Function at 0x1800bb4c0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe90
lea rdi, [rsp + 0x20]
mov ecx, 0x39c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xea0]
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0xe88], rax
mov edx, 0x577
mov rcx, qword [rsp + 0xea0]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov qword [rsp + 0x20], rax
lea rcx, str.SampleCount
call sym.ProcessMonitor.dll_PhGetIntegerSetting
xor r9d, r9d
mov r8d, eax
mov edx, 0x500
mov rcx, qword [rsp + 0xea0]
call sym.ProcessMonitor.dll_PhSetDialogItemValue
lea rcx, str.SampleCountAutomatic
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bb551
mov dword [rsp + 0xdb0], 1
jmp 0x1800bb55c
mov dword [rsp + 0xdb0], 0
movsxd rax, dword [rsp + 0xdb0]
mov qword [rsp + 0xdb8], rax
mov edx, 0x551
mov rcx, qword [rsp + 0xea0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov rcx, qword [rsp + 0xdb8]
mov r8, rcx
mov edx, 0xf1
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, str.SampleCountAutomatic
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bb5c9
mov edx, 0x500
mov rcx, qword [rsp + 0xea0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
xor r9d, r9d
lea r8, str.Allow_only_one_instance
xor edx, edx
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Hide_when_closed
mov edx, 1
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Hide_when_minimized
mov edx, 2
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Start_when_I_log_on
mov edx, 3
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Start_hidden
mov edx, 4
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_warnings
mov edx, 5
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_kernel_mode_driver
mov edx, 6
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_mitigation_policy
mov edx, 7
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_plugins
mov edx, 8
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_undecorated_symbols
mov edx, 9
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_column_header_totals__experimental_
mov edx, 0xa
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_cycle_based_CPU_usage
mov edx, 0xb
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_fixed_graph_scaling__experimental_
mov edx, 0xc
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_tray_information_window
mov edx, 0xd
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Remember_last_selected_window
mov edx, 0xe
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_theme_support__experimental_
mov edx, 0xf
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_start_as_admin__experimental_
mov edx, 0x10
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Resolve_network_addresses
mov edx, 0x11
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Resolve_DNS_over_HTTPS__DoH_
mov edx, 0x12
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Show_tooltips_instantly
mov edx, 0x13
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Check_images_for_coherency
mov edx, 0x14
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Check_images_for_digital_signatures
mov edx, 0x15
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Check_services_for_digital_signatures
mov edx, 0x16
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Single_click_tray_icons
mov edx, 0x17
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Icon_click_toggles_visibility
mov edx, 0x18
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Include_usage_of_collapsed_processes
mov edx, 0x19
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
xor r9d, r9d
lea r8, str.Show_advanced_options
mov edx, 0x1a
mov rcx, qword [rsp + 0x20]
call sym.ProcessMonitor.dll_PhAddListViewItem
mov dword [rsp + 0x50], 0xf000
lea rcx, str.AllowOnlyOneInstance
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bb88e
mov dword [rsp + 0xdc0], 1
jmp 0x1800bb899
mov dword [rsp + 0xdc0], 0
cmp dword [rsp + 0xdc0], 0
je 0x1800bb8b0
mov dword [rsp + 0xdc4], 2
jmp 0x1800bb8bb
mov dword [rsp + 0xdc4], 1
mov eax, dword [rsp + 0xdc4]
shl eax, 0xc
mov dword [rsp + 0x4c], eax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xd0], 0xf000
lea rcx, str.HideOnClose
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bb909
mov dword [rsp + 0xdc8], 1
jmp 0x1800bb914
mov dword [rsp + 0xdc8], 0
cmp dword [rsp + 0xdc8], 0
je 0x1800bb92b
mov dword [rsp + 0xdcc], 2
jmp 0x1800bb936
mov dword [rsp + 0xdcc], 1
mov eax, dword [rsp + 0xdcc]
shl eax, 0xc
mov dword [rsp + 0xcc], eax
lea r9, [rsp + 0xc0]
mov r8d, 1
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x150], 0xf000
lea rcx, str.HideOnMinimize
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bb98d
mov dword [rsp + 0xdd0], 1
jmp 0x1800bb998
mov dword [rsp + 0xdd0], 0
cmp dword [rsp + 0xdd0], 0
je 0x1800bb9af
mov dword [rsp + 0xdd4], 2
jmp 0x1800bb9ba
mov dword [rsp + 0xdd4], 1
mov eax, dword [rsp + 0xdd4]
shl eax, 0xc
mov dword [rsp + 0x14c], eax
lea r9, [rsp + 0x140]
mov r8d, 2
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x1d0], 0xf000
lea rcx, str.StartHidden
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bba11
mov dword [rsp + 0xdd8], 1
jmp 0x1800bba1c
mov dword [rsp + 0xdd8], 0
cmp dword [rsp + 0xdd8], 0
je 0x1800bba33
mov dword [rsp + 0xddc], 2
jmp 0x1800bba3e
mov dword [rsp + 0xddc], 1
mov eax, dword [rsp + 0xddc]
shl eax, 0xc
mov dword [rsp + 0x1cc], eax
lea r9, [rsp + 0x1c0]
mov r8d, 4
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x250], 0xf000
lea rcx, str.MiniInfoWindowEnabled
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bba95
mov dword [rsp + 0xde0], 1
jmp 0x1800bbaa0
mov dword [rsp + 0xde0], 0
cmp dword [rsp + 0xde0], 0
je 0x1800bbab7
mov dword [rsp + 0xde4], 2
jmp 0x1800bbac2
mov dword [rsp + 0xde4], 1
mov eax, dword [rsp + 0xde4]
shl eax, 0xc
mov dword [rsp + 0x24c], eax
lea r9, [rsp + 0x240]
mov r8d, 0xd
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x2d0], 0xf000
lea rcx, str.MainWindowTabRestoreEnabled
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bbb19
mov dword [rsp + 0xde8], 1
jmp 0x1800bbb24
mov dword [rsp + 0xde8], 0
cmp dword [rsp + 0xde8], 0
je 0x1800bbb3b
mov dword [rsp + 0xdec], 2
jmp 0x1800bbb46
mov dword [rsp + 0xdec], 1
mov eax, dword [rsp + 0xdec]
shl eax, 0xc
mov dword [rsp + 0x2cc], eax
lea r9, [rsp + 0x2c0]
mov r8d, 0xe
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x350], 0xf000
lea rcx, str.EnableKph
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bbb9d
mov dword [rsp + 0xdf0], 1
jmp 0x1800bbba8
mov dword [rsp + 0xdf0], 0
cmp dword [rsp + 0xdf0], 0
je 0x1800bbbbf
mov dword [rsp + 0xdf4], 2
jmp 0x1800bbbca
mov dword [rsp + 0xdf4], 1
mov eax, dword [rsp + 0xdf4]
shl eax, 0xc
mov dword [rsp + 0x34c], eax
lea r9, [rsp + 0x340]
mov r8d, 6
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x3d0], 0xf000
lea rcx, str.EnableWarnings
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bbc21
mov dword [rsp + 0xdf8], 1
jmp 0x1800bbc2c
mov dword [rsp + 0xdf8], 0
cmp dword [rsp + 0xdf8], 0
je 0x1800bbc43
mov dword [rsp + 0xdfc], 2
jmp 0x1800bbc4e
mov dword [rsp + 0xdfc], 1
mov eax, dword [rsp + 0xdfc]
shl eax, 0xc
mov dword [rsp + 0x3cc], eax
lea r9, [rsp + 0x3c0]
mov r8d, 5
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x450], 0xf000
lea rcx, str.EnablePlugins
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bbca5
mov dword [rsp + 0xe00], 1
jmp 0x1800bbcb0
mov dword [rsp + 0xe00], 0
cmp dword [rsp + 0xe00], 0
je 0x1800bbcc7
mov dword [rsp + 0xe04], 2
jmp 0x1800bbcd2
mov dword [rsp + 0xe04], 1
mov eax, dword [rsp + 0xe04]
shl eax, 0xc
mov dword [rsp + 0x44c], eax
lea r9, [rsp + 0x440]
mov r8d, 8
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x4d0], 0xf000
lea rcx, str.DbgHelpUndecorate
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bbd29
mov dword [rsp + 0xe08], 1
jmp 0x1800bbd34
mov dword [rsp + 0xe08], 0
cmp dword [rsp + 0xe08], 0
je 0x1800bbd4b
mov dword [rsp + 0xe0c], 2
jmp 0x1800bbd56
mov dword [rsp + 0xe0c], 1
mov eax, dword [rsp + 0xe0c]
shl eax, 0xc
mov dword [rsp + 0x4cc], eax
lea r9, [rsp + 0x4c0]
mov r8d, 9
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x550], 0xf000
lea rcx, str.TreeListEnableHeaderTotals
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bbdad
mov dword [rsp + 0xe10], 1
jmp 0x1800bbdb8
mov dword [rsp + 0xe10], 0
cmp dword [rsp + 0xe10], 0
je 0x1800bbdcf
mov dword [rsp + 0xe14], 2
jmp 0x1800bbdda
mov dword [rsp + 0xe14], 1
mov eax, dword [rsp + 0xe14]
shl eax, 0xc
mov dword [rsp + 0x54c], eax
lea r9, [rsp + 0x540]
mov r8d, 0xa
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x5d0], 0xf000
lea rcx, str.EnableScaleCpuGraph
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bbe31
mov dword [rsp + 0xe18], 1
jmp 0x1800bbe3c
mov dword [rsp + 0xe18], 0
cmp dword [rsp + 0xe18], 0
je 0x1800bbe53
mov dword [rsp + 0xe1c], 2
jmp 0x1800bbe5e
mov dword [rsp + 0xe1c], 1
mov eax, dword [rsp + 0xe1c]
shl eax, 0xc
mov dword [rsp + 0x5cc], eax
lea r9, [rsp + 0x5c0]
mov r8d, 0xc
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x650], 0xf000
lea rcx, str.EnableCycleCpuUsage
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bbeb5
mov dword [rsp + 0xe20], 1
jmp 0x1800bbec0
mov dword [rsp + 0xe20], 0
cmp dword [rsp + 0xe20], 0
je 0x1800bbed7
mov dword [rsp + 0xe24], 2
jmp 0x1800bbee2
mov dword [rsp + 0xe24], 1
mov eax, dword [rsp + 0xe24]
shl eax, 0xc
mov dword [rsp + 0x64c], eax
lea r9, [rsp + 0x640]
mov r8d, 0xb
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x6d0], 0xf000
lea rcx, str.EnableThemeSupport
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bbf39
mov dword [rsp + 0xe28], 1
jmp 0x1800bbf44
mov dword [rsp + 0xe28], 0
cmp dword [rsp + 0xe28], 0
je 0x1800bbf5b
mov dword [rsp + 0xe2c], 2
jmp 0x1800bbf66
mov dword [rsp + 0xe2c], 1
mov eax, dword [rsp + 0xe2c]
shl eax, 0xc
mov dword [rsp + 0x6cc], eax
lea r9, [rsp + 0x6c0]
mov r8d, 0xf
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x750], 0xf000
lea rcx, str.EnableStartAsAdmin
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bbfbd
mov dword [rsp + 0xe30], 1
jmp 0x1800bbfc8
mov dword [rsp + 0xe30], 0
cmp dword [rsp + 0xe30], 0
je 0x1800bbfdf
mov dword [rsp + 0xe34], 2
jmp 0x1800bbfea
mov dword [rsp + 0xe34], 1
mov eax, dword [rsp + 0xe34]
shl eax, 0xc
mov dword [rsp + 0x74c], eax
lea r9, [rsp + 0x740]
mov r8d, 0x10
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x7d0], 0xf000
lea rcx, str.EnableNetworkResolve
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bc041
mov dword [rsp + 0xe38], 1
jmp 0x1800bc04c
mov dword [rsp + 0xe38], 0
cmp dword [rsp + 0xe38], 0
je 0x1800bc063
mov dword [rsp + 0xe3c], 2
jmp 0x1800bc06e
mov dword [rsp + 0xe3c], 1
mov eax, dword [rsp + 0xe3c]
shl eax, 0xc
mov dword [rsp + 0x7cc], eax
lea r9, [rsp + 0x7c0]
mov r8d, 0x11
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x850], 0xf000
lea rcx, str.EnableNetworkResolveDoH
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bc0c5
mov dword [rsp + 0xe40], 1
jmp 0x1800bc0d0
mov dword [rsp + 0xe40], 0
cmp dword [rsp + 0xe40], 0
je 0x1800bc0e7
mov dword [rsp + 0xe44], 2
jmp 0x1800bc0f2
mov dword [rsp + 0xe44], 1
mov eax, dword [rsp + 0xe44]
shl eax, 0xc
mov dword [rsp + 0x84c], eax
lea r9, [rsp + 0x840]
mov r8d, 0x12
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x8d0], 0xf000
lea rcx, str.EnableInstantTooltips
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bc149
mov dword [rsp + 0xe48], 1
jmp 0x1800bc154
mov dword [rsp + 0xe48], 0
cmp dword [rsp + 0xe48], 0
je 0x1800bc16b
mov dword [rsp + 0xe4c], 2
jmp 0x1800bc176
mov dword [rsp + 0xe4c], 1
mov eax, dword [rsp + 0xe4c]
shl eax, 0xc
mov dword [rsp + 0x8cc], eax
lea r9, [rsp + 0x8c0]
mov r8d, 0x13
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x950], 0xf000
lea rcx, str.EnableImageCoherencySupport
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bc1cd
mov dword [rsp + 0xe50], 1
jmp 0x1800bc1d8
mov dword [rsp + 0xe50], 0
cmp dword [rsp + 0xe50], 0
je 0x1800bc1ef
mov dword [rsp + 0xe54], 2
jmp 0x1800bc1fa
mov dword [rsp + 0xe54], 1
mov eax, dword [rsp + 0xe54]
shl eax, 0xc
mov dword [rsp + 0x94c], eax
lea r9, [rsp + 0x940]
mov r8d, 0x14
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x9d0], 0xf000
lea rcx, str.EnableStage2
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bc251
mov dword [rsp + 0xe58], 1
jmp 0x1800bc25c
mov dword [rsp + 0xe58], 0
cmp dword [rsp + 0xe58], 0
je 0x1800bc273
mov dword [rsp + 0xe5c], 2
jmp 0x1800bc27e
mov dword [rsp + 0xe5c], 1
mov eax, dword [rsp + 0xe5c]
shl eax, 0xc
mov dword [rsp + 0x9cc], eax
lea r9, [rsp + 0x9c0]
mov r8d, 0x15
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xa50], 0xf000
lea rcx, str.EnableServiceStage2
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bc2d5
mov dword [rsp + 0xe60], 1
jmp 0x1800bc2e0
mov dword [rsp + 0xe60], 0
cmp dword [rsp + 0xe60], 0
je 0x1800bc2f7
mov dword [rsp + 0xe64], 2
jmp 0x1800bc302
mov dword [rsp + 0xe64], 1
mov eax, dword [rsp + 0xe64]
shl eax, 0xc
mov dword [rsp + 0xa4c], eax
lea r9, [rsp + 0xa40]
mov r8d, 0x16
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xad0], 0xf000
lea rcx, str.IconSingleClick
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bc359
mov dword [rsp + 0xe68], 1
jmp 0x1800bc364
mov dword [rsp + 0xe68], 0
cmp dword [rsp + 0xe68], 0
je 0x1800bc37b
mov dword [rsp + 0xe6c], 2
jmp 0x1800bc386
mov dword [rsp + 0xe6c], 1
mov eax, dword [rsp + 0xe6c]
shl eax, 0xc
mov dword [rsp + 0xacc], eax
lea r9, [rsp + 0xac0]
mov r8d, 0x17
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xb50], 0xf000
lea rcx, str.IconTogglesVisibility
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bc3dd
mov dword [rsp + 0xe70], 1
jmp 0x1800bc3e8
mov dword [rsp + 0xe70], 0
cmp dword [rsp + 0xe70], 0
je 0x1800bc3ff
mov dword [rsp + 0xe74], 2
jmp 0x1800bc40a
mov dword [rsp + 0xe74], 1
mov eax, dword [rsp + 0xe74]
shl eax, 0xc
mov dword [rsp + 0xb4c], eax
lea r9, [rsp + 0xb40]
mov r8d, 0x18
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xbd0], 0xf000
lea rcx, str.PropagateCpuUsage
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bc461
mov dword [rsp + 0xe78], 1
jmp 0x1800bc46c
mov dword [rsp + 0xe78], 0
cmp dword [rsp + 0xe78], 0
je 0x1800bc483
mov dword [rsp + 0xe7c], 2
jmp 0x1800bc48e
mov dword [rsp + 0xe7c], 1
mov eax, dword [rsp + 0xe7c]
shl eax, 0xc
mov dword [rsp + 0xbcc], eax
lea r9, [rsp + 0xbc0]
mov r8d, 0x19
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xc50], 0xf000
lea rcx, str.EnableAdvancedOptions
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bc4e5
mov dword [rsp + 0xe80], 1
jmp 0x1800bc4f0
mov dword [rsp + 0xe80], 0
cmp dword [rsp + 0xe80], 0
je 0x1800bc507
mov dword [rsp + 0xe84], 2
jmp 0x1800bc512
mov dword [rsp + 0xe84], 1
mov eax, dword [rsp + 0xe84]
shl eax, 0xc
mov dword [rsp + 0xc4c], eax
lea r9, [rsp + 0xc40]
mov r8d, 0x1a
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x1805aa089]
test eax, eax
je 0x1800bc580
mov dword [rsp + 0xcd0], 0xf000
mov dword [rsp + 0xccc], 0x2000
lea r9, [rsp + 0xcc0]
mov r8d, 3
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.18000e880
movzx eax, al
test eax, eax
je 0x1800bc5c0
mov dword [rsp + 0xd50], 0xf000
mov dword [rsp + 0xd4c], 0x2000
lea r9, [rsp + 0xd40]
mov r8d, 7
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, str.EnableAdvancedOptions
call sym.ProcessMonitor.dll_PhGetIntegerSetting
test eax, eax
je 0x1800bc5d7
xor ecx, ecx
call fcn.1800ba680
mov rcx, rsp
lea rdx, [0x18047f0f0]
call fcn.180014e20
mov rcx, qword [rsp + 0xe88]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0xe90
pop rdi
ret