Function at 0x14007f2c0
Capabilities:
Check processdebugport

Disassembly:
mov rax, rsp
push rdi
push r14
sub rsp, 0xa8
cmp qword [rcx + 0x20], 0
mov rdi, rcx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x28], rsi
mov rsi, rdx
mov rax, qword [rdx + 0x58]
mov qword [rcx + 0x28], rax
mov eax, dword [rdx + 0x64]
mov dword [rcx + 0x38], eax
mov rax, qword [rdx + 0x20]
mov qword [rcx + 0x40], rax
je 0x14007f371
movzx eax, word [rdx + 0x38]
xor r14d, r14d
test ax, ax
jne 0x14007f311
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x14007f3c9
mov qword [rsp + 0x98], rbp
movzx ebp, ax
mov qword [rsp + 0x88], r15
mov r15, qword [rdx + 0x40]
mov rdx, qword [0x140196800]
lea rcx, [rbp + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rbp
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rbp], r14w
test r15, r15
je 0x14007f35f
mov rcx, qword [rbx + 8]
mov r8d, ebp
mov rdx, r15
call fcn.14010e700
mov rbp, qword [rsp + 0x98]
mov r15, qword [rsp + 0x88]
jmp 0x14007f3c9
mov rdx, qword [0x140196800]
mov ecx, 0x38
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], 0x26
add rax, 0x10
mov qword [rbx + 8], rax
xor r14d, r14d
mov word [rax + 0x26], r14w
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.System_Idle_Process]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140159730]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x140159740]
mov dword [rcx + 0x20], eax
movzx eax, word [0x140159744]
mov word [rcx + 0x24], ax
mov qword [rdi + 0x30], rbx
lea rdx, [rdi + 0x112]
mov ecx, dword [rdi + 0x28]
mov r8d, 0xa
call fcn.14010ffa8
mov ecx, dword [rdi + 0x38]
lea rdx, [rdi + 0x12c]
mov r8d, 0xa
call fcn.14010ffa8
mov r8, qword [rdi + 0x20]
test r8, r8
jle 0x14007f435
mov edx, 0x400
lea rcx, [rdi + 0x48]
call fcn.1400d3b50
test eax, eax
js 0x14007f41c
or dword [rdi + 0xd0], 0x80
cmp qword [rdi + 0x48], 0
jne 0x14007f435
mov r8, qword [rdi + 0x20]
lea rcx, [rdi + 0x48]
mov edx, 0x1000
call fcn.1400d3b50
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x14007f48c
mov r9d, 0x40
mov qword [rsp + 0x40], 0x40
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r14
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14007f48c
mov eax, dword [rsp + 0x78]
mov ecx, eax
and dword [rdi + 0xd0], 0xfffe3dff
and ecx, 1
shl ecx, 6
and eax, 0x182
or ecx, eax
or ecx, 8
shl ecx, 8
or dword [rdi + 0xd0], ecx
mov rax, qword [rdi + 0x20]
cmp rax, 4
je 0x14007f4c2
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x14007f4aa
lea rdx, [rdi + 0x50]
call sym.ProcessHacker.exe_PhGetProcessImageFileNameWin32
jmp 0x14007f4f1
lea rdx, [rsp + 0x30]
mov rcx, rax
call sym.ProcessHacker.exe_PhGetProcessImageFileNameByProcessId
test eax, eax
js 0x14007f4f1
mov rbx, qword [rsp + 0x30]
jmp 0x14007f4cf
call sym.ProcessHacker.exe_PhGetKernelFileName
mov rbx, rax
test rax, rax
je 0x14007f4f1
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetFileName
mov qword [rdi + 0x50], rax
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14007f4f1
call fcn.1400c8bc0
mov rbx, qword [rdi + 0x48]
test rbx, rbx
je 0x14007f5a6
cmp qword [rdi + 0x20], 4
je 0x14007f5a6
cmp byte [0x1401937ba], 0
lea r8, [rsp + 0xd0]
mov edx, 8
mov rcx, rbx
jne 0x14007f54c
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, 0xc0000022
jne 0x14007f551
cmp byte [0x1401937ba], 0
je 0x14007f5c7
lea r8, [rsp + 0xd0]
mov edx, 8
mov rcx, rbx
call fcn.1400dcbd0
test eax, eax
js 0x14007f5c7
mov rcx, qword [rsp + 0xd0]
lea r8, [rsp + 0x38]
mov edx, 1
call fcn.1400d55f0
test eax, eax
js 0x14007f596
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rbx]
call fcn.14007e5f0
mov rcx, qword [0x140196670]
mov r8, rbx
xor edx, edx
mov qword [rdi + 0x90], rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14007f5c7
test qword [rdi + 0x20], 0xfffffffffffffffb
jne 0x14007f5c7
mov rax, qword [0x140192540]
mov qword [rdi + 0x90], rax
test rax, rax
je 0x14007f5c7
lock inc dword [rax - 8]
mov rdx, qword [rdi + 0x50]
mov rcx, qword [rdi + 0x20]
call sym.ProcessHacker.exe_PhGetProcessKnownTypeEx
mov rcx, qword [rdi + 0x48]
mov rbx, qword [rsp + 0xa0]
mov dword [rdi + 0x370], eax
test rcx, rcx
je 0x14007f641
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
jb 0x14007f625
mov r9d, 1
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0xc0]
lea edx, [r9 + 0x3c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14007f648
movzx eax, byte [rsp + 0xc0]
mov byte [rdi + 0x374], al
jmp 0x14007f648
test dword [rdi + 0xd0], 0x4000
je 0x14007f648
and byte [rdi + 0x374], 0xfa
or byte [rdi + 0x374], 2
jmp 0x14007f648
mov byte [rdi + 0x374], 0xff
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
jb 0x14007f6a6
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x14007f6a6
mov r9d, 8
mov dword [rsp + 0xd8], 7
lea r8, [rsp + 0xd8]
mov qword [rsp + 0x20], r14
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14007f6a6
movzx eax, byte [rsp + 0xdc]
and dword [rdi + 0xd0], 0xfffdffff
and al, 1
movzx eax, al
shl eax, 0x11
or dword [rdi + 0xd0], eax
cmp dword [rsi + 4], 0
mov rsi, qword [rsp + 0x90]
jne 0x14007f6c7
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x14007f6c7
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rdi + 0x48], r14
add rsp, 0xa8
pop r14
pop rdi
ret