Function at 0x14002e050
Capabilities:
Check os version
Create process on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
lea rbp, [r11 - 0x48]
sub rsp, 0x138
lea eax, [rcx - 0x9c41]
mov esi, ecx
cmp eax, 0x11d
ja case.default.0x14002e0a6
mov qword [r11 + 0x18], rbx
lea r9, [0x140000000]
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
movzx eax, byte [r9 + rax + 0x31438]
mov edx, dword [r9 + rax*4 + 0x312e8]
add rdx, r9
jmp rdx
mov esi, 5
xor eax, eax
lock cmpxchg qword [0x14018d8b0], rsi
je 0x14002e0c6
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockShared
mov r14, qword [0x140191a30]
lea rax, str.HideOnClose
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], 0x16
mov qword [rsp + 0x50], rax
call qword [r14 + 0x10]
mov ecx, dword [r14 + 0x18]
xor ebx, ebx
btr eax, 0x1f
dec ecx
mov r12d, eax
mov rax, qword [r14 + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002e13e
nop dword [rax]
mov edi, dword [r14]
add edi, 8
imul edi, edx
add rdi, qword [r14 + 0x30]
cmp dword [rdi], r12d
jne 0x14002e136
lea r15, [rdi + 8]
mov rcx, r15
lea rdx, [rsp + 0x40]
call qword [r14 + 8]
test al, al
jne 0x14002e18b
mov edx, dword [rdi + 4]
cmp edx, 0xffffffff
jne 0x14002e110
mov edi, dword [rbp + 0x50]
mov r15, rbx
mov rax, rsi
lock cmpxchg qword [0x14018d8b0], rbx
je 0x14002e15e
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfReleaseQueuedLockShared
test r15, r15
je 0x14002f38f
test edi, edi
je 0x14002e19c
cmp dword [0x140192288], ebx
je case.0x14002e0a6.40002
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x14002e0a6.40002
test r15, r15
je 0x14002e13e
cmp dword [r15], 1
jne 0x14002e13e
mov edi, dword [r15 + 0x28]
jmp 0x14002e144
xor eax, eax
lock cmpxchg qword [0x14018d8b0], rsi
je 0x14002e1b5
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockShared
mov r14, qword [0x140191a30]
lea rax, str.CloseOnEscape
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x78], 0x1a
mov qword [rbp - 0x80], rax
call qword [r14 + 0x10]
mov ecx, dword [r14 + 0x18]
btr eax, 0x1f
mov r12d, eax
dec ecx
mov rax, qword [r14 + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002e22e
nop word [rax + rax]
mov edi, dword [r14]
add edi, 8
imul edi, edx
add rdi, qword [r14 + 0x30]
cmp dword [rdi], r12d
jne 0x14002e226
lea r15, [rdi + 8]
mov rcx, r15
lea rdx, [rsp + 0x70]
call qword [r14 + 8]
test al, al
jne 0x14002e27c
mov edx, dword [rdi + 4]
cmp edx, 0xffffffff
jne 0x14002e200
mov edi, dword [rbp + 0x50]
mov r15, rbx
mov rax, rsi
lock cmpxchg qword [0x14018d8b0], rbx
je 0x14002e24e
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfReleaseQueuedLockShared
test r15, r15
je 0x14002f38f
test edi, edi
je case.0x14002e0a6.40002
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8079
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x14002e0a6.40002
test r15, r15
je 0x14002e22e
cmp dword [r15], 1
jne 0x14002e22e
mov edi, dword [r15 + 0x28]
jmp 0x14002e234
mov rax, qword [0x140190f00]
test rax, rax
je case.0x14002e0a6.40002
xor ebx, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov dword [0x14018de18], ebx
jmp 0x14002e2fb
mov rax, qword [0x140190f00]
test rax, rax
je case.0x14002e0a6.40002
mov edi, 1
lea rcx, str.Type_the_name_of_a_program_that_will_be_opened_under_alternate_credentials.
jmp 0x14002e2ea
mov rax, qword [0x140190f00]
test rax, rax
je case.0x14002e0a6.40002
mov edi, 2
lea rcx, str.Type_the_name_of_a_program_that_will_be_opened_under_standard_user_privileges.
xor ebx, ebx
mov dword [0x14018de18], edi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call rax
jmp case.0x14002e0a6.40002
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x807b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
lea r8, [0x14015d4b0]
xor ebx, ebx
mov r9d, 5
mov qword [rsp + 0x38], rbx
xor edx, edx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call fcn.14000dcd0
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
xor r9d, r9d
xor r8d, r8d
test al, al
je 0x14002e380
mov edx, 0x8079
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x14002e0a6.40002
mov edx, 0x807c
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x14002e0a6.40002
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateSaveFileDialog
mov rcx, qword [0x14018e060]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
mov r12, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
lea rdi, str.Output
cmp eax, dword [0x14018df7c]
mov r15, rax
mov r13d, ebx
jne 0x14002e3d0
lea rdi, [0x14015d138]
jmp 0x14002e42b
cmp r15d, dword [0x14018df54]
jne 0x14002e3e2
lea rdi, [0x14015d150]
jmp 0x14002e42b
cmp r15d, dword [0x14018e004]
jne 0x14002e3f4
lea rdi, [0x14015d168]
jmp 0x14002e42b
mov r9, qword [0x14018e0a0]
test r9, r9
je 0x14002e42b
mov r8d, dword [r9]
mov ecx, ebx
test r8d, r8d
je 0x14002e42b
mov r9, qword [r9 + 8]
nop
mov eax, ecx
mov rdx, qword [r9 + rax*8]
cmp dword [rdx + 0x20], r15d
je 0x14002e425
inc ecx
cmp ecx, r8d
jb 0x14002e410
jmp 0x14002e42b
mov rdi, qword [rdx]
mov r13, rdx
mov r8d, 3
lea rdx, str.Text_files__.txt_.log_
mov rcx, r12
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhSetFileDialogFilter
mov rdx, rdi
lea rcx, str.ProcessChecker__s.txt
call fcn.1400013f0
mov rcx, r12
mov rdx, qword [rax + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhSetFileDialogFileName
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov rdx, r12
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowFileDialog
test al, al
je 0x14002e7b8
mov rcx, r12
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetFileDialogFileName
mov rcx, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhAutoDereferenceObject
mov r14, qword [r12 + 8]
mov qword [rbp + 0x58], rax
cmp byte [r12], bl
je 0x14002e4af
mov r8, qword [r14]
lea rdx, [rbp + 0x50]
mov rcx, r14
call qword [r8 + 0x30]
test eax, eax
mov r14d, ebx
mov rax, qword [rbp + 0x58]
cmovns r14d, dword [rbp + 0x50]
jmp 0x14002e4b3
mov r14d, dword [r14 + 0x2c]
mov rdx, qword [rax + 8]
lea rcx, [rbp + 0x58]
mov dword [rsp + 0x28], ebx
mov r9d, 1
mov r8d, 0x120116
mov dword [rsp + 0x20], 5
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateFileStream
mov edi, eax
test eax, eax
js 0x14002e715
mov r8, qword [0x140185e68]
mov edi, 2
mov rdx, qword [0x140185e70]
cmp r14d, edi
mov r14, qword [rbp + 0x58]
mov rcx, r14
cmovne edi, ebx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhWriteStringAsUtf8FileStreamEx
mov rcx, r14
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhWritePhTextHeader
cmp r15d, dword [0x14018df7c]
mov rsi, 0xffffffffffffffff
jne 0x14002e5b5
mov rdx, qword [0x14018f338]
mov r9d, edi
mov edx, dword [rdx]
call fcn.140096360
mov r15, rax
cmp dword [rax], ebx
jbe 0x14002e58f
nop dword [rax + rax]
mov rdx, qword [r15 + 8]
mov rcx, r14
mov r8d, ebx
mov rdi, qword [rdx + r8*8]
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhWriteStringAsUtf8FileStreamEx
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002e56f
call fcn.1400d9400
mov r14, qword [rbp + 0x58]
lea rdx, [0x140157ed8]
mov rcx, r14
mov r8d, 4
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhWriteStringAsUtf8FileStreamEx
inc ebx
cmp ebx, dword [r15]
jb 0x14002e540
lea rcx, [r15 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002e6e3
call fcn.1400d9400
mov r14, qword [rbp + 0x58]
lea rcx, [r14 - 0x10]
jmp 0x14002e7a9
cmp r15d, dword [0x14018df54]
jne 0x14002e654
mov rcx, qword [0x14018f448]
mov edx, edi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetGenericTreeNewLines
mov r15, rax
cmp dword [rax], ebx
jbe 0x14002e62e
nop word [rax + rax]
mov rcx, qword [r15 + 8]
mov edx, ebx
mov rdi, qword [rcx + rdx*8]
mov rcx, r14
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhWriteStringAsUtf8FileStreamEx
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002e60e
call fcn.1400d9400
mov r14, qword [rbp + 0x58]
lea rdx, [0x140157ed8]
mov rcx, r14
mov r8d, 4
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhWriteStringAsUtf8FileStreamEx
inc ebx
cmp ebx, dword [r15]
jb 0x14002e5e0
lea rcx, [r15 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002e6e3
call fcn.1400d9400
mov r14, qword [rbp + 0x58]
lea rcx, [r14 - 0x10]
jmp 0x14002e7a9
cmp r15d, dword [0x14018e004]
jne 0x14002e6f0
mov rcx, qword [0x14018e380]
mov edx, edi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetGenericTreeNewLines
mov r15, rax
cmp dword [rax], ebx
jbe 0x14002e6ce
nop word [rax + rax]
mov rcx, qword [r15 + 8]
mov edx, ebx
mov rdi, qword [rcx + rdx*8]
mov rcx, r14
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhWriteStringAsUtf8FileStreamEx
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002e6ae
call fcn.1400d9400
mov r14, qword [rbp + 0x58]
lea rdx, [0x140157ed8]
mov rcx, r14
mov r8d, 4
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhWriteStringAsUtf8FileStreamEx
inc ebx
cmp ebx, dword [r15]
jb 0x14002e680
lea rcx, [r15 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002e6e3
call fcn.1400d9400
mov r14, qword [rbp + 0x58]
lea rcx, [r14 - 0x10]
jmp 0x14002e7a9
test r13, r13
je 0x14002e70c
mov rax, qword [r13 + 0x30]
test rax, rax
je 0x14002e70c
mov r9, qword [r13 + 8]
xor r8d, r8d
mov edx, edi
mov rcx, r14
call rax
lea rcx, [r14 - 0x10]
jmp 0x14002e7a9
mov rsi, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
cmp edi, 0xc0000022
je 0x14002e73d
cmp edi, 0xc0000005
je 0x14002e73d
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14002e749
movzx eax, di
jmp 0x14002e745
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x14002e752
mov ecx, edi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetNtMessage
jmp 0x14002e759
mov ecx, eax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetWin32Message
lea r9, str.Unable_to_create_the_file
mov rbx, rax
mov edx, 0x10
mov rcx, rsi
test rax, rax
jne 0x14002e789
lea r8, [0x140166310]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
mov rcx, r12
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhFreeFileDialog
jmp case.0x14002e0a6.40002
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov rsi, 0xffffffffffffffff
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x14002e7b8
call fcn.1400d9400
mov rcx, r12
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhFreeFileDialog
jmp case.0x14002e0a6.40002
mov rax, qword [0x14018cd50]
test rax, rax
jne 0x14002e7ff
mov r8, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
lea r9, [0x140017890]
mov rcx, qword [0x140192458]
xor ebx, ebx
mov edx, 0x82
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [0x14018cd50], rax
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x14002e81e
mov rcx, qword [0x14018cd50]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14018cd50]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x14002e0a6.40002
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call fcn.140055630
jmp case.0x14002e0a6.40002
cmp byte [0x14018cac4], 0
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
je 0x14002e879
xor ebx, ebx
lea r9, [0x140080dc0]
mov r8, rcx
mov qword [rsp + 0x20], rbx
mov rcx, qword [0x140192458]
mov edx, 0xbb
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x14002e0a6.40002
lea r8, str.Plugins_are_not_enabled._To_use_plugins_enable_them_in_Options_and_restart_ProcessChecker.
mov edx, 0x40
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
jmp case.0x14002e0a6.40002
call fcn.140034170
jmp case.0x14002e0a6.40002
xor ecx, ecx
call fcn.1400b5810
jmp case.0x14002e0a6.40002
sub esi, 0x9c9d
je 0x14002e8e2
sub esi, 1
je 0x14002e8db
sub esi, 2
je 0x14002e8d4
sub esi, 1
je 0x14002e8cd
cmp esi, 0x47
jne 0x14002e8c8
mov edi, 2
jmp 0x14002e8e7
mov edi, dword [rbp + 0x50]
jmp 0x14002e8e7
mov edi, 8
jmp 0x14002e8e7
mov edi, 4
jmp 0x14002e8e7
mov edi, 0x10
jmp 0x14002e8e7
mov edi, 1
test dword [0x140192288], edi
mov ecx, edi
sete dl
call fcn.1400527d0
jmp case.0x14002e0a6.40002
mov rdi, qword [0x14018dde8]
xor ebx, ebx
test rdi, rdi
jne 0x14002e922
xor r8d, r8d
lea rdx, [0x140036d10]
lea rcx, [0x14018eb08]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhAddTreeNewFilter
jmp 0x14002e994
mov rsi, qword [0x14018eb08]
test rsi, rsi
je 0x14002e991
mov ecx, dword [rsi]
mov r10d, ebx
test ecx, ecx
je 0x14002e991
mov rdx, qword [rsi + 8]
nop dword [rax + rax]
mov eax, r10d
cmp qword [rdx + rax*8], rdi
je 0x14002e953
inc r10d
cmp r10d, ecx
jb 0x14002e940
jmp 0x14002e991
cmp r10d, 0xffffffff
je 0x14002e991
mov r8d, ecx
lea eax, [r10 + 1]
mov r9, rdx
sub r8d, r10d
lea rdx, [rdx + rax*8]
dec r8d
mov eax, r10d
shl r8, 3
lea rcx, [r9 + rax*8]
call fcn.1401317c0
dec dword [rsi]
mov r8, rdi
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, rbx
lea rcx, [0x14018eb08]
mov qword [0x14018dde8], rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhApplyTreeNewFilters
cmp qword [0x14018dde8], rbx
mov r12d, ebx
setne r12b
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x14002e9d2
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov r14, qword [0x140191a30]
lea rax, str.HideOtherUserProcesses
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x78], 0x2c
mov qword [rbp - 0x80], rax
call qword [r14 + 0x10]
mov ecx, dword [r14 + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [r14 + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002f101
nop word [rax + rax]
mov edi, dword [r14]
add edi, 8
imul edi, edx
add rdi, qword [r14 + 0x30]
cmp dword [rdi], r15d
jne 0x14002ea4a
lea rsi, [rdi + 8]
mov rcx, rsi
lea rdx, [rsp + 0x70]
call qword [r14 + 8]
test al, al
jne 0x14002f0f0
mov edx, dword [rdi + 4]
cmp edx, 0xffffffff
jne 0x14002ea20
jmp 0x14002f101
mov rdi, qword [0x14018e0f0]
test rdi, rdi
jne 0x14002eb3a
cmp byte [0x14018cac7], dil
jne 0x14002ea88
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
lea r8, str.This_filter_cannot_function_because_digital_signature_checking_is_not_enabled._Enable_it_in_Options___Advanced_and_restart_ProcessChecker.
mov edx, 0x40
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r14, rax
xor ebx, ebx
lea rax, [0x140036d50]
mov qword [r14], rax
mov qword [r14 + 8], rbx
mov rsi, qword [0x14018eb08]
test rsi, rsi
jne 0x14002eaff
mov rdx, qword [0x140191178]
mov ecx, 0x10
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov edx, 4
mov r8d, 0x10
mov rsi, rax
mov dword [rax], ebx
mov dword [rax + 4], 2
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsi + 8], rax
mov qword [0x14018eb08], rsi
mov eax, dword [rsi + 4]
cmp dword [rsi], eax
jne 0x14002eb2c
mov r8, qword [rsi + 8]
add eax, eax
mov r9d, eax
mov edx, 4
mov dword [rsi + 4], eax
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
shl r9, 3
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov qword [rsi + 8], rax
mov ecx, dword [rsi]
mov rax, qword [rsi + 8]
mov qword [rax + rcx*8], r14
inc dword [rsi]
jmp 0x14002eba9
mov rsi, qword [0x14018eb08]
xor ebx, ebx
test rsi, rsi
je 0x14002eba6
mov ecx, dword [rsi]
mov r10d, ebx
test ecx, ecx
je 0x14002eba6
mov rdx, qword [rsi + 8]
mov eax, r10d
cmp qword [rdx + rax*8], rdi
je 0x14002eb68
inc r10d
cmp r10d, ecx
jb 0x14002eb55
jmp 0x14002eba6
cmp r10d, 0xffffffff
je 0x14002eba6
mov r8d, ecx
lea eax, [r10 + 1]
mov r9, rdx
sub r8d, r10d
lea rdx, [rdx + rax*8]
dec r8d
mov eax, r10d
shl r8, 3
lea rcx, [r9 + rax*8]
call fcn.1401317c0
dec dword [rsi]
mov r8, rdi
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r14, rbx
lea rcx, [0x14018eb08]
mov qword [0x14018e0f0], r14
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhApplyTreeNewFilters
cmp qword [0x14018e0f0], 0
mov r12d, ebx
setne r12b
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x14002ebe8
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov r14, qword [0x140191a30]
lea rax, str.HideSignedProcesses
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x78], 0x26
mov qword [rbp - 0x80], rax
call qword [r14 + 0x10]
mov ecx, dword [r14 + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [r14 + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002f101
nop dword [rax]
mov edi, dword [r14]
add edi, 8
imul edi, edx
add rdi, qword [r14 + 0x30]
cmp dword [rdi], r15d
jne 0x14002ec5a
lea rsi, [rdi + 8]
mov rcx, rsi
lea rdx, [rsp + 0x70]
call qword [r14 + 8]
test al, al
jne 0x14002f0f0
mov edx, dword [rdi + 4]
cmp edx, 0xffffffff
jne 0x14002ec30
jmp 0x14002f101
xor ebx, ebx
cmp dword [0x140191ac8], ebx
mov r12d, ebx
sete r12b
mov dword [0x140191ac8], r12d
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x14002ec9a
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov r14, qword [0x140191a30]
lea rax, str.ScrollToNewProcesses
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x78], 0x28
mov qword [rbp - 0x80], rax
call qword [r14 + 0x10]
mov ecx, dword [r14 + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [r14 + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002f101
nop
mov edi, dword [r14]
add edi, 8
imul edi, edx
add rdi, qword [r14 + 0x30]
cmp dword [rdi], r15d
jne 0x14002ed0a
lea rsi, [rdi + 8]
mov rcx, rsi
lea rdx, [rsp + 0x70]
call qword [r14 + 8]
test al, al
jne 0x14002f0f0
mov edx, dword [rdi + 4]
cmp edx, 0xffffffff
jne 0x14002ece0
jmp 0x14002f101
xor ebx, ebx
cmp dword [0x140191ac0], ebx
mov r12d, ebx
sete r12b
mov dword [0x140191ac0], r12d
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x14002ed4a
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov r14, qword [0x140191a30]
lea rax, str.ShowCpuBelow001
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x78], 0x1e
mov qword [rbp - 0x80], rax
call qword [r14 + 0x10]
mov ecx, dword [r14 + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [r14 + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002edd1
nop word [rax + rax]
mov edi, dword [r14]
add edi, 8
imul edi, edx
add rdi, qword [r14 + 0x30]
cmp dword [rdi], r15d
jne 0x14002edb6
lea rsi, [rdi + 8]
mov rcx, rsi
lea rdx, [rsp + 0x70]
call qword [r14 + 8]
test al, al
jne 0x14002edc0
mov edx, dword [rdi + 4]
cmp edx, 0xffffffff
jne 0x14002ed90
jmp 0x14002edd1
mov rbx, rsi
test rsi, rsi
je 0x14002edd1
cmp dword [rsi], 1
jne 0x14002edd1
mov dword [rsi + 0x28], r12d
mov rsi, 0xffffffffffffffff
lock xadd qword [0x14018d8b0], rsi
movzx eax, sil
and al, 6
cmp al, 2
jne 0x14002ee0a
lea rax, [rsi - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x14002ee0a
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x14002f38f
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhInvalidateAllProcessNodes
jmp case.0x14002e0a6.40002
mov rdi, qword [0x14018e0b0]
test rdi, rdi
jne 0x14002eedf
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r14, rax
xor ebx, ebx
lea rax, [0x1400387c0]
mov qword [r14], rax
mov qword [r14 + 8], rbx
mov rsi, qword [0x14018f420]
test rsi, rsi
jne 0x14002eea4
mov rdx, qword [0x140191178]
mov ecx, 0x10
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov edx, 4
mov r8d, 0x10
mov rsi, rax
mov dword [rax], ebx
mov dword [rax + 4], 2
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsi + 8], rax
mov qword [0x14018f420], rsi
mov eax, dword [rsi + 4]
cmp dword [rsi], eax
jne 0x14002eed1
mov r8, qword [rsi + 8]
add eax, eax
mov r9d, eax
mov edx, 4
mov dword [rsi + 4], eax
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
shl r9, 3
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov qword [rsi + 8], rax
mov ecx, dword [rsi]
mov rax, qword [rsi + 8]
mov qword [rax + rcx*8], r14
inc dword [rsi]
jmp 0x14002ef54
mov rsi, qword [0x14018f420]
xor ebx, ebx
test rsi, rsi
je 0x14002ef51
mov ecx, dword [rsi]
mov r10d, ebx
test ecx, ecx
je 0x14002ef51
mov rdx, qword [rsi + 8]
nop word [rax + rax]
mov eax, r10d
cmp qword [rdx + rax*8], rdi
je 0x14002ef13
inc r10d
cmp r10d, ecx
jb 0x14002ef00
jmp 0x14002ef51
cmp r10d, 0xffffffff
je 0x14002ef51
mov r8d, ecx
lea eax, [r10 + 1]
mov r9, rdx
sub r8d, r10d
lea rdx, [rdx + rax*8]
dec r8d
mov eax, r10d
shl r8, 3
lea rcx, [r9 + rax*8]
call fcn.1401317c0
dec dword [rsi]
mov r8, rdi
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r14, rbx
lea rcx, [0x14018f420]
mov qword [0x14018e0b0], r14
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhApplyTreeNewFilters
cmp qword [0x14018e0b0], 0
mov r12d, ebx
setne r12b
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x14002ef93
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov r14, qword [0x140191a30]
lea rax, str.HideDriverServices
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x78], 0x24
mov qword [rbp - 0x80], rax
call qword [r14 + 0x10]
mov ecx, dword [r14 + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [r14 + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002f101
nop word [rax + rax]
mov edi, dword [r14]
add edi, 8
imul edi, edx
add rdi, qword [r14 + 0x30]
cmp dword [rdi], r15d
jne 0x14002f00a
lea rsi, [rdi + 8]
mov rcx, rsi
lea rdx, [rsp + 0x70]
call qword [r14 + 8]
test al, al
jne 0x14002f0f0
mov edx, dword [rdi + 4]
cmp edx, 0xffffffff
jne 0x14002efe0
jmp 0x14002f101
cmp byte [0x14018da4a], 0
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
sete al
mov dword [rsp + 0x30], 0x13
movzx edx, al
xor ebx, ebx
sub rdx, 2
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov byte [0x14018da4a], al
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_SetWindowPos]
movzx r12d, byte [0x14018da4a]
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x14002f078
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov r14, qword [0x140191a30]
lea rax, str.MainWindowAlwaysOnTop
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x78], 0x2a
mov qword [rbp - 0x80], rax
call qword [r14 + 0x10]
mov ecx, dword [r14 + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [r14 + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002f101
nop dword [rax + rax]
mov edi, dword [r14]
add edi, 8
imul edi, edx
add rdi, qword [r14 + 0x30]
cmp dword [rdi], r15d
jne 0x14002f0e6
lea rsi, [rdi + 8]
mov rcx, rsi
lea rdx, [rsp + 0x70]
call qword [r14 + 8]
test al, al
jne 0x14002f0f0
mov edx, dword [rdi + 4]
cmp edx, 0xffffffff
jne 0x14002f0c0
jmp 0x14002f101
mov rbx, rsi
test rsi, rsi
je 0x14002f101
cmp dword [rsi], 1
jne 0x14002f101
mov dword [rsi + 0x28], r12d
mov rsi, 0xffffffffffffffff
lock xadd qword [0x14018d8b0], rsi
movzx eax, sil
and al, 6
cmp al, 2
jne 0x14002f13a
lea rax, [rsi - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x14002f13a
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x14002f38f
jmp case.0x14002e0a6.40002
lea eax, [rcx + rcx*4]
mov r15d, 0x62066
add eax, eax
sub r15d, eax
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x14002f173
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x140191a30]
lea rax, str.MainWindowOpacity
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x78], 0x22
mov qword [rbp - 0x80], rax
call qword [rsi + 0x10]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002f1dd
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x14002f1d5
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rsp + 0x70]
call qword [rsi + 8]
test al, al
jne 0x14002f235
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14002f1b1
xor ebx, ebx
mov rsi, 0xffffffffffffffff
lock xadd qword [0x14018d8b0], rsi
movzx eax, sil
and al, 6
cmp al, 2
jne 0x14002f218
lea rax, [rsi - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x14002f218
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rbx, rbx
je 0x14002f38f
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov edx, r15d
call fcn.14000d2a0
jmp case.0x14002e0a6.40002
mov rbx, rdi
test rdi, rdi
je 0x14002f1df
cmp dword [rdi], 1
jne 0x14002f1df
mov dword [rdi + 0x28], r15d
jmp 0x14002f1df
lea rcx, [0x14018ded0]
call fcn.14010cc20
lea rcx, [0x14018dfa8]
call fcn.14010cc20
jmp case.0x14002e0a6.40002
sub esi, 0x9cdb
je 0x14002f2a7
sub esi, 1
je 0x14002f29f
sub esi, 1
je 0x14002f297
sub esi, 1
je 0x14002f28f
cmp esi, 1
jne 0x14002f289
mov r14d, 0x2710
jmp 0x14002f2ad
mov r14d, dword [rbp + 0x50]
jmp 0x14002f2ad
mov r14d, 0x1388
jmp 0x14002f2ad
mov r14d, 0x7d0
jmp 0x14002f2ad
mov r14d, 0x3e8
jmp 0x14002f2ad
mov r14d, 0x1f4
mov dword [0x140191ac4], r14d
lock bts qword [0x14018d8b0], 0
setb al
test al, al
je 0x14002f2d1
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockExclusive
mov r15, qword [0x140191a30]
lea rax, str.UpdateInterval
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x78], 0x1c
mov qword [rbp - 0x80], rax
call qword [r15 + 0x10]
mov ecx, dword [r15 + 0x18]
xor ebx, ebx
btr eax, 0x1f
dec ecx
mov r12d, eax
mov rax, qword [r15 + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14002f34e
nop dword [rax]
nop word [rax + rax]
mov edi, dword [r15]
add edi, 8
imul edi, edx
add rdi, qword [r15 + 0x30]
cmp dword [rdi], r12d
jne 0x14002f346
lea rsi, [rdi + 8]
mov rcx, rsi
lea rdx, [rsp + 0x70]
call qword [r15 + 8]
test al, al
jne 0x14002f39b
mov edx, dword [rdi + 4]
cmp edx, 0xffffffff
jne 0x14002f320
mov rdi, rbx
mov rsi, 0xffffffffffffffff
lock xadd qword [0x14018d8b0], rsi
movzx eax, sil
and al, 6
cmp al, 2
jne 0x14002f38a
lea rax, [rsi - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x14018d8b0], rdx
jne 0x14002f38a
lea rcx, [0x14018d8b0]
call fcn.1400ee3a0
test rdi, rdi
jne 0x14002f3ae
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rdi, rsi
test rsi, rsi
je 0x14002f351
cmp dword [rsi], 1
jne 0x14002f351
mov dword [rsi + 0x28], r14d
jmp 0x14002f351
mov rcx, qword [0x140192368]
mov dword [0x140192370], r14d
test rcx, rcx
je 0x14002f3ed
mov eax, r14d
xor r9d, r9d
imul rdx, rax, 0xffffffffffffd8f0
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rbp + 0x58], rdx
lea rdx, [rbp + 0x58]
mov dword [rsp + 0x28], r14d
mov byte [rsp + 0x20], bl
call qword [sym.imp.ntdll.dll_NtSetTimer]
mov rcx, qword [0x1401923a8]
mov dword [0x1401923b0], r14d
test rcx, rcx
je 0x14002f42c
mov eax, r14d
xor r9d, r9d
imul rdx, rax, 0xffffffffffffd8f0
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rbp + 0x58], rdx
lea rdx, [rbp + 0x58]
mov dword [rsp + 0x28], r14d
mov byte [rsp + 0x20], bl
call qword [sym.imp.ntdll.dll_NtSetTimer]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov edx, 1
cmp r14d, 0x3e8
jbe 0x14002f455
xor r9d, r9d
mov r8d, 0x3e8
call qword [sym.imp.USER32.dll_SetTimer]
jmp case.0x14002e0a6.40002
call qword [sym.imp.USER32.dll_KillTimer]
jmp case.0x14002e0a6.40002
cmp byte [0x140187ffa], 0
mov edx, 0x130b
mov rcx, qword [0x14018e060]
sete al
xor r9d, r9d
xor r8d, r8d
mov byte [0x140187ffa], al
mov byte [0x14018defc], al
mov byte [0x14018dfd4], al
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, dword [0x14018e004]
jne case.0x14002e0a6.40002
movzx eax, byte [0x140187ffa]
mov byte [0x14018de54], al
jmp case.0x14002e0a6.40002
xor ebx, ebx
lea r9, [0x1400af290]
mov qword [rsp + 0x20], rbx
mov edx, 0xa8
jmp 0x14003040a
cmp qword [0x14018d910], 0
jne 0x14002f4ec
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
lea r8, str.Hidden_process_detection_cannot_function_properly_without_Kprocesscheckr._Make_sure_ProcessChecker_is_running_with_administrative_privileges.
mov edx, 0x30
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
mov rax, qword [0x14018cd68]
test rax, rax
jne 0x14002f526
mov r8, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
lea r9, [0x14001a7f0]
mov rcx, qword [0x140192458]
xor ebx, ebx
mov edx, 0x87
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [0x14018cd68], rax
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
mov rcx, qword [0x14018cd68]
test eax, eax
jne 0x14002e825
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x14002e0a6.40002
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateOpenFileDialog
mov r8d, 2
lea rdx, str.Executable_files__.exe_.dll_.ocx_.sys_.scr_.cpl_
mov rcx, rax
mov rbx, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhSetFileDialogFilter
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov rdx, rbx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowFileDialog
test al, al
je 0x14002f5b4
mov rcx, rbx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetFileDialogFileName
mov rcx, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhAutoDereferenceObject
lea rcx, str.Make_sure_the_PE_Viewer_executable_file_is_present.
xor r9d, r9d
mov qword [rsp + 0x20], rcx
lea rdx, str.ProgramInspectExecutables
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov r8, qword [rax + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShellExecuteUserString
mov rcx, rbx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhFreeFileDialog
jmp case.0x14002e0a6.40002
xor ebx, ebx
lea r9, [0x14005c240]
mov qword [rsp + 0x20], rbx
mov edx, 0x8a
jmp 0x14003040a
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetSystemDirectory
mov rcx, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhAutoDereferenceObject
movzx edx, byte [0x14018dbaa]
mov r15, qword [rax + 8]
cmp dl, 1
jb 0x14002f665
mov rsi, r15
mov ecx, r15d
and rsi, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x14002f625
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rsi]
pmovmskb eax, xmm0
sar eax, cl
bsf ecx, eax
je 0x14002f621
mov esi, ecx
shr rsi, 1
jmp 0x14002f67b
add rsi, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rsi]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x14002f655
nop word [rax + rax]
add rsi, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rsi]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x14002f640
sub rsi, r15
mov eax, ecx
sar rsi, 1
shr rax, 1
add rsi, rax
jmp 0x14002f67b
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x14002f670
lea r12, [rsi + rsi]
lea r13, str._taskmgr.exe
cmp dl, 1
jb 0x14002f6f6
mov r14, r13
mov rcx, r13
and r14, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x14002f6bc
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [r14]
pmovmskb eax, xmm0
sar eax, cl
bsf ecx, eax
je 0x14002f6b8
mov r14d, ecx
shr r14, 1
jmp 0x14002f6fc
add r14, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [r14]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x14002f6e6
nop dword [rax]
add r14, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [r14]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x14002f6d0
sub r14, r13
mov eax, ecx
sar r14, 1
shr rax, 1
add r14, rax
jmp 0x14002f6fc
mov r14d, 0xc
mov rdx, qword [0x140191180]
add r14, r14
lea rdi, [r14 + r12]
lea rcx, [rdi + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
xor ebx, ebx
mov r8, r12
mov rdx, r15
mov rsi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rdi
mov qword [rax + 8], rcx
mov word [rdi + rcx], bx
mov rcx, qword [rax + 8]
call fcn.1401317c0
mov rcx, qword [rsi + 8]
mov r8, r14
add rcx, r12
mov rdx, r13
call fcn.1401317c0
mov rcx, rsi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhAutoDereferenceObject
cmp dword [sym.4yUlCM3HuVsHzW5CaCX.exe_WindowsVersion], 0x3e
mov rbx, rax
jb 0x14002f798
lea rcx, [rsp + 0x40]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetOwnTokenAttributes
test byte [rax + 8], 1
jne 0x14002f798
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
xor r8d, r8d
xor edx, edx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiConnectToPhSvcEx
test al, al
je case.0x14002e0a6.40002
mov rcx, qword [rbx + 8]
call fcn.14007a5c0
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiDisconnectFromPhSvc
jmp case.0x14002e0a6.40002
mov rcx, qword [rbx + 8]
call fcn.14000e8f0
jmp case.0x14002e0a6.40002
mov edx, dword [0x14018df78]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiConnectSession
jmp case.0x14002e0a6.40002
mov edx, dword [0x14018df78]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiDisconnectSession
jmp case.0x14002e0a6.40002
mov edx, dword [0x14018df78]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiLogoffSession
jmp case.0x14002e0a6.40002
mov rax, qword gs:[0x30]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov rdx, qword [rax + 0x60]
mov eax, dword [0x14018df78]
cmp eax, dword [rdx + 0x2c0]
jne 0x14002f823
lea r8, str.You_cannot_remote_control_the_current_session.
mov edx, 0x10
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
jmp case.0x14002e0a6.40002
mov r8, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [0x140192458]
lea r9, [0x1400a7890]
mov edx, 0xc1
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x14002e0a6.40002
mov eax, dword [0x14018df78]
lea r9, [0x1400b53b0]
mov edx, 0x98
jmp 0x140030405
mov eax, dword [0x14018df78]
lea r9, [0x1400a73e0]
mov edx, 0x99
jmp 0x140030405
mov rcx, qword [0x14018cd70]
test rcx, rcx
jne 0x14002f8d2
mov r8, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
lea r9, [0x140027b80]
mov rcx, qword [0x140192458]
xor ebx, ebx
mov edx, 0xb2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rcx, rax
mov qword [0x14018cd70], rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhRegisterDialog
mov rcx, qword [0x14018cd70]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14018cd70]
call qword [sym.imp.USER32.dll_IsIconic]
mov rcx, qword [0x14018cd70]
test eax, eax
je 0x14002e825
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x14002e0a6.40002
xorps xmm0, xmm0
mov dword [rbp - 0x60], 0x70
xor eax, eax
lea rcx, [rbp - 0x60]
mov qword [rbp + 4], rax
xor ebx, ebx
mov dword [rbp + 0xc], eax
mov esi, 5
movups xmmword [rbp - 0x4c], xmm0
lea rax, str.https:__sourceforge.net_project_project_donations.php_group_id242527
movups xmmword [rbp - 0x3c], xmm0
mov qword [rbp - 0x48], rax
mov rax, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
movups xmmword [rbp - 0x5c], xmm0
mov qword [rbp - 0x58], rax
movups xmmword [rbp - 0x2c], xmm0
mov qword [rbp - 0x40], rbx
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0x30], esi
movups xmmword [rbp - 0xc], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp case.0x14002e0a6.40002
call fcn.140014f10
jmp case.0x14002e0a6.40002
xor ebx, ebx
lea r9, section..text
mov qword [rsp + 0x20], rbx
mov edx, 0x79
jmp 0x14003040a
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x10
xor ebx, ebx
mov edi, 2
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8, qword [0x14018f338]
mov esi, ebx
mov r14, rax
cmp dword [r8], ebx
jbe 0x14002fa01
nop word [rax + rax]
mov rcx, qword [r8 + 8]
mov edx, esi
mov r15, qword [rcx + rdx*8]
test byte [r15], 2
je 0x14002f9fa
cmp rbx, rdi
jne 0x14002f9ef
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
add rdi, rdi
mov r8, r14
mov edx, 4
lea r9, [rdi*8]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov r8, qword [0x14018f338]
mov r14, rax
mov rax, qword [r15 + 0x70]
mov qword [r14 + rbx*8], rax
inc rbx
inc esi
cmp esi, dword [r8]
jb 0x14002f9b0
test ebx, ebx
je 0x14002fa21
mov rcx, r14
mov edx, ebx
nop word [rax + rax]
mov rax, qword [rcx]
lock inc dword [rax - 8]
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14002fa10
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov r8d, ebx
mov rdx, r14
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiTerminateProcesses
mov rsi, 0xffffffffffffffff
test al, al
je 0x14002fa56
mov rcx, qword [0x14018eb20]
mov r9, rsi
xor r8d, r8d
mov edx, 0x41d
call qword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
je 0x1400311c2
mov rdi, r14
mov ebx, ebx
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rdi]
mov eax, esi
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002fa88
call fcn.1400d9400
add rdi, 8
sub rbx, 1
jne 0x14002fa70
jmp 0x1400311c2
mov r8, qword [0x14018f338]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x14002fac6
inc ebx
cmp ebx, edx
jb 0x14002fab0
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x70]
test rdx, rdx
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiTerminateTreeProcess
jmp 0x14002fd37
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x10
xor ebx, ebx
mov edi, 2
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8, qword [0x14018f338]
mov esi, ebx
mov r14, rax
cmp dword [r8], ebx
jbe 0x14002fb71
nop dword [rax]
mov rcx, qword [r8 + 8]
mov edx, esi
mov r15, qword [rcx + rdx*8]
test byte [r15], 2
je 0x14002fb6a
cmp rbx, rdi
jne 0x14002fb5f
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
add rdi, rdi
mov r8, r14
mov edx, 4
lea r9, [rdi*8]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov r8, qword [0x14018f338]
mov r14, rax
mov rax, qword [r15 + 0x70]
mov qword [r14 + rbx*8], rax
inc rbx
inc esi
cmp esi, dword [r8]
jb 0x14002fb20
test ebx, ebx
je 0x14002fb91
mov rcx, r14
mov edx, ebx
nop word [rax + rax]
mov rax, qword [rcx]
lock inc dword [rax - 8]
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14002fb80
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov r8d, ebx
mov rdx, r14
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiSuspendProcesses
test ebx, ebx
je 0x1400311c2
mov rdi, r14
mov ebx, ebx
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
mov rcx, qword [rdi]
mov eax, esi
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002fbd8
call fcn.1400d9400
add rdi, 8
sub rbx, 1
jne 0x14002fbc0
jmp 0x1400311c2
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x10
xor ebx, ebx
mov edi, 2
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8, qword [0x14018f338]
mov esi, ebx
mov r14, rax
cmp dword [r8], ebx
jbe 0x14002fc71
nop word [rax + rax]
mov rcx, qword [r8 + 8]
mov edx, esi
mov r15, qword [rcx + rdx*8]
test byte [r15], 2
je 0x14002fc6a
cmp rbx, rdi
jne 0x14002fc5f
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
add rdi, rdi
mov r8, r14
mov edx, 4
lea r9, [rdi*8]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov r8, qword [0x14018f338]
mov r14, rax
mov rax, qword [r15 + 0x70]
mov qword [r14 + rbx*8], rax
inc rbx
inc esi
cmp esi, dword [r8]
jb 0x14002fc20
test ebx, ebx
je 0x14002fc91
mov rcx, r14
mov edx, ebx
nop word [rax + rax]
mov rax, qword [rcx]
lock inc dword [rax - 8]
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14002fc80
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov r8d, ebx
mov rdx, r14
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiResumeProcesses
test ebx, ebx
je 0x1400311c2
mov rdi, r14
mov ebx, ebx
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
mov rcx, qword [rdi]
mov eax, esi
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14002fcd8
call fcn.1400d9400
add rdi, 8
sub rbx, 1
jne 0x14002fcc0
jmp 0x1400311c2
mov r8, qword [0x14018f338]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x14002fd16
inc ebx
cmp ebx, edx
jb 0x14002fd00
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x70]
test rdx, rdx
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiRestartProcess
mov rsi, 0xffffffffffffffff
test al, al
je 0x140030d3f
mov rcx, qword [0x14018eb20]
mov r9, rsi
xor r8d, r8d
mov edx, 0x41d
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140030d3f
mov r8, qword [0x14018f338]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x14002fd96
inc ebx
cmp ebx, edx
jb 0x14002fd80
jmp case.0x14002e0a6.40002
mov r15, qword [rcx + 0x70]
test r15, r15
je case.0x14002e0a6.40002
lock inc dword [r15 - 8]
mov r12, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateSaveFileDialog
mov r8d, 2
lea rdx, str.Dump_files__.dmp_
mov rcx, rax
mov rsi, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhSetFileDialogFilter
mov rcx, qword [r15 + 0x30]
lea rdx, str..dmp
mov rcx, qword [rcx + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhConcatStrings2
mov rcx, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhAutoDereferenceObject
mov rcx, rsi
mov rdx, qword [rax + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhSetFileDialogFileName
mov rdx, rsi
mov rcx, r12
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowFileDialog
mov rcx, rsi
test al, al
jne 0x14002fe0d
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhFreeFileDialog
jmp 0x14002fe35
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetFileDialogFileName
mov rcx, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhAutoDereferenceObject
mov rcx, rsi
mov rbx, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhFreeFileDialog
mov r8, qword [rbx + 8]
mov rcx, r12
mov rdx, qword [r15 + 0x20]
call fcn.14003a680
mov rsi, 0xffffffffffffffff
lock xadd dword [r15 - 8], esi
cmp esi, 1
jne case.0x14002e0a6.40002
lea rcx, [r15 - 0x10]
call fcn.1400d9400
jmp case.0x14002e0a6.40002
mov r8, qword [0x14018f338]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x14002fe87
inc ebx
cmp ebx, edx
jb 0x14002fe71
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x70]
test rdx, rdx
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiDebugProcess
jmp 0x140030d38
mov r8, qword [0x14018f338]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x14002fedb
inc ebx
cmp ebx, edx
jb 0x14002fec5
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x70]
test rdx, rdx
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
cmp byte [0x14018da45], 0
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
sete r8b
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiSetVirtualizationProcess
jmp 0x140030d38
mov r9, qword [0x14018f338]
xor ebx, ebx
mov ecx, ebx
mov r8d, dword [r9]
test r8d, r8d
je case.0x14002e0a6.40002
mov r9, qword [r9 + 8]
nop word [rax + rax]
mov eax, ecx
mov rdx, qword [r9 + rax*8]
test byte [rdx], 2
jne 0x14002ff47
inc ecx
cmp ecx, r8d
jb 0x14002ff30
jmp case.0x14002e0a6.40002
mov rax, qword [rdx + 0x70]
test rax, rax
je case.0x14002e0a6.40002
lea rdi, [rax - 0x10]
lock inc dword [rdi + 8]
mov r8, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
lea r9, [0x140007570]
mov rcx, qword [0x140192458]
mov edx, 0x95
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rbx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rsi, 0xffffffffffffffff
lock xadd dword [rdi + 8], esi
cmp esi, 1
jne case.0x14002e0a6.40002
mov rcx, rdi
call fcn.1400d9400
jmp case.0x14002e0a6.40002
mov r8, qword [0x14018f338]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop word [rax + rax]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x14002ffe6
inc ebx
cmp ebx, edx
jb 0x14002ffd0
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x70]
test rdx, rdx
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
invalid
add al, ch
fld dword [rsi - 3]
invalid
jmp 0x140030d38
mov r9, qword [0x14018f338]
xor ebx, ebx
mov ecx, ebx
mov r8d, dword [r9]
test r8d, r8d
je case.0x14002e0a6.40002
mov r9, qword [r9 + 8]
nop word [rax + rax]
mov eax, ecx
mov rdx, qword [r9 + rax*8]
test byte [rdx], 2
jne 0x140030047
inc ecx
cmp ecx, r8d
jb 0x140030030
jmp case.0x14002e0a6.40002
mov r14, qword [rdx + 0x70]
test r14, r14
je case.0x14002e0a6.40002
lock inc dword [r14 - 8]
mov rdx, qword [0x140191178]
mov ecx, 0x10
mov rsi, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov qword [rsp + 0x40], r14
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov edx, 4
mov r8d, 0xa0
mov rdi, rax
mov dword [rax], ebx
mov dword [rax + 4], 0x14
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, qword [0x140192458]
lea r9, [0x14001a380]
mov qword [rdi + 8], rax
mov r8, rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rdi
mov edx, 0xaf
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rdx, qword [rsp + 0x48]
mov rsi, 0xffffffffffffffff
cmp dword [rdx], ebx
jbe 0x140030137
nop dword [rax]
mov eax, ebx
lea rdi, [rax*8]
mov rax, qword [rdx + 8]
mov rcx, qword [rdi + rax]
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140030115
add rcx, 0xfffffffffffffff0
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140030110
call fcn.1400d9400
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx + 8]
xor edx, edx
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8, qword [rdi + rax]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdx, qword [rsp + 0x48]
inc ebx
cmp ebx, dword [rdx]
jb 0x1400300e0
lea rcx, [rdx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003014c
call fcn.1400d9400
lea rcx, [r14 - 0x10]
jmp 0x140031204
mov r8, qword [0x14018f338]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop dword [rax]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030186
inc ebx
cmp ebx, edx
jb 0x140030170
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x70]
test rdx, rdx
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiInjectDllProcess
jmp 0x140030d38
mov r8, qword [0x14018f338]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x1400301da
inc ebx
cmp ebx, edx
jb 0x1400301c4
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x70]
test rdx, rdx
je case.0x14002e0a6.40002
sub esi, 0x9d2f
je 0x140030224
sub esi, 1
je 0x14003021d
sub esi, 1
je 0x140030216
sub esi, 1
je 0x14003020f
cmp esi, 1
jne 0x14003020a
mov edi, 1
jmp 0x140030229
mov edi, dword [rbp + 0x50]
jmp 0x140030229
mov edi, 2
jmp 0x140030229
mov edi, 3
jmp 0x140030229
mov edi, 4
jmp 0x140030229
mov edi, 5
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov r8d, edi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiSetPagePriorityProcess
jmp 0x140030d38
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x10
xor ebx, ebx
mov edi, 2
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8, qword [0x14018f338]
mov esi, ebx
mov r14, rax
cmp dword [r8], ebx
jbe 0x1400302d1
nop word [rax + rax]
mov rcx, qword [r8 + 8]
mov edx, esi
mov r15, qword [rcx + rdx*8]
test byte [r15], 2
je 0x1400302ca
cmp rbx, rdi
jne 0x1400302bf
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
add rdi, rdi
mov r8, r14
mov edx, 4
lea r9, [rdi*8]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov r8, qword [0x14018f338]
mov r14, rax
mov rax, qword [r15 + 0x70]
mov qword [r14 + rbx*8], rax
inc rbx
inc esi
cmp esi, dword [r8]
jb 0x140030280
test ebx, ebx
je 0x1400302f1
mov rcx, r14
mov edx, ebx
nop word [rax + rax]
mov rax, qword [rcx]
lock inc dword [rax - 8]
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1400302e0
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov r8d, ebx
mov rdx, r14
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiReduceWorkingSetProcesses
test ebx, ebx
je 0x1400311c2
mov rdi, r14
mov ebx, ebx
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
mov rcx, qword [rdi]
mov eax, esi
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140030338
call fcn.1400d9400
add rdi, 8
sub rbx, 1
jne 0x140030320
jmp 0x1400311c2
mov r8, qword [0x14018f338]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030376
inc ebx
cmp ebx, edx
jb 0x140030360
jmp case.0x14002e0a6.40002
mov rax, qword [rcx + 0x70]
test rax, rax
je case.0x14002e0a6.40002
mov rdx, qword [rax + 0x50]
test rdx, rdx
je case.0x14002e0a6.40002
lea rcx, str.RunAsProgram
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhSetStringSetting2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
jmp 0x1400303f4
mov r9, qword [0x14018f338]
xor ebx, ebx
mov ecx, ebx
mov r8d, dword [r9]
test r8d, r8d
je case.0x14002e0a6.40002
mov r9, qword [r9 + 8]
mov eax, ecx
mov rdx, qword [r9 + rax*8]
test byte [rdx], 2
jne 0x1400303d9
inc ecx
cmp ecx, r8d
jb 0x1400303c2
jmp case.0x14002e0a6.40002
mov rax, qword [rdx + 0x70]
test rax, rax
je case.0x14002e0a6.40002
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x40]
mov edx, 0x88
lea r9, [0x1400a4de0]
mov qword [rsp + 0x20], rax
mov r8, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov rcx, qword [0x140192458]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x14002e0a6.40002
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x10
xor ebx, ebx
mov edi, 2
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8, qword [0x14018f338]
mov r14d, ebx
mov r15, rax
cmp dword [r8], ebx
jbe 0x1400304b4
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r8 + 8]
mov edx, r14d
mov r13, qword [rcx + rdx*8]
test byte [r13], 2
je 0x1400304ac
cmp rbx, rdi
jne 0x1400304a1
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
add rdi, rdi
mov r8, r15
mov edx, 4
lea r9, [rdi*8]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov r8, qword [0x14018f338]
mov r15, rax
mov rax, qword [r13 + 0x70]
mov qword [r15 + rbx*8], rax
inc rbx
inc r14d
cmp r14d, dword [r8]
jb 0x140030460
test ebx, ebx
je 0x1400304d1
mov rcx, r15
mov edx, ebx
nop dword [rax]
mov rax, qword [rcx]
lock inc dword [rax - 8]
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1400304c0
mov r8d, ebx
mov rdx, r15
mov ecx, esi
call fcn.140036d60
test ebx, ebx
je 0x140030602
mov rdi, r15
mov ebx, ebx
mov rsi, 0xffffffffffffffff
mov rcx, qword [rdi]
mov eax, esi
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003050a
call fcn.1400d9400
add rdi, 8
sub rbx, 1
jne 0x1400304f2
jmp 0x140030602
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x10
xor ebx, ebx
mov edi, 2
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8, qword [0x14018f338]
mov r14d, ebx
mov r15, rax
cmp dword [r8], ebx
jbe 0x1400305a4
nop word [rax + rax]
mov rcx, qword [r8 + 8]
mov edx, r14d
mov r13, qword [rcx + rdx*8]
test byte [r13], 2
je 0x14003059c
cmp rbx, rdi
jne 0x140030591
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
add rdi, rdi
mov r8, r15
mov edx, 4
lea r9, [rdi*8]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov r8, qword [0x14018f338]
mov r15, rax
mov rax, qword [r13 + 0x70]
mov qword [r15 + rbx*8], rax
inc rbx
inc r14d
cmp r14d, dword [r8]
jb 0x140030550
test ebx, ebx
je 0x1400305c1
mov rcx, r15
mov edx, ebx
nop dword [rax]
mov rax, qword [rcx]
lock inc dword [rax - 8]
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1400305b0
mov r8d, ebx
mov rdx, r15
mov ecx, esi
call fcn.140036e70
test ebx, ebx
je 0x140030602
mov rdi, r15
mov ebx, ebx
mov rsi, 0xffffffffffffffff
nop
mov rcx, qword [rdi]
mov eax, esi
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400305f8
call fcn.1400d9400
add rdi, 8
sub rbx, 1
jne 0x1400305e0
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp case.0x14002e0a6.40002
mov rcx, qword [0x14018e180]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x14002e0a6.40002
mov rcx, qword [0x14018e180]
lea rdx, [rsp + 0x40]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 0x2c
xor eax, eax
movups xmmword [rsp + 0x44], xmm0
mov qword [rsp + 0x64], rax
movups xmmword [rsp + 0x54], xmm0
call qword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword [rsp + 0x48], 6
mov rcx, qword [0x14018e180]
jne 0x14002e825
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindowAsync]
jmp case.0x14002e0a6.40002
mov rcx, qword [0x14018e180]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x14002e0a6.40002
mov rcx, qword [0x14018e180]
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindowAsync]
jmp case.0x14002e0a6.40002
mov rcx, qword [0x14018e180]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x14002e0a6.40002
mov rcx, qword [0x14018e180]
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindowAsync]
jmp case.0x14002e0a6.40002
mov rcx, qword [0x14018e180]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x14002e0a6.40002
mov rcx, qword [0x14018e180]
mov edx, 3
call qword [sym.imp.USER32.dll_ShowWindowAsync]
jmp case.0x14002e0a6.40002
mov rcx, qword [0x14018e180]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x14002e0a6.40002
mov rcx, qword [0x14018e180]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
call qword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x14002e0a6.40002
mov r8, qword [0x14018f338]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop dword [rax]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030766
inc ebx
cmp ebx, edx
jb 0x140030750
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x70]
test rdx, rdx
je case.0x14002e0a6.40002
cmp qword [rdx + 0x50], 0
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rdx, qword [rdx + 0x50]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov rdx, qword [rdx + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShellExploreFile
jmp 0x140030d38
mov r9, qword [0x14018f338]
xor ebx, ebx
mov ecx, ebx
mov r8d, dword [r9]
test r8d, r8d
je case.0x14002e0a6.40002
mov r9, qword [r9 + 8]
nop word [rax + rax]
mov eax, ecx
mov rdx, qword [r9 + rax*8]
test byte [rdx], 2
jne 0x1400307d7
inc ecx
cmp ecx, r8d
jb 0x1400307c0
jmp case.0x14002e0a6.40002
mov r8, qword [rdx + 0x70]
test r8, r8
je case.0x14002e0a6.40002
mov r8, qword [r8 + 0x30]
lea rdx, str.SearchEngine
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov r9b, 1
mov qword [rsp + 0x20], rbx
mov r8, qword [r8 + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShellExecuteUserString
jmp case.0x14002e0a6.40002
mov r8, qword [0x14018f338]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x14003083a
inc ebx
cmp ebx, edx
jb 0x140030824
jmp case.0x14002e0a6.40002
mov rcx, qword [rcx + 0x70]
test rcx, rcx
je case.0x14002e0a6.40002
call fcn.140036c80
jmp case.0x14002e0a6.40002
mov rcx, qword [0x14018eb20]
xor edx, edx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetTreeNewText
mov rcx, qword [0x14018eb20]
jmp 0x1400311ee
mov r8, qword [0x14018f440]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030899
inc ebx
cmp ebx, edx
jb 0x140030883
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x58]
test rdx, rdx
je case.0x14002e0a6.40002
mov rdx, qword [rdx + 0x30]
mov rax, rdx
shr rax, 2
movzx ecx, al
mov rax, qword [r9 + rcx*8 + 0x18eb30]
test rax, rax
je case.0x14002e0a6.40002
nop word [rax + rax]
cmp rdx, qword [rax + 0x28]
lea rsi, [rax - 0x40]
je 0x140030de9
mov rax, qword [rax]
test rax, rax
jne 0x1400308d0
jmp case.0x14002e0a6.40002
mov r8, qword [0x14018f440]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030919
inc ebx
cmp ebx, edx
jb 0x140030903
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x58]
test rdx, rdx
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiStartService
jmp 0x140030d38
mov r8, qword [0x14018f440]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop word [rax + rax]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030976
inc ebx
cmp ebx, edx
jb 0x140030960
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x58]
test rdx, rdx
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiContinueService
jmp 0x140030d38
mov r8, qword [0x14018f440]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x1400309ca
inc ebx
cmp ebx, edx
jb 0x1400309b4
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x58]
test rdx, rdx
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiPauseService
jmp 0x140030d38
mov r8, qword [0x14018f440]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030a26
inc ebx
cmp ebx, edx
jb 0x140030a10
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x58]
test rdx, rdx
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiStopService
jmp 0x140030d38
mov r8, qword [0x14018f440]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030a7a
inc ebx
cmp ebx, edx
jb 0x140030a64
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x58]
test rdx, rdx
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiDeleteService
mov rsi, 0xffffffffffffffff
test al, al
je 0x140030d3f
mov rcx, qword [0x14018f448]
mov r9, rsi
xor r8d, r8d
mov edx, 0x41d
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140030d3f
mov r9, qword [0x14018f440]
xor ebx, ebx
mov ecx, ebx
mov r8d, dword [r9]
test r8d, r8d
je case.0x14002e0a6.40002
mov r9, qword [r9 + 8]
mov eax, ecx
mov rdx, qword [r9 + rax*8]
test byte [rdx], 2
jne 0x140030af9
inc ecx
cmp ecx, r8d
jb 0x140030ae2
jmp case.0x14002e0a6.40002
mov r14, qword [rdx + 0x58]
test r14, r14
je case.0x14002e0a6.40002
mov r14, qword [r14 + 0x10]
mov rdi, qword [0x140188460]
mov rdx, qword [0x140191180]
add rdi, qword [r14]
lea rcx, [rdi + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rsi, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rdi], bx
mov r8, qword [0x140188460]
mov rdx, qword [str.SystemCurrentControlSetServices_]
mov rcx, qword [rax + 8]
call fcn.1401317c0
mov rcx, qword [0x140188460]
add rcx, qword [rsi + 8]
mov r8, qword [r14]
mov rdx, qword [r14 + 8]
call fcn.1401317c0
mov rcx, rsi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhAutoDereferenceObject
mov r9, rax
mov dword [rsp + 0x20], ebx
mov edx, 0x20019
lea rcx, [rbp + 0x58]
mov r8, 0xfffffffffffffffd
mov r14, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhOpenKey
test eax, eax
js case.0x14002e0a6.40002
mov rdi, qword [0x140188490]
add rdi, qword [r14]
mov rdx, qword [0x140191180]
lea rcx, [rdi + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rsi, rax
mov qword [rax], rdi
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rdi], bx
mov r8, qword [0x140188490]
mov rdx, qword [str.HKLM_]
mov rcx, qword [rax + 8]
call fcn.1401317c0
mov rcx, qword [0x140188490]
add rcx, qword [rsi + 8]
mov r8, qword [r14]
mov rdx, qword [r14 + 8]
call fcn.1401317c0
mov rcx, rsi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhAutoDereferenceObject
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov rdx, rax
call fcn.14000fd10
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
jmp case.0x14002e0a6.40002
mov r8, qword [0x14018f440]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030c46
inc ebx
cmp ebx, edx
jb 0x140030c30
jmp case.0x14002e0a6.40002
mov rbx, qword [rcx + 0x58]
test rbx, rbx
je case.0x14002e0a6.40002
mov rax, qword [rbx + 0x10]
mov edi, 1
mov r8d, edi
xor edx, edx
xor ecx, ecx
mov r14, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je case.0x14002e0a6.40002
mov r8d, edi
mov rdx, r14
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je case.0x14002e0a6.40002
mov rcx, qword [rbx + 0x10]
mov rdx, rdi
call fcn.14000c510
mov rbx, rax
test rax, rax
je 0x140030cdb
mov rdx, qword [rax + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShellExploreFile
lea rcx, [rbx - 0x10]
mov rsi, 0xffffffffffffffff
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x140030cdb
call fcn.1400d9400
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp case.0x14002e0a6.40002
mov r8, qword [0x14018f440]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030d17
inc ebx
cmp ebx, edx
jb 0x140030d01
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x58]
test rdx, rdx
je case.0x14002e0a6.40002
lea rbx, [rdx - 0x10]
lock inc dword [rbx + 8]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
call fcn.1400b2a60
mov rsi, 0xffffffffffffffff
lock xadd dword [rbx + 8], esi
cmp esi, 1
jne case.0x14002e0a6.40002
mov rcx, rbx
call fcn.1400d9400
jmp case.0x14002e0a6.40002
mov rcx, qword [0x14018f448]
xor edx, edx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetTreeNewText
mov rcx, qword [0x14018f448]
jmp 0x1400311ee
mov r8, qword [0x14018e330]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop dword [rax]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030da6
inc ebx
cmp ebx, edx
jb 0x140030d90
jmp case.0x14002e0a6.40002
mov rdx, qword [rcx + 0x58]
test rdx, rdx
je case.0x14002e0a6.40002
mov rdx, qword [rdx + 0x38]
mov rax, rdx
shr rax, 2
movzx ecx, al
mov rax, qword [r9 + rcx*8 + 0x18eb30]
test rax, rax
je case.0x14002e0a6.40002
cmp rdx, qword [rax + 0x28]
lea rsi, [rax - 0x40]
je 0x140030de9
mov rax, qword [rax]
test rax, rax
jne 0x140030dd2
jmp case.0x14002e0a6.40002
test rsi, rsi
je case.0x14002e0a6.40002
mov rcx, qword [0x14018e060]
xor r9d, r9d
mov edi, dword [0x14018df7c]
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14018e060]
mov r8d, edi
xor r9d, r9d
mov edx, 0x130c
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, ebx
call fcn.140035550
mov rcx, qword [0x14018e008]
call qword [sym.imp.USER32.dll_SetFocus]
mov edx, 1
mov qword [rbp + 0x58], rsi
lea rcx, [rbp + 0x58]
call fcn.140096000
jmp case.0x14002e0a6.40002
mov r8, qword [0x14018e330]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030e86
inc ebx
cmp ebx, edx
jb 0x140030e70
jmp case.0x14002e0a6.40002
mov rax, qword [rcx + 0x58]
test rax, rax
je case.0x14002e0a6.40002
mov rcx, qword [rax + 0x58]
test rcx, rcx
je case.0x14002e0a6.40002
mov rcx, qword [rcx + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhReferenceServiceItem
mov rsi, rax
test rax, rax
je case.0x14002e0a6.40002
mov rcx, qword [0x14018e060]
xor r9d, r9d
mov edi, dword [0x14018df54]
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14018e060]
mov r8d, edi
xor r9d, r9d
mov edx, 0x130c
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, ebx
call fcn.140035550
mov rcx, qword [0x14018e0a8]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov r9, rsi
xor r8d, r8d
mov edx, 0x8086
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsi - 0x10]
jmp 0x1400311fd
mov r8, qword [0x14018e330]
xor ebx, ebx
mov edx, dword [r8]
test edx, edx
je case.0x14002e0a6.40002
mov r8, qword [r8 + 8]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [r8 + rax*8]
test byte [rcx], 2
jne 0x140030f56
inc ebx
cmp ebx, edx
jb 0x140030f40
jmp case.0x14002e0a6.40002
mov rdi, qword [rcx + 0x58]
test rdi, rdi
je case.0x14002e0a6.40002
lock inc dword [rdi - 8]
mov rcx, qword [rdi + 0x38]
mov r14, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov qword [rsp + 0x48], rdi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateSymbolProvider
mov qword [rsp + 0x50], rax
cmp byte [rax + 0x20], 0
je 0x140031078
mov rcx, qword [rdi + 0x38]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x58], rcx
lea r9, [0x140050da0]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rdx, qword [rax + 0x18]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEnumGenericModules
mov r9d, 0x20
mov qword [rsp + 0x58], 4
lea r8, [0x1400df390]
mov ecx, 8
lea rdx, [0x1400df380]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateHashtable
lea rcx, [rbp + 0x58]
mov rsi, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhEnumKernelModules
test eax, eax
js 0x140031013
mov rcx, qword [rbp + 0x58]
lea r8, [rsp + 0x40]
mov r9, rsi
lea rdx, [0x140050da0]
call fcn.1400eaca0
mov r8, qword [rbp + 0x58]
xor edx, edx
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea rcx, [rsi - 0x10]
mov rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003102f
call fcn.1400d9400
mov rcx, qword [0x140192458]
lea rax, [rsp + 0x40]
lea r9, [0x140050df0]
mov qword [rsp + 0x20], rax
mov r8, r14
mov edx, 0xa7
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, qword [rsp + 0x50]
mov eax, esi
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400310a8
call fcn.1400d9400
lea rcx, [rdi - 0x10]
jmp 0x140031204
mov rsi, 0xffffffffffffffff
lea rcx, [rax - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140031094
call fcn.1400d9400
lea r8, str.Unable_to_open_the_process.
mov edx, 0x10
mov rcx, r14
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
lea rcx, [rdi - 0x10]
jmp 0x140031204
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov r8d, 0x10
xor ebx, ebx
mov edi, 2
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8, qword [0x14018e330]
mov esi, ebx
mov r14, rax
cmp dword [r8], ebx
jbe 0x140031141
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r8 + 8]
mov edx, esi
mov r15, qword [rcx + rdx*8]
test byte [r15], 2
je 0x14003113a
cmp rbx, rdi
jne 0x14003112f
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
add rdi, rdi
mov r8, r14
mov edx, 4
lea r9, [rdi*8]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov r8, qword [0x14018e330]
mov r14, rax
mov rax, qword [r15 + 0x58]
mov qword [r14 + rbx*8], rax
inc rbx
inc esi
cmp esi, dword [r8]
jb 0x1400310f0
test ebx, ebx
je 0x140031161
mov rcx, r14
mov edx, ebx
nop word [rax + rax]
mov rax, qword [rcx]
lock inc dword [rax - 8]
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140031150
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
mov r8d, ebx
mov rdx, r14
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhUiCloseConnections
mov rsi, 0xffffffffffffffff
test al, al
je 0x140031196
mov rcx, qword [0x14018e380]
mov r9, rsi
xor r8d, r8d
mov edx, 0x41d
call qword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
je 0x1400311c2
mov rdi, r14
mov ebx, ebx
nop
mov rcx, qword [rdi]
mov eax, esi
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400311b8
call fcn.1400d9400
add rdi, 8
sub rbx, 1
jne 0x1400311a0
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp case.0x14002e0a6.40002
mov rcx, qword [0x14018e380]
xor edx, edx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetTreeNewText
mov rcx, qword [0x14018e380]
mov rdx, rax
mov rbx, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhSetClipboardString
lea rcx, [rbx - 0x10]
mov rsi, 0xffffffffffffffff
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne case.0x14002e0a6.40002
call fcn.1400d9400
jmp case.0x14002e0a6.40002
mov rcx, qword [0x14018e060]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, dword [0x14018e000]
mov rdi, rax
je 0x140031243
inc edi
jmp 0x140031272
xor ebx, ebx
mov edi, ebx
jmp 0x140031272
mov rcx, qword [0x14018e060]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
test eax, eax
je 0x14003126c
dec edi
jmp 0x140031272
mov edi, dword [0x14018e000]
mov rcx, qword [0x14018e060]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14018e060]
xor r9d, r9d
mov r8d, edi
mov edx, 0x130c
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, ebx
call fcn.140035550
mov r14, qword [rsp + 0x118]
mov r13, qword [rsp + 0x120]
mov r12, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x160]
mov r15, qword [rsp + 0x110]
add rsp, 0x138
pop rsi
pop rbp
ret