Function at 0x14000fdd0
Capabilities:
Continue service
Delete service
Pause service
Resume thread
Start service
Suspend thread
Terminate process

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x430]
sub rsp, 0x530
or r14, 0xffffffffffffffff
lea rdx, [rsp + 0x50]
mov rcx, r14
call sym.ProcessHacker.exe_PhGetProcessCommandLine
mov edi, eax
test eax, eax
js 0x140010cd8
mov qword [rsp + 0x528], rbx
lea rax, [0x14000fdc0]
mov rbx, qword [rsp + 0x50]
lea rdx, [0x14018ab48]
mov qword [rsp + 0x520], rsi
mov rcx, rbx
mov esi, 1
mov qword [rsp + 0x518], r15
xor r15d, r15d
mov r9d, esi
mov qword [rsp + 0x28], r15
mov r8d, esi
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhParseCommandLine
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, esi
jne 0x14000fe5e
call fcn.1400c8bc0
mov rcx, qword [0x1401978e0]
lea rax, str.process
movzx r8d, sil
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1400107cd
mov r9, qword [0x1401978e8]
test r9, r9
je 0x14000ff55
mov r8, qword [r9]
mov rcx, r15
shr r8, 1
je 0x14000fec9
mov rdx, qword [r9 + 8]
nop
movzx eax, word [rdx]
sub ax, 0x30
cmp ax, 0xa
jae 0x14000fec9
inc rcx
add rdx, 2
cmp rcx, r8
jb 0x14000feb0
cmp rcx, r8
jne 0x14000ff5f
movups xmm1, xmmword [r9]
xor bl, bl
movq r8, xmm1
movups xmmword [rsp + 0x40], xmm1
mov r10, qword [rsp + 0x48]
test r8, r8
je 0x14000ff0a
movzx eax, word [r10]
cmp ax, 0x2d
je 0x14000fefe
cmp ax, 0x2b
jne 0x14000ff0a
jmp 0x14000ff02
movzx ebx, sil
add r10, 2
sub r8, 2
shr r8, 1
movzx r11d, sil
mov rcx, r15
mov rdx, r15
je 0x14000ff44
lea r14, [0x14016ae00]
movzx eax, byte [r10 + rdx*2]
mov r9d, dword [r14 + rax*4]
cmp r9d, 0xa
jae 0x14000ff39
lea rcx, [rcx + rcx*4]
lea rcx, [r9 + rcx*2]
jmp 0x14000ff3c
xor r11b, r11b
inc rdx
cmp rdx, r8
jb 0x14000ff20
mov r14, rcx
neg r14
test bl, bl
cmove r14, rcx
test r11b, r11b
jne 0x14000ffb7
mov eax, 0xc000000d
jmp 0x140010cc0
mov edx, 5
lea rcx, [rsp + 0x58]
call sym.ProcessHacker.exe_PhEnumProcessesEx
mov edi, eax
test eax, eax
js 0x140010cc0
mov rbx, qword [rsp + 0x58]
mov rdx, qword [0x1401978e8]
mov rcx, rbx
call sym.ProcessHacker.exe_PhFindProcessInformationByImageName
mov rcx, qword [0x140196670]
xor edx, edx
mov r8, rbx
test rax, rax
jne 0x14000ffad
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000225
jmp 0x140010cc0
mov r14, qword [rax + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [0x1401978f0]
lea rax, str.terminate
movzx r8d, sil
mov qword [rbp + 0x1d8], rax
lea rdx, [rbp + 0x1d0]
mov qword [rbp + 0x1d0], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14001005c
xorps xmm0, xmm0
mov dword [rbp + 0x210], 0x30
lea r9, [rbp - 0x70]
mov qword [rbp + 0x218], r15
lea r8, [rbp + 0x210]
mov dword [rbp + 0x228], r15d
mov edx, esi
mov qword [rbp + 0x220], r15
lea rcx, [rbp + 0x468]
mov qword [rbp - 0x70], r14
movdqu xmmword [rbp + 0x230], xmm0
mov qword [rbp - 0x68], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov edi, eax
test eax, eax
js 0x140010cbe
mov rcx, qword [rbp + 0x468]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rcx, qword [rbp + 0x468]
jmp 0x140010cb6
mov rcx, qword [0x1401978f0]
lea rax, str.suspend
movzx r8d, sil
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x60], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1400100f9
xorps xmm0, xmm0
mov dword [rbp + 0x240], 0x30
lea r9, [rbp - 0x50]
mov qword [rbp + 0x248], r15
lea r8, [rbp + 0x240]
mov dword [rbp + 0x258], r15d
mov edx, 0x800
mov qword [rbp + 0x250], r15
lea rcx, [rbp + 0x468]
mov qword [rbp - 0x50], r14
movdqu xmmword [rbp + 0x260], xmm0
mov qword [rbp - 0x48], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov edi, eax
test eax, eax
js 0x140010cbe
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.ntdll.dll_NtSuspendProcess]
mov rcx, qword [rbp + 0x468]
jmp 0x140010cb6
mov rcx, qword [0x1401978f0]
lea rax, str.resume
movzx r8d, sil
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x40], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010196
xorps xmm0, xmm0
mov dword [rbp + 0x270], 0x30
lea r9, [rbp - 0x30]
mov qword [rbp + 0x278], r15
lea r8, [rbp + 0x270]
mov dword [rbp + 0x288], r15d
mov edx, 0x800
mov qword [rbp + 0x280], r15
lea rcx, [rbp + 0x468]
mov qword [rbp - 0x30], r14
movdqu xmmword [rbp + 0x290], xmm0
mov qword [rbp - 0x28], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov edi, eax
test eax, eax
js 0x140010cbe
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.ntdll.dll_NtResumeProcess]
mov rcx, qword [rbp + 0x468]
jmp 0x140010cb6
mov rcx, qword [0x1401978f0]
lea rax, str.priority
movzx r8d, sil
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010393
mov rcx, qword [0x1401978f8]
test rcx, rcx
je 0x14000ff55
lea rax, str.idle
mov qword [rbp - 0x10], 8
movzx r8d, sil
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x10]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010202
movzx ebx, sil
jmp 0x1400102f5
mov rcx, qword [0x1401978f8]
lea rax, str.normal
movzx r8d, sil
mov qword [rbp + 8], rax
lea rdx, [rbp]
mov qword [rbp], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010234
mov bl, 2
jmp 0x1400102f5
mov rcx, qword [0x1401978f8]
lea rax, str.high
movzx r8d, sil
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010266
mov bl, 3
jmp 0x1400102f5
mov rcx, qword [0x1401978f8]
lea rax, str.realtime
movzx r8d, sil
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0x20]
mov qword [rbp + 0x20], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010295
mov bl, 4
jmp 0x1400102f5
mov rcx, qword [0x1401978f8]
lea rax, str.abovenormal
movzx r8d, sil
mov qword [rbp + 0x38], rax
lea rdx, [rbp + 0x30]
mov qword [rbp + 0x30], 0x16
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1400102c4
mov bl, 6
jmp 0x1400102f5
mov rcx, qword [0x1401978f8]
lea rax, str.belownormal
movzx r8d, sil
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0x40]
mov qword [rbp + 0x40], 0x16
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ff55
mov bl, 5
xorps xmm0, xmm0
mov dword [rbp + 0x2a0], 0x30
lea r9, [rbp + 0x50]
mov qword [rbp + 0x2a8], r15
lea r8, [rbp + 0x2a0]
mov dword [rbp + 0x2b8], r15d
mov edx, 0x200
mov qword [rbp + 0x2b0], r15
lea rcx, [rbp + 0x468]
mov qword [rbp + 0x50], r14
movdqu xmmword [rbp + 0x2c0], xmm0
mov qword [rbp + 0x58], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov edi, eax
test eax, eax
js 0x140010cbe
mov rcx, qword [rbp + 0x468]
lea r8, [rbp + 0x450]
mov byte [rbp + 0x450], r15b
mov r9d, 2
mov byte [rbp + 0x451], bl
movzx eax, word [rbp + 0x450]
mov word [rbp + 0x450], ax
lea edx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rcx, qword [rbp + 0x468]
jmp 0x140010cb6
mov rcx, qword [0x1401978f0]
lea rax, str.iopriority
movzx r8d, sil
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x60]
mov qword [rbp + 0x60], 0x14
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14001053c
mov rcx, qword [0x1401978f8]
test rcx, rcx
je 0x14000ff55
lea rax, str.verylow
mov qword [rbp + 0x70], 0xe
movzx r8d, sil
mov qword [rbp + 0x78], rax
lea rdx, [rbp + 0x70]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1400103fe
mov esi, r15d
jmp 0x1400104aa
mov rcx, qword [0x1401978f8]
lea rax, [0x140159878]
movzx r8d, sil
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x80]
mov qword [rbp + 0x80], 6
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x1400104aa
mov rcx, qword [0x1401978f8]
lea rax, str.normal
movzx r8d, sil
mov qword [rbp + 0x98], rax
lea rdx, [rbp + 0x90]
mov qword [rbp + 0x90], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14001046d
mov esi, 2
jmp 0x1400104aa
mov rcx, qword [0x1401978f8]
lea rax, str.high
movzx r8d, sil
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0xa0]
mov qword [rbp + 0xa0], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14000ff55
mov esi, 3
xorps xmm0, xmm0
mov dword [rbp + 0x2d0], 0x30
lea r9, [rbp + 0xb0]
mov qword [rbp + 0x2d8], r15
lea r8, [rbp + 0x2d0]
mov dword [rbp + 0x2e8], r15d
mov edx, 0x200
mov qword [rbp + 0x2e0], r15
lea rcx, [rbp + 0x468]
mov qword [rbp + 0xb0], r14
movdqu xmmword [rbp + 0x2f0], xmm0
mov qword [rbp + 0xb8], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov edi, eax
test eax, eax
js 0x140010cbe
mov rcx, qword [rbp + 0x468]
lea r8, [rbp + 0x458]
mov r9d, 4
mov dword [rbp + 0x458], esi
lea edx, [r9 + 0x1d]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rcx, qword [rbp + 0x468]
jmp 0x140010cb6
mov rcx, qword [0x1401978f0]
lea rax, str.pagepriority
movzx r8d, sil
mov qword [rbp + 0xc8], rax
lea rdx, [rbp + 0xc0]
mov qword [rbp + 0xc0], 0x18
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010629
mov rcx, qword [0x1401978f8]
test rcx, rcx
je 0x14000ff55
lea r8, [rsp + 0x60]
mov edx, 0xa
call sym.ProcessHacker.exe_PhStringToInteger64
xorps xmm0, xmm0
mov dword [rbp + 0x300], 0x30
lea r9, [rbp + 0xd0]
mov qword [rbp + 0x308], r15
lea r8, [rbp + 0x300]
mov dword [rbp + 0x318], r15d
mov edx, 0x200
mov qword [rbp + 0x310], r15
lea rcx, [rbp + 0x468]
mov qword [rbp + 0xd0], r14
movdqu xmmword [rbp + 0x320], xmm0
mov qword [rbp + 0xd8], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov edi, eax
test eax, eax
js 0x140010cbe
mov eax, dword [rsp + 0x60]
lea r8, [rbp + 0x460]
mov rcx, qword [rbp + 0x468]
mov r9d, 4
mov dword [rbp + 0x460], eax
lea edx, [r9 + 0x23]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rcx, qword [rbp + 0x468]
jmp 0x140010cb6
mov rcx, qword [0x1401978f0]
lea rax, str.unloaddll
movzx r8d, sil
mov qword [rbp + 0xe8], rax
lea rdx, [rbp + 0xe0]
mov qword [rbp + 0xe0], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010cbe
cmp qword [0x1401978f8], r15
je 0x14000ff55
mov edx, dword [sym.ProcessHacker.exe_ProcessQueryAccess]
lea r9, [rbp + 0xf0]
xorps xmm0, xmm0
mov dword [rbp + 0x330], 0x30
or edx, 0x3a
mov qword [rbp + 0x338], r15
lea r8, [rbp + 0x330]
mov dword [rbp + 0x348], r15d
lea rcx, [rbp + 0x468]
mov qword [rbp + 0x340], r15
movdqu xmmword [rbp + 0x350], xmm0
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov edi, eax
test eax, eax
js 0x140010cbe
mov rax, qword [0x1401978f8]
lea r8, [rsp + 0x68]
mov rbx, qword [rbp + 0x468]
mov r9d, 8
mov rcx, rbx
mov qword [rbp - 0x78], r15
mov qword [rsp + 0x20], r15
movups xmm0, xmmword [rax]
lea edx, [r9 + 0x12]
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rsi, [0x140010cf0]
test eax, eax
js 0x140010751
cmp qword [rsp + 0x68], r15
je 0x140010751
lea rax, [rsp + 0x78]
mov qword [rbp + 0x1e0], rsi
lea r8, [rbp + 0x1e0]
mov qword [rbp + 0x1e8], rax
lea rdx, [0x1400d6f30]
mov dword [rbp + 0x1f0], r15d
mov rcx, rbx
call fcn.1400d6d90
mov edi, eax
jmp 0x140010757
mov edi, dword [rbp + 0x450]
mov rax, qword [rbp - 0x78]
test rax, rax
jne 0x140010796
lea rax, [rsp + 0x78]
mov qword [rbp + 0x1f8], rsi
lea r8, [rbp + 0x1f8]
mov qword [rbp + 0x200], rax
lea rdx, [0x1400d6a60]
mov dword [rbp + 0x208], r15d
mov rcx, rbx
call fcn.1400d68d0
mov edi, eax
mov rax, qword [rbp - 0x78]
mov rdx, qword [rbp + 0x450]
test edi, edi
cmovns rdx, rax
js 0x1400107c1
mov rcx, qword [rbp + 0x468]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x70], 0xfffffffffd050f80
call sym.ProcessHacker.exe_PhUnloadDllProcess
mov edi, eax
mov rcx, qword [rbp + 0x468]
jmp 0x140010cb8
mov rcx, qword [0x1401978e0]
lea rax, str.service
movzx r8d, sil
mov qword [rbp + 0x108], rax
lea rdx, [rbp + 0x100]
mov qword [rbp + 0x100], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010a5d
cmp qword [0x1401978e8], r15
je 0x14000ff55
mov rcx, qword [0x1401978f0]
lea rax, str.start
movzx r8d, sil
mov qword [rbp + 0x118], rax
lea rdx, [rbp + 0x110]
mov qword [rbp + 0x110], 0xa
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14001087a
mov rcx, qword [0x1401978e8]
mov edx, 0x10
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rbx, rax
test rax, rax
je 0x140010a12
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x140010a36
mov rcx, qword [0x1401978f0]
lea rax, [0x14013dc20]
movzx r8d, sil
mov qword [rbp + 0x128], rax
lea rdx, [rbp + 0x120]
mov qword [rbp + 0x120], 0x10
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1400108e9
mov rcx, qword [0x1401978e8]
mov edx, 0x40
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rbx, rax
test rax, rax
je 0x140010a12
lea r8, [rbp + 0x3f0]
mov edx, 3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x140010a36
mov rcx, qword [0x1401978f0]
lea rax, str.pause
movzx r8d, sil
mov qword [rbp + 0x138], rax
lea rdx, [rbp + 0x130]
mov qword [rbp + 0x130], 0xa
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010958
mov rcx, qword [0x1401978e8]
mov edx, 0x40
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rbx, rax
test rax, rax
je 0x140010a12
lea r8, [rbp + 0x3f0]
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x140010a36
mov rcx, qword [0x1401978f0]
lea rax, str.stop
movzx r8d, sil
mov qword [rbp + 0x148], rax
lea rdx, [rbp + 0x140]
mov qword [rbp + 0x140], 8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x1400109bd
mov rcx, qword [0x1401978e8]
mov edx, 0x20
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rbx, rax
test rax, rax
je 0x140010a12
lea r8, [rbp + 0x3f0]
mov edx, esi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x140010a36
mov rcx, qword [0x1401978f0]
lea rax, [0x14013dd48]
movzx r8d, sil
mov qword [rbp + 0x158], rax
lea rdx, [rbp + 0x150]
mov qword [rbp + 0x150], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010cbe
mov rcx, qword [0x1401978e8]
mov edx, 0x10000
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rbx, rax
test rax, rax
jne 0x140010a2d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140010cc0
movzx eax, ax
or eax, 0xc0070000
jmp 0x140010cc0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140010a4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x140010a4f
movzx edi, ax
or edi, 0xc0070000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140010cbe
mov rcx, qword [0x1401978e0]
lea rax, str.thread
movzx r8d, sil
mov qword [rbp + 0x168], rax
lea rdx, [rbp + 0x160]
mov qword [rbp + 0x160], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010cbe
mov rcx, qword [0x1401978e8]
test rcx, rcx
je 0x14000ff55
lea r8, [rsp + 0x38]
mov edx, 0xa
call sym.ProcessHacker.exe_PhStringToInteger64
test al, al
je 0x14000ff55
mov rcx, qword [0x1401978f0]
lea rax, str.terminate
movzx r8d, sil
mov qword [rbp + 0x178], rax
lea rdx, [rbp + 0x170]
mov qword [rbp + 0x170], 0x12
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010b64
mov rax, qword [rsp + 0x38]
lea r9, [rbp + 0x180]
xorps xmm0, xmm0
mov qword [rbp + 0x188], rax
lea r8, [rbp + 0x360]
mov qword [rbp + 0x180], r15
mov edx, esi
mov dword [rbp + 0x360], 0x30
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x368], r15
movdqu xmmword [rbp + 0x380], xmm0
mov dword [rbp + 0x378], r15d
mov qword [rbp + 0x370], r15
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov edi, eax
test eax, eax
js 0x140010cbe
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtTerminateThread]
jmp 0x140010cb1
mov rcx, qword [0x1401978f0]
lea rax, str.suspend
movzx r8d, sil
mov qword [rbp + 0x198], rax
lea rdx, [rbp + 0x190]
mov qword [rbp + 0x190], 0xe
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010c0f
mov rax, qword [rsp + 0x38]
lea r9, [rbp + 0x1a0]
xorps xmm0, xmm0
mov qword [rbp + 0x1a8], rax
lea r8, [rbp + 0x390]
mov qword [rbp + 0x1a0], r15
mov edx, 2
mov dword [rbp + 0x390], 0x30
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x398], r15
movdqu xmmword [rbp + 0x3b0], xmm0
mov dword [rbp + 0x3a8], r15d
mov qword [rbp + 0x3a0], r15
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov edi, eax
test eax, eax
js 0x140010cbe
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSuspendThread]
jmp 0x140010cb1
mov rcx, qword [0x1401978f0]
lea rax, str.resume
movzx r8d, sil
mov qword [rbp + 0x1b8], rax
lea rdx, [rbp + 0x1b0]
mov qword [rbp + 0x1b0], 0xc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140010cbe
mov rax, qword [rsp + 0x38]
lea r9, [rbp + 0x1c0]
xorps xmm0, xmm0
mov qword [rbp + 0x1c8], rax
lea r8, [rbp + 0x3c0]
mov qword [rbp + 0x1c0], r15
mov edx, 2
mov dword [rbp + 0x3c0], 0x30
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x3c8], r15
movdqu xmmword [rbp + 0x3e0], xmm0
mov dword [rbp + 0x3d8], r15d
mov qword [rbp + 0x3d0], r15
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov edi, eax
test eax, eax
js 0x140010cbe
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rcx, qword [rsp + 0x30]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
mov rsi, qword [rsp + 0x520]
mov rbx, qword [rsp + 0x528]
mov r15, qword [rsp + 0x518]
add rsp, 0x530
pop r14
pop rdi
pop rbp
ret