Function at 0x14001a500
Capabilities:
Parse pe header

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
mov r13, rdx
mov rdi, rcx
mov edx, 5
lea rcx, [rsp + 0x78]
call sym.ProcessHacker.exe_PhEnumProcessesEx
mov ebx, eax
test eax, eax
jns 0x14001a60d
cmp eax, 0xc0000022
je 0x14001a56d
cmp eax, 0xc0000005
je 0x14001a56d
mov ecx, eax
and ecx, 0xfff0000
cmp ecx, 0x70000
jne 0x14001a57c
movzx eax, bx
jmp 0x14001a578
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x14001a588
lfence
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x14001a592
lfence
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_enumerate_processes
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x14001a5f7
lfence
lfence
mov rax, qword [rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
lea rax, [0x1401b8d58]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov r12d, 0xffffffff
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x14001ae1e
lfence
call fcn.1400fbcc0
jmp 0x14001ae1e
lea r8, [0x1401efb68]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
jmp 0x14001ae1e
mov rcx, qword [r13 + 0x98]
xor r9d, r9d
mov qword [rsp + 0x400], rsi
xor r8d, r8d
mov qword [rsp + 0x3b8], r14
mov edx, 0x845c
mov qword [rsp + 0x3b0], r15
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [r13 + 0x98]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [r13 + 0x90]
mov r12d, 0xffffffff
mov edx, r12d
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400f654f.0]
mov r15, qword [rsp + 0x78]
xor edi, edi
nop dword [rax]
cmp qword [r15 + 0x50], 0
mov r14, rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
je 0x14001a6f1
movzx eax, word [r15 + 0x38]
test ax, ax
jne 0x14001a6ad
nop
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x14001a748
mov rdx, qword [0x1402418e8]
lea rcx, ds:[rax + 0x12]
mov rsi, qword [r15 + 0x40]
mov rdi, rax
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
xor ecx, ecx
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], cx
test rsi, rsi
je 0x14001a6ed
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.140188690
xor edi, edi
jmp 0x14001a748
mov rdx, qword [0x1402418e8]
mov ecx, 0x38
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], 0x26
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + 0x26], di
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [str.System_Idle_Process]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401da748]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x1401da758]
mov dword [rcx + 0x20], eax
movzx eax, word [0x1401da75c]
mov word [rcx + 0x24], ax
mov rdx, qword ds:[r15 + 0x50]
lea r9, [rbp + 0x50]
mov rax, qword [rbx + 8]
xor r8d, r8d
mov rcx, qword [r13 + 0x98]
mov qword [rbp + 0x78], rdx
mov edx, 0x104d
mov dword [rbp + 0x50], 5
mov qword [rbp + 0x54], 0x7fffffff
mov qword [rbp + 0x68], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx - 0x10]
mov edx, r12d
mov rsi, rax
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14001a79f
call fcn.1400fbcc0
cmp byte [0x140240e3f], 0
mov rcx, qword [r15 + 0x50]
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rdi
je 0x14001a805
lea rax, [rbp + 0x278]
mov dword [rbp - 0x60], 0x1000
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x50]
lea rax, [rbp - 0x80]
mov dword [rbp - 0x50], edi
mov qword [rbp - 0x58], rax
call fcn.14011f9e0
mov dword ss:[rsp + 0x48], edi
lea rax, [rbp - 0x68]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0x20
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb0]
jmp 0x14001a89b
xorps xmm0, xmm0
mov dword [rbp + 0x18], 0x30
lea r9, [rbp - 0x80]
mov qword [rbp + 0x20], rdi
lea r8, [rbp + 0x18]
mov dword [rbp + 0x30], edi
mov edx, 0x1000
mov qword [rbp + 0x28], rdi
lea rcx, [rbp + 0x278]
movdqu xmmword [rbp + 0x38], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
nop dword [rax]
cmp eax, 0xc0000022
jne 0x14001a8bd
cmp byte [0x140240e3f], 0
je 0x14001aa09
lea rax, [rbp + 0x278]
mov dword [rbp - 0x40], 0x1000
mov qword [rbp - 0x48], rax
lea rcx, [rbp - 0x30]
lea rax, [rbp - 0x80]
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x38], rax
call fcn.14011f9e0
mov dword [rsp + 0x48], edi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0x20
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xc0]
mov rcx, qword [0x140241b70]
xor r9d, r9d
mov dword [rsp + 0x28], 0x999920cb
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
nop dword [rax]
test eax, eax
js 0x14001aa09
cmp byte [0x140240e3f], 0
mov rbx, qword [rbp + 0x278]
je 0x14001a91d
lea rax, [rbp + 0x270]
mov qword [rbp - 0x28], rbx
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x20], 8
mov dword [rbp - 0x10], edi
call fcn.14011f9e0
mov dword [rsp + 0x48], edi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0x20
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xd0]
jmp 0x14001a989
lea r8, [rbp + 0x270]
mov edx, 8
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, 0xc0000022
jne 0x14001a9ab
cmp byte [0x140240e3f], 0
je 0x14001a9fc
lea rax, [rbp + 0x270]
mov qword [rbp - 8], rbx
lea rcx, [rbp + 0x10]
mov qword [rbp + 8], rax
mov dword [rbp], 8
mov dword [rbp + 0x10], edi
call fcn.14011f9e0
mov dword [rsp + 0x48], edi
lea rax, [rbp - 8]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0x20
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xe0]
mov rcx, qword [0x140241b70]
xor r9d, r9d
mov dword [rsp + 0x28], 0x999920cf
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x14001a9fc
mov rcx, qword ds:[rbp + 0x270]
lea r8, [rbp - 0x70]
mov edx, 1
call fcn.140113ba0
test eax, eax
js 0x14001a9ef
mov rbx, qword [rbp - 0x70]
xor r8d, r8d
mov dl, 1
mov rcx, qword [rbx]
call sym.ProcessHacker.exe_PhGetSidFullName
mov rcx, qword [0x140241998]
mov r8, rbx
xor edx, edx
mov r14, rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x270]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x278]
call qword [sym.imp.ntdll.dll_NtClose]
cmp qword [r15 + 0x50], 0
jne 0x14001aa32
test r14, r14
jne 0x14001aa32
xor r8d, r8d
lea rcx, [0x140238018]
mov dl, 1
call sym.ProcessHacker.exe_PhGetSidFullName
mov r14, rax
test rax, rax
je 0x14001aa32
lock inc dword [rax - 8]
mov rcx, qword [r15 + 0x50]
cmp rcx, 4
jne 0x14001aa4c
nop dword [rax]
call sym.ProcessHacker.exe_PhGetKernelFileName
mov qword [rsp + 0x60], rax
jmp 0x14001aa5f
test rcx, rcx
jle 0x14001ac4f
lea rdx, [rsp + 0x60]
call sym.ProcessHacker.exe_PhGetProcessImageFileNameByProcessId
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14001ac4f
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetFileName
mov qword ds:[rsp + 0x60], rax
mov rdi, rax
test rbx, rbx
je 0x14001aa9b
lea rcx, [rbx - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14001aa9b
call fcn.1400fbcc0
nop dword [rax + rax]
test rdi, rdi
je 0x14001ac4d
cmp qword [rdi], 0
je 0x14001ac4d
mov rbx, qword [rdi + 8]
xor edi, edi
test byte [0x14023e090], 1
mov qword [rsp + 0x68], rdi
jne 0x14001ab71
lock bts qword [0x14023e090], 0x1f
jb 0x14001ab5a
lea rcx, [0x1401d9d58]
call fcn.1400f9d00
mov rcx, rax
test rax, rax
je 0x14001ab42
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001ab42
mov edx, dword ds:[rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x14001ab42
cmp dword [rdx + rcx], 0x4550
jne 0x14001ab42
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14001ab42
cmp dword [rdx + 4], edi
je 0x14001ab42
lea r8, [rcx + rax]
mov word [rsp + 0x20], di
lea r9, str.PrivateExtractIconExW
call fcn.1400fa1a0
nop
jmp 0x14001ab45
mov rax, rdi
lea rcx, [0x14023e090]
mov qword [0x140244850], rax
call sym.ProcessHacker.exe_PhfSetEvent
jmp 0x14001ab71
test byte [0x14023e090], 1
jne 0x14001ab71
xor edx, edx
lea rcx, [0x14023e090]
call sym.ProcessHacker.exe_PhfWaitForEvent
mov rax, qword [0x140244850]
nop dword [rax + rax]
test rax, rax
je 0x14001ac4f
lea r9, ds:[rsp + 0x68]
mov dword [rsp + 0x20], 1
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [case.0x1400f654f.0]
test eax, eax
jle 0x14001ac37
mov rbx, qword ds:[rsp + 0x68]
mov qword [rsp + 0x70], rbx
test rbx, rbx
je 0x14001ac4f
mov rcx, qword [r13 + 0x90]
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], r12d
mov r8, rbx
mov edx, r12d
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400f654f.0]
mov eax, dword [rsp + 0x58]
lea r9, [rbp + 0xf0]
mov rcx, qword [r13 + 0x98]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x114], eax
mov dword [rbp + 0xf0], 2
mov dword [rbp + 0xf4], esi
mov dword [rbp + 0xf8], edi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x14001acc6
mov rcx, qword ds:[rsp + 0x68]
test rcx, rcx
je 0x14001ac4f
call qword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x14001ac4f
xor edi, edi
lea rdx, [rsp + 0x70]
xor ecx, ecx
call sym.ProcessHacker.exe_PhGetStockApplicationIcon
mov rcx, qword ds:[r13 + 0x90]
lea r9, [rsp + 0x50]
mov r8, qword [rsp + 0x70]
mov edx, r12d
mov dword [rsp + 0x50], r12d
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400f654f.0]
mov eax, dword ds:[rsp + 0x50]
lea r9, [rbp + 0x150]
mov rcx, qword [r13 + 0x98]
xor r8d, r8d
mov edx, 0x104c
mov dword [rbp + 0x174], eax
mov dword [rbp + 0x150], 2
mov dword [rbp + 0x154], esi
mov dword [rbp + 0x158], edi
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [r15 + 0x50]
lea rdx, [rbp + 0x280]
mov r8d, 0xa
call fcn.140189644
mov rcx, qword ds:[r13 + 0x98]
lea rax, [rbp + 0x280]
lea r9, [rbp + 0x1b0]
mov qword [rbp + 0x1c8], rax
xor r8d, r8d
mov dword [rbp + 0x1b0], 1
mov edx, 0x104c
mov dword [rbp + 0x1b4], esi
mov dword [rbp + 0x1b8], 1
call qword [sym.imp.USER32.dll_SendMessageW]
test r14, r14
je 0x14001ad31
mov rax, qword [r14 + 8]
jmp 0x14001ad34
mov rax, rdi
mov rcx, qword [r13 + 0x98]
lea r9, [rbp + 0x210]
xor r8d, r8d
mov dword [rbp + 0x210], 1
mov edx, 0x104c
mov dword [rbp + 0x214], esi
mov dword [rbp + 0x218], 2
mov qword [rbp + 0x228], rax
call qword [sym.imp.USER32.dll_SendMessageW]
test r14, r14
je 0x14001ad8c
lea rcx, [r14 - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001ad8c
call fcn.1400fbcc0
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14001adac
lea rcx, [rbx - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001adac
call fcn.1400fbcc0
mov eax, dword [r15]
test eax, eax
je 0x14001adbc
add r15, rax
jne 0x14001a680
mov r8, qword [rsp + 0x78]
xor edx, edx
mov rcx, qword [0x140241998]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [r13 + 0x98]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x844d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword ds:[r13 + 0x98]
xor r9d, r9d
mov edx, 0x845c
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15, qword [rsp + 0x3b0]
mov r14, qword [rsp + 0x3b8]
mov rsi, qword [rsp + 0x400]
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x3c0
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret