Function at 0x14003ff40
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0xe8], rax
test byte [0x140246920], 1
jne 0x140040230
mov rcx, qword [0x140246928]
mov qword [r11 + 0x10], rbp
mov qword [r11 - 8], rdi
test rcx, rcx
je 0x14003ff91
mov rcx, qword [rcx + 8]
xor edx, edx
call sym.ProcessHacker.exe_PhGetFullPath
mov qword [0x140240e10], rax
jmp 0x14003ff98
mov rax, qword [0x140240e10]
xor ebp, ebp
mov qword [rsp + 0x100], rbx
lea edi, [rbp - 1]
test rax, rax
jne 0x140040078
lock cmpxchg qword [0x1402447c8], rbp
mov rbx, rax
je 0x14003ffc2
lock inc dword [rax - 8]
jmp 0x14003ffeb
mov rcx, qword [0x140241948]
xor edx, edx
call sym.ProcessHacker.exe_PhGetDllFileName
mov rbx, rax
xor eax, eax
lock cmpxchg qword [0x1402447c8], rbx
jne 0x14003ffe6
lock inc dword [rbx - 8]
test rbx, rbx
je 0x140040050
lea rdx, [0x14023a9a8]
mov qword ss:[rsp + 0x110], rsi
mov rcx, rbx
call sym.ProcessHacker.exe_PhConcatStringRef2
mov rsi, rax
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
test al, al
je 0x14004001e
mov qword [0x140240e10], rsi
jmp 0x140040033
lea rcx, [rsi - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140040033
call fcn.1400fbcc0
lea rcx, [rbx - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
mov rsi, qword [rsp + 0x110]
cmp eax, 1
jne 0x140040050
call fcn.1400fbcc0
mov rax, qword [0x140240e10]
test rax, rax
jne 0x140040078
lea rcx, [0x14023a968]
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
mov qword [0x140240e10], rax
test rax, rax
je 0x140040218
mov rcx, qword ds:[rax + 8]
call sym.ProcessHacker.exe_PhLoadSettings
cmp eax, 0xc0000102
jne 0x140040218
lea rax, str.If_you_select_No__the_settings_system_will_not_function_properly.
mov edx, 6
lea r9, str.Process_Hackers_settings_file_is_corrupt._Do_you_want_to_reset_it_
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xffff
call sym.ProcessHacker.exe_PhShowMessage2
cmp eax, 6
jne 0x1400401f7
mov eax, dword [0x1401dfa78]
lea rdx, ds:[rsp + 0x70]
movups xmm0, xmmword [str._settings___settings_]
mov dword [rsp + 0xe0], eax
xor r9d, r9d
movzx eax, word [0x1401dfa7c]
xor r8d, r8d
mov word [rsp + 0xe4], ax
mov rax, qword [0x140240e10]
movups xmmword [rsp + 0xd0], xmm0
mov rcx, qword [rax + 8]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
test eax, eax
js 0x140040218
mov dword [rsp + 0x50], ebp
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rbp
lea r9, [rsp + 0xb0]
mov dword [rsp + 0x40], 0x60
lea r8, [rsp + 0x80]
mov dword [rsp + 0x38], 4
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x30], 5
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x120116
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], rbp
mov dword [rsp + 0x98], 0x40
mov qword [rsp + 0x90], rax
movdqu xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
lea rcx, ds:[rsp + 0x70]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test ebx, ebx
js 0x140040218
mov rbx, qword [rsp + 0x68]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rbp
xor r8d, r8d
mov dword [rsp + 0x30], 0x15
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rbx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140040218
mov rcx, qword [0x140240e10]
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x140040211
call fcn.1400fbcc0
mov qword [0x140240e10], rbp
mov rbx, qword [rsp + 0x100]
mov rbp, qword [rsp + 0x108]
mov rdi, qword [rsp + 0xf0]
lea rcx, str.EnablePlugins
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
lea rcx, str.MaxSizeUnit
setne byte [0x140240b74]
call sym.ProcessHacker.exe_PhGetIntegerSetting
lea rcx, str.SampleCountAutomatic
mov dword [0x14023f728], eax
nop
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x140040293
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
inc eax
mov ecx, 0x800
cdq
sub eax, edx
sar eax, 1
cmp eax, ecx
cmova eax, ecx
lea rcx, str.SampleCount
mov edx, eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov rcx, qword ds:[rsp + 0xe8]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0xf8
ret