Function at 0x140003a80
Capabilities:
Write file on windows

Disassembly:
jmp 0x140075fc0
push rsi
push rdi
sub rsp, 0x108
lea rdi, [rsp + 0x50]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1405dc580]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov eax, dword [0x1405e8520]
and eax, 1
test eax, eax
jne 0x1400761cc
cmp qword [0x1405e8528], 0
je 0x140076021
xor edx, edx
mov rax, qword [0x1405e8528]
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhGetFullPath
mov qword [0x1405dfde8], rax
cmp qword [0x1405dfde8], 0
jne 0x14007608d
call sym.ProcessHacker.exe_PhGetApplicationFileName
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x14007608d
mov rax, qword [rsp + 0x60]
lea rdx, [0x1405c4860]
mov rcx, rax
call sym.ProcessHacker.exe_PhConcatStringRef2
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
movzx eax, al
test eax, eax
je 0x140076079
mov rax, qword [rsp + 0x58]
mov qword [0x1405dfde8], rax
jmp 0x140076083
mov rcx, qword [rsp + 0x58]
call sym.ProcessHacker.exe_PhDereferenceObject
mov rcx, qword [rsp + 0x60]
call sym.ProcessHacker.exe_PhDereferenceObject
cmp qword [0x1405dfde8], 0
jne 0x1400760aa
lea rcx, [0x1405c4850]
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
mov qword [0x1405dfde8], rax
cmp qword [0x1405dfde8], 0
je 0x1400761cc
mov rax, qword [0x1405dfde8]
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhLoadSettings
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xc0000102
jne 0x1400761cc
lea rax, str.If_you_select_No__the_settings_system_will_not_function_properly.
mov qword [rsp + 0x20], rax
lea r9, str.Process_Hackers_settings_file_is_corrupt._Do_you_want_to_reset_it_
mov r8d, 0xffff
mov edx, 6
xor ecx, ecx
call sym.ProcessHacker.exe_PhShowMessage2
cmp eax, 6
jne 0x1400761b5
lea rax, [rsp + 0xc8]
lea rcx, str._settings___settings_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x16
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
mov r9d, 0x80
mov r8d, 0x120116
mov rax, qword [0x1405dfde8]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x78]
call sym.ProcessHacker.exe_PhCreateFileWin32
test eax, eax
jl 0x1400761b3
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x15
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x1400761cc
mov rcx, qword [0x1405dfde8]
call sym.ProcessHacker.exe_PhDereferenceObject
mov qword [0x1405dfde8], 0
lea rcx, str.EnablePlugins
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400761e9
mov dword [rsp + 0xf0], 1
jmp 0x1400761f4
mov dword [rsp + 0xf0], 0
movzx eax, byte [rsp + 0xf0]
mov byte [0x1405dfde0], al
lea rcx, str.MaxSizeUnit
call sym.ProcessHacker.exe_PhGetIntegerSetting
mov dword [0x1405d5f54], eax
lea rcx, str.MaxPrecisionUnit
call sym.ProcessHacker.exe_PhGetIntegerSetting
mov word [0x1405d5f58], ax
lea rcx, str.SampleCountAutomatic
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14007627b
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
inc eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0xe4], eax
cmp dword [rsp + 0xe4], 0x800
jbe 0x140076268
mov dword [rsp + 0xe4], 0x800
mov edx, dword [rsp + 0xe4]
lea rcx, str.SampleCount
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov rcx, rsp
lea rdx, [0x1403e3a50]
call fcn.140015750
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.14000d430
add rsp, 0x108
pop rdi
pop rsi
ret