Function at 0x140027210
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rdi, qword [0x140192528]
mov rbx, qword [0x14018ad68]
mov rdx, qword [0x140196800]
add rbx, qword [rdi]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
xor r12d, r12d
mov r14, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r12w
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
call fcn.14010e700
mov rcx, qword [r14 + 8]
add rcx, qword [rdi]
mov r8, qword [0x14018ad68]
mov rdx, qword [0x14018ad70]
call fcn.14010e700
mov rdi, qword [0x140192528]
mov rbx, qword [0x14018ad98]
mov rdx, qword [0x140196800]
add rbx, qword [rdi]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r15, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r12w
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
call fcn.14010e700
mov rcx, qword [rdi]
add rcx, qword [r15 + 8]
mov r8, qword [0x14018ad98]
mov rdx, qword [str.ProcessHacker.sig]
call fcn.14010e700
mov rcx, qword [r14 + 8]
call qword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
jne 0x140027403
lea rcx, str.EnableKphWarnings
mov qword [rsp + 0x60], 0x22
mov qword [rsp + 0x68], rcx
xor eax, eax
mov r15d, 5
lock cmpxchg qword [0x140193950], r15
je 0x14002732c
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x60]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 8]
movups xmmword [rbp + 0x10], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002738b
nop
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x140027383
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 8]
call qword [rdi + VariantCopy]
test al, al
jne 0x14002738e
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140027360
mov rsi, r12
test rsi, rsi
je 0x14002739d
cmp dword [rsi], 1
jne 0x14002739d
mov ebx, dword [rsi + 0x28]
jmp 0x1400273a6
mov ebx, dword [rbp + 0x80]
mov rsi, r12
mov rax, r15
lock cmpxchg qword [0x140193950], r12
je 0x1400273c0
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x1400273d1
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test ebx, ebx
je 0x14002765f
lea rax, str.You_will_be_unable_to_use_more_advanced_features__view_details_about_system_processes_or_terminate_malicious_software.
mov edx, 0x20
lea r9, str.The_Process_Hacker_kernel_driver_kprocesshacker.sys_was_not_found_in_the_application_directory.
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x14002765f
mov dword [rbp + 0x88], 3
lea r8, [rbp + 0x88]
mov byte [rbp + 0x8c], 1
mov rdx, qword [r14 + 8]
call fcn.1400dc3a0
mov ebx, eax
test eax, eax
js 0x140027607
mov rcx, qword [r15 + 8]
lea rdx, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov edi, eax
test eax, eax
js 0x140027543
mov dword [rsp + 0x50], r12d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r12
lea r9, [rbp - 0x28]
mov dword [rsp + 0x40], 0x60
lea r8, [rbp - 0x58]
mov dword [rsp + 0x38], 1
lea rcx, [rbp + 0x90]
mov dword [rsp + 0x30], 1
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x120089
mov qword [rsp + 0x20], r12
mov dword [rbp - 0x58], 0x30
mov qword [rbp - 0x50], r12
mov dword [rbp - 0x40], 0x40
mov qword [rbp - 0x48], rax
movdqu xmmword [rbp - 0x38], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
lea rcx, [rsp + 0x70]
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test edi, edi
js 0x140027543
mov rcx, qword [0x140196670]
mov edx, 4
mov rbx, qword [rbp + 0x90]
mov r8d, 0x400
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], r12
mov rsi, rax
mov dword [rsp + 0x30], 0x400
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp - 0x68]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x140027531
mov eax, dword [rbp - 0x60]
jmp 0x140027550
mov rcx, qword [0x140196670]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, qword [rbp + 0x80]
mov eax, dword [rbp + 0x80]
test edi, edi
js 0x1400275ec
mov dword [rsp + 0x48], r12d
lea rcx, [0x1400dcf20]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov dword [rbp - 0x70], eax
xor r8d, r8d
mov dword [rsp + 0x38], 0x18
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp - 0x18]
mov qword [rbp - 0x80], rcx
mov rcx, qword [0x140193948]
mov dword [rsp + 0x28], 0x99992007
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x78], rsi
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
test eax, eax
js 0x1400275ba
mov byte [0x1401937ba], 1
jmp 0x1400275d8
lea rcx, str.EnableKphWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400275d8
mov edx, ebx
lea rcx, str.Unable_to_verify_the_kernel_driver_signature.
call fcn.1400270d0
mov rcx, qword [0x140196670]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140027634
lea rcx, str.EnableKphWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x140027634
mov edx, edi
lea rcx, str.Unable_to_load_the_kernel_driver_signature.
jmp 0x14002762f
lea rcx, str.EnableKphWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x140027634
lea rcx, [rbp - 8]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
test byte [rax + 8], 1
je 0x140027634
mov edx, ebx
lea rcx, str.Unable_to_load_the_kernel_driver.
call fcn.1400270d0
or ebx, 0xffffffff
lea rcx, [r14 - 0x10]
mov eax, ebx
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002764c
call fcn.1400c8bc0
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], ebx
cmp ebx, 1
jne 0x14002765f
call fcn.1400c8bc0
add rsp, 0x140
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret