Function at 0x1800d1cc0
Capabilities:
Write file on windows

Disassembly:
jmp 0x1800d1cc0
push rsi
push rdi
sub rsp, 0x108
lea rdi, [rsp + 0x50]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov eax, dword [0x180c38d60]
and eax, 1
test eax, eax
jne 0x1800d1ecc
cmp qword [0x180c38d68], 0
je 0x1800d1d21
xor edx, edx
mov rax, qword [0x180c38d68]
mov rcx, qword [rax + 8]
call sym.ProcessMonitor.dll_PhGetFullPath
mov qword [0x1805aabe8], rax
cmp qword [0x1805aabe8], 0
jne 0x1800d1d8d
call sym.ProcessMonitor.dll_PhGetApplicationFileName
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x1800d1d8d
mov rax, qword [rsp + 0x60]
lea rdx, [0x18059c100]
mov rcx, rax
call sym.ProcessMonitor.dll_PhConcatStringRef2
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call sym.ProcessMonitor.dll_PhDoesFileExistsWin32
movzx eax, al
test eax, eax
je 0x1800d1d79
mov rax, qword [rsp + 0x58]
mov qword [0x1805aabe8], rax
jmp 0x1800d1d83
mov rcx, qword [rsp + 0x58]
call sym.ProcessMonitor.dll_PhDereferenceObject
mov rcx, qword [rsp + 0x60]
call sym.ProcessMonitor.dll_PhDereferenceObject
cmp qword [0x1805aabe8], 0
jne 0x1800d1daa
lea rcx, [0x18059c0f0]
call sym.ProcessMonitor.dll_PhExpandEnvironmentStrings
mov qword [0x1805aabe8], rax
cmp qword [0x1805aabe8], 0
je 0x1800d1ecc
mov rax, qword [0x1805aabe8]
mov rcx, qword [rax + 8]
call sym.ProcessMonitor.dll_PhLoadSettings
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xc0000102
jne 0x1800d1ecc
lea rax, str.If_you_select_No__the_settings_system_will_not_function_properly.
mov qword [rsp + 0x20], rax
lea r9, str.Process_Hackers_settings_file_is_corrupt._Do_you_want_to_reset_it_
mov r8d, 0xffff
mov edx, 6
xor ecx, ecx
call sym.ProcessMonitor.dll_PhShowMessage2
cmp eax, 6
jne 0x1800d1eb5
lea rax, [rsp + 0xc8]
lea rcx, str._settings___settings_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x16
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
mov r9d, 0x80
mov r8d, 0x120116
mov rax, qword [0x1805aabe8]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x78]
call sym.ProcessMonitor.dll_PhCreateFileWin32
test eax, eax
jl 0x1800d1eb3
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x15
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x1800d1ecc
mov rcx, qword [0x1805aabe8]
call sym.ProcessMonitor.dll_PhDereferenceObject
mov qword [0x1805aabe8], 0
lea rcx, str.EnablePlugins
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800d1ee9
mov dword [rsp + 0xf0], 1
jmp 0x1800d1ef4
mov dword [rsp + 0xf0], 0
movzx eax, byte [rsp + 0xf0]
mov byte [0x1805aabe0], al
lea rcx, str.MaxSizeUnit
call sym.ProcessMonitor.dll_PhGetIntegerSetting
mov dword [0x18059fc24], eax
lea rcx, str.MaxPrecisionUnit
call sym.ProcessMonitor.dll_PhGetIntegerSetting
mov word [0x18059fc28], ax
lea rcx, str.SampleCountAutomatic
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800d1f7b
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
inc eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0xe4], eax
cmp dword [rsp + 0xe4], 0x800
jbe 0x1800d1f68
mov dword [rsp + 0xe4], 0x800
mov edx, dword [rsp + 0xe4]
lea rcx, str.SampleCount
call sym.ProcessMonitor.dll_PhSetIntegerSetting
mov rcx, rsp
lea rdx, [0x180486020]
call fcn.180014e20
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0x108
pop rdi
pop rsi
ret