7ff7c00c6290
test rdi, rdi
je 0x7ff7c00858d5
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c00858d5
nop
call fcn.7ff7c00c6290
test r14, r14
je 0x7ff7c00858ef
lea rcx, [r14 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c00858ef
call fcn.7ff7c00c6290
nop
test r15, r15
je 0x7ff7c008590a
lea rcx, [r15 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c008590a
call fcn.7ff7c00c6290
mov rcx, qword [rbp - 0x21]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov rcx, qword [rbp - 0x19]
lea rdx, [rbp + 0x7f]
xor ebx, ebx
mov qword [rsp + 0x20], rdx
mov dword [rbp + 0x7f], ebx
lea r9, [rbp - 0x21]
mov edx, esi
mov rax, qword [rcx]
lea r8d, [rbx + 1]
mov rax, qword [rax + 0x20]
call qword [case.0x7ff7c00c1f48.0]
test eax, eax
jns 0x7ff7c00856d0
mov r15, qword [rbp + 0x1f]
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], esi
mov r15, qword [rsp + 0xa0]
cmp esi, 1
mov rsi, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xb0]
jne 0x7ff7c008597b
call fcn.7ff7c00c6290
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x7ff7c0085996
mov rax, qword ds:[rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x7ff7c00859ac
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x7ff7c00859c2
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov eax, r13d
mov r13, qword [rsp + 0xa8]
add rsp, 0xb8
pop r14
pop r12
pop rbx
pop rbp
ret