Function at 0x7ff7bffe7130
Capabilities:
Check mutex on windows
Map section object

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd90]
sub rsp, 0xe90
mov rax, qword [0x7ff7c01ca008]
xor rax, rsp
mov qword [rbp + 0xd80], rax
mov rax, qword [rcx + 0x10]
lea r13, [0x7ff7c0152200]
mov rdi, rcx
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x7ff7bffe7180
mov rdx, qword [rcx + 8]
jmp 0x7ff7bffe7183
mov rdx, r13
mov eax, dword [rdi + 0x88]
lea r9, [rbp + 0x350]
mov rcx, qword [rdi]
mov r15d, 1
mov qword [rbp + 0x368], rdx
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x350], r15d
mov dword [rbp + 0x358], r15d
mov dword [rbp + 0x354], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x7ff7bffe71d5
mov rcx, qword [rcx + 8]
jmp 0x7ff7bffe71d8
mov rcx, r13
mov eax, dword ds:[rdi + 0x8c]
lea r9, [rbp + 0x2f0]
mov qword [rbp + 0x308], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x2f0], r15d
mov dword [rbp + 0x2f4], eax
mov dword [rbp + 0x2f8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x10]
mov r14d, 0x30
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x7ff7bffe7287
lea r8d, [r14 - 0x20]
mov dword [rbp + 0xa20], 0x780030
lea rdx, [rbp + 0xa24]
call fcn.7ff7c01259c4
mov eax, dword [rdi + 0x90]
lea r9, [rbp + 0x3b0]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x3b4], eax
mov edx, 0x104c
lea rax, [rbp + 0xa20]
mov dword [rbp + 0x3b0], r15d
mov qword [rbp + 0x3c8], rax
mov dword [rbp + 0x3b8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x10]
mov rcx, qword ds:[rax + 0x30]
test rcx, rcx
je 0x7ff7bffe729b
mov rcx, qword [rcx + 8]
jmp 0x7ff7bffe729e
mov rcx, r13
lea r8, [rbp - 0x50]
mov qword [rsp + 0xec8], rbx
lea rdx, [rbp + 0xa0]
call sym.ProcessHacker.exe_PhGetAccessEntries
mov rcx, qword [rdi + 0x10]
test al, al
je 0x7ff7bffe73aa
mov rbx, qword [rbp + 0xa0]
mov r8d, dword [rbp - 0x50]
mov rdx, rbx
mov ecx, dword [rcx + 0x24]
call sym.ProcessHacker.exe_PhGetAccessString
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
cmp qword [rax], 0
je 0x7ff7bffe7332
mov rcx, qword [rdi + 0x10]
mov r8, qword [rax + 8]
mov edx, dword [rcx + 0x24]
lea rcx, [0x7ff7c0177b70]
call sym.ProcessHacker.exe_PhFormatString
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov dword ds:[rbp + 0x410], r15d
lea r9, [rbp + 0x410]
mov dword [rbp + 0x414], 3
mov dword [rbp + 0x418], r15d
mov rcx, qword [rax + 8]
mov qword [rbp + 0x428], rcx
jmp 0x7ff7bffe7382
mov rax, qword [rdi + 0x10]
lea rdx, [rbp + 0xa24]
mov r8d, 0x10
mov ecx, dword [rax + 0x24]
mov dword [rbp + 0xa20], 0x780030
call fcn.7ff7c01259c4
lea rax, [rbp + 0xa20]
mov dword [rbp + 0x260], r15d
mov qword [rbp + 0x278], rax
lea r9, [rbp + 0x260]
mov dword [rbp + 0x264], 3
mov dword [rbp + 0x268], r15d
mov rcx, qword ds:[rdi]
xor r8d, r8d
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x7ff7bffe7407
mov ecx, dword [rcx + 0x24]
lea rdx, [rbp + 0xa24]
mov r8d, 0x10
mov dword [rbp + 0xa20], 0x780030
call fcn.7ff7c01259c4
mov rcx, qword [rdi]
lea rax, [rbp + 0xa20]
lea r9, [rbp + 0x260]
mov qword [rbp + 0x278], rax
xor r8d, r8d
mov dword [rbp + 0x260], r15d
mov edx, 0x104c
mov dword [rbp + 0x264], 3
mov dword [rbp + 0x268], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword ds:[rdi + 8]
lea r9, [rbp + 0x18]
xor esi, esi
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
mov qword [rbp + 0x20], rsi
lea r8, [rbp + 0xa8]
mov dword [rbp + 0xa8], r14d
lea rcx, [rbp + 8]
mov qword [rbp + 0xb0], rsi
lea edx, [rsi + 0x40]
mov dword [rbp + 0xc0], esi
mov qword [rbp + 0xb8], rsi
movdqu xmmword [rbp + 0xc8], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x7ff7bffe747a
cmp byte [0x7ff7c01d30ef], sil
je 0x7ff7bffe7642
lea r8, [rbp + 0x18]
lea edx, [rsi + 0x40]
lea rcx, [rbp + 8]
call fcn.7ff7c00e3530
test eax, eax
js 0x7ff7bffe7642
mov rax, qword [rdi + 0x10]
lea rcx, [rbp + 0x8c0]
mov qword [rsp + 0x48], rsi
xor r9d, r9d
mov qword [rsp + 0x40], rsi
mov r8d, 0xffffffff
mov qword [rsp + 0x38], rsi
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 8]
call sym.ProcessHacker.exe_PhGetHandleInformationEx
test eax, eax
js 0x7ff7bffe7638
mov eax, dword [rsp + 0x70]
test eax, eax
js 0x7ff7bffe7638
mov ecx, dword ds:[rbp + 0x8cc]
lea rdx, [rbp + 0xa20]
mov r8d, 0xa
call fcn.7ff7c01259e8
mov rcx, qword ds:[rdi]
lea rax, [rbp + 0xa20]
lea r9, [rbp + 0x470]
mov qword [rbp + 0x488], rax
xor r8d, r8d
mov dword [rbp + 0x470], r15d
mov edx, 0x104c
mov dword [rbp + 0x474], 4
mov dword [rbp + 0x478], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0x8c8]
lea rdx, [rbp + 0xa20]
mov r8d, 0xa
call fcn.7ff7c01259e8
mov rcx, qword [rdi]
lea rax, [rbp + 0xa20]
lea r9, [rbp + 0x4d0]
mov qword [rbp + 0x4e8], rax
xor r8d, r8d
mov dword [rbp + 0x4d0], r15d
mov edx, 0x104c
mov dword [rbp + 0x4d4], 5
mov dword [rbp + 0x4d8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0x8d0]
lea rdx, [rbp + 0xa20]
mov r8d, 0xa
call fcn.7ff7c01259e8
mov rcx, qword [rdi]
lea rax, [rbp + 0xa20]
lea r9, [rbp + 0x530]
mov qword [rbp + 0x548], rax
xor r8d, r8d
mov dword [rbp + 0x530], r15d
mov edx, 0x104c
mov dword [rbp + 0x534], 6
mov dword [rbp + 0x538], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0x8d4]
lea rdx, [rbp + 0xa20]
mov r8d, 0xa
call fcn.7ff7c01259e8
mov rcx, qword [rdi]
lea rax, [rbp + 0xa20]
lea r9, [rbp + 0x900]
mov qword [rbp + 0x918], rax
xor r8d, r8d
mov dword [rbp + 0x900], r15d
mov edx, 0x104c
mov dword [rbp + 0x904], 7
mov dword [rbp + 0x908], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword ds:[rdi + 0x10]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x7ff7bffe9016
cmp qword [rcx], rsi
je 0x7ff7bffe9016
lea rax, [0x7ff7c0177938]
mov qword [rbp + 0x90], 0x12
movzx r8d, r15b
mov qword [rbp + 0x98], rax
lea rdx, [rbp + 0x90]
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x7ff7bffe7848
mov rax, qword [rdi + 8]
lea r9, [rbp + 0x18]
xorps xmm0, xmm0
mov qword [rbp + 0x18], rax
lea r8, [rbp + 0xa8]
mov qword [rbp + 0x20], rsi
mov edx, 0x40
mov dword [rbp + 0xa8], r14d
lea rcx, [rsp + 0x58]
mov qword [rbp + 0xb0], rsi
movdqu xmmword [rbp + 0xc8], xmm0
mov dword [rbp + 0xc0], esi
mov qword [rbp + 0xb8], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x7ff7bffe770c
cmp byte [0x7ff7c01d30ef], sil
je 0x7ff7bffe9016
lea r8, [rbp + 0x18]
mov edx, 0x40
lea rcx, [rsp + 0x58]
call fcn.7ff7c00e3530
nop dword [rax]
test eax, eax
js 0x7ff7bffe9016
mov rdx, qword [rdi + 0x10]
lea r9, [rbp - 0x70]
mov rcx, qword [rsp + 0x58]
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x20000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword ds:[rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x7ff7bffe9016
mov rcx, qword [rbp - 0x70]
lea r8, [rbp + 0x90]
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x7ff7bffe783f
mov ecx, dword [rbp + 0x94]
lea rdx, [rbp + 0xa20]
mov r8d, 0xa
call fcn.7ff7c01259e8
mov eax, dword [rdi + 0xa8]
lea r9, [rbp + 0x900]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x904], eax
mov edx, 0x104c
lea rax, [rbp + 0xa20]
mov dword [rbp + 0x900], r15d
mov qword [rbp + 0x918], rax
mov dword [rbp + 0x908], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x98]
lea rdx, [rbp + 0xa24]
mov r8d, 0x10
mov dword [rbp + 0xa20], 0x780030
call fcn.7ff7c01259c4
mov eax, dword [rdi + 0xac]
lea r9, [rbp + 0x900]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x904], eax
mov edx, 0x104c
lea rax, [rbp + 0xa20]
mov dword [rbp + 0x900], r15d
mov qword [rbp + 0x918], rax
mov dword [rbp + 0x908], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp - 0x70]
jmp 0x7ff7bffe900f
mov rax, qword [rdi + 0x10]
lea rcx, [0x7ff7c0177990]
mov qword [rbp + 0x148], rcx
lea rdx, [rbp + 0x140]
movzx r8d, r15b
mov qword [rbp + 0x140], 0x1e
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
mov rcx, qword [rdi + 0x10]
test al, al
je 0x7ff7bffe78cc
mov rax, qword [rcx + 0x38]
test rax, rax
je 0x7ff7bffe788e
mov rsi, qword [rax + 8]
mov eax, dword [rdi + 0xe8]
lea r9, [rbp + 0x900]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x904], eax
mov dword [rbp + 0x900], r15d
mov dword [rbp + 0x908], r15d
mov qword [rbp + 0x918], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x7ff7bffe9016
mov rcx, qword [rcx + 0x30]
lea r12, [0x7ff7c0175d98]
movzx r8d, r15b
mov qword [rbp + 0x168], r12
lea rdx, [rbp + 0x160]
mov qword [rbp + 0x160], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffe800c
mov rax, qword [rdi + 8]
lea r9, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x28]
mov qword [rbp - 0x78], rsi
mov edx, 0x40
mov dword [rbp - 0x28], r14d
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x20], rsi
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp - 0x10], esi
mov qword [rbp - 0x18], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x7ff7bffe7961
cmp byte [0x7ff7c01d30ef], sil
je 0x7ff7bffe9016
lea r8, [rbp - 0x80]
mov edx, 0x40
lea rcx, [rbp - 0x70]
call fcn.7ff7c00e3530
test eax, eax
js 0x7ff7bffe9016
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x58]
mov rcx, qword [rbp - 0x70]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x2000000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp - 0x70]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x7ff7bffe9016
mov rcx, qword [rsp + 0x58]
lea r9d, [r14 + 9]
lea r8, [rbp + 0x850]
mov byte [rsp + 0x50], sil
lea rdx, [rbp + 0x1e0]
mov dword [rsp + 0x20], 4
xor r13b, r13b
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x7ff7bffe7b27
mov eax, dword ds:[rbp + 0x850]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x7ff7bffe7a12.9
lea rdx, [0x7ff7bffc0000]
movzx eax, byte [rdx + rax + 0x29060]
mov ecx, dword [rdx + rax*4 + 0x2904c]
add rcx, rdx
jmp rcx
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0xa90]
mov dword [rbp + 0xa94], eax
lea rax, [0x7ff7c0177b88]
mov qword [rbp + 0xaa8], rax
mov dword [rbp + 0xa90], r15d
mov dword [rbp + 0xa98], r15d
jmp 0x7ff7bffe7b16
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0xb00]
mov dword [rbp + 0xb04], eax
lea rax, [0x7ff7c0177b98]
mov qword [rbp + 0xb18], rax
mov dword [rbp + 0xb00], r15d
mov dword [rbp + 0xb08], r15d
jmp 0x7ff7bffe7b16
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0x180]
mov dword [rbp + 0x184], eax
lea rax, [0x7ff7c0177ba8]
mov qword [rbp + 0x198], rax
mov byte [rsp + 0x50], r15b
mov dword [rbp + 0x180], r15d
mov dword [rbp + 0x188], r15d
jmp 0x7ff7bffe7b16
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0x200]
mov dword [rbp + 0x204], eax
movzx r13d, r15b
lea rax, [0x7ff7c0177bd0]
mov dword [rbp + 0x200], r15d
mov qword [rbp + 0x218], rax
mov dword [rbp + 0x208], r15d
jmp 0x7ff7bffe7b16
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0xe0]
mov dword [rbp + 0xe4], eax
lea rax, [0x7ff7c0177be0]
mov qword [rbp + 0xf8], rax
mov dword [rbp + 0xe0], r15d
mov dword [rbp + 0xe8], r15d
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d3cd0]
mov edx, 4
mov rbx, qword [rsp + 0x58]
lea r8d, [rdx + 0x2c]
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
lea r9, [rbp + 0x840]
mov qword [rbp + 0x840], 0xffffffffff676980
mov r15, rax
mov rdx, r15
mov dword [rax], 3
mov dword [rax + 4], 0xc0000001
mov qword [rax + 8], rbx
mov dword [rax + 0x10], 0x10
lea rax, [rbp - 0x58]
mov qword [r15 + 0x18], rax
mov dword [r15 + 0x20], 4
call fcn.7ff7c00ec7c0
mov ebx, eax
test eax, eax
js 0x7ff7bffe7b91
mov ebx, dword [r15 + 4]
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
js 0x7ff7bffe7cd7
mov eax, dword ds:[rbp - 0x58]
mov r8d, 6
mov edx, eax
mov ecx, eax
btr edx, 0x18
bts ecx, 0x18
test al, 0x30
cmovne ecx, edx
lea rdx, [0x7ff7c01caae0]
call sym.ProcessHacker.exe_PhGetAccessString
mov ecx, dword [rbp - 0x58]
lea r8, [rbp + 0xb70]
mov rbx, rax
mov dword [rbp + 0x9b0], ecx
mov r15d, 1
mov qword [rbp + 0x990], 4
lea rax, [0x7ff7c0177bec]
mov dword [rbp + 0x980], r15d
mov qword [rbp + 0x998], rax
lea rcx, [rbp + 0x980]
lea rax, [0x7ff7c0176954]
mov dword [rbp + 0x9a0], 0x108
mov qword [rbp + 0x9d8], rax
lea edx, [r15 + 4]
mov byte [rbp + 0x9aa], 0x10
lea rax, [0x7ff7c0177bf4]
mov dword [rbp + 0x9c0], r15d
mov r9d, 0x208
mov qword [rbp + 0x9d0], 4
mov dword [rbp + 0x9e0], r15d
movups xmm0, xmmword [rbx]
mov dword [rbp + 0xa00], r15d
mov qword [rbp + 0xa10], 2
movaps xmmword [rbp + 0x9f0], xmm0
mov qword [rbp + 0xa18], rax
mov qword [rsp + 0x20], rsi
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
je 0x7ff7bffe7cc0
mov eax, dword [rdi + 0xb4]
lea r9, [rbp + 0x30]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x34], eax
mov edx, 0x104c
lea rax, [rbp + 0xb70]
mov dword [rbp + 0x30], r15d
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x38], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, r15d
jne 0x7ff7bffe7cdd
nop
call fcn.7ff7c00c6290
jmp 0x7ff7bffe7cdd
mov r15d, 1
test r13b, r13b
jne 0x7ff7bffe8002
mov rcx, qword [0x7ff7c01d3cd0]
mov r13d, 0x30
mov rbx, qword [rsp + 0x58]
mov r8d, r13d
lea edx, [r13 - 0x2c]
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
lea r9, [rbp + 0x840]
mov qword [rbp + 0x840], 0xffffffffff676980
mov r14, rax
mov rdx, r14
mov dword [rax], 3
mov dword [rax + 4], 0xc0000001
mov qword [rax + 8], rbx
mov dword [rax + 0x10], 5
lea rax, [rbp + 0x800]
mov qword [r14 + 0x18], rax
mov dword [r14 + 0x20], 0x18
call fcn.7ff7c00ec7c0
mov ebx, eax
test eax, eax
js 0x7ff7bffe7d58
mov ebx, dword [r14 + 4]
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop word [rax + rax]
test ebx, ebx
js 0x7ff7bffe7e4b
mov rax, qword ds:[rbp + 0x808]
lea r8, [rbp + 0xb00]
mov r9d, 0x64
mov qword [rbp + 0x170], rax
mov edx, r15d
mov dword [rbp + 0x160], 0xc
lea rcx, [rbp + 0x160]
mov qword [rsp + 0x20], rsi
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
je 0x7ff7bffe7df9
mov eax, dword [rdi + 0xbc]
lea r9, [rbp + 0xe0]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0xe4], eax
mov edx, 0x104c
lea rax, [rbp + 0xb00]
mov dword [rbp + 0xe0], r15d
mov qword [rbp + 0xf8], rax
mov dword [rbp + 0xe8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rsp + 0x50], sil
je 0x7ff7bffe7e4b
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0x200]
cmp byte [rbp + 0x815], sil
mov edx, 0x104c
mov rcx, qword [rdi]
mov dword [rbp + 0x204], eax
lea rax, [0x7ff7c0177bf8]
cmovne r12, rax
mov dword [rbp + 0x200], r15d
xor r8d, r8d
mov qword [rbp + 0x218], r12
mov dword [rbp + 0x208], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, r13
mov rbx, qword [rsp + 0x58]
mov edx, 4
call qword [sym.imp.kernel32.dll_HeapAlloc_1]
lea r9, [rbp + 0x840]
mov qword [rbp + 0x840], 0xffffffffff676980
mov r14, rax
mov rdx, r14
mov dword [rax], 3
mov dword [rax + 4], 0xc0000001
mov qword [rax + 8], rbx
mov dword [rax + 0x10], 0xe
lea rax, [rbp + 0x820]
mov qword [r14 + 0x18], rax
mov dword [r14 + 0x20], 8
call fcn.7ff7c00ec7c0
mov ebx, eax
test eax, eax
js 0x7ff7bffe7eb8
mov ebx, dword [r14 + 4]
mov rcx, qword [0x7ff7c01d3cd0]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop word [rax + rax]
test ebx, ebx
js 0x7ff7bffe8002
mov rax, qword [rbp + 0x820]
test rax, rax
je 0x7ff7bffe8002
mov rcx, qword [rbp + 0x808]
lea r8, [rbp + 0xa90]
mov qword [rsp + 0x20], rsi
mov r9d, 0x64
test rcx, rcx
je 0x7ff7bffe7f9e
xorps xmm1, xmm1
mov qword [rbp + 0x910], rax
cvtsi2sd xmm1, rax
mov dword [rbp + 0x900], 0x10009
lea rdx, [0x7ff7c0176954]
mov qword [rbp + 0x938], rdx
lea rax, [0x7ff7c0177c0c]
mov dword [rbp + 0x920], r15d
lea edx, [r9 - 0x60]
mov qword [rbp + 0x930], 4
xorps xmm0, xmm0
mov dword [rbp + 0x940], 0x4b
cvtsi2sd xmm0, rcx
mov word [rbp + 0x944], r15w
lea rcx, [rbp + 0x900]
mov dword [rbp + 0x960], r15d
mov qword [rbp + 0x970], 4
mov qword [rbp + 0x978], rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x7ff7c01a94f0]
movsd qword [rbp + 0x950], xmm1
jmp 0x7ff7bffe7fb9
mov dword [rbp + 0x140], 0x10009
lea rcx, [rbp + 0x140]
mov qword [rbp + 0x150], rax
mov edx, r15d
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
je 0x7ff7bffe8002
mov eax, dword [rdi + 0xb8]
lea r9, [rbp + 0x180]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x184], eax
mov edx, 0x104c
lea rax, [rbp + 0xa90]
mov dword [rbp + 0x180], r15d
mov qword [rbp + 0x198], rax
mov dword [rbp + 0x188], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x58]
jmp 0x7ff7bffe900f
mov rax, qword [rdi + 0x10]
lea rcx, [0x7ff7c0177218]
mov qword [rbp + 0x848], rcx
lea rdx, [rbp + 0x840]
movzx r8d, r15b
mov qword [rbp + 0x840], 0xe
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffe8360
mov rax, qword [rdi + 8]
lea r9, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x28]
mov qword [rbp - 0x78], rsi
mov edx, 0x40
mov dword [rbp - 0x28], r14d
lea rcx, [rsp + 0x58]
mov qword [rbp - 0x20], rsi
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp - 0x10], esi
mov qword [rbp - 0x18], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x7ff7bffe80a9
cmp byte [0x7ff7c01d30ef], sil
nop
je 0x7ff7bffe9016
lea r8, [rbp - 0x80]
mov edx, 0x40
lea rcx, [rsp + 0x58]
call fcn.7ff7c00e3530
nop dword [rax]
test eax, eax
js 0x7ff7bffe9016
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov ebx, eax
test eax, eax
jns 0x7ff7bffe811e
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax]
test ebx, ebx
js 0x7ff7bffe9016
mov rcx, qword [rsp + 0x70]
lea r15, [0x7ff7c0176740]
mov r9d, 0x18
mov qword [rbp - 0x50], rsi
lea r8, [rbp + 0x800]
mov qword [rsp + 0x20], rsi
xor edx, edx
mov r12, r15
mov r13, rsi
call qword [sym.imp.ntdll.dll_NtQuerySection]
nop dword [rax + rax]
test eax, eax
js 0x7ff7bffe8200
mov eax, dword [rbp + 0x808]
bt eax, 0x1b
jae 0x7ff7bffe818d
lea r12, [0x7ff7c0177c18]
jmp 0x7ff7bffe81ba
bt eax, 0x17
jae 0x7ff7bffe819c
lea r12, [0x7ff7c0175d98]
jmp 0x7ff7bffe81ba
bt eax, 0x18
jae 0x7ff7bffe81ab
lea r12, [0x7ff7c0177c28]
jmp 0x7ff7bffe81ba
bt eax, 0x1a
lea r12, [0x7ff7c0177c38]
cmovae r12, r15
movzx eax, byte [0x7ff7c01d1968]
lea rcx, ds:[rbp + 0x1e0]
xor r8d, r8d
mov byte [rbp + 0x1ea], al
mov rax, qword [rbp + 0x810]
mov dword [rbp + 0x1e0], 0x10c
mov qword [rbp + 0x1f0], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov r13, rax
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x820]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x70]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov rdx, r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov qword [rbp + 0x820], 1
mov qword [rbp - 0x70], rsi
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop
test eax, eax
js 0x7ff7bffe82a0
mov rdx, qword [rbp - 0x70]
lea r8, [rbp - 0x50]
mov rcx, r14
call sym.ProcessHacker.exe_PhGetProcessMappedFileName
mov rdx, qword ds:[rbp - 0x70]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov rsi, qword [rbp - 0x50]
test ebx, ebx
js 0x7ff7bffe82a0
mov rcx, rsi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, rsi
call sym.ProcessHacker.exe_PhResolveDevicePrefix
nop
test rax, rax
je 0x7ff7bffe82a0
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rsi, rax
mov eax, dword ds:[rdi + 0xc0]
lea r9, [rbp + 0x30]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x34], eax
mov dword [rbp + 0x30], 1
mov dword [rbp + 0x38], 1
mov qword [rbp + 0x48], r12
call qword [sym.imp.USER32.dll_SendMessageW]
test rsi, rsi
je 0x7ff7bffe82e1
mov rcx, qword [rsi + 8]
jmp 0x7ff7bffe82e8
lea rcx, [0x7ff7c0177c48]
mov eax, dword [rdi + 0xc4]
lea r9, [rbp + 0x30]
mov qword [rbp + 0x48], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x30], 1
mov dword [rbp + 0x34], eax
mov dword [rbp + 0x38], 1
call qword [sym.imp.USER32.dll_SendMessageW]
test r13, r13
je 0x7ff7bffe8321
mov r15, qword [r13 + 8]
mov eax, dword ds:[rdi + 0xc8]
lea r9, [rbp + 0x30]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x34], eax
mov dword [rbp + 0x30], 1
mov dword [rbp + 0x38], 1
mov qword [rbp + 0x48], r15
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x70]
jmp 0x7ff7bffe900f
mov rax, qword ds:[rdi + 0x10]
lea rcx, [0x7ff7c0177a78]
mov qword [rbp + 0x858], rcx
lea rdx, [rbp + 0x850]
movzx r8d, r15b
mov qword [rbp + 0x850], 0xc
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffe85ae
mov rax, qword [rdi + 8]
lea r9, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x28]
mov qword [rbp - 0x78], rsi
mov edx, 0x40
mov dword [rbp - 0x28], r14d
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x20], rsi
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp - 0x10], esi
mov qword [rbp - 0x18], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x7ff7bffe83fd
cmp byte [0x7ff7c01d30ef], sil
je 0x7ff7bffe9016
lea r8, [rbp - 0x80]
mov edx, 0x40
lea rcx, [rbp - 0x70]
call fcn.7ff7c00e3530
test eax, eax
js 0x7ff7bffe9016
mov rdx, qword ds:[rdi + 0x10]
lea r9, [rsp + 0x58]
mov rcx, qword [rbp - 0x70]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp - 0x70]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x7ff7bffe9016
mov rcx, qword [rsp + 0x58]
lea r9d, [r14 + 9]
lea r8, [rbp - 0x58]
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x7ff7bffe851a
movsxd rax, dword ds:[rbp - 0x58]
lea rcx, [rbp + 0x800]
xor r8d, r8d
mov qword [rbp + 0x810], rax
mov edx, r15d
mov dword [rbp + 0x800], 0x10009
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [rdi]
lea r9, [rbp + 0x30]
xor r8d, r8d
mov dword [rbp + 0x30], r15d
mov dword [rbp + 0x38], r15d
mov rdx, qword [rax + 8]
mov eax, dword [rdi + 0xcc]
mov qword [rbp + 0x48], rdx
mov edx, 0x104c
mov dword [rbp + 0x34], eax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rbp - 0x53], sil
lea rax, [0x7ff7c0177c50]
lea rcx, [0x7ff7c0177c60]
mov dword [rbp + 0xe0], r15d
cmovne rcx, rax
mov dword [rbp + 0xe8], r15d
mov eax, dword [rdi + 0xd0]
lea r9, [rbp + 0xe0]
mov qword [rbp + 0xf8], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0xe4], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x58]
lea r8, [rbp + 0x820]
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
mov edx, r15d
call qword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x7ff7bffe8002
cmp qword [rbp + 0x820], rsi
je 0x7ff7bffe8002
lea rcx, [rbp + 0x820]
call sym.ProcessHacker.exe_PhStdGetClientIdName
mov edx, dword [rdi + 0xd4]
lea r9, [rbp + 0x30]
mov rcx, qword [rdi]
mov rbx, rax
mov dword [rbp + 0x34], edx
mov edx, 0x104c
mov r8, qword [rax + 8]
mov qword [rbp + 0x48], r8
xor r8d, r8d
mov dword [rbp + 0x30], r15d
mov dword [rbp + 0x38], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, r15d
jne 0x7ff7bffe8002
call fcn.7ff7c00c6290
mov rcx, qword [rsp + 0x58]
jmp 0x7ff7bffe900f
mov rax, qword [rdi + 0x10]
lea rcx, [0x7ff7c0175cd0]
mov qword [rbp - 0x68], rcx
lea rdx, [rbp - 0x70]
movzx r8d, r15b
mov qword [rbp - 0x70], 0xe
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffe8af5
mov rax, qword [rdi + 8]
lea r9, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x28]
mov qword [rbp - 0x78], rsi
mov edx, 0x40
mov dword [rbp - 0x28], r14d
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x20], rsi
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp - 0x10], esi
mov qword [rbp - 0x18], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x7ff7bffe8640
cmp byte [0x7ff7c01d30ef], sil
je 0x7ff7bffe9016
lea r8, [rbp - 0x80]
mov edx, 0x40
lea rcx, [rsp + 0x78]
call fcn.7ff7c00e3530
test eax, eax
js 0x7ff7bffe9016
mov rdx, qword [rdi + 0x10]
lea r9, [rbp - 0x30]
mov rcx, qword [rsp + 0x78]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x7ff7bffe9016
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0x820]
call sym.ProcessHacker.exe_PhGetProcessImageFileName
test eax, eax
js 0x7ff7bffe873a
mov rbx, qword [rbp + 0x820]
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetFileName
mov r15, rax
test rbx, rbx
je 0x7ff7bffe86d5
lea rcx, [rbx - 0x10]
mov edx, r14d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7bffe86d5
nop
call fcn.7ff7c00c6290
test r15, r15
je 0x7ff7bffe86e0
mov rcx, qword [r15 + 8]
jmp 0x7ff7bffe86e3
mov rcx, r13
mov eax, dword [rdi + 0xd8]
lea r9, [rbp + 0x5f0]
mov qword [rbp + 0x608], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x5f0], 1
mov dword [rbp + 0x5f4], eax
mov dword [rbp + 0x5f8], 1
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, ds:[r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffe873a
call fcn.7ff7c00c6290
mov rcx, qword [rbp - 0x30]
lea r8, [rbp + 0x7d0]
mov r9d, 0x30
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rcx, qword [rbp - 0x30]
lea r8, [rbp + 0x880]
mov r9d, 0x20
mov qword [rsp + 0x20], rsi
test eax, eax
mov r12d, 0x103
cmovns r12d, dword [rbp + 0x7d0]
lea edx, [r9 - 0x1c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
nop dword [rax + rax]
test eax, eax
js 0x7ff7bffe89da
mov ebx, 0x7ffe0024
mov esi, 0x7ffe0020
lea r15d, [rbx + 4]
nop word [rax + rax]
mov ecx, dword [rbx]
mov eax, dword [rsi]
mov dword [rsp + 0x68], eax
mov eax, dword [r15]
mov dword [rsp + 0x6c], ecx
cmp ecx, eax
jne 0x7ff7bffe87b0
mov eax, dword [rbp + 0x880]
lea rdx, [rbp + 0x870]
mov dword [rbp - 0x40], eax
lea rcx, [rbp - 0x40]
mov eax, dword [rbp + 0x884]
mov dword [rbp - 0x3c], eax
mov rax, qword [rsp + 0x68]
sub qword [rbp - 0x40], rax
call qword [sym.imp.ntdll.dll_RtlTimeToTimeFields]
movzx eax, word [rbp + 0x870]
lea rcx, [rbp + 0x830]
mov word [rbp + 0x830], ax
movzx eax, word [rbp + 0x872]
mov word [rbp + 0x832], ax
movzx eax, word [rbp + 0x874]
mov word [rbp + 0x836], ax
movzx eax, word [rbp + 0x876]
mov word [rbp + 0x838], ax
movzx eax, word [rbp + 0x878]
mov word [rbp + 0x83a], ax
movzx eax, word [rbp + 0x87a]
mov word [rbp + 0x83c], ax
movzx eax, word [rbp + 0x87c]
mov word [rbp + 0x83e], ax
movzx eax, word [rbp + 0x87e]
mov word [rbp + 0x834], ax
call sym.ProcessHacker.exe_PhFormatDateTime
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [rdi]
lea r9, [rbp + 0x590]
xor r8d, r8d
mov dword [rbp + 0x590], 1
mov dword [rbp + 0x598], 1
mov rdx, qword [rax + 8]
mov eax, dword [rdi + 0xdc]
mov qword [rbp + 0x5a8], rdx
mov edx, 0x104c
mov dword [rbp + 0x594], eax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp r12d, 0x103
je 0x7ff7bffe8aea
nop word [rax + rax]
mov ecx, dword [rbx]
mov eax, dword [rsi]
mov dword [rsp + 0x68], eax
mov eax, dword [r15]
mov dword [rsp + 0x6c], ecx
cmp ecx, eax
jne 0x7ff7bffe88d0
mov eax, dword [rbp + 0x888]
lea rdx, [rbp + 0x860]
mov dword [rbp - 0x38], eax
lea rcx, [rbp - 0x38]
mov eax, dword [rbp + 0x88c]
mov dword [rbp - 0x34], eax
mov rax, qword [rsp + 0x68]
sub qword [rbp - 0x38], rax
call qword [sym.imp.ntdll.dll_RtlTimeToTimeFields]
movzx eax, word [rbp + 0x860]
lea rcx, [rbp + 0x830]
mov word [rbp + 0x830], ax
movzx eax, word [rbp + 0x862]
mov word [rbp + 0x832], ax
movzx eax, word [rbp + 0x864]
mov word [rbp + 0x836], ax
movzx eax, word [rbp + 0x866]
mov word [rbp + 0x838], ax
movzx eax, word [rbp + 0x868]
mov word [rbp + 0x83a], ax
movzx eax, word [rbp + 0x86a]
mov word [rbp + 0x83c], ax
movzx eax, word [rbp + 0x86c]
mov word [rbp + 0x83e], ax
movzx eax, word [rbp + 0x86e]
mov word [rbp + 0x834], ax
call sym.ProcessHacker.exe_PhFormatDateTime
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [rdi]
lea r9, [rbp + 0x650]
xor r8d, r8d
mov dword [rbp + 0x650], 1
mov dword [rbp + 0x658], 1
mov rdx, qword [rax + 8]
mov eax, dword [rdi + 0xe0]
mov qword [rbp + 0x668], rdx
mov edx, 0x104c
mov dword [rbp + 0x654], eax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x7ff7bffe89e7
cmp r12d, 0x103
je 0x7ff7bffe8aea
nop word [rax + rax]
cmp r12d, 0xc0000022
je 0x7ff7bffe8a1d
cmp r12d, 0xc0000005
je 0x7ff7bffe8a1d
mov eax, r12d
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x7ff7bffe8a2a
movzx eax, r12w
jmp 0x7ff7bffe8a26
mov ecx, r12d
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x7ff7bffe8a37
mov ecx, r12d
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x7ff7bffe8a3e
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
test rax, rax
je 0x7ff7bffe8a4c
mov r15, qword [rax + 8]
jmp 0x7ff7bffe8a53
lea r15, [0x7ff7c0176740]
mov r8, r15
lea rcx, [0x7ff7c0177b70]
mov edx, r12d
call sym.ProcessHacker.exe_PhFormatString
mov rsi, rax
test rax, rax
je 0x7ff7bffe8a71
mov r13, qword [rax + 8]
mov eax, dword ds:[rdi + 0xe4]
lea r9, [rbp + 0x6b0]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x6b4], eax
mov dword [rbp + 0x6b0], 1
mov dword [rbp + 0x6b8], 1
mov qword [rbp + 0x6c8], r13
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsi - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffe8acc
call fcn.7ff7c00c6290
nop dword [rax]
test rbx, rbx
je 0x7ff7bffe8aea
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x7ff7bffe8aea
call fcn.7ff7c00c6290
mov rcx, qword ds:[rbp - 0x30]
jmp 0x7ff7bffe900f
mov rax, qword [rdi + 0x10]
lea rcx, [0x7ff7c0177250]
mov qword [rsp + 0x60], rcx
lea rdx, [rsp + 0x58]
movzx r8d, r15b
mov qword [rsp + 0x58], 0xc
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x7ff7bffe9016
mov rax, qword [rdi + 8]
lea r9, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x28]
mov qword [rbp - 0x78], rsi
mov edx, 0x40
mov dword [rbp - 0x28], r14d
lea rcx, [rbp + 0x10]
mov qword [rbp - 0x20], rsi
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp - 0x10], esi
mov qword [rbp - 0x18], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x7ff7bffe8b88
cmp byte [0x7ff7c01d30ef], sil
je 0x7ff7bffe9016
lea r8, [rbp - 0x80]
mov edx, 0x40
lea rcx, [rbp + 0x10]
call fcn.7ff7c00e3530
nop dword [rax + rax]
test eax, eax
js 0x7ff7bffe9016
mov rdx, qword [rdi + 0x10]
lea r9, [rbp - 0x48]
mov rcx, qword [rbp + 0x10]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x800
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword ds:[rbp + 0x10]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x7ff7bffe9016
mov rcx, qword ds:[rbp - 0x48]
lea rdx, [rbp + 0x820]
xor r12b, r12b
call fcn.7ff7c00e26e0
test eax, eax
js 0x7ff7bffe8c5d
mov rbx, qword [rbp + 0x820]
test rbx, rbx
je 0x7ff7bffe8c0b
mov rcx, qword [rbx + 8]
jmp 0x7ff7bffe8c0e
mov rcx, r13
mov eax, dword [rdi + 0xd8]
lea r9, [rbp + 0x710]
mov qword [rbp + 0x728], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x710], r15d
mov dword [rbp + 0x714], eax
mov dword [rbp + 0x718], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, r15d
jne 0x7ff7bffe8c5d
call fcn.7ff7c00c6290
mov rcx, qword [rbp - 0x48]
lea r8, [rbp - 0x60]
mov r9d, 4
mov qword [rsp + 0x20], rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x7ff7bffe8dbb
mov eax, dword ds:[rbp - 0x60]
test eax, eax
setne r12b
test eax, eax
je 0x7ff7bffe8dbb
mov rcx, qword [rbp - 0x48]
lea r8, [rbp + 0x2c0]
mov r9d, 0x30
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x7ff7bffe8dbb
mov ebx, dword [rbp + 0x2c0]
cmp ebx, 0xc0000022
je 0x7ff7bffe8ceb
nop dword [rax]
cmp ebx, 0xc0000005
je 0x7ff7bffe8ceb
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x7ff7bffe8cfa
movzx eax, bx
jmp 0x7ff7bffe8cf6
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x7ff7bffe8d03
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x7ff7bffe8d0a
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
test rax, rax
je 0x7ff7bffe8d1b
mov r15, qword [rax + 8]
jmp 0x7ff7bffe8d22
lea r15, [0x7ff7c0176740]
mov edx, dword [rbp + 0x2c0]
lea rcx, [0x7ff7c0177b70]
mov r8, r15
call sym.ProcessHacker.exe_PhFormatString
mov r15, rax
test rax, rax
je 0x7ff7bffe8d43
mov r13, qword [rax + 8]
mov eax, dword [rdi + 0xe4]
lea r9, [rbp + 0x770]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x774], eax
mov dword [rbp + 0x770], 1
mov dword [rbp + 0x778], 1
mov qword [rbp + 0x788], r13
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, ds:[r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffe8d9a
call fcn.7ff7c00c6290
test rbx, rbx
je 0x7ff7bffe8db5
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x7ff7bffe8db5
nop
call fcn.7ff7c00c6290
mov r15d, 1
mov rcx, qword [rbp - 0x48]
lea r8, [rbp + 0x8a0]
mov r9d, 0x20
mov qword [rsp + 0x20], rsi
mov edx, r15d
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x7ff7bffe900b
mov ebx, 0x7ffe0024
mov esi, 0x7ffe0020
lea r15d, [rbx + 4]
mov ecx, dword [rbx]
mov eax, dword [rsi]
mov dword [rsp + 0x78], eax
mov eax, dword [r15]
mov dword [rsp + 0x7c], ecx
cmp ecx, eax
jne 0x7ff7bffe8df0
mov eax, dword ds:[rbp + 0x8a0]
lea rdx, [rbp + 0x840]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x58]
mov eax, dword [rbp + 0x8a4]
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x78]
sub qword [rsp + 0x58], rax
call qword [sym.imp.ntdll.dll_RtlTimeToTimeFields]
movzx eax, word ds:[rbp + 0x840]
lea rcx, [rbp + 0x820]
mov word [rbp + 0x820], ax
movzx eax, word [rbp + 0x842]
mov word [rbp + 0x822], ax
movzx eax, word [rbp + 0x844]
mov word [rbp + 0x826], ax
movzx eax, word [rbp + 0x846]
mov word [rbp + 0x828], ax
movzx eax, word [rbp + 0x848]
mov word [rbp + 0x82a], ax
movzx eax, word [rbp + 0x84a]
mov word [rbp + 0x82c], ax
movzx eax, word [rbp + 0x84c]
mov word [rbp + 0x82e], ax
movzx eax, word [rbp + 0x84e]
mov word [rbp + 0x824], ax
call sym.ProcessHacker.exe_PhFormatDateTime
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, ds:[rbp + 0x30]
mov dword [rbp + 0x30], 1
xor r8d, r8d
mov dword [rbp + 0x38], 1
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov eax, dword [rdi + 0xdc]
mov qword [rbp + 0x48], rcx
mov rcx, qword [rdi]
mov dword [rbp + 0x34], eax
call qword [sym.imp.USER32.dll_SendMessageW]
test r12b, r12b
je 0x7ff7bffe900b
nop
mov ecx, dword ds:[rbx]
mov eax, dword [rsi]
mov dword [rsp + 0x78], eax
mov eax, dword [r15]
mov dword [rsp + 0x7c], ecx
cmp ecx, eax
jne 0x7ff7bffe8f00
mov eax, dword [rbp + 0x8a8]
lea rdx, [rbp + 0x850]
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x70]
mov eax, dword [rbp + 0x8ac]
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x78]
sub qword [rsp + 0x70], rax
call qword [sym.imp.ntdll.dll_RtlTimeToTimeFields]
movzx eax, word [rbp + 0x850]
lea rcx, [rbp + 0x820]
mov word [rbp + 0x820], ax
movzx eax, word [rbp + 0x852]
mov word [rbp + 0x822], ax
movzx eax, word [rbp + 0x854]
mov word [rbp + 0x826], ax
movzx eax, word [rbp + 0x856]
mov word [rbp + 0x828], ax
movzx eax, word [rbp + 0x858]
mov word [rbp + 0x82a], ax
movzx eax, word [rbp + 0x85a]
mov word [rbp + 0x82c], ax
movzx eax, word [rbp + 0x85c]
mov word [rbp + 0x82e], ax
movzx eax, word [rbp + 0x85e]
mov word [rbp + 0x824], ax
call sym.ProcessHacker.exe_PhFormatDateTime
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rbp + 0xe0]
mov dword [rbp + 0xe0], 1
xor r8d, r8d
mov dword [rbp + 0xe8], 1
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov eax, dword [rdi + 0xe0]
mov qword [rbp + 0xf8], rcx
mov rcx, qword [rdi]
mov dword [rbp + 0xe4], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp - 0x48]
nop
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, qword [rsp + 0xec8]
mov rcx, qword [rbp + 0xd80]
xor rcx, rsp
call fcn.7ff7c0121390
lea r11, [rsp + 0xe90]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret