Function at 0x140030c40
Capabilities:
Check mutex on windows
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc20]
sub rsp, 0xd20
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rbp + 0xc10], rax
mov rax, qword [rcx + 0x10]
lea r12, [0x1401b790c]
mov rdi, rcx
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140030c95
mov rdx, qword [rcx + 8]
jmp 0x140030c98
mov rdx, r12
mov eax, dword [rdi + 0x88]
lea r9, [rbp + 0x4d0]
mov rcx, qword [rdi]
mov r15d, 1
mov qword [rbp + 0x4e8], rdx
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x4d0], r15d
mov dword [rbp + 0x4d8], r15d
mov dword [rbp + 0x4d4], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword ds:[rdi + 0x10]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x140030ceb
mov rcx, qword [rcx + 8]
jmp 0x140030cee
mov rcx, r12
mov eax, dword [rdi + 0x8c]
lea r9, [rbp + 0x530]
mov qword [rbp + 0x548], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x530], r15d
mov dword [rbp + 0x534], eax
mov dword [rbp + 0x538], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x10]
mov r14d, 0x30
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140030d98
lea r8d, [r14 - 0x20]
mov dword [rbp + 0x8b0], 0x780030
lea rdx, [rbp + 0x8b4]
call fcn.140189620
mov eax, dword [rdi + 0x90]
lea r9, [rbp + 0x1d0]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x1d4], eax
mov edx, 0x104c
lea rax, [rbp + 0x8b0]
mov dword [rbp + 0x1d0], r15d
mov qword [rbp + 0x1e8], rax
mov dword [rbp + 0x1d8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 0x10]
mov rcx, qword ds:[rax + 0x30]
test rcx, rcx
je 0x140030dab
mov rcx, qword [rcx + 8]
jmp 0x140030dae
mov rcx, r12
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0xf0]
call sym.ProcessHacker.exe_PhGetAccessEntries
mov rcx, qword [rdi + 0x10]
test al, al
je 0x140030eba
mov rbx, qword ds:[rbp + 0xf0]
mov r8d, dword [rbp - 0x50]
mov rdx, rbx
mov ecx, dword [rcx + 0x24]
call sym.ProcessHacker.exe_PhGetAccessString
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
cmp qword [rax], 0
je 0x140030e3e
mov rcx, qword [rdi + 0x10]
mov r8, qword [rax + 8]
mov edx, dword [rcx + 0x24]
lea rcx, str.0x_x___s_
call sym.ProcessHacker.exe_PhFormatString
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov dword [rbp + 0x470], r15d
lea r9, [rbp + 0x470]
mov dword [rbp + 0x474], 3
mov dword [rbp + 0x478], r15d
mov rcx, qword [rax + 8]
mov qword [rbp + 0x488], rcx
jmp 0x140030e92
mov rax, qword ds:[rdi + 0x10]
lea rdx, [rbp + 0x8b4]
mov r8d, 0x10
mov ecx, dword [rax + 0x24]
mov dword [rbp + 0x8b0], 0x780030
call fcn.140189620
lea rax, [rbp + 0x8b0]
mov dword [rbp + 0x170], r15d
mov qword [rbp + 0x188], rax
lea r9, [rbp + 0x170]
mov dword [rbp + 0x174], 3
mov dword [rbp + 0x178], r15d
mov rcx, qword ds:[rdi]
xor r8d, r8d
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140241998]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140030f17
mov ecx, dword [rcx + 0x24]
lea rdx, [rbp + 0x8b4]
mov r8d, 0x10
mov dword [rbp + 0x8b0], 0x780030
call fcn.140189620
mov rcx, qword [rdi]
lea rax, [rbp + 0x8b0]
lea r9, [rbp + 0x170]
mov qword [rbp + 0x188], rax
xor r8d, r8d
mov dword [rbp + 0x170], r15d
mov edx, 0x104c
mov dword [rbp + 0x174], 3
mov dword [rbp + 0x178], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi + 8]
lea r9, [rbp - 0x48]
xor esi, esi
mov qword [rbp - 0x48], rax
xorps xmm0, xmm0
mov qword [rbp - 0x40], rsi
lea r8, [rbp + 0xf8]
mov dword [rbp + 0xf8], r14d
lea rcx, [rbp + 0x5f8]
mov qword [rbp + 0x100], rsi
lea edx, [rsi + 0x40]
mov dword [rbp + 0x110], esi
mov qword [rbp + 0x108], rsi
movdqu xmmword [rbp + 0x118], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
lea rbx, [0x14011fab0]
cmp eax, 0xc0000022
jne 0x140031038
cmp byte [0x140240e3f], sil
nop
je 0x140031215
mov rcx, qword [0x140241b70]
lea rax, [rbp + 0x5f8]
mov qword [rbp + 0x770], rax
lea r8, [0x14011f940]
mov dword [rsp + 0x48], esi
lea rax, [rbp - 0x48]
mov qword [rbp + 0x780], rax
xor r9d, r9d
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x770]
mov qword [rbp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x38], 4
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x128]
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x778], 0x40
mov dword [rbp + 0x788], esi
mov dword [rbp - 0x4c], 2
mov qword [rbp + 0x138], rbx
mov dword [rbp + 0x148], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov eax, dword [rbp + 0x148]
test ebx, ebx
cmovs eax, ebx
lea rbx, [0x14011fab0]
nop dword [rax + rax]
test eax, eax
js 0x140031215
mov rax, qword [rdi + 0x10]
lea rcx, [rbp + 0x6e8]
mov qword [rsp + 0x48], rsi
xor r9d, r9d
mov qword [rsp + 0x40], rsi
mov r8d, 0xffffffff
mov qword [rsp + 0x38], rsi
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x5a8]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x5f8]
call sym.ProcessHacker.exe_PhGetHandleInformationEx
test eax, eax
js 0x140031208
mov eax, dword ds:[rbp + 0x5a8]
test eax, eax
js 0x140031208
mov ecx, dword ds:[rbp + 0x6f4]
lea rdx, [rbp + 0x8b0]
mov r8d, 0xa
call fcn.140189644
mov rcx, qword ds:[rdi]
lea rax, [rbp + 0x8b0]
lea r9, [rbp + 0x790]
mov qword [rbp + 0x7a8], rax
xor r8d, r8d
mov dword [rbp + 0x790], r15d
mov edx, 0x104c
mov dword [rbp + 0x794], 4
mov dword [rbp + 0x798], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0x6f0]
lea rdx, [rbp + 0x8b0]
mov r8d, 0xa
call fcn.140189644
mov rcx, qword [rdi]
lea rax, [rbp + 0x8b0]
lea r9, [rbp + 0x920]
mov qword [rbp + 0x938], rax
xor r8d, r8d
mov dword [rbp + 0x920], r15d
mov edx, 0x104c
mov dword [rbp + 0x924], 5
mov dword [rbp + 0x928], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0x6f8]
lea rdx, [rbp + 0x8b0]
mov r8d, 0xa
call fcn.140189644
mov rcx, qword [rdi]
lea rax, [rbp + 0x8b0]
lea r9, [rbp + 0x990]
mov qword [rbp + 0x9a8], rax
xor r8d, r8d
mov dword [rbp + 0x990], r15d
mov edx, 0x104c
mov dword [rbp + 0x994], 6
mov dword [rbp + 0x998], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rbp + 0x6fc]
lea rdx, [rbp + 0x8b0]
mov r8d, 0xa
call fcn.140189644
mov rcx, qword [rdi]
lea rax, [rbp + 0x8b0]
lea r9, [rbp + 0x90]
mov qword [rbp + 0xa8], rax
xor r8d, r8d
mov dword [rbp + 0x90], r15d
mov edx, 0x104c
mov dword [rbp + 0x94], 7
mov dword [rbp + 0x98], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x5f8]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword ds:[rdi + 0x10]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x140032c15
cmp qword [rcx], rsi
je 0x140032c15
lea rax, str.ALPC_Port
mov qword [rbp + 0x600], 0x12
movzx r8d, r15b
mov qword [rbp + 0x608], rax
lea rdx, [rbp + 0x600]
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax + rax]
test al, al
je 0x1400314d6
mov rax, qword [rdi + 8]
lea r9, [rbp - 0x48]
xorps xmm0, xmm0
mov qword [rbp - 0x48], rax
lea r8, [rbp + 0xf8]
mov qword [rbp + 0x590], rsi
mov edx, 0x40
mov qword [rbp - 0x40], rsi
lea rcx, [rbp + 0x598]
mov dword [rbp + 0xf8], r14d
movdqu xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x100], rsi
mov dword [rbp + 0x110], esi
mov qword [rbp + 0x108], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
nop
cmp eax, 0xc0000022
jne 0x140031387
cmp byte [0x140240e3f], sil
je 0x140032c15
mov rcx, qword [0x140241b70]
lea rax, [rbp + 0x598]
mov qword [rbp + 0x770], rax
lea r8, [0x14011f940]
mov dword [rsp + 0x48], esi
lea rax, [rbp - 0x48]
mov qword [rbp + 0x780], rax
xor r9d, r9d
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x770]
mov qword [rbp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x38], 4
lea rax, [rbp + 0x5a8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x128]
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x778], 0x40
mov dword [rbp + 0x788], esi
mov dword [rbp + 0x5a8], 2
mov qword [rbp + 0x138], rbx
mov dword [rbp + 0x148], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov eax, dword [rbp + 0x148]
test ebx, ebx
cmovs eax, ebx
test eax, eax
js 0x140032c15
mov rdx, qword ds:[rdi + 0x10]
lea r9, [rbp + 0x590]
mov rcx, qword [rbp + 0x598]
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x20000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x598]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140032c15
mov rcx, qword [rbp + 0x590]
test rcx, rcx
je 0x140032c15
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x600]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x1400314ca
mov ecx, dword [rbp + 0x604]
lea rdx, [rbp + 0x8b0]
mov r8d, 0xa
call fcn.140189644
mov eax, dword [rdi + 0xa8]
lea r9, [rbp + 0x90]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x94], eax
mov edx, 0x104c
lea rax, [rbp + 0x8b0]
mov dword [rbp + 0x90], r15d
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0x98], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x608]
lea rdx, [rbp + 0x8b4]
mov r8d, 0x10
mov dword [rbp + 0x8b0], 0x780030
call fcn.140189620
mov eax, dword [rdi + 0xac]
lea r9, [rbp + 0x90]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x94], eax
mov edx, 0x104c
lea rax, [rbp + 0x8b0]
mov dword [rbp + 0x90], r15d
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0x98], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x590]
jmp 0x140032c0f
mov rax, qword [rdi + 0x10]
lea rcx, str.EtwRegistration
mov qword [rbp + 0x168], rcx
lea rdx, [rbp + 0x160]
movzx r8d, r15b
mov qword [rbp + 0x160], 0x1e
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
mov rcx, qword [rdi + 0x10]
test al, al
je 0x14003155a
mov rax, qword [rcx + 0x38]
test rax, rax
je 0x14003151c
mov rsi, qword [rax + 8]
mov eax, dword [rdi + 0xe8]
lea r9, [rbp + 0x90]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x94], eax
mov dword [rbp + 0x90], r15d
mov dword [rbp + 0x98], r15d
mov qword [rbp + 0xa8], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140032c15
mov rcx, qword [rcx + 0x30]
lea r13, [0x1401dbaf8]
movzx r8d, r15b
mov qword [rbp + 0x158], r13
lea rdx, [rbp + 0x150]
mov qword [rbp + 0x150], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140031b96
mov rax, qword ds:[rdi + 8]
lea r9, [rbp + 0x660]
xorps xmm0, xmm0
mov qword [rbp + 0x660], rax
lea r8, [rsp + 0x58]
mov qword [rbp + 0x598], rsi
mov edx, 0x40
mov qword [rbp + 0x668], rsi
lea rcx, [rbp + 0x5b0]
mov dword [rsp + 0x58], r14d
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400316a1
cmp byte [0x140240e3f], sil
je 0x140032c15
mov rcx, qword [0x140241b70]
lea rax, [rbp + 0x5b0]
mov qword [rbp + 0x750], rax
lea r8, [0x14011f940]
mov dword [rsp + 0x48], esi
lea rax, [rbp + 0x660]
mov qword [rbp + 0x760], rax
xor r9d, r9d
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x750]
mov qword [rbp - 0x60], rax
xor edx, edx
mov dword [rsp + 0x38], 4
lea rax, [rbp + 0x590]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x78]
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x758], 0x40
mov dword [rbp + 0x768], esi
mov dword [rbp + 0x590], 2
mov qword [rbp - 0x68], rbx
mov dword [rbp - 0x58], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov eax, dword [rbp - 0x58]
test ebx, ebx
cmovs eax, ebx
test eax, eax
js 0x140032c15
mov rdx, qword [rdi + 0x10]
lea r9, [rbp + 0x598]
mov rcx, qword [rbp + 0x5b0]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x2000000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x5b0]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140032c15
mov rcx, qword ds:[rbp + 0x598]
test rcx, rcx
je 0x140032c15
lea r9d, [r14 + 9]
mov dword [rsp + 0x20], 4
lea r8, [rbp + 0x678]
xor r15b, r15b
lea rdx, [rbp + 0x698]
xor bl, bl
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x140031806
mov eax, dword ds:[rbp + 0x678]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x140031762.9
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x32c5c]
mov ecx, dword [rdx + rax*4 + 0x32c48]
add rcx, rdx
jmp rcx
mov eax, dword [rdi + 0xb0]
mov r12d, 1
mov dword [rbp + 0x34], eax
lea rax, str.Pipe
mov dword [rbp + 0x30], r12d
mov dword [rbp + 0x38], r12d
jmp 0x1400317e8
mov eax, dword [rdi + 0xb0]
mov r12d, 1
mov dword [rbp + 0x34], eax
lea rax, str.Network
mov dword [rbp + 0x30], r12d
mov dword [rbp + 0x38], r12d
jmp 0x1400317e8
mov eax, dword [rdi + 0xb0]
mov r15b, 1
mov dword [rbp + 0x34], eax
lea rax, str.File_or_directory
jmp 0x1400317dd
mov eax, dword [rdi + 0xb0]
mov bl, 1
mov dword [rbp + 0x34], eax
lea rax, str.Console
jmp 0x1400317dd
mov eax, dword [rdi + 0xb0]
mov dword [rbp + 0x34], eax
lea rax, [0x1401dd948]
mov edx, 1
mov dword [rbp + 0x30], edx
mov dword [rbp + 0x38], edx
mov rcx, qword ds:[rdi]
lea r9, [rbp + 0x30]
xor r8d, r8d
mov qword [rbp + 0x48], rax
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword ds:[rbp + 0x598]
lea r8, [rbp + 0x5d0]
mov r9d, 4
lea edx, [r9 + 0xc]
call fcn.140133360
lea r12, [0x1401dc684]
test eax, eax
js 0x14003196c
mov eax, dword [rbp + 0x5d0]
mov r8d, 6
mov edx, eax
mov ecx, eax
btr edx, 0x18
bts ecx, 0x18
test al, 0x30
cmovne ecx, edx
lea rdx, str.FILE_FLAG_OVERLAPPED
call sym.ProcessHacker.exe_PhGetAccessString
mov ecx, dword [rbp + 0x5d0]
lea r8, [rbp + 0xa00]
mov edx, 1
mov dword [rbp + 0x840], ecx
mov r12, rax
mov dword [rbp + 0x810], edx
mov dword [rbp + 0x850], edx
lea rax, [0x1401dd954]
mov qword [rbp + 0x828], rax
lea rcx, [rbp + 0x810]
mov dword [rbp + 0x870], edx
lea rax, [0x1401dc684]
mov qword [rbp + 0x868], rax
mov r9d, 0x208
mov qword [rbp + 0x820], 4
lea rax, [0x1401dd95c]
mov dword [rbp + 0x830], pe_nt_image_headers64
mov byte [rbp + 0x83a], 0x10
mov qword [rbp + 0x860], 4
movups xmm0, xmmword [r12]
mov dword [rbp + 0x890], edx
mov edx, 5
mov qword [rbp + 0x8a0], 2
movaps xmmword [rbp + 0x880], xmm0
mov qword [rbp + 0x8a8], rax
mov qword [rsp + 0x20], rsi
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
je 0x14003194c
mov eax, dword [rdi + 0xb4]
lea r9, [rbp - 0x30]
mov rcx, qword [rdi]
mov edx, 1
mov dword [rbp - 0x2c], eax
xor r8d, r8d
mov dword [rbp - 0x30], edx
lea rax, [rbp + 0xa00]
mov dword [rbp - 0x28], edx
mov edx, 0x104c
mov qword [rbp - 0x18], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [r12 - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140031965
nop dword [rax]
call fcn.1400fbcc0
lea r12, [0x1401dc684]
test bl, bl
jne 0x140031b8a
mov rcx, qword [rbp + 0x598]
lea r8, [rbp + 0x610]
mov r9d, 0x18
lea edx, [r9 - 0x13]
call fcn.140133360
mov ebx, 1
test eax, eax
js 0x140031a46
mov rax, qword [rbp + 0x618]
lea r9d, [rbx + 0x63]
lea r8, [rbp + 0x990]
mov qword [rbp + 0x760], rax
mov edx, ebx
mov dword [rbp + 0x750], 0xc
lea rcx, [rbp + 0x750]
mov qword [rsp + 0x20], rsi
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
je 0x140031a07
mov eax, dword [rdi + 0xbc]
lea r9, [rbp - 0x30]
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp - 0x2c], eax
mov edx, 0x104c
lea rax, [rbp + 0x990]
mov dword [rbp - 0x30], ebx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x28], ebx
call qword [sym.imp.USER32.dll_SendMessageW]
test r15b, r15b
je 0x140031a46
mov eax, dword [rdi + 0xb0]
lea r9, [rbp + 0x30]
cmp byte [rbp + 0x625], sil
mov edx, 0x104c
mov rcx, qword [rdi]
mov dword [rbp + 0x34], eax
lea rax, [0x1401dd960]
cmovne r13, rax
mov dword [rbp + 0x30], ebx
xor r8d, r8d
mov qword [rbp + 0x48], r13
mov dword [rbp + 0x38], ebx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword ds:[rbp + 0x598]
lea r8, [rbp + 0x5d8]
mov r9d, 8
lea edx, [r9 + 6]
call fcn.140133360
test eax, eax
js 0x140031b8a
mov rax, qword [rbp + 0x5d8]
test rax, rax
je 0x140031b8a
mov rcx, qword [rbp + 0x618]
lea r8, [rbp + 0x920]
mov qword [rsp + 0x20], rsi
mov r9d, 0x64
test rcx, rcx
je 0x140031b29
xorps xmm1, xmm1
mov qword [rbp + 0x7a0], rax
cvtsi2sd xmm1, rax
mov dword [rbp + 0x790], 0x10009
lea rax, [0x1401dd974]
mov dword [rbp + 0x7b0], ebx
lea edx, [r9 - 0x60]
mov qword [rbp + 0x7c0], 4
mov qword [rbp + 0x7c8], r12
xorps xmm0, xmm0
mov dword [rbp + 0x7d0], 0x4b
cvtsi2sd xmm0, rcx
mov word [rbp + 0x7d4], bx
lea rcx, [rbp + 0x790]
mov dword [rbp + 0x7f0], ebx
mov qword [rbp + 0x800], 4
mov qword [rbp + 0x808], rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x140211978]
movsd qword [rbp + 0x7e0], xmm1
jmp 0x140031b43
mov dword [rbp + 0x770], 0x10009
lea rcx, [rbp + 0x770]
mov qword [rbp + 0x780], rax
mov edx, ebx
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
je 0x140031b8a
mov eax, dword [rdi + 0xb8]
lea r9, [rbp + 0x90]
mov dword [rbp + 0x94], eax
lea rax, [rbp + 0x920]
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0x90], ebx
mov dword [rbp + 0x98], ebx
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x598]
jmp 0x140032c0f
mov rax, qword [rdi + 0x10]
lea rcx, [0x1401dcfb8]
mov qword [rbp + 0x680], rcx
lea rdx, [rbp + 0x678]
movzx r8d, r15b
mov qword [rbp + 0x678], 0xe
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140031fcd
mov rax, qword ds:[rdi + 8]
lea r9, [rbp + 0x660]
xorps xmm0, xmm0
mov qword [rbp + 0x660], rax
lea r8, [rsp + 0x58]
mov qword [rbp + 0x598], rsi
mov edx, 0x40
mov qword [rbp + 0x668], rsi
lea rcx, [rbp + 0x5a8]
mov dword [rsp + 0x58], r14d
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140031ce1
cmp byte [0x140240e3f], sil
je 0x140032c15
mov rcx, qword [0x140241b70]
lea rax, [rbp + 0x5a8]
mov qword [rbp + 0x750], rax
lea r8, [0x14011f940]
mov dword [rsp + 0x48], esi
lea rax, [rbp + 0x660]
mov qword [rbp + 0x760], rax
xor r9d, r9d
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x750]
mov qword [rbp - 0x60], rax
xor edx, edx
mov dword [rsp + 0x38], 4
lea rax, [rbp + 0x590]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x78]
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x758], 0x40
mov dword [rbp + 0x768], esi
mov dword [rbp + 0x590], 2
mov qword [rbp - 0x68], rbx
mov dword [rbp - 0x58], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov eax, dword [rbp - 0x58]
test ebx, ebx
cmovs eax, ebx
test eax, eax
js 0x140032c15
mov rdx, qword [rdi + 0x10]
lea r9, [rbp + 0x598]
mov rcx, qword [rbp + 0x5a8]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov ebx, eax
test eax, eax
jns 0x140031d53
mov rdx, qword [rdi + 0x10]
lea r9, [rbp + 0x598]
mov rcx, qword [rbp + 0x5a8]
mov r8, r14
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov ebx, eax
mov rcx, qword ds:[rbp + 0x5a8]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140032c15
mov rcx, qword [rbp + 0x598]
test rcx, rcx
je 0x140032c15
lea r15, [0x1401dc510]
mov qword [rbp + 0x5b0], rsi
mov r9d, 0x18
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x610]
xor edx, edx
mov r12, r15
call qword [sym.imp.ntdll.dll_NtQuerySection]
test eax, eax
js 0x140031e3b
mov eax, dword [rbp + 0x618]
bt eax, 0x1b
jae 0x140031dc6
lea r12, [0x1401dd980]
jmp 0x140031df1
bt eax, 0x17
jae 0x140031dd1
mov r12, r13
jmp 0x140031df1
bt eax, 0x18
jae 0x140031de2
lea r12, [0x1401dd990]
nop
jmp 0x140031df1
bt eax, 0x1a
lea r12, str.Reserve
cmovae r12, r15
movzx eax, byte [0x14023f728]
lea rcx, [rbp + 0x750]
mov byte [rbp + 0x75a], al
mov r13d, 1
mov rax, qword [rbp + 0x620]
xor r8d, r8d
mov edx, r13d
mov qword [rbp + 0x760], rax
mov dword [rbp + 0x750], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rsi, rax
jmp 0x140031e41
mov r13d, 1
mov rcx, qword [rbp + 0x598]
lea rdx, [rbp + 0x5b0]
call fcn.140130600
test eax, eax
js 0x140031f37
mov ecx, dword [0x140244804]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, qword [rbp + 0x5b0]
mov rbx, rax
test r14, r14
je 0x140031f1d
mov eax, dword ds:[rax]
cmp eax, 0x40
jae 0x140031e91
mov qword [rbx + rax*8 + 8], r14
inc dword [rbx]
jmp 0x140031f1d
cmp qword [rbx + 0x210], 0
jne 0x140031ec4
mov rcx, qword [0x140241998]
mov edx, 4
mov r8d, 0x200
mov dword [rbx + 0x20c], 0x40
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 0x210], rax
mov eax, dword [rbx + 0x208]
mov ecx, dword [rbx + 0x20c]
cmp eax, ecx
jne 0x140031f0a
mov r8, qword [rbx + 0x210]
lea eax, [rcx + rcx]
mov rcx, qword [0x140241998]
mov edx, 4
mov r9d, eax
shl r9, 3
mov dword [rbx + 0x20c], eax
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov qword [rbx + 0x210], rax
mov eax, dword [rbx + 0x208]
mov ecx, eax
mov rax, qword [rbx + 0x210]
mov qword [rax + rcx*8], r14
inc dword [rbx + 0x208]
mov rcx, r14
call sym.ProcessHacker.exe_PhResolveDevicePrefix
test rax, rax
je 0x140031f3e
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov r14, rax
jmp 0x140031f3e
mov r14, qword [rbp + 0x5b0]
mov eax, dword [rdi + 0xc0]
lea r9, [rbp - 0x30]
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x30], r13d
mov dword [rbp - 0x28], r13d
mov qword [rbp - 0x18], r12
call qword [sym.imp.USER32.dll_SendMessageW]
test r14, r14
je 0x140031f73
mov rcx, qword [r14 + 8]
jmp 0x140031f7a
lea rcx, [0x1401dd9b0]
mov eax, dword ds:[rdi + 0xc4]
lea r9, [rbp - 0x30]
mov qword [rbp - 0x18], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp - 0x30], r13d
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], r13d
call qword [sym.imp.USER32.dll_SendMessageW]
test rsi, rsi
je 0x140031faf
mov r15, qword [rsi + 8]
mov eax, dword [rdi + 0xc8]
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x30], r13d
mov dword [rbp - 0x28], r13d
mov qword [rbp - 0x18], r15
jmp 0x140031b79
mov rax, qword [rdi + 0x10]
lea rcx, [0x1401dd7e0]
mov qword [rbp + 0x6a0], rcx
lea rdx, [rbp + 0x698]
movzx r8d, r15b
mov qword [rbp + 0x698], 0xc
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
je 0x1400322fa
mov rax, qword [rdi + 8]
lea r9, [rbp + 0x660]
xorps xmm0, xmm0
mov qword [rbp + 0x660], rax
lea r8, [rsp + 0x58]
mov qword [rbp + 0x598], rsi
mov edx, 0x40
mov qword [rbp + 0x668], rsi
lea rcx, [rbp + 0x5b0]
mov dword [rsp + 0x58], r14d
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
nop dword [rax + rax]
cmp eax, 0xc0000022
jne 0x14003211b
cmp byte [0x140240e3f], sil
je 0x140032c15
mov rcx, qword [0x140241b70]
lea rax, [rbp + 0x5b0]
mov qword [rbp + 0x750], rax
lea r8, [0x14011f940]
mov dword [rsp + 0x48], esi
lea rax, [rbp + 0x660]
mov qword [rbp + 0x760], rax
xor r9d, r9d
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x750]
mov qword [rbp - 0x60], rax
xor edx, edx
mov dword [rsp + 0x38], 4
lea rax, [rbp + 0x590]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x78]
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x758], 0x40
mov dword [rbp + 0x768], esi
mov dword [rbp + 0x590], 2
mov qword [rbp - 0x68], rbx
mov dword [rbp - 0x58], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov eax, dword [rbp - 0x58]
test ebx, ebx
cmovs eax, ebx
nop dword [rax + rax]
test eax, eax
js 0x140032c15
mov rdx, qword [rdi + 0x10]
lea r9, [rbp + 0x598]
mov rcx, qword [rbp + 0x5b0]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x5b0]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140032c15
mov rcx, qword ds:[rbp + 0x598]
test rcx, rcx
je 0x140032c15
lea r9d, ds:[r14 + 9]
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x5d0]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x140032256
movsxd rax, dword [rbp + 0x5d0]
lea rcx, [rbp + 0x610]
xor r8d, r8d
mov qword [rbp + 0x620], rax
mov edx, r15d
mov dword [rbp + 0x610], 0x10009
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [rdi]
lea r9, [rbp - 0x30]
xor r8d, r8d
mov dword [rbp - 0x30], r15d
mov dword [rbp - 0x28], r15d
mov rdx, qword [rax + 8]
mov eax, dword [rdi + 0xcc]
mov qword [rbp - 0x18], rdx
mov edx, 0x104c
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rbp + 0x5d5], sil
lea rax, str.True
lea rcx, str.False
mov dword [rbp + 0x30], r15d
cmovne rcx, rax
mov dword [rbp + 0x38], r15d
mov eax, dword [rdi + 0xd0]
lea r9, [rbp + 0x30]
mov qword [rbp + 0x48], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x34], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x598]
lea r8, [rbp + 0x5d8]
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
mov edx, r15d
call qword [sym.imp.ntdll.dll_NtQueryMutant]
nop dword [rax + rax]
test eax, eax
js 0x140031b8a
cmp qword [rbp + 0x5d8], rsi
je 0x140031b8a
xor edx, edx
lea rcx, [rbp + 0x5d8]
call fcn.1401306a0
mov edx, dword [rdi + 0xd4]
lea r9, [rbp - 0x30]
mov rcx, qword [rdi]
mov rbx, rax
mov dword [rbp - 0x2c], edx
mov edx, 0x104c
mov r8, qword [rax + 8]
mov qword [rbp - 0x18], r8
xor r8d, r8d
mov dword [rbp - 0x30], r15d
mov dword [rbp - 0x28], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, r15d
jne 0x140031b8a
call fcn.1400fbcc0
mov rcx, qword [rbp + 0x598]
jmp 0x140032c0f
mov rax, qword [rdi + 0x10]
lea rcx, [0x1401dba30]
mov qword [rbp + 0x5b8], rcx
lea rdx, [rbp + 0x5b0]
movzx r8d, r15b
mov qword [rbp + 0x5b0], 0xe
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14003278b
mov rax, qword [rdi + 8]
lea r9, [rbp + 0x660]
xorps xmm0, xmm0
mov qword [rbp + 0x660], rax
lea r8, [rsp + 0x58]
mov qword [rbp + 0x5c8], rsi
mov edx, 0x40
mov qword [rbp + 0x668], rsi
lea rcx, [rbp + 0x5f0]
mov dword [rsp + 0x58], r14d
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x140032441
cmp byte [0x140240e3f], sil
je 0x140032c15
mov rcx, qword [0x140241b70]
lea rax, [rbp + 0x5f0]
mov qword [rbp + 0x750], rax
lea r8, [0x14011f940]
mov dword [rsp + 0x48], esi
lea rax, [rbp + 0x660]
mov qword [rbp + 0x760], rax
xor r9d, r9d
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x750]
mov qword [rbp - 0x60], rax
xor edx, edx
mov dword [rsp + 0x38], 4
lea rax, [rbp + 0x590]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x78]
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x758], 0x40
mov dword [rbp + 0x768], esi
mov dword [rbp + 0x590], 2
mov qword [rbp - 0x68], rbx
mov dword [rbp - 0x58], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov eax, dword [rbp - 0x58]
test ebx, ebx
cmovs eax, ebx
test eax, eax
js 0x140032c15
mov rdx, qword [rdi + 0x10]
lea r9, [rbp + 0x5c8]
mov rcx, qword [rbp + 0x5f0]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x5f0]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140032c15
mov rcx, qword ds:[rbp + 0x5c8]
test rcx, rcx
je 0x140032c15
lea rdx, [rbp + 0x5d8]
call sym.ProcessHacker.exe_PhGetProcessImageFileName
test eax, eax
js 0x140032550
mov rbx, qword [rbp + 0x5d8]
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetFileName
mov r15, rax
test rbx, rbx
je 0x1400324ea
lea rcx, [rbx - 0x10]
mov edx, r14d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400324ea
call fcn.1400fbcc0
test r15, r15
je 0x1400324f5
mov rcx, qword [r15 + 8]
jmp 0x1400324f8
mov rcx, r12
mov eax, dword [rdi + 0xd8]
lea r9, [rbp + 0x290]
mov edx, 1
mov qword [rbp + 0x2a8], rcx
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rbp + 0x290], edx
mov dword [rbp + 0x298], edx
mov edx, 0x104c
mov dword [rbp + 0x294], eax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003254a
call fcn.1400fbcc0
mov r15d, 1
mov rcx, qword [rbp + 0x5c8]
lea r8, [rbp + 0x720]
mov r9d, 0x30
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rcx, qword ds:[rbp + 0x5c8]
lea r8, [rbp + 0x6c8]
mov r9d, 0x20
mov qword [rsp + 0x20], rsi
test eax, eax
mov ebx, 0x103
cmovns ebx, dword [rbp + 0x720]
lea edx, [r9 - 0x1c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x140032692
lea rdx, ds:[rbp + 0x6c8]
lea rcx, [rbp + 0x688]
call sym.ProcessHacker.exe_PhLargeIntegerToLocalSystemTime
lea rcx, [rbp + 0x688]
call sym.ProcessHacker.exe_PhFormatDateTime
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [rdi]
lea r9, [rbp + 0x230]
xor r8d, r8d
mov dword [rbp + 0x230], r15d
mov dword [rbp + 0x238], r15d
mov rdx, qword [rax + 8]
mov eax, dword [rdi + 0xdc]
mov qword [rbp + 0x248], rdx
mov edx, 0x104c
mov dword [rbp + 0x234], eax
call qword [sym.imp.USER32.dll_SendMessageW]
nop word [rax + rax]
cmp ebx, 0x103
je 0x14003277f
lea rdx, [rbp + 0x6d0]
lea rcx, [rbp + 0x688]
call sym.ProcessHacker.exe_PhLargeIntegerToLocalSystemTime
lea rcx, [rbp + 0x688]
call sym.ProcessHacker.exe_PhFormatDateTime
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [rdi]
lea r9, [rbp + 0x2f0]
xor r8d, r8d
mov dword [rbp + 0x2f0], r15d
mov dword [rbp + 0x2f8], r15d
mov rdx, qword [rax + 8]
mov eax, dword [rdi + 0xe0]
mov qword [rbp + 0x308], rdx
mov edx, 0x104c
mov dword [rbp + 0x2f4], eax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14003269e
cmp ebx, 0x103
je 0x14003277f
nop
cmp ebx, 0xc0000022
je 0x1400326c3
cmp ebx, 0xc0000005
je 0x1400326c3
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x1400326cf
movzx eax, bx
jmp 0x1400326cb
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x1400326d8
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x1400326df
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rsi, rax
test rax, rax
je 0x1400326ed
mov r15, qword [rax + 8]
jmp 0x1400326f4
lea r15, [0x1401dc510]
mov r8, r15
lea rcx, str.0x_x___s_
mov edx, ebx
call sym.ProcessHacker.exe_PhFormatString
mov rbx, rax
test rax, rax
je 0x140032711
mov r12, qword [rax + 8]
mov eax, dword [rdi + 0xe4]
lea r9, [rbp + 0x350]
mov rcx, qword [rdi]
mov edx, 1
mov dword [rbp + 0x350], edx
xor r8d, r8d
mov dword [rbp + 0x358], edx
mov edx, 0x104c
mov dword [rbp + 0x354], eax
mov qword [rbp + 0x368], r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140032765
nop
call fcn.1400fbcc0
test rsi, rsi
je 0x14003277f
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x14003277f
call fcn.1400fbcc0
mov rcx, qword [rbp + 0x5c8]
jmp 0x140032c0f
mov rax, qword [rdi + 0x10]
lea rcx, str.Thread
mov qword [rbp + 0x5a0], rcx
lea rdx, [rbp + 0x598]
movzx r8d, r15b
mov qword [rbp + 0x598], 0xc
mov rcx, qword [rax + 0x30]
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x140032c15
mov rax, qword [rdi + 8]
lea r9, [rbp + 0x660]
xorps xmm0, xmm0
mov qword [rbp + 0x660], rax
lea r8, [rsp + 0x58]
mov qword [rbp + 0x5c0], rsi
mov edx, 0x40
mov qword [rbp + 0x668], rsi
lea rcx, [rbp + 0x5e8]
mov dword [rsp + 0x58], r14d
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
nop dword [rax + rax]
cmp eax, 0xc0000022
jne 0x1400328db
cmp byte [0x140240e3f], sil
je 0x140032c15
mov rcx, qword [0x140241b70]
lea rax, [rbp + 0x5e8]
mov qword [rbp + 0x750], rax
lea r8, [0x14011f940]
mov dword [rsp + 0x48], esi
lea rax, [rbp + 0x660]
mov qword [rbp + 0x760], rax
xor r9d, r9d
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x750]
mov qword [rbp - 0x60], rax
xor edx, edx
mov dword [rsp + 0x38], 4
