Function at 0x1400d6d10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f8]
sub rsp, 0x2f8
mov r14, rcx
mov r15, rdx
mov rcx, qword [rcx + 0xc0]
nop dword [rax]
xor r13d, r13d
cmp qword [r15 + 0x50], rcx
je 0x1400d6d63
mov eax, dword [r15]
test eax, eax
je 0x1400d6d55
add r15, rax
jne 0x1400d6d40
lea r15, [rbp + 0x90]
mov dword [rbp + 0x94], r13d
mov r12d, dword [r15 + 4]
test rcx, rcx
jne 0x1400d6d90
test r12d, r12d
je 0x1400d6d90
mov rax, r13
lea rcx, [r15 + 0x130]
mov edx, r12d
nop
mov qword [rcx], rax
lea rcx, [rcx + 0x50]
inc rax
sub rdx, 1
jne 0x1400d6d80
mov rbx, r13
mov esi, r13d
mov rax, qword [r14]
mov ecx, dword [rax + 0x40]
cmp esi, ecx
jae 0x1400d6dc6
mov edx, dword [rax]
mov r8, qword [rax + 0x30]
add edx, 8
mov eax, edx
imul eax, esi
nop
mov edi, eax
inc esi
add rdi, r8
add eax, edx
cmp dword [rdi], 0xffffffff
jne 0x1400d6e5f
cmp esi, ecx
jb 0x1400d6db0
test rbx, rbx
je 0x1400d6f79
lea rcx, [r14 + 8]
call sym.ProcessHacker.exe_PhfAcquireFastLockExclusive
mov esi, r13d
cmp dword [rbx], r13d
jbe 0x1400d6e30
mov rax, qword [rbx + 8]
lea rdx, [rbp + 0x258]
mov ecx, esi
mov rcx, qword [rax + rcx*8]
mov qword [rbp + 0x258], rcx
mov rcx, qword [r14]
call sym.ProcessHacker.exe_PhRemoveEntryHashtable
mov rcx, qword [rbp + 0x258]
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400d6e1d
call fcn.1400258b0
inc esi
cmp esi, dword [rbx]
jb 0x1400d6de0
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14 + 8]
test eax, 0xffc00000
je 0x1400d6f30
lea ecx, [rax - 0x3fffff]
lock cmpxchg dword [r14 + 8], ecx
jne 0x1400d6f4b
mov rcx, qword [r14 + 0x10]
mov edx, 1
jmp 0x1400d6f5a
mov edx, r13d
test r12d, r12d
je 0x1400d6e8e
mov rax, qword [rdi + 8]
mov r8, qword [rax]
nop
mov eax, edx
lea rcx, [rax + rax*4]
add rcx, rcx
cmp r8, qword [r15 + rcx*8 + 0x130]
je 0x1400d6d96
inc edx
cmp edx, r12d
jb 0x1400d6e70
mov rdx, qword [rdi + 8]
lea rcx, [r14 + 0x60]
call sym.ProcessHacker.exe_PhInvokeCallback
test rbx, rbx
jne 0x1400d6eee
mov rbx, qword [0x14015f3f0]
mov edx, 0x10
mov rcx, rbx
call fcn.1400257d0
lock inc dword [rbx + 4]
mov dword [rax + 8], 1
mov edx, 4
movzx ecx, byte [rbx + 2]
lea rbx, [rax + 0x10]
mov word [rax], cx
mov dword [rbx], r13d
mov dword [rbx + 4], 2
lea r8d, [rdx + 0xc]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 8], rax
mov eax, dword [rbx + 4]
mov rdi, qword [rdi + 8]
cmp dword [rbx], eax
jne 0x1400d6f1f
mov r8, qword [rbx + 8]
add eax, eax
mov r9d, eax
mov edx, 4
mov dword [rbx + 4], eax
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
shl r9, 3
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov qword [rbx + 8], rax
mov ecx, dword [rbx]
mov rax, qword [rbx + 8]
mov qword [rax + rcx*8], rdi
inc dword [rbx]
jmp 0x1400d6d96
mov edx, eax
mov ecx, eax
shr edx, 0xc
and edx, 0x3ff
and ecx, 0xffc00ffe
lock cmpxchg dword [r14 + 8], ecx
je 0x1400d6f52
pause
jmp 0x1400d6e30
test edx, edx
je 0x1400d6f63
mov rcx, qword [r14 + 0x18]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtReleaseSemaphore]
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400d6f79
call fcn.1400258b0
lea rcx, [r14 + 0xe0]
call qword [sym.imp.ntdll.dll_RtlInterlockedFlushSList]
mov rdi, rax
test rax, rax
je 0x1400d706f
mov rbx, rdi
mov rdi, qword [rdi]
cmp dword [rbx + 0x30], r13d
jne 0x1400d6fdf
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400d6fdf
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax + 0x70]
mov qword [rax + 0x70], rcx
lock inc dword [rcx - 8]
test rdx, rdx
je 0x1400d6fd2
lea rcx, [rdx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400d6fd2
call fcn.1400258b0
mov rcx, qword [rbx + 0x18]
mov eax, dword [rbx + 0x30]
mov dword [rcx + 0x80], eax
mov rax, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x38]
mov rdx, qword [rax + 0x90]
mov qword [rax + 0x90], rcx
test rdx, rdx
je 0x1400d7010
lea rcx, [rdx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400d7010
call fcn.1400258b0
mov rax, qword [rbx + 0x18]
mov byte [rax + 0xa1], 1
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400d703a
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400d703a
call fcn.1400258b0
mov rcx, qword [rbx + 0x18]
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400d7054
call fcn.1400258b0
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test rdi, rdi
jne 0x1400d6f92
test r12d, r12d
je 0x1400d7a43
movaps xmmword [rsp + 0x2e0], xmm6
add r15, 0x130
movss xmm6, dword [0x140137844]
mov rsi, r12
mov rdx, qword [r15]
mov rcx, r14
call fcn.1400d6700
mov qword [rbp + 0x248], rax
mov rcx, rax
test rax, rax
jne 0x1400d75b7
mov rdx, qword [0x14015a518]
mov rbx, qword [0x14015dd90]
add rdx, 0xc0
mov rdi, qword [r15]
mov rcx, rbx
mov qword [rbp + 0x250], r13
mov qword [0x14015a510], 0xc0
call fcn.1400257d0
lock inc dword [rbx + 4]
mov r12d, 1
mov r8d, 0xc0
mov dword [rax + 8], r12d
movzx edx, byte [rbx + 2]
lea rbx, [rax + 0x10]
mov word [rax], dx
mov rcx, rbx
xor edx, edx
call fcn.1400e2690
lea rdx, [rbx + 0xa2]
mov qword [rbx], rdi
lea r8d, [r12 + 9]
mov ecx, edi
call fcn.1400e9c98
xor r8d, r8d
lea ecx, [r12 + 5]
mov rdx, rbx
call fcn.14004fb60
mov rax, qword [r15 - 0x20]
lea edx, [r12 + 0x3f]
mov qword [rbp + 0x248], rbx
mov qword [rbx + 8], rax
mov rax, qword [rbp + 0x248]
mov rcx, qword [r15 - 0x30]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x248]
mov rcx, qword [r15 - 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rbp + 0x248]
mov eax, dword [r15 + 0x10]
sub eax, dword [rcx + 0x48]
mov dword [rcx + 0x4c], eax
mov ecx, dword [r15 + 0x10]
mov rax, qword [rbp + 0x248]
mov dword [rax + 0x48], ecx
mov ecx, dword [r15 + 8]
mov rax, qword [rbp + 0x248]
mov dword [rax + 0x60], ecx
mov ecx, dword [r15 + 0xc]
mov rax, qword [rbp + 0x248]
mov dword [rax + 0x64], ecx
mov ecx, dword [r15 + 0x14]
mov rax, qword [rbp + 0x248]
mov dword [rax + 0x84], ecx
mov ecx, dword [r15 + 0x18]
mov rax, qword [rbp + 0x248]
mov dword [rax + 0x88], ecx
mov r8, qword [rbp + 0x248]
lea rcx, [r8 + 0x98]
mov r8, qword [r8]
call sym.ProcessHacker.exe_PhOpenThread
test eax, eax
jns 0x1400d71f6
mov r8, qword [rbp + 0x248]
mov edx, dword [sym.ProcessHacker.exe_ThreadQueryAccess]
lea rcx, [r8 + 0x98]
mov r8, qword [r8]
call sym.ProcessHacker.exe_PhOpenThread
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
jb 0x1400d7279
cmp qword [r14 + 0xc0], r13
je 0x1400d7244
mov rax, qword [rbp + 0x248]
lea r8, [rbp + 0x50]
mov r9d, 0x10
mov qword [rsp + 0x20], r13
mov rcx, qword [rax + 0x98]
lea edx, [r9 + 7]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x1400d7279
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x248]
jmp 0x1400d7263
mov rdx, qword [rbp + 0x248]
movsx eax, byte [0x14015f3d8]
mov ecx, dword [rdx]
cmp ecx, eax
jae 0x1400d7280
mov rax, qword [0x14015e148]
mov rcx, qword [rax + rcx*8]
mov rax, rcx
sub rax, qword [rdx + 0x50]
mov qword [rdx + 0x58], rax
mov rax, qword [rbp + 0x248]
mov qword [rax + 0x50], rcx
mov rdx, qword [rbp + 0x248]
mov rax, qword [rdx + 0x10]
sub rax, qword [rdx + 0x28]
mov qword [rdx + 0x30], rax
mov rcx, qword [rbp + 0x248]
mov rax, qword [rcx + 0x10]
mov qword [rcx + 0x28], rax
mov rcx, qword [rbp + 0x248]
mov rax, qword [rcx + 0x18]
sub rax, qword [rcx + 0x38]
mov qword [rcx + 0x40], rax
mov rcx, qword [rbp + 0x248]
mov rax, qword [rcx + 0x18]
mov qword [rcx + 0x38], rax
mov rdx, qword [rbp + 0x248]
mov rcx, qword [rdx + 0x98]
test rcx, rcx
je 0x1400d72f3
mov r9d, 8
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x250]
lea edx, [r9 + 1]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov rdx, qword [rbp + 0x248]
mov rax, qword [rbp + 0x250]
test rax, rax
jne 0x1400d730a
mov rax, qword [r15 - 0x10]
mov qword [rbp + 0x250], rax
mov qword [rdx + 0x68], rax
mov rcx, qword [rbp + 0x248]
mov rcx, qword [rcx + 0x98]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rcx, qword [rbp + 0x248]
mov dword [rcx + 0x8c], eax
cmp qword [r14 + 0x108], r13
je 0x1400d735d
mov rdx, qword [rbp + 0x248]
mov rcx, r14
lea r8, [rdx + 0x80]
mov rdx, qword [rdx + 0x68]
call fcn.1400d6a70
mov rcx, qword [rbp + 0x248]
mov qword [rcx + 0x70], rax
mov rbx, qword [rbp + 0x248]
cmp qword [rbx + 0x70], r13
jne 0x1400d7405
mov dword [rbx + 0x80], 2
mov edx, 0x42
mov rbx, qword [0x14015f3f8]
mov rcx, rbx
call fcn.1400257d0
lock inc dword [rbx + 4]
mov dword [rax + 8], r12d
lea rdx, [rax + 0x10]
movzx ecx, byte [rbx + 2]
mov r8d, 0x30
mov word [rax], cx
lea rax, [rdx + 0x10]
mov qword [rdx], r8
mov r8d, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x30], r13w
mov rax, qword [rbp + 0x248]
mov qword [rax + 0x70], rdx
mov rax, qword [rbp + 0x248]
mov rdx, qword [rdx + 8]
mov rcx, qword [rax + 0x68]
mov dword [rdx], 0x780030
add rdx, 4
call fcn.1400e9c74
mov rax, qword [rbp + 0x248]
mov rbx, qword [rax + 0x70]
mov rcx, qword [rbx + 8]
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rbx], rax
mov rbx, qword [rbp + 0x248]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov edx, 4
lea r8d, [rdx + 0x3c]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, rax
xor eax, eax
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rax
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x38], rax
mov qword [rdx + 0x10], r14
lock inc dword [r14 - 8]
mov qword [rdx + 0x18], rbx
test rbx, rbx
je 0x1400d7451
lock inc dword [rbx - 8]
mov rax, qword [r14 + 0x100]
mov qword [rdx + 0x20], rax
call fcn.1400d5ea0
mov rax, qword [rbp + 0x248]
mov rdx, qword [rax + 0x98]
test rdx, rdx
je 0x1400d74e5
mov rcx, qword [0x14015a2a8]
test rcx, rcx
je 0x1400d74e5
mov dword [rsp + 0x48], r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r13
xor r9d, r9d
mov qword [rbp + 0x10], rax
xor r8d, r8d
mov dword [rsp + 0x38], 0x28
lea rax, [rbp]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x70]
mov qword [rbp], rdx
xor edx, edx
mov dword [rsp + 0x28], 0x999921af
mov qword [rsp + 0x20], rax
mov dword [rbp + 8], r12d
mov dword [rbp + 0x18], 8
mov qword [rbp + 0x20], r13
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x1400d7535
cmp qword [rsp + 0x50], r13
jmp 0x1400d7525
xor ecx, ecx
mov dword [rsp + 0x60], 0x48
mov qword [rsp + 0x64], rcx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x6c], rcx
mov qword [rsp + 0x74], rcx
mov qword [rsp + 0x7c], rcx
mov qword [rbp - 0x7c], rcx
mov qword [rbp - 0x74], rcx
mov qword [rbp - 0x6c], rcx
mov qword [rbp - 0x64], rcx
mov dword [rbp - 0x5c], ecx
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
mov rax, qword [rbp + 0x248]
setne cl
mov byte [rax + 0xa0], cl
lea rcx, [r14 + 8]
call sym.ProcessHacker.exe_PhfAcquireFastLockExclusive
mov rcx, qword [r14]
lea rdx, [rbp + 0x248]
call sym.ProcessHacker.exe_PhAddEntryHashtable
nop dword [rax]
mov eax, dword [r14 + 8]
test eax, 0xffc00000
je 0x1400d7572
lea ecx, [rax - 0x3fffff]
lock cmpxchg dword [r14 + 8], ecx
jne 0x1400d758d
mov rcx, qword [r14 + 0x10]
mov edx, r12d
jmp 0x1400d7599
mov edx, eax
mov ecx, eax
shr edx, 0xc
and edx, 0x3ff
and ecx, 0xffc00ffe
lock cmpxchg dword [r14 + 8], ecx
je 0x1400d7591
pause
jmp 0x1400d7550
test edx, edx
je 0x1400d75a2
mov rcx, qword [r14 + 0x18]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtReleaseSemaphore]
mov rdx, qword [rbp + 0x248]
lea rcx, [r14 + 0x20]
call sym.ProcessHacker.exe_PhInvokeCallback
jmp 0x1400d7a2d
xor al, al
mov r12d, 1
cmp byte [rcx + 0xa1], al
movzx edi, al
mov rax, qword [r15 - 0x30]
cmovne edi, r12d
mov qword [rcx + 0x10], rax
mov rcx, qword [r15 - 0x28]
mov rax, qword [rbp + 0x248]
mov qword [rax + 0x18], rcx
mov ecx, dword [r15 + 8]
mov rax, qword [rbp + 0x248]
mov dword [rax + 0x60], ecx
mov ecx, dword [r15 + 0xc]
mov rax, qword [rbp + 0x248]
mov dword [rax + 0x64], ecx
mov rax, qword [rbp + 0x248]
mov ecx, dword [r15 + 0x14]
mov dword [rax + 0x84], ecx
mov rcx, qword [rbp + 0x248]
mov eax, dword [r15 + 0x18]
cmp dword [rcx + 0x88], eax
je 0x1400d7634
mov dword [rcx + 0x88], eax
movzx edi, r12b
mov rcx, qword [rbp + 0x248]
lea r8, [rcx + 0x80]
cmp dword [r8], 2
jne 0x1400d768b
cmp qword [r14 + 0x108], r13
je 0x1400d768b
mov rdx, qword [rcx + 0x68]
mov rcx, r14
call fcn.1400d6a70
mov rcx, qword [rbp + 0x248]
mov rdx, qword [rcx + 0x70]
mov qword [rcx + 0x70], rax
test rdx, rdx
je 0x1400d7680
lea rcx, [rdx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, r12d
jne 0x1400d7680
call fcn.1400258b0
mov rcx, qword [rbp + 0x248]
movzx edi, r12b
cmp byte [rcx + 0xa1], r13b
je 0x1400d7719
cmp dword [rcx + 0x80], 2
jne 0x1400d7719
mov rax, qword [r15 - 0x10]
cmp qword [rcx + 0x68], rax
je 0x1400d7719
mov qword [rcx + 0x68], rax
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov rbx, qword [rbp + 0x248]
lea r8d, [rdx + 0x3c]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, rax
xor eax, eax
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rax
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x38], rax
mov qword [rdx + 0x10], r14
lock inc dword [r14 - 8]
mov qword [rdx + 0x18], rbx
test rbx, rbx
je 0x1400d7702
lock inc dword [rbx - 8]
mov rax, qword [r14 + 0x100]
mov qword [rdx + 0x20], rax
call fcn.1400d5ea0
mov rcx, qword [rbp + 0x248]
mov eax, dword [r15 + 0x10]
sub eax, dword [rcx + 0x48]
mov edx, dword [rcx + 0x4c]
mov dword [rcx + 0x4c], eax
mov rax, qword [rbp + 0x248]
mov ecx, dword [r15 + 0x10]
movzx edi, dil
mov dword [rax + 0x48], ecx
mov r10, qword [rbp + 0x248]
cmp dword [r10 + 0x4c], edx
cmovne edi, r12d
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
jb 0x1400d77d4
mov rbx, qword [r10 + 0x58]
cmp qword [r14 + 0xc0], r13
je 0x1400d7792
mov rcx, qword [r10 + 0x98]
lea r8, [rbp + 0x60]
mov r9d, 0x10
mov qword [rsp + 0x20], r13
lea edx, [r9 + 7]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov r10, qword [rbp + 0x248]
test eax, eax
js 0x1400d77d4
mov rcx, qword [rbp + 0x60]
jmp 0x1400d77ab
mov ecx, dword [r10]
movsx eax, byte [0x14015f3d8]
cmp ecx, eax
jae 0x1400d77d4
mov rax, qword [0x14015e148]
mov rcx, qword [rax + rcx*8]
mov rax, rcx
movzx edi, dil
sub rax, qword [r10 + 0x50]
mov qword [r10 + 0x58], rax
mov rax, qword [rbp + 0x248]
mov qword [rax + 0x50], rcx
mov r10, qword [rbp + 0x248]
cmp qword [r10 + 0x58], rbx
cmovne edi, r12d
mov rax, qword [r10 + 0x10]
sub rax, qword [r10 + 0x28]
mov qword [r10 + 0x30], rax
mov rcx, qword [rbp + 0x248]
mov rax, qword [rcx + 0x10]
mov qword [rcx + 0x28], rax
mov rcx, qword [rbp + 0x248]
mov rax, qword [rcx + 0x18]
sub rax, qword [rcx + 0x38]
mov qword [rcx + 0x40], rax
mov rcx, qword [rbp + 0x248]
mov rax, qword [rcx + 0x18]
mov qword [rcx + 0x38], rax
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
mov r8, qword [rbp + 0x248]
jb 0x1400d7865
cmp byte [0x14015360f], r13b
je 0x1400d7865
cmp qword [r14 + 0xc0], r13
je 0x1400d783c
cmp qword [r8 + 0x98], r13
je 0x1400d7865
mov rax, qword [r8 + 0x58]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
test rax, rax
jns 0x1400d7851
addss xmm0, xmm6
mov rax, qword [0x14015e110]
xorps xmm1, xmm1
test rax, rax
cvtsi2ss xmm1, rax
jmp 0x1400d7898
mov rax, qword [r8 + 0x40]
xorps xmm0, xmm0
add rax, qword [r8 + 0x30]
cvtsi2ss xmm0, rax
jns 0x1400d787b
addss xmm0, xmm6
mov rdx, qword [0x14015e098]
xorps xmm1, xmm1
add rdx, qword [0x14015e128]
add rdx, qword [0x14015e138]
cvtsi2ss xmm1, rdx
jns 0x1400d789e
addss xmm1, xmm6
divss xmm0, xmm1
movss dword [r8 + 0x20], xmm0
mov rcx, qword [rbp + 0x248]
mov ebx, dword [rcx + 0x8c]
mov rcx, qword [rcx + 0x98]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rcx, qword [rbp + 0x248]
cmp eax, ebx
movzx edi, dil
cmovne edi, r12d
mov dword [rcx + 0x8c], eax
mov rax, qword [rbp + 0x248]
mov rdx, qword [rax + 0x98]
test rdx, rdx
je 0x1400d7992
mov rcx, qword [0x14015a2a8]
test rcx, rcx
je 0x1400d7992
mov dword [rsp + 0x48], r13d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], r13
xor r9d, r9d
mov qword [rbp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x38], 0x28
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x80]
mov qword [rbp + 0x28], rdx
xor edx, edx
mov dword [rsp + 0x28], 0x999921af
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x30], r12d
mov dword [rbp + 0x40], 8
mov qword [rbp + 0x48], r13
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x1400d79ed
cmp qword [rsp + 0x58], r13
mov rcx, qword [rbp + 0x248]
setne al
movzx edx, byte [rcx + 0xa0]
mov byte [rcx + 0xa0], al
mov rax, qword [rbp + 0x248]
cmp byte [rax + 0xa0], dl
je 0x1400d79ed
movzx edi, r12b
jmp 0x1400d79ed
xor ecx, ecx
mov dword [rbp - 0x50], 0x48
mov qword [rbp - 0x4c], rcx
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x44], rcx
mov qword [rbp - 0x3c], rcx
mov qword [rbp - 0x34], rcx
mov qword [rbp - 0x2c], rcx
mov qword [rbp - 0x24], rcx
mov qword [rbp - 0x1c], rcx
mov qword [rbp - 0x14], rcx
mov dword [rbp - 0xc], ecx
mov ecx, dword [rax]
movzx ebx, byte [rax + 0xa0]
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
movzx edi, dil
mov rax, qword [rbp + 0x248]
setne cl
cmp cl, bl
cmovne edi, r12d
mov byte [rax + 0xa0], cl
mov rax, qword [rbp + 0x248]
mov byte [rax + 0xa1], r13b
test dil, dil
je 0x1400d7a10
mov rdx, qword [rbp + 0x248]
lea rcx, [r14 + 0x40]
call sym.ProcessHacker.exe_PhInvokeCallback
mov rcx, qword [rbp + 0x248]
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, r12d
jne 0x1400d7a2d
call fcn.1400258b0
add r15, 0x50
sub rsi, 1
jne 0x1400d7092
movaps xmm6, xmmword [rsp + 0x2e0]
lea rcx, [r14 + 0x80]
xor edx, edx
call sym.ProcessHacker.exe_PhInvokeCallback
inc qword [r14 + 0x100]
add rsp, 0x2f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret