Function at 0x1400a67a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov qword [rsp + 0x80], rbp
mov ebp, r9d
mov r14, r8
mov rbx, rcx
test r9d, r9d
jne 0x1400a67fc
mov rax, qword [rcx + 0x40]
mov edx, r15d
cmp dword [rax], edx
jbe 0x1400a688f
nop
mov rax, qword [rax + 8]
mov ecx, edx
inc edx
mov rcx, qword [rax + rcx*8]
or dword [rcx], 1
mov rax, qword [rbx + 0x40]
cmp edx, dword [rax]
jb 0x1400a67e0
jmp 0x1400a688f
cmp r9d, 1
je 0x1400a688f
mov rax, qword [rcx + 0x40]
mov edx, r15d
mov dword [rsp + 0x38], 0x9c4b
mov dword [rsp + 0x3c], 0x9c4e
mov dword [rsp + 0x40], 0x9c4c
mov dword [rsp + 0x44], 0x9c4d
mov dword [rsp + 0x48], 0x9d03
cmp dword [rax], edx
jbe 0x1400a6857
nop dword [rax]
mov rax, qword [rax + 8]
mov ecx, edx
inc edx
mov rcx, qword [rax + rcx*8]
or dword [rcx], 1
mov rax, qword [rbx + 0x40]
cmp edx, dword [rax]
jb 0x1400a6840
lea rdi, [rsp + 0x38]
mov esi, 5
mov r9d, dword [rdi]
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rcx, rbx
mov qword [rsp + 0x20], r15
lea edx, [r8 + 1]
call fcn.140009d50
test rax, rax
je 0x1400a6885
and dword [rax], 0xfffffffe
add rdi, 4
sub rsi, 1
jne 0x1400a6861
or r12d, 0xffffffff
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
jae 0x1400a6922
mov qword [rsp + 0x28], r15
lea r8, [0x14012f178]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor edx, edx
mov rcx, rbx
call fcn.140009d50
mov rdi, rax
test rax, rax
je 0x1400a68e1
cmp qword [rax + 0x38], r15
je 0x1400a68d9
mov r8d, r12d
mov rdx, rax
xor ecx, ecx
call sym.ProcessHacker.exe_PhRemoveEMenuItem
mov rcx, rdi
call fcn.140009c50
mov qword [rsp + 0x28], r15
lea r8, [0x14012f268]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor edx, edx
mov rcx, rbx
call fcn.140009d50
mov rdi, rax
test rax, rax
je 0x1400a6922
cmp qword [rax + 0x38], r15
je 0x1400a691a
mov r8d, r12d
mov rdx, rax
xor ecx, ecx
call sym.ProcessHacker.exe_PhRemoveEMenuItem
mov rcx, rdi
call fcn.140009c50
mov qword [rsp + 0x28], r15
mov r9d, 0x9c4e
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
mov rcx, rbx
call fcn.140009d50
mov rdi, rax
test rax, rax
je 0x1400a6962
cmp qword [rax + 0x38], r15
je 0x1400a695a
mov r8d, r12d
mov rdx, rax
xor ecx, ecx
call sym.ProcessHacker.exe_PhRemoveEMenuItem
mov rcx, rdi
call fcn.140009c50
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov r9d, 0x9c50
mov qword [rsp + 0x20], r15
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.140009d50
test rax, rax
je 0x1400a6989
or dword [rax], 1
cmp ebp, 1
mov rbp, qword [rsp + 0x80]
jne 0x1400a6be1
mov r8, qword [r14]
lea rcx, [rsp + 0x30]
mov edx, dword [sym.ProcessHacker.exe_ThreadQueryAccess]
mov edi, r12d
mov dword [rsp + 0x98], r12d
mov r8, qword [r8]
call sym.ProcessHacker.exe_PhOpenThread
test eax, eax
js 0x1400a6b18
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
mov esi, eax
jb 0x1400a6a3b
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x98]
mov r9d, 4
mov qword [rsp + 0x20], r15
lea edx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov ecx, dword [rsp + 0x98]
lea r8, [rsp + 0x88]
test eax, eax
mov qword [rsp + 0x20], r15
mov r9d, 4
cmovs ecx, r12d
mov dword [rsp + 0x98], ecx
mov rcx, qword [rsp + 0x30]
lea edx, [r9 + 0x14]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
cmovns edi, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x88]
mov r8b, 1
mov edx, 8
call qword [sym.imp.ntdll.dll_NtOpenThreadToken]
test eax, eax
js 0x1400a6a8f
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov r9d, 0x9c50
mov qword [rsp + 0x20], r15
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.140009d50
test rax, rax
je 0x1400a6a81
and dword [rax], 0xfffffffe
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
cmp esi, 0xf
ja 0x1400a6acf
je 0x1400a6ac7
test esi, esi
je 0x1400a6abf
sub esi, 1
je 0x1400a6ab7
cmp esi, 1
jne 0x1400a6b18
mov r9d, 0x9c55
jmp 0x1400a6af4
mov r9d, 0x9c56
jmp 0x1400a6af4
mov r9d, 0x9c57
jmp 0x1400a6af4
mov r9d, 0x9c54
jmp 0x1400a6af4
cmp esi, 0xfffffff1
je 0x1400a6aee
cmp esi, 0xfffffffe
je 0x1400a6ae6
cmp esi, r12d
jne 0x1400a6b18
mov r9d, 0x9c58
jmp 0x1400a6af4
mov r9d, 0x9c59
jmp 0x1400a6af4
mov r9d, 0x9c5a
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rcx, rbx
mov qword [rsp + 0x20], r15
lea edx, [r8 + 1]
call fcn.140009d50
test rax, rax
je 0x1400a6b18
or dword [rax], 0x82
mov eax, dword [rsp + 0x98]
cmp eax, r12d
je 0x1400a6b79
test eax, eax
je 0x1400a6b4f
sub eax, 1
je 0x1400a6b47
sub eax, 1
je 0x1400a6b3f
cmp eax, 1
jne 0x1400a6b79
mov r9d, 0x9c5f
jmp 0x1400a6b55
mov r9d, 0x9c5e
jmp 0x1400a6b55
mov r9d, 0x9c5d
jmp 0x1400a6b55
mov r9d, 0x9c5c
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rcx, rbx
mov qword [rsp + 0x20], r15
lea edx, [r8 + 1]
call fcn.140009d50
test rax, rax
je 0x1400a6b79
or dword [rax], 0x82
cmp edi, r12d
je 0x1400a6be1
sub edi, 1
je 0x1400a6bb7
sub edi, 1
je 0x1400a6baf
sub edi, 1
je 0x1400a6ba7
sub edi, 1
je 0x1400a6b9f
cmp edi, 1
jne 0x1400a6be1
mov r9d, 0x9d2f
jmp 0x1400a6bbd
mov r9d, 0x9d30
jmp 0x1400a6bbd
mov r9d, 0x9d31
jmp 0x1400a6bbd
mov r9d, 0x9d32
jmp 0x1400a6bbd
mov r9d, 0x9d33
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rcx, rbx
mov qword [rsp + 0x20], r15
lea edx, [r8 + 1]
call fcn.140009d50
test rax, rax
je 0x1400a6be1
or dword [rax], 0x82
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret