Function at 0x1400d6d00
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rbp + 0x130], rax
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x140246410]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x522
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400d6d98
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x140246418]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x523
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d6e06
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x140246414]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x524
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400d6e78
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x14024195c]
xor r8d, r8d
sub ecx, dword [0x14024640c]
movzx eax, byte [0x14023f728]
shl rcx, 0xc
mov qword [rbp - 0x80], rcx
lea edx, [r8 + 1]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x10c
mov byte [rsp + 0x7a], al
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x525
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d6ee6
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x14024195c]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x526
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400d6f58
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244700]
nop
test rcx, rcx
je 0x1400d6fb5
movzx eax, byte [0x14023f728]
xor r8d, r8d
mov qword [rbp - 0x80], rcx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x10c
mov byte [rsp + 0x7a], al
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x533
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d6fe6
mov r9, rbx
jmp 0x1400d6fd3
mov rcx, qword [0x140244620]
mov edx, 0x533
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d6fe6
lea r9, [0x1401edaf0]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x140246484]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x527
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400d7058
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x14024646c]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x528
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d70c6
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x14024648c]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x529
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400d7138
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x140246488]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x52a
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d71a6
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x140246450]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x52b
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400d7218
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140244770], 1
nop
jbe 0x1400d7270
mov eax, dword [0x140244634]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], 0x10009
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x52d
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d72a6
mov r9, rbx
jmp 0x1400d7292
mov rcx, qword [0x140244620]
mov edx, 0x52d
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d72a6
lea r9, [0x1401edaf0]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140244770], 1
jbe 0x1400d72fb
mov eax, dword [0x14024473c]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], 0x10009
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x52e
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7329
mov r9, rbx
jmp 0x1400d7319
mov rcx, qword [0x140244620]
mov edx, 0x52e
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7329
lea r9, [0x1401edaf0]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x140246454]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x52f
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400d7398
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140244770], 1
nop
jbe 0x1400d73f0
mov eax, dword [0x140244634]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], 0x10009
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x531
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7426
mov r9, rbx
jmp 0x1400d7412
mov rcx, qword [0x140244620]
mov edx, 0x531
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7426
lea r9, [0x1401edaf0]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140244770], 1
jbe 0x1400d7478
mov eax, dword [0x140244654]
lea rcx, [rbp - 0x68]
xor r8d, r8d
mov dword [rbp - 0x68], 0x10009
mov qword [rbp - 0x58], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x532
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d74a6
mov r9, rbx
jmp 0x1400d7496
mov rcx, qword [0x140244620]
mov edx, 0x532
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d74a6
lea r9, [0x1401edaf0]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x140244610], 0
mov qword [rsp + 0x258], rdi
je 0x1400d76eb
mov rdx, qword [0x140244720]
mov rax, qword [0x140244730]
test rdx, rdx
jne 0x1400d74d7
test rax, rax
je 0x1400d76eb
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x250], rsi
xor ebx, ebx
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], rcx
mov rdi, rcx
lea rsi, [0x14011fba0]
test rdx, rdx
je 0x1400d75b1
cmp dword [0x140237d34], 0x3e
jae 0x1400d75b1
mov dword [rsp + 0x48], ebx
lea rax, [rbp + 0x120]
mov qword [rbp - 0x38], rax
lea r8, [0x14011f940]
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x48]
mov qword [rbp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x38], 4
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x18]
mov qword [rbp - 0x48], rcx
mov rcx, qword [0x140241b70]
mov qword [rbp - 0x40], rdx
xor edx, edx
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x30], 8
mov qword [rbp - 0x28], rbx
mov dword [rbp - 0x20], ebx
mov dword [rbp - 0x70], 2
mov qword [rbp + 0x28], rsi
mov dword [rbp + 0x38], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov rax, qword [0x140244730]
mov rcx, qword [rbp + 0x120]
mov rdi, qword [rbp + 0x128]
test rax, rax
je 0x1400d7654
mov rcx, qword [0x140241b70]
lea r8, [0x14011f940]
mov qword [rbp - 0x10], rax
xor r9d, r9d
mov dword [rsp + 0x48], ebx
lea rax, [rbp + 0x128]
mov qword [rbp - 8], rax
xor edx, edx
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x18]
mov qword [rbp + 0x58], rax
lea rax, [rbp - 0x6c]
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x18], 0xffffffffffffffff
mov qword [rbp], 8
mov qword [rbp + 8], rbx
mov dword [rbp + 0x10], ebx
mov dword [rbp - 0x6c], 2
mov qword [rbp + 0x50], rsi
mov dword [rbp + 0x60], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
nop
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov rcx, qword [rbp + 0x120]
mov rdi, qword [rbp + 0x128]
mov rsi, qword ss:[rsp + 0x250]
cmp rcx, 0xffffffffffffffff
je 0x1400d769c
movzx eax, byte [0x14023f728]
xor r8d, r8d
mov qword [rbp - 0x80], rcx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x10c
mov byte [rsp + 0x7a], al
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rbx, qword [rax + 8]
jmp 0x1400d76a3
lea rbx, [0x1401dd9b0]
cmp rdi, 0xffffffffffffffff
je 0x1400d76e2
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], 0x10c
mov byte [rsp + 0x5a], al
mov qword [rsp + 0x60], rdi
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rdi, qword ds:[rax + 8]
jmp 0x1400d7706
lea rdi, [0x1401dd9b0]
jmp 0x1400d7706
cmp qword [0x140241b70], 0
lea rbx, str.no_driver
je 0x1400d7703
lea rbx, str.no_symbols
mov rdi, rbx
mov rcx, qword [0x140244620]
mov edx, 0x52c
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7730
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x530
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d775e
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140244770], 1
jbe 0x1400d77b0
mov eax, dword [0x14024472c]
lea rcx, [rbp - 0x68]
xor r8d, r8d
mov dword [rbp - 0x68], 0x10009
mov qword [rbp - 0x58], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x558
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d77e6
mov r9, rbx
jmp 0x1400d77d2
mov rcx, qword [0x140244620]
mov edx, 0x558
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d77e6
lea r9, [0x1401edaf0]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140244770], 1
jbe 0x1400d7838
mov eax, dword [0x14024462c]
lea rcx, [rbp - 0x68]
xor r8d, r8d
mov dword [rbp - 0x68], 0x10009
mov qword [rbp - 0x58], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x559
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7866
mov r9, rbx
jmp 0x1400d7856
mov rcx, qword [0x140244620]
mov edx, 0x559
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7866
lea r9, [0x1401edaf0]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140244770], 1
jbe 0x1400d78b8
mov eax, dword [0x1402445fc]
lea rcx, [rbp - 0x68]
xor r8d, r8d
mov dword [rbp - 0x68], 0x10009
mov qword [rbp - 0x58], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x55a
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d78e6
mov r9, rbx
jmp 0x1400d78d6
mov rcx, qword [0x140244620]
mov edx, 0x55a
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d78e6
lea r9, [0x1401edaf0]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140244770], 1
jbe 0x1400d7938
mov eax, dword [0x14024463c]
lea rcx, [rbp - 0x68]
xor r8d, r8d
mov dword [rbp - 0x68], 0x10009
mov qword [rbp - 0x58], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x55b
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7966
mov r9, rbx
jmp 0x1400d7956
mov rcx, qword [0x140244620]
mov edx, 0x55b
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7966
lea r9, [0x1401edaf0]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140244770], 1
jbe 0x1400d79ca
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov byte [rsp + 0x5a], al
mov rax, qword [0x140244790]
mov dword [rsp + 0x50], 0x10c
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x55c
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax]
test rax, rax
je 0x1400d79fc
mov r9, rbx
jmp 0x1400d79ec
mov rcx, qword [0x140244620]
mov edx, 0x55c
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax]
test rax, rax
je 0x1400d79fc
lea r9, [0x1401edaf0]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140244770], 1
jbe 0x1400d7a5d
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov byte [rsp + 0x5a], al
mov rax, qword [0x140244608]
mov dword [rsp + 0x50], 0x10c
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x55e
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7a8b
mov r9, rbx
jmp 0x1400d7a7b
mov rcx, qword [0x140244620]
mov edx, 0x55e
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7a8b
lea r9, [0x1401edaf0]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea rdx, [rbp + 0x70]
mov r8d, 0xb0
lea ecx, [r9 + 0x50]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1400d80ef
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov rbx, qword [rbp + 0xd0]
xor r8d, r8d
add rbx, qword [rbp + 0xc8]
add rbx, qword [rbp + 0xc0]
add rbx, qword [rbp + 0xb8]
add rbx, qword [rbp + 0xb0]
lea edx, [r8 + 1]
add rbx, qword [rbp + 0xa8]
add rbx, qword [rbp + 0xa0]
add rbx, qword [rbp + 0x98]
mov byte [rsp + 0x5a], al
mov rax, qword [rbp + 0x70]
shl rax, 0xc
mov dword [rsp + 0x50], 0x10c
mov qword [rsp + 0x60], rax
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x534
mov rdi, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7b4d
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x78]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x535
mov rdi, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax]
test rax, rax
je 0x1400d7bb8
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x80]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x536
mov rdi, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7c26
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x88]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x537
mov rdi, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400d7c98
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
xor r8d, r8d
shl rbx, 0xc
mov dword [rsp + 0x50], 0x10c
mov byte [rsp + 0x5a], al
mov qword [rsp + 0x60], rbx
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x539
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7cfe
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x98]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x542
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7d68
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xa0]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x543
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400d7dd8
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xa8]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x544
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7e46
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xb0]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x545
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400d7eb8
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xb8]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x554
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d7f26
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xc0]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x555
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400d7f98
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xc8]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x556
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d8006
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xd0]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x557
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400d8078
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140237d34], 0x3e
nop
jb 0x1400d80e5
movzx eax, byte [0x14023f728]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x118]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140244620]
mov edx, 0x55d
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d8394
mov r9, rbx
jmp 0x1400d8384
mov edx, 0x55d
jmp 0x1400d836b
mov rcx, qword [0x140244620]
mov edx, 0x534
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d8126
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x535
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d8154
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x536
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d8186
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x537
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d81b4
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x55d
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d81e6
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x539
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d8214
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x542
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d8246
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x543
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d8274
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x544
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d82a6
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x545
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d82d4
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x554
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d8306
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x555
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d8334
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140244620]
mov edx, 0x556
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d8366
xor r8d, r8d
lea r9, [0x1401dd9b0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x557
mov rcx, qword [0x140244620]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400d8394
lea r9, [0x1401dd9b0]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rsp + 0x258]
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.1401848a0
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rbp
ret