lea rax, [rbp + 0x590]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x78]
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x758], 0x40
mov dword [rbp + 0x768], esi
mov dword [rbp + 0x590], 2
mov qword [rbp - 0x68], rbx
mov dword [rbp - 0x58], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov eax, dword [rbp - 0x58]
test ebx, ebx
cmovs eax, ebx
nop dword [rax + rax]
test eax, eax
js 0x140032c15
mov rdx, qword [rdi + 0x10]
lea r9, [rbp + 0x5c0]
mov rcx, qword [rbp + 0x5e8]
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x30], esi
mov r8, r14
mov dword [rsp + 0x28], esi
mov rdx, qword [rdx + 0x10]
mov dword [rsp + 0x20], 0x800
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov rcx, qword [rbp + 0x5e8]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140032c15
mov rcx, qword ds:[rbp + 0x5c0]
test rcx, rcx
je 0x140032c15
lea rdx, [rbp + 0x5d8]
xor r13b, r13b
call fcn.14011d2a0
nop dword [rax + rax]
test eax, eax
js 0x1400329cc
mov rbx, qword [rbp + 0x5d8]
test rbx, rbx
je 0x14003297a
mov rcx, qword [rbx + 8]
jmp 0x14003297d
mov rcx, r12
mov eax, dword [rdi + 0xd8]
lea r9, [rbp + 0x3b0]
mov qword [rbp + 0x3c8], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, 0x104c
mov dword [rbp + 0x3b0], r15d
mov dword [rbp + 0x3b4], eax
mov dword [rbp + 0x3b8], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, r15d
jne 0x1400329cc
call fcn.1400fbcc0
mov rcx, qword [rbp + 0x5c0]
lea r8, [rbp + 0x670]
mov r9d, 4
mov qword [rsp + 0x20], rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x140032b2b
mov eax, dword [rbp + 0x670]
test eax, eax
setne r13b
test eax, eax
je 0x140032b2b
mov rcx, qword [rbp + 0x5c0]
lea r8, [rbp + 0x630]
mov r9d, 0x30
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x140032b2b
mov ebx, dword ds:[rbp + 0x630]
cmp ebx, 0xc0000022
je 0x140032a63
cmp ebx, 0xc0000005
je 0x140032a63
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140032a6f
movzx eax, bx
jmp 0x140032a6b
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140032a78
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140032a7f
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
test rax, rax
je 0x140032a8d
mov r15, qword [rax + 8]
jmp 0x140032a94
lea r15, [0x1401dc510]
mov edx, dword [rbp + 0x630]
lea rcx, str.0x_x___s_
mov r8, r15
call sym.ProcessHacker.exe_PhFormatString
mov r15, rax
test rax, rax
je 0x140032ab5
mov r12, qword [rax + 8]
mov eax, dword [rdi + 0xe4]
lea r9, [rbp + 0x410]
mov rcx, qword [rdi]
mov edx, 1
mov dword [rbp + 0x410], edx
xor r8d, r8d
mov dword [rbp + 0x418], edx
mov edx, 0x104c
mov dword [rbp + 0x414], eax
mov qword [rbp + 0x428], r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, ds:[r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140032b0a
call fcn.1400fbcc0
test rbx, rbx
je 0x140032b25
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140032b25
nop
call fcn.1400fbcc0
mov r15d, 1
mov rcx, qword [rbp + 0x5c0]
lea r8, [rbp + 0x6a8]
mov r9d, 0x20
mov qword [rsp + 0x20], rsi
mov edx, r15d
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x140032c08
lea rdx, [rbp + 0x6a8]
lea rcx, [rbp + 0x660]
call sym.ProcessHacker.exe_PhLargeIntegerToLocalSystemTime
lea rcx, [rbp + 0x660]
call sym.ProcessHacker.exe_PhFormatDateTime
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rbp - 0x30]
mov dword [rbp - 0x30], r15d
xor r8d, r8d
mov dword [rbp - 0x28], r15d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov eax, dword [rdi + 0xdc]
mov qword [rbp - 0x18], rcx
mov rcx, qword [rdi]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
test r13b, r13b
je 0x140032c08
lea rdx, [rbp + 0x6b0]
lea rcx, [rbp + 0x660]
call sym.ProcessHacker.exe_PhLargeIntegerToLocalSystemTime
lea rcx, [rbp + 0x660]
call sym.ProcessHacker.exe_PhFormatDateTime
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rbp + 0x30]
mov dword [rbp + 0x30], r15d
xor r8d, r8d
mov dword [rbp + 0x38], r15d
mov edx, 0x104c
mov rcx, qword [rax + 8]
mov eax, dword [rdi + 0xe0]
mov qword [rbp + 0x48], rcx
mov rcx, qword [rdi]
mov dword [rbp + 0x34], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x5c0]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword ds:[rbp + 0xc10]
xor rcx, rsp
call fcn.1401848a0
lea r11, [rsp + 0xd20]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret