Function at 0x1400c8110
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xf20
lea rdi, [rsp + 0x20]
mov ecx, 0x3c0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xf30]
mov rax, qword [0x1405dc580]
xor rax, rsp
mov qword [rsp + 0xf10], rax
mov edx, 0x577
mov rcx, qword [rsp + 0xf30]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov qword [rsp + 0x20], rax
lea rcx, str.SampleCount
call sym.ProcessHacker.exe_PhGetIntegerSetting
xor r9d, r9d
mov r8d, eax
mov edx, 0x500
mov rcx, qword [rsp + 0xf30]
call sym.ProcessHacker.exe_PhSetDialogItemValue
lea rcx, str.SampleCountAutomatic
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c81a1
mov dword [rsp + 0xe30], 1
jmp 0x1400c81ac
mov dword [rsp + 0xe30], 0
movsxd rax, dword [rsp + 0xe30]
mov qword [rsp + 0xe38], rax
mov edx, 0x551
mov rcx, qword [rsp + 0xf30]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov rcx, qword [rsp + 0xe38]
mov r8, rcx
mov edx, 0xf1
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, str.SampleCountAutomatic
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8219
mov edx, 0x500
mov rcx, qword [rsp + 0xf30]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
xor r9d, r9d
lea r8, str.Allow_only_one_instance
xor edx, edx
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Hide_when_closed
mov edx, 1
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Hide_when_minimized
mov edx, 2
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Start_when_I_log_on
mov edx, 3
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Start_hidden
mov edx, 4
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_warnings
mov edx, 5
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_kernel_mode_driver
mov edx, 6
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_mitigation_policy
mov edx, 7
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_plugins
mov edx, 8
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_undecorated_symbols
mov edx, 9
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_column_header_totals__experimental_
mov edx, 0xa
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_cycle_based_CPU_usage
mov edx, 0xb
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_fixed_graph_scaling__experimental_
mov edx, 0xc
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_tray_information_window
mov edx, 0xd
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Remember_last_selected_window
mov edx, 0xe
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_theme_support__experimental_
mov edx, 0xf
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_start_as_admin__experimental_
mov edx, 0x10
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Enable_silent_crash_notification__experimental_
mov edx, 0x11
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Resolve_network_addresses
mov edx, 0x12
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Resolve_DNS_over_HTTPS__DoH_
mov edx, 0x13
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Show_tooltips_instantly
mov edx, 0x14
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Check_images_for_coherency
mov edx, 0x15
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Check_images_for_digital_signatures
mov edx, 0x16
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Check_services_for_digital_signatures
mov edx, 0x17
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Single_click_tray_icons
mov edx, 0x18
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Icon_click_toggles_visibility
mov edx, 0x19
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Include_usage_of_collapsed_processes
mov edx, 0x1a
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
xor r9d, r9d
lea r8, str.Show_advanced_options
mov edx, 0x1b
mov rcx, qword [rsp + 0x20]
call sym.ProcessHacker.exe_PhAddListViewItem
mov dword [rsp + 0x50], 0xf000
lea rcx, str.AllowOnlyOneInstance
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c84f7
mov dword [rsp + 0xe40], 1
jmp 0x1400c8502
mov dword [rsp + 0xe40], 0
cmp dword [rsp + 0xe40], 0
je 0x1400c8519
mov dword [rsp + 0xe44], 2
jmp 0x1400c8524
mov dword [rsp + 0xe44], 1
mov eax, dword [rsp + 0xe44]
shl eax, 0xc
mov dword [rsp + 0x4c], eax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xd0], 0xf000
lea rcx, str.HideOnClose
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8572
mov dword [rsp + 0xe48], 1
jmp 0x1400c857d
mov dword [rsp + 0xe48], 0
cmp dword [rsp + 0xe48], 0
je 0x1400c8594
mov dword [rsp + 0xe4c], 2
jmp 0x1400c859f
mov dword [rsp + 0xe4c], 1
mov eax, dword [rsp + 0xe4c]
shl eax, 0xc
mov dword [rsp + 0xcc], eax
lea r9, [rsp + 0xc0]
mov r8d, 1
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x150], 0xf000
lea rcx, str.HideOnMinimize
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c85f6
mov dword [rsp + 0xe50], 1
jmp 0x1400c8601
mov dword [rsp + 0xe50], 0
cmp dword [rsp + 0xe50], 0
je 0x1400c8618
mov dword [rsp + 0xe54], 2
jmp 0x1400c8623
mov dword [rsp + 0xe54], 1
mov eax, dword [rsp + 0xe54]
shl eax, 0xc
mov dword [rsp + 0x14c], eax
lea r9, [rsp + 0x140]
mov r8d, 2
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x1d0], 0xf000
lea rcx, str.StartHidden
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c867a
mov dword [rsp + 0xe58], 1
jmp 0x1400c8685
mov dword [rsp + 0xe58], 0
cmp dword [rsp + 0xe58], 0
je 0x1400c869c
mov dword [rsp + 0xe5c], 2
jmp 0x1400c86a7
mov dword [rsp + 0xe5c], 1
mov eax, dword [rsp + 0xe5c]
shl eax, 0xc
mov dword [rsp + 0x1cc], eax
lea r9, [rsp + 0x1c0]
mov r8d, 4
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x250], 0xf000
lea rcx, str.MiniInfoWindowEnabled
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c86fe
mov dword [rsp + 0xe60], 1
jmp 0x1400c8709
mov dword [rsp + 0xe60], 0
cmp dword [rsp + 0xe60], 0
je 0x1400c8720
mov dword [rsp + 0xe64], 2
jmp 0x1400c872b
mov dword [rsp + 0xe64], 1
mov eax, dword [rsp + 0xe64]
shl eax, 0xc
mov dword [rsp + 0x24c], eax
lea r9, [rsp + 0x240]
mov r8d, 0xd
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x2d0], 0xf000
lea rcx, str.MainWindowTabRestoreEnabled
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8782
mov dword [rsp + 0xe68], 1
jmp 0x1400c878d
mov dword [rsp + 0xe68], 0
cmp dword [rsp + 0xe68], 0
je 0x1400c87a4
mov dword [rsp + 0xe6c], 2
jmp 0x1400c87af
mov dword [rsp + 0xe6c], 1
mov eax, dword [rsp + 0xe6c]
shl eax, 0xc
mov dword [rsp + 0x2cc], eax
lea r9, [rsp + 0x2c0]
mov r8d, 0xe
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x350], 0xf000
lea rcx, str.EnableKph
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8806
mov dword [rsp + 0xe70], 1
jmp 0x1400c8811
mov dword [rsp + 0xe70], 0
cmp dword [rsp + 0xe70], 0
je 0x1400c8828
mov dword [rsp + 0xe74], 2
jmp 0x1400c8833
mov dword [rsp + 0xe74], 1
mov eax, dword [rsp + 0xe74]
shl eax, 0xc
mov dword [rsp + 0x34c], eax
lea r9, [rsp + 0x340]
mov r8d, 6
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x3d0], 0xf000
lea rcx, str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c888a
mov dword [rsp + 0xe78], 1
jmp 0x1400c8895
mov dword [rsp + 0xe78], 0
cmp dword [rsp + 0xe78], 0
je 0x1400c88ac
mov dword [rsp + 0xe7c], 2
jmp 0x1400c88b7
mov dword [rsp + 0xe7c], 1
mov eax, dword [rsp + 0xe7c]
shl eax, 0xc
mov dword [rsp + 0x3cc], eax
lea r9, [rsp + 0x3c0]
mov r8d, 5
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x450], 0xf000
lea rcx, str.EnablePlugins
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c890e
mov dword [rsp + 0xe80], 1
jmp 0x1400c8919
mov dword [rsp + 0xe80], 0
cmp dword [rsp + 0xe80], 0
je 0x1400c8930
mov dword [rsp + 0xe84], 2
jmp 0x1400c893b
mov dword [rsp + 0xe84], 1
mov eax, dword [rsp + 0xe84]
shl eax, 0xc
mov dword [rsp + 0x44c], eax
lea r9, [rsp + 0x440]
mov r8d, 8
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x4d0], 0xf000
lea rcx, str.DbgHelpUndecorate
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8992
mov dword [rsp + 0xe88], 1
jmp 0x1400c899d
mov dword [rsp + 0xe88], 0
cmp dword [rsp + 0xe88], 0
je 0x1400c89b4
mov dword [rsp + 0xe8c], 2
jmp 0x1400c89bf
mov dword [rsp + 0xe8c], 1
mov eax, dword [rsp + 0xe8c]
shl eax, 0xc
mov dword [rsp + 0x4cc], eax
lea r9, [rsp + 0x4c0]
mov r8d, 9
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x550], 0xf000
lea rcx, str.TreeListEnableHeaderTotals
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8a16
mov dword [rsp + 0xe90], 1
jmp 0x1400c8a21
mov dword [rsp + 0xe90], 0
cmp dword [rsp + 0xe90], 0
je 0x1400c8a38
mov dword [rsp + 0xe94], 2
jmp 0x1400c8a43
mov dword [rsp + 0xe94], 1
mov eax, dword [rsp + 0xe94]
shl eax, 0xc
mov dword [rsp + 0x54c], eax
lea r9, [rsp + 0x540]
mov r8d, 0xa
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x5d0], 0xf000
lea rcx, str.EnableScaleCpuGraph
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8a9a
mov dword [rsp + 0xe98], 1
jmp 0x1400c8aa5
mov dword [rsp + 0xe98], 0
cmp dword [rsp + 0xe98], 0
je 0x1400c8abc
mov dword [rsp + 0xe9c], 2
jmp 0x1400c8ac7
mov dword [rsp + 0xe9c], 1
mov eax, dword [rsp + 0xe9c]
shl eax, 0xc
mov dword [rsp + 0x5cc], eax
lea r9, [rsp + 0x5c0]
mov r8d, 0xc
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x650], 0xf000
lea rcx, str.EnableCycleCpuUsage
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8b1e
mov dword [rsp + 0xea0], 1
jmp 0x1400c8b29
mov dword [rsp + 0xea0], 0
cmp dword [rsp + 0xea0], 0
je 0x1400c8b40
mov dword [rsp + 0xea4], 2
jmp 0x1400c8b4b
mov dword [rsp + 0xea4], 1
mov eax, dword [rsp + 0xea4]
shl eax, 0xc
mov dword [rsp + 0x64c], eax
lea r9, [rsp + 0x640]
mov r8d, 0xb
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x6d0], 0xf000
lea rcx, str.EnableThemeSupport
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8ba2
mov dword [rsp + 0xea8], 1
jmp 0x1400c8bad
mov dword [rsp + 0xea8], 0
cmp dword [rsp + 0xea8], 0
je 0x1400c8bc4
mov dword [rsp + 0xeac], 2
jmp 0x1400c8bcf
mov dword [rsp + 0xeac], 1
mov eax, dword [rsp + 0xeac]
shl eax, 0xc
mov dword [rsp + 0x6cc], eax
lea r9, [rsp + 0x6c0]
mov r8d, 0xf
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x750], 0xf000
lea rcx, str.EnableStartAsAdmin
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8c26
mov dword [rsp + 0xeb0], 1
jmp 0x1400c8c31
mov dword [rsp + 0xeb0], 0
cmp dword [rsp + 0xeb0], 0
je 0x1400c8c48
mov dword [rsp + 0xeb4], 2
jmp 0x1400c8c53
mov dword [rsp + 0xeb4], 1
mov eax, dword [rsp + 0xeb4]
shl eax, 0xc
mov dword [rsp + 0x74c], eax
lea r9, [rsp + 0x740]
mov r8d, 0x10
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x7d0], 0xf000
lea rcx, str.EnableSilentCrashNotify
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8caa
mov dword [rsp + 0xeb8], 1
jmp 0x1400c8cb5
mov dword [rsp + 0xeb8], 0
cmp dword [rsp + 0xeb8], 0
je 0x1400c8ccc
mov dword [rsp + 0xebc], 2
jmp 0x1400c8cd7
mov dword [rsp + 0xebc], 1
mov eax, dword [rsp + 0xebc]
shl eax, 0xc
mov dword [rsp + 0x7cc], eax
lea r9, [rsp + 0x7c0]
mov r8d, 0x11
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x850], 0xf000
lea rcx, str.EnableNetworkResolve
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8d2e
mov dword [rsp + 0xec0], 1
jmp 0x1400c8d39
mov dword [rsp + 0xec0], 0
cmp dword [rsp + 0xec0], 0
je 0x1400c8d50
mov dword [rsp + 0xec4], 2
jmp 0x1400c8d5b
mov dword [rsp + 0xec4], 1
mov eax, dword [rsp + 0xec4]
shl eax, 0xc
mov dword [rsp + 0x84c], eax
lea r9, [rsp + 0x840]
mov r8d, 0x12
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x8d0], 0xf000
lea rcx, str.EnableNetworkResolveDoH
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8db2
mov dword [rsp + 0xec8], 1
jmp 0x1400c8dbd
mov dword [rsp + 0xec8], 0
cmp dword [rsp + 0xec8], 0
je 0x1400c8dd4
mov dword [rsp + 0xecc], 2
jmp 0x1400c8ddf
mov dword [rsp + 0xecc], 1
mov eax, dword [rsp + 0xecc]
shl eax, 0xc
mov dword [rsp + 0x8cc], eax
lea r9, [rsp + 0x8c0]
mov r8d, 0x13
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x950], 0xf000
lea rcx, str.EnableInstantTooltips
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8e36
mov dword [rsp + 0xed0], 1
jmp 0x1400c8e41
mov dword [rsp + 0xed0], 0
cmp dword [rsp + 0xed0], 0
je 0x1400c8e58
mov dword [rsp + 0xed4], 2
jmp 0x1400c8e63
mov dword [rsp + 0xed4], 1
mov eax, dword [rsp + 0xed4]
shl eax, 0xc
mov dword [rsp + 0x94c], eax
lea r9, [rsp + 0x940]
mov r8d, 0x14
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x9d0], 0xf000
lea rcx, str.EnableImageCoherencySupport
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8eba
mov dword [rsp + 0xed8], 1
jmp 0x1400c8ec5
mov dword [rsp + 0xed8], 0
cmp dword [rsp + 0xed8], 0
je 0x1400c8edc
mov dword [rsp + 0xedc], 2
jmp 0x1400c8ee7
mov dword [rsp + 0xedc], 1
mov eax, dword [rsp + 0xedc]
shl eax, 0xc
mov dword [rsp + 0x9cc], eax
lea r9, [rsp + 0x9c0]
mov r8d, 0x15
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xa50], 0xf000
lea rcx, str.EnableStage2
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8f3e
mov dword [rsp + 0xee0], 1
jmp 0x1400c8f49
mov dword [rsp + 0xee0], 0
cmp dword [rsp + 0xee0], 0
je 0x1400c8f60
mov dword [rsp + 0xee4], 2
jmp 0x1400c8f6b
mov dword [rsp + 0xee4], 1
mov eax, dword [rsp + 0xee4]
shl eax, 0xc
mov dword [rsp + 0xa4c], eax
lea r9, [rsp + 0xa40]
mov r8d, 0x16
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xad0], 0xf000
lea rcx, str.EnableServiceStage2
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c8fc2
mov dword [rsp + 0xee8], 1
jmp 0x1400c8fcd
mov dword [rsp + 0xee8], 0
cmp dword [rsp + 0xee8], 0
je 0x1400c8fe4
mov dword [rsp + 0xeec], 2
jmp 0x1400c8fef
mov dword [rsp + 0xeec], 1
mov eax, dword [rsp + 0xeec]
shl eax, 0xc
mov dword [rsp + 0xacc], eax
lea r9, [rsp + 0xac0]
mov r8d, 0x17
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xb50], 0xf000
lea rcx, str.IconSingleClick
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c9046
mov dword [rsp + 0xef0], 1
jmp 0x1400c9051
mov dword [rsp + 0xef0], 0
cmp dword [rsp + 0xef0], 0
je 0x1400c9068
mov dword [rsp + 0xef4], 2
jmp 0x1400c9073
mov dword [rsp + 0xef4], 1
mov eax, dword [rsp + 0xef4]
shl eax, 0xc
mov dword [rsp + 0xb4c], eax
lea r9, [rsp + 0xb40]
mov r8d, 0x18
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xbd0], 0xf000
lea rcx, str.IconTogglesVisibility
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c90ca
mov dword [rsp + 0xef8], 1
jmp 0x1400c90d5
mov dword [rsp + 0xef8], 0
cmp dword [rsp + 0xef8], 0
je 0x1400c90ec
mov dword [rsp + 0xefc], 2
jmp 0x1400c90f7
mov dword [rsp + 0xefc], 1
mov eax, dword [rsp + 0xefc]
shl eax, 0xc
mov dword [rsp + 0xbcc], eax
lea r9, [rsp + 0xbc0]
mov r8d, 0x19
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xc50], 0xf000
lea rcx, str.PropagateCpuUsage
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c914e
mov dword [rsp + 0xf00], 1
jmp 0x1400c9159
mov dword [rsp + 0xf00], 0
cmp dword [rsp + 0xf00], 0
je 0x1400c9170
mov dword [rsp + 0xf04], 2
jmp 0x1400c917b
mov dword [rsp + 0xf04], 1
mov eax, dword [rsp + 0xf04]
shl eax, 0xc
mov dword [rsp + 0xc4c], eax
lea r9, [rsp + 0xc40]
mov r8d, 0x1a
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0xcd0], 0xf000
lea rcx, str.EnableAdvancedOptions
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c91d2
mov dword [rsp + 0xf08], 1
jmp 0x1400c91dd
mov dword [rsp + 0xf08], 0
cmp dword [rsp + 0xf08], 0
je 0x1400c91f4
mov dword [rsp + 0xf0c], 2
jmp 0x1400c91ff
mov dword [rsp + 0xf0c], 1
mov eax, dword [rsp + 0xf0c]
shl eax, 0xc
mov dword [rsp + 0xccc], eax
lea r9, [rsp + 0xcc0]
mov r8d, 0x1b
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x1405e0879]
test eax, eax
je 0x1400c926d
mov dword [rsp + 0xd50], 0xf000
mov dword [rsp + 0xd4c], 0x2000
lea r9, [rsp + 0xd40]
mov r8d, 3
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.14000eeb0
movzx eax, al
test eax, eax
je 0x1400c92ad
mov dword [rsp + 0xdd0], 0xf000
mov dword [rsp + 0xdcc], 0x2000
lea r9, [rsp + 0xdc0]
mov r8d, 7
mov edx, 0x102b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, str.EnableAdvancedOptions
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400c92c4
xor ecx, ecx
call fcn.1400c6ef0
mov rcx, rsp
lea rdx, [0x1404af4e0]
call fcn.140015750
mov rcx, qword [rsp + 0xf10]
xor rcx, rsp
call fcn.14000d430
add rsp, 0xf20
pop rdi
ret