Function at 0x140009dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
cmp dword [rsp + 0x98], 0
je 0x140009e00
cmp dword [rsp + 0x98], 1
jne 0x140009f0a
mov eax, dword [rsp + 0x90]
shl rax, 2
mov rdx, rax
lea rcx, [rsp + 0x28]
call sym.ProcessHacker.exe_PhCreateAlloc
mov rcx, qword [rsp + 0x28]
call sym.ProcessHacker.exe_PhaDereferenceObject
mov eax, dword [rsp + 0x90]
shl rax, 2
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0x28]
xor eax, eax
mov rcx, qword [rsp + 0x58]
rep stosb byte [rdi], al
mov dword [rsp + 0x24], 0
jmp 0x140009e54
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x24], eax
jae 0x140009f0a
mov dword [rsp + 0x20], 0
jmp 0x140009e79
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x20], eax
jae 0x140009f05
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rdx + rax*8]
cmp qword [rax + rcx*8], 0
je 0x140009ed6
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rdx + rax*8]
mov rax, qword [rax + rcx*8]
xor edx, edx
mov rax, qword [rax]
mov ecx, 2
div rcx
xor edx, edx
mov ecx, 8
div rcx
mov dword [rsp + 0x30], eax
jmp 0x140009ede
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rsp + 0x30]
cmp dword [rcx + rax*4], edx
jae 0x140009f00
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rsp + 0x30]
mov dword [rcx + rax*4], edx
jmp 0x140009e6f
jmp 0x140009e4a
mov ecx, dword [rsp + 0x88]
call sym.ProcessHacker.exe_PhCreateList
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x24], 0
jmp 0x140009f2f
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x24], eax
jae 0x14000a204
mov edx, 0x64
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhInitializeStringBuilder
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140009f7c
cmp dword [rsp + 0x34], 1
je 0x14000a064
cmp dword [rsp + 0x34], 2
je 0x14000a14c
jmp 0x14000a1e8
mov dword [rsp + 0x20], 0
jmp 0x140009f90
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x20], eax
jae 0x14000a05f
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rdx + rax*8]
cmp qword [rax + rcx*8], 0
je 0x14000a033
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
inc eax
mov eax, eax
mov qword [rsp + 0x68], rax
mov ecx, dword [rsp + 0x24]
mov edx, dword [rsp + 0x20]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rdi + rcx*8]
mov rcx, qword [rcx + rdx*8]
xor edx, edx
mov rax, qword [rcx]
mov ecx, 2
div rcx
xor edx, edx
mov ecx, 8
div rcx
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rdx + rax*8]
mov rdx, qword [rax + rcx*8]
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhAppendStringBuilder
jmp 0x14000a045
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
inc eax
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3c]
mov r8d, eax
mov dx, 9
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhAppendCharStringBuilder2
jmp 0x140009f86
jmp 0x14000a1e8
mov dword [rsp + 0x20], 0
jmp 0x14000a078
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x20], eax
jae 0x14000a147
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rdx + rax*8]
cmp qword [rax + rcx*8], 0
je 0x14000a116
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
lea eax, [rax*8 + 8]
mov eax, eax
mov qword [rsp + 0x60], rax
mov ecx, dword [rsp + 0x24]
mov edx, dword [rsp + 0x20]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rdi + rcx*8]
mov rcx, qword [rcx + rdx*8]
xor edx, edx
mov rax, qword [rcx]
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rdx + rax*8]
mov rdx, qword [rax + rcx*8]
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhAppendStringBuilder
jmp 0x14000a12d
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
lea eax, [rax*8 + 8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
mov r8d, eax
mov dx, 0x20
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhAppendCharStringBuilder2
jmp 0x14000a06e
jmp 0x14000a1e8
mov dword [rsp + 0x20], 0
jmp 0x14000a160
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x20], eax
jae 0x14000a1e8
mov dx, 0x22
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhAppendCharStringBuilder
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rdx + rax*8]
cmp qword [rax + rcx*8], 0
je 0x14000a1b8
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rdx + rax*8]
mov rdx, qword [rax + rcx*8]
lea rcx, [rsp + 0x40]
call fcn.140009c00
mov dx, 0x22
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhAppendCharStringBuilder
mov eax, dword [rsp + 0x90]
dec eax
cmp dword [rsp + 0x20], eax
je 0x14000a1e3
mov dx, 0x2c
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhAppendCharStringBuilder
jmp 0x14000a156
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhFinalStringBuilderString
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call sym.ProcessHacker.exe_PhAddItemList
jmp 0x140009f25
mov rax, qword [rsp + 0x50]
add rsp, 0x70
pop rdi
ret