Function at 0x14009dea0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov edx, 0x577
mov r14, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x500
mov rcx, r14
mov rdi, rax
call sym.SystemInformer.exe_Ordinal_1826
lea r15, str.SampleCountAutomatic
mov qword [rbp - 0x10], 0x28
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r15
mov esi, eax
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x551
mov rcx, r14
mov ebx, eax
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009df30
mov byte [0x1402c63a8], 1
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x28
mov qword [rbp - 8], r15
call sym.SystemInformer.exe_Ordinal_1904
test esi, esi
mov qword [rbp - 0x10], 0x16
mov r12d, 1
lea rbx, str.SampleCount
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], rbx
cmove esi, r12d
call sym.SystemInformer.exe_Ordinal_1886
cmp esi, eax
je 0x14009df7b
mov byte [0x1402c63a8], r12b
mov edx, esi
mov qword [rbp - 0x10], 0x16
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], rbx
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x477
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r8, [rbp + 0x38]
xor edx, edx
mov rcx, rax
call sym.SystemInformer.exe_Ordinal_1803
mov rcx, qword [rbp + 0x38]
call sym.SystemInformer.exe_Ordinal_1238
lea rcx, str.SearchEngine
mov qword [rbp - 0x10], 0x18
mov qword [rbp - 8], rcx
mov rdx, rax
lea rcx, [rbp - 0x10]
call sym.SystemInformer.exe_Ordinal_1908
mov edx, 0x47f
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r8, [rbp + 0x38]
xor edx, edx
mov rcx, rax
call sym.SystemInformer.exe_Ordinal_1803
mov rcx, qword ds:[rbp + 0x38]
call sym.SystemInformer.exe_Ordinal_1238
lea rcx, str.ProgramInspectExecutables
mov qword ds:[rbp - 0x10], 0x32
mov qword [rbp - 8], rcx
mov rdx, rax
lea rcx, [rbp - 0x10]
call sym.SystemInformer.exe_Ordinal_1908
mov edx, 0x478
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, str.MaxSizeUnit
mov qword [rbp - 0x10], 0x16
mov qword [rbp - 8], rcx
mov edx, eax
lea rcx, [rbp - 0x10]
mov dword [0x1402c29e0], eax
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x4e0
mov rcx, r14
call sym.SystemInformer.exe_Ordinal_1826
lea rcx, str.IconProcesses
mov qword [rbp - 0x10], 0x1a
mov qword [rbp - 8], rcx
mov edx, eax
lea rcx, [rbp - 0x10]
call sym.SystemInformer.exe_Ordinal_1904
lea rsi, str.DbgHelpSearchPath
mov qword [rbp - 0x10], 0x22
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], rsi
call sym.SystemInformer.exe_Ordinal_1889
mov edx, 0x4c2
mov rcx, r14
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r8, [rbp + 0x38]
xor edx, edx
mov rcx, rax
call sym.SystemInformer.exe_Ordinal_1803
mov rcx, rbx
call sym.SystemInformer.exe_Ordinal_1238
mov rcx, qword [rbp + 0x38]
mov rbx, rax
call sym.SystemInformer.exe_Ordinal_1238
movzx r8d, r12b
mov rdx, rbx
mov rcx, rax
call sym.SystemInformer.exe_Ordinal_1351
test al, al
jne 0x14009e144
mov edx, 0x4c2
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r8, [rbp + 0x38]
xor edx, edx
mov rcx, rax
call sym.SystemInformer.exe_Ordinal_1803
mov rcx, qword ds:[rbp + 0x38]
call sym.SystemInformer.exe_Ordinal_1238
mov rdx, rax
mov qword [rbp - 0x10], 0x22
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], rsi
call sym.SystemInformer.exe_Ordinal_1908
mov byte [0x1402c63a8], r12b
mov r9d, 0xf000
xor r8d, r8d
mov edx, 0x102c
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
mov qword [rbp - 0x10], 0x28
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
mov edx, esi
lea rax, str.AllowOnlyOneInstance
sete dl
mov qword [rbp - 8], rax
call sym.SystemInformer.exe_Ordinal_1904
mov r9d, 0xf000
mov r8, r12
mov edx, 0x102c
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x16
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.HideOnClose
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x1c
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.HideOnMinimize
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x16
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.StartHidden
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
lea r14, str.MiniInfoWindowEnabled
mov qword [rbp - 0x10], 0x2a
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xe
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009e2ab
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x2a
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xf
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x36
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.MainWindowTabRestoreEnabled
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
lea r14, str.KsiEnable
mov qword [rbp - 0x10], 0x12
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 6
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009e363
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x12
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 5
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x1c
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.EnableWarnings
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
lea r14, str.EnablePlugins
mov qword ds:[rbp - 0x10], 0x1a
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 8
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009e423
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x1a
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xa
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x22
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.DbgHelpUndecorate
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 9
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x20
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.EnableAvxSupport
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
lea r14, str.TreeListEnableHeaderTotals
mov qword [rbp - 0x10], 0x34
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xb
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009e523
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x34
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1904
lea r14, str.EnableGraphMaxScale
mov qword [rbp - 0x10], 0x26
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xd
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009e590
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x26
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1904
lea r14, str.EnableCycleCpuUsage
mov qword ds:[rbp - 0x10], 0x26
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xc
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009e603
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x26
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1904
lea r15, str.EnableThemeSupport
mov qword [rbp - 0x10], 0x24
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r15
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x10
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009e670
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x24
mov qword [rbp - 8], r15
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x11
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x24
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.EnableStartAsAdmin
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
lea r14, str.EnableStreamerMode
mov qword [rbp - 0x10], 0x24
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x12
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009e726
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x24
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x13
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x2e
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.EnableSilentCrashNotify
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 7
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x26
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.EnableMonospaceFont
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
lea r14, str.EnableNetworkResolve
mov qword [rbp - 0x10], 0x28
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x14
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009e823
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x28
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1904
lea r14, str.EnableNetworkResolveDoH
mov qword [rbp - 0x10], 0x2e
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x15
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009e890
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x2e
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x16
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x2a
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.EnableInstantTooltips
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
lea r14, str.EnableImageCoherencySupport
mov qword [rbp - 0x10], 0x36
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x17
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009e946
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x36
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1904
lea r14, str.EnableStage2
mov qword [rbp - 0x10], 0x18
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x18
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009e9b3
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x18
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1904
lea r14, str.EnableServiceStage2
mov qword [rbp - 0x10], 0x26
lea rcx, [rbp - 0x10]
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1886
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x19
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete cl
test ebx, ebx
setne al
cmp cl, al
je 0x14009ea23
mov byte [0x1402c63a8], r12b
movzx edx, cl
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x26
mov qword [rbp - 8], r14
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x1a
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x1e
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.IconSingleClick
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x1b
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x2a
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.IconTogglesVisibility
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x1c
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x10], 0x22
and eax, 0xfffff000
lea rcx, [rbp - 0x10]
cmp eax, 0x2000
lea rax, str.PropagateCpuUsage
mov qword [rbp - 8], rax
sete dl
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x1d
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x2a
and eax, 0xfffff000
cmp eax, 0x2000
lea rax, str.EnableAdvancedOptions
mov qword [rbp - 8], rax
sete sil
mov edx, esi
call sym.SystemInformer.exe_Ordinal_1904
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x10], 0x24
mov qword [rbp - 8], r15
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x14009eb8f
lea rax, str.GraphColorMode
mov qword [rbp - 0x10], 0x1c
mov edx, r12d
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x10]
call sym.SystemInformer.exe_Ordinal_1904
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x102c
mov r9d, 0xf000
and eax, 0xfffff000
mov r8d, 3
cmp eax, 0x2000
mov rcx, rdi
sete bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
movzx edx, bl
cmp eax, 0x2000
sete cl
call fcn.14009bb40
lea r8, [0x14009dac0]
xor edx, edx
mov ecx, 0x10
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rbp
jmp sym.SystemInformer.exe_Ordinal_1172