Function at 0x140034d10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x14020a008]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov r15d, 5
xor r12d, r12d
test byte [0x140218960], 1
lea r13, [r15 - 6]
jne 0x140035025
mov rcx, qword [0x140218968]
test rcx, rcx
je 0x140034d92
mov rcx, qword [rcx + 8]
lea r8, [rsp + 0x78]
xor edx, edx
call fcn.1400ff0f0
mov rcx, qword [rsp + 0x78]
test eax, eax
cmovs rcx, r12
mov qword [0x1402130c0], rcx
jmp 0x140034d99
mov rcx, qword [0x1402130c0]
test rcx, rcx
jne 0x140034ea9
xor eax, eax
lock cmpxchg qword [0x1402169a0], r12
mov rdi, rax
je 0x140034db8
lock inc dword [rax - 8]
jmp 0x140034de3
mov rcx, qword [sym.ProcessHacker.exe_PhInstanceHandle]
xor edx, edx
call sym.ProcessHacker.exe_PhGetDllFileName
mov rdi, rax
xor eax, eax
lock cmpxchg qword [0x1402169a0], rdi
jne 0x140034dda
lock inc dword [rdi - 8]
test rdi, rdi
je 0x140034e7e
mov rbx, qword [0x14020d620]
add rbx, qword [rdi]
mov rdx, qword [0x140213b58]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rsi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r12w
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
call fcn.140165120
mov rcx, qword [rdi]
add rcx, qword [rsi + 8]
mov r8, qword [0x14020d620]
mov rdx, qword [str..settings.xml]
call fcn.140165120
mov rcx, qword [rsi + 8]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
test al, al
je 0x140034e52
mov qword [0x1402130c0], rsi
nop
jmp 0x140034e68
lea rcx, [rsi - 0x10]
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140034e68
call fcn.140106290
lea rcx, [rdi - 0x10]
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140034e7e
call fcn.140106290
mov rcx, qword [0x1402130c0]
test rcx, rcx
jne 0x140034ea9
lea rcx, [0x14020d5d0]
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
mov qword [0x1402130c0], rax
mov rcx, rax
test rax, rax
je 0x140035025
mov rcx, qword ds:[rcx + 8]
call sym.ProcessHacker.exe_PhLoadSettings
cmp eax, 0xc0000102
jne 0x140035025
lea rax, str.If_you_select_No__the_settings_system_will_not_function_properly.
mov edx, 6
lea r9, str.Process_Hackers_settings_file_is_corrupt._Do_you_want_to_reset_it_
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xffff
call sym.ProcessHacker.exe_PhShowMessage2
cmp eax, 6
jne 0x140035001
mov eax, dword [0x1401b9be8]
lea rdx, ds:[rbp - 0x78]
movups xmm0, xmmword [str._settings___settings_]
mov dword [rbp + 0xb8], eax
xor r9d, r9d
movzx eax, word [0x1401b9bec]
xor r8d, r8d
mov word [rbp + 0xbc], ax
mov rax, qword [0x1402130c0]
movups xmmword [rbp + 0xa8], xmm0
mov rcx, qword [rax + 8]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
test eax, eax
js 0x140035025
mov dword [rsp + 0x50], r12d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], r12
lea r9, [rbp - 0x38]
mov dword [rsp + 0x40], 0x60
lea r8, [rbp - 0x68]
mov dword [rsp + 0x38], 4
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x120116
mov qword [rsp + 0x20], r12
mov dword [rbp - 0x68], 0x30
mov qword [rbp - 0x60], r12
mov dword [rbp - 0x50], 0x40
mov qword [rbp - 0x58], rax
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
lea rcx, [rbp - 0x78]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop
test ebx, ebx
js 0x140035025
mov rbx, qword ds:[rbp - 0x80]
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], r12
xor r8d, r8d
mov dword [rsp + 0x30], 0x15
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rbx
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140035025
mov rcx, qword [0x1402130c0]
mov eax, r13d
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003501e
call fcn.140106290
mov qword [0x1402130c0], r12
lea rax, str.EnablePlugins
mov qword [rsp + 0x68], 0x1a
mov qword [rsp + 0x70], rax
xor eax, eax
lock cmpxchg qword [0x140213dc0], r15
je 0x140035055
lea rcx, [0x140213dc0]
nop
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x1402178b0]
lea rcx, ds:[rbp - 0x18]
movups xmm0, xmmword [rsp + 0x68]
mov rax, qword [rsi + 0x10]
movups xmmword [rbp - 0x10], xmm0
call qword [case.0x140101f48.0]
mov ecx, dword ds:[rsi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x1400350d6
nop word [rax + rax]
mov ebx, dword ds:[rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x1400350ce
mov rax, qword [rsi + 8]
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 0x18]
call qword [case.0x140101f48.0]
test al, al
jne 0x140035108
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x1400350a0
mov ebx, dword [rsp + 0x60]
mov rdi, r12
mov rax, r15
lock cmpxchg qword [0x140213dc0], r12
je 0x1400350f7
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rdi, rdi
jne 0x140035117
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rdi, rdi
je 0x1400350d6
cmp dword [rdi], 1
jne 0x1400350d6
mov ebx, dword [rdi + 0x28]
jmp 0x1400350dd
test ebx, ebx
mov qword [rsp + 0x68], 0x16
lea rax, str.MaxSizeUnit
setne byte [0x140212e24]
mov qword [rsp + 0x70], rax
xor eax, eax
lock cmpxchg qword [0x140213dc0], r15
je 0x14003514e
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x1402178b0]
lea rcx, [rbp + 0x18]
movups xmm0, xmmword [rsp + 0x68]
mov rax, qword [rsi + 0x10]
movups xmmword [rbp + 0x20], xmm0
call qword [case.0x140101f48.0]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x1400351c2
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x1400351ba
mov rax, qword [rsi + 8]
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp + 0x18]
call qword [case.0x140101f48.0]
test al, al
jne 0x1400351f7
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140035190
mov ebx, dword [rsp + 0x60]
mov rdi, r12
mov rax, r15
lock cmpxchg qword [0x140213dc0], r12
je 0x1400351e3
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rdi, rdi
jne 0x140035206
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rdi, rdi
je 0x1400351c2
cmp dword [rdi], 1
jne 0x1400351c2
mov ebx, dword [rdi + 0x28]
jmp 0x1400351c9
lea rax, str.SampleCountAutomatic
mov dword [0x140211968], ebx
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rsp + 0x68], 0x28
lock cmpxchg qword [0x140213dc0], r15
je 0x14003523a
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x1402178b0]
lea rcx, [rbp + 0x48]
movups xmm0, xmmword [rsp + 0x68]
mov rax, qword [rsi + 0x10]
movups xmmword [rbp + 0x50], xmm0
call qword [case.0x140101f48.0]
mov ecx, dword ds:[rsi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x1400352b6
nop word [rax + rax]
mov ebx, dword ds:[rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x1400352ae
mov rax, qword [rsi + 8]
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp + 0x48]
call qword [case.0x140101f48.0]
test al, al
jne 0x1400352e8
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140035280
mov ebx, dword [rsp + 0x60]
mov rdi, r12
mov rax, r15
lock cmpxchg qword [0x140213dc0], r12
je 0x1400352d7
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rdi, rdi
jne 0x1400352f7
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rdi, rdi
je 0x1400352b6
cmp dword [rdi], 1
jne 0x1400352b6
mov ebx, dword [rdi + 0x28]
jmp 0x1400352bd
test ebx, ebx
je 0x140035418
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
inc eax
mov qword [rsp + 0x68], 0x16
cdq
sub eax, edx
sar eax, 1
mov r15d, eax
mov eax, 0x800
cmp r15d, eax
cmova r15d, eax
lea rax, str.SampleCount
lock bts qword [0x140213dc0], 0
mov qword [rsp + 0x70], rax
jae 0x14003534d
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x1402178b0]
lea rcx, [rbp + 0x78]
movups xmm0, xmmword [rsp + 0x68]
mov rax, qword [rsi + 0x10]
movups xmmword [rbp + 0x80], xmm0
call qword [case.0x140101f48.0]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x1400353c2
nop dword [rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x1400353ba
mov rax, qword [rsi + 8]
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp + 0x78]
call qword [case.0x140101f48.0]
test al, al
jne 0x140035408
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140035390
mov rdi, r12
lock xadd qword [0x140213dc0], r13
movzx eax, r13b
and al, 6
cmp al, 2
jne 0x1400353f7
lea rax, [r13 - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x140213dc0], rdx
jne 0x1400353f7
lea rcx, [0x140213dc0]
call fcn.140123de0
test rdi, rdi
jne 0x140035418
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rdi, rdi
je 0x1400353c5
cmp dword [rdi], 1
jne 0x1400353c5
mov dword [rdi + 0x28], r15d
jmp 0x1400353c5
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.140161390
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret