Function at 0x14003d480
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov r8, rcx
mov esi, r9d
call fcn.140107100
test eax, eax
js 0x14003d513
nop dword [rax]
call sym.ProcessHacker.exe_PhGetApplicationDirectory
test rax, rax
je 0x14003d513
movzx ecx, word [rax]
lea rbx, [rax - 0x10]
mov word [rbp + 0x170], cx
movzx ecx, word [rax]
add cx, 2
mov word [rbp + 0x172], cx
mov rcx, qword [rax + 8]
mov qword [rbp + 0x178], rcx
cmp qword [rax], 0xfffe
jbe 0x14003d53f
mov rdi, 0xffffffffffffffff
lock xadd dword [rbx + 8], edi
cmp edi, 1
jne 0x14003d513
mov rcx, rbx
call fcn.1400fbcc0
mov eax, 1
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1401848a0
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea rcx, [rbp + 0x170]
call qword [sym.imp.ntdll.dll_RtlSetCurrentDirectory_U]
mov rdi, 0xffffffffffffffff
test eax, eax
js 0x14003d501
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14003d56d
mov rcx, rbx
call fcn.1400fbcc0
xor r14d, r14d
lea r8, [rbp + 0x148]
mov rcx, rdi
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 4]
lea edx, [r14 + 0xc]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14003d5c6
mov eax, dword ds:[rbp + 0x148]
lea r9d, [r14 + 4]
and eax, 0xffff7ffc
lea r8, [rbp + 0x150]
lea edx, [r14 + 0xc]
mov dword [rbp + 0x148], eax
mov rcx, rdi
mov dword [rbp + 0x150], eax
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
lea rcx, [0x14003ee80]
call qword [sym.imp.ntdll.dll_RtlSetUnhandledExceptionFilter]
mov dword [rbp + 0x1c0], 1
lea rax, str.PhMutant_
mov qword [rbp + 0x1d8], rax
lea r8, [rbp + 0x270]
mov qword [rbp + 0x1d0], 0x12
mov r9d, 0x66
mov dword [rbp + 0x1e0], 8
mov rax, qword gs:[0x30]
lea edx, [r9 - 0x64]
mov ecx, dword [rax + 0x40]
lea rax, [rbp + 0x168]
mov dword [rbp + 0x1f0], ecx
lea rcx, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhFormatToBuffer
nop dword [rax + rax]
test al, al
je 0x14003d513
mov rcx, qword [rbp + 0x168]
add rcx, 0xfffffffffffffffe
mov word [rbp + 0x180], cx
lea eax, [rcx + 2]
mov word [rbp + 0x182], ax
lea rax, [rbp + 0x270]
mov qword [rbp + 0x188], rax
cmp rcx, 0xfffe
ja 0x14003d513
mov dword [rbp + 0x110], 0x30
call fcn.1400f8f00
mov qword [rbp + 0x118], rax
lea r8, [rbp + 0x110]
lea rax, [rbp + 0x180]
mov dword [rbp + 0x128], 0x40
xorps xmm0, xmm0
mov qword [rbp + 0x120], rax
mov r9b, 1
lea rcx, [rbp + 0x108]
mov edx, 1
movdqu xmmword [rbp + 0x130], xmm0
call qword [sym.imp.ntdll.dll_NtCreateMutant]
call fcn.14003f0e0
nop dword [rax]
test al, al
je 0x14003d513
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.1400409c0
lea r8, [rbp + 0x100]
mov edx, 0x20
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, 0xc0000022
jne 0x14003d7c8
cmp byte [0x140240e3f], r14b
je 0x14003d893
mov rcx, qword [0x140241b70]
lea rax, [rbp + 0x100]
mov qword [rbp + 0x60], rax
lea r8, [0x14011f940]
mov dword [rsp + 0x48], r14d
lea rax, [0x14011fb00]
mov qword [rbp + 0xd0], rax
xor r9d, r9d
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x50]
mov qword [rbp + 0xd8], rax
xor edx, edx
mov dword [rsp + 0x38], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xc0]
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x50], rdi
mov dword [rbp + 0x58], 0x20
mov dword [rbp + 0x68], r14d
mov dword [rsp + 0x50], 2
mov dword [rbp + 0xe0], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov eax, dword [rbp + 0xe0]
test ebx, ebx
cmovs eax, ebx
test eax, eax
js 0x14003d893
mov dword [rbp + 0x200], 9
mov edx, r14d
nop dword [rax]
mov eax, edx
inc edx
lea rcx, [rax + rax*2]
mov dword [rbp + rcx*4 + 0x20c], 2
mov dword [rbp + rcx*4 + 0x208], r14d
cmp edx, dword [rbp + 0x200]
jb 0x14003d7e0
mov rcx, qword ds:[rbp + 0x100]
lea r8, [rbp + 0x200]
mov qword [rsp + 0x28], r14
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r14
mov dword [rbp + 0x204], 0x14
mov dword [rbp + 0x210], 0xe
mov dword [rbp + 0x21c], 0x21
mov dword [rbp + 0x228], 0xa
mov dword [rbp + 0x234], 0xd
mov dword [rbp + 0x240], 0x11
mov dword [rbp + 0x24c], 0x12
mov dword [rbp + 0x258], 0x13
mov dword [rbp + 0x264], 9
call qword [sym.imp.ntdll.dll_NtAdjustPrivilegesToken]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [0x140246930]
test rcx, rcx
je 0x14003d8ae
nop
call fcn.1400bb5c0
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
mov r9d, 0x200
lea r8, [0x140124b00]
lea rdx, [0x140124a40]
mov ecx, 0x30
call sym.ProcessHacker.exe_PhCreateHashtable
mov rdx, qword [0x1402418f0]
mov ecx, 0x10
mov qword [0x140245818], rax
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, qword [0x140241998]
mov edx, 4
mov rbx, rax
mov dword [rax], r14d
lea r8d, [rdx + 0x1c]
mov dword [rax + 4], 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 8], rax
mov qword [0x140245810], rbx
call fcn.1400c0160
call sym.ProcessHacker.exe_PhUpdateCachedSettings
nop dword [rax]
call fcn.14003ff40
lea rcx, str.AllowOnlyOneInstance
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14003d959
test dword [0x140246920], 0x580
nop
jne 0x14003d959
call fcn.1400f8f00
mov rcx, rax
lea rdx, [0x14003e5a0]
xor r8d, r8d
call sym.ProcessHacker.exe_PhEnumDirectoryObjects
lea rcx, str.EnableStartAsAdmin
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14003d9ae
test dword [0x140246920], 0x580
jne 0x14003d9ae
lea rcx, ds:[rbp + 0xe8]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
test byte [rax + 8], 1
jne 0x14003d9ae
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
call fcn.140017380
test eax, eax
js 0x14003d9ae
nop
call fcn.14003ebe0
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
lea rcx, str.EnableKph
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x14003d9cc
test byte [0x140246920], 8
jne 0x14003d9cc
call fcn.14003f840
mov ecx, dword [0x140244804]
mov dword [0x140241da0], r14d
mov qword [0x140241fa8], r14
mov qword [0x140241fb0], r14
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x140244804]
lea rdx, [0x140241da0]
mov qword [0x140241fb8], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14003e027
lea rcx, [rbp + 0x158]
mov dword [rbp + 0x158], 8
mov dword [rbp + 0x15c], 0xc42f
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.140107760
xor eax, eax
mov dword [rsp + 0x60], 0x50
xorps xmm0, xmm0
mov qword [rbp - 0x5c], rax
movups xmmword [rsp + 0x64], xmm0
mov dword [rbp - 0x54], eax
lea rax, [0x14015c9a0]
movups xmmword [rsp + 0x74], xmm0
mov qword [rsp + 0x68], rax
mov edx, 0x7f00
mov rax, qword [0x140241948]
xor ecx, ecx
movups xmmword [rbp - 0x7c], xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rbp - 0x6c], xmm0
mov dword [rsp + 0x64], 0x4008
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x74], 8
mov qword [rbp - 0x80], r14
call qword [sym.imp.USER32.dll_LoadCursorW]
xorps xmm0, xmm0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x78], rax
lea rcx, [rsp + 0x60]
lea rax, [0x1401e0260]
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
nop
test ax, ax
je 0x14003daf0
lea rcx, str.comctl32.dll
call fcn.1400f9d00
mov qword [0x140245750], rax
mov eax, dword [0x140237d48]
mov dword [0x140245758], eax
mov eax, dword [0x140237d4c]
mov dword [0x14024575c], eax
xor eax, eax
mov dword [rbp - 0x50], 0x50
xorps xmm0, xmm0
mov qword [rbp - 0xc], rax
movups xmmword [rbp - 0x4c], xmm0
mov dword [rbp - 4], eax
lea rax, [0x14015bbe0]
movups xmmword [rbp - 0x3c], xmm0
mov qword [rbp - 0x48], rax
mov edx, 0x7f00
mov rax, qword [0x140241948]
xor ecx, ecx
movups xmmword [rbp - 0x2c], xmm0
mov qword [rbp - 0x38], rax
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0x4c], 0x4008
mov dword [rbp - 0x40], r14d
mov dword [rbp - 0x3c], 8
mov qword [rbp - 0x30], r14
call qword [sym.imp.USER32.dll_LoadCursorW]
xorps xmm0, xmm0
mov qword [rbp - 8], r14
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x50]
lea rax, str.PhGraph
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
lea rax, str.PhHexEdit
mov dword [rbp + 0x80], r14d
mov qword [rbp + 0xb0], rax
xorps xmm0, xmm0
mov rax, qword [0x140241948]
mov edx, 0x7f00
mov qword [rbp + 0x88], rax
xor ecx, ecx
lea rax, [0x140157580]
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x78], rax
movdqa xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb8], r14
mov dword [rbp + 0x70], 0x50
mov dword [rbp + 0x74], 0x4000
mov dword [rbp + 0x84], 8
call qword [sym.imp.USER32.dll_LoadCursorW]
lea rcx, [rbp + 0x70]
mov qword [rbp + 0x98], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
xor eax, eax
mov dword [rbp], 0x50
xorps xmm0, xmm0
mov qword [rbp + 0x44], rax
movups xmmword [rbp + 4], xmm0
mov dword [rbp + 0x4c], eax
lea rax, [0x140157180]
movups xmmword [rbp + 0x14], xmm0
mov qword [rbp + 8], rax
mov edx, 0x7f00
mov rax, qword [0x140241948]
xor ecx, ecx
movups xmmword [rbp + 0x24], xmm0
mov qword [rbp + 0x18], rax
movups xmmword [rbp + 0x34], xmm0
mov dword [rbp + 4], 0x4000
mov dword [rbp + 0x10], r14d
mov dword [rbp + 0x14], 8
mov qword [rbp + 0x20], r14
call qword [sym.imp.USER32.dll_LoadCursorW]
xorps xmm0, xmm0
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x28], rax
lea rcx, [rbp]
lea rax, [0x1401f5690]
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
call fcn.14008a6e0
test al, al
je 0x14003dd1d
mov rdx, qword [0x140241890]
mov ecx, 0x40
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, 1
mov word [rax], r14w
lock xadd dword [0x14024185c], ecx
movzx edx, cl
lea r8, [0x1400c9da0]
lea rcx, [0x1400c9cc0]
mov byte [rax + 2], dl
mov qword [rax + 8], rcx
mov r9d, 0x28
lea rcx, str.ServiceItem
mov dword [rax + 4], r14d
mov qword [rax + 0x10], rcx
lea rcx, [0x140245840]
mov qword [rcx + rdx*8], rax
lea rdx, [0x1400c9d90]
lea ecx, [r9 - 0x20]
mov qword [0x140241860], rax
call sym.ProcessHacker.exe_PhCreateHashtable
lea rcx, [0x1402439a0]
mov qword [0x140241868], rax
nop dword [rax + rax]
call qword [sym.imp.ntdll.dll_RtlInitializeSListHead]
call fcn.140069580
test al, al
je 0x14003dd1d
lea rax, [sym.ProcessHacker.exe_PhGetClientIdName]
xchg qword [0x14023e8b8], rax
nop dword [rax]
call fcn.1400824a0
test byte [0x140246920], 0x80
lea rax, [0x140240bb0]
mov qword [0x140240bb8], rax
lea r10, [0x140240b90]
mov qword [0x140240bb0], rax
lea rax, [0x140240bd0]
mov qword [0x140240bd8], rax
mov qword [0x140240bd0], rax
lea rax, [0x140240bf0]
mov qword [0x140240bf8], rax
mov qword [0x140240bf0], rax
lea rax, [0x140240c10]
mov qword [0x140240c18], rax
mov qword [0x140240c10], rax
lea rax, [0x140240c30]
mov qword [0x140240c38], rax
mov qword [0x140240c30], rax
lea rax, [0x140240c50]
mov qword [0x140240c58], rax
mov qword [0x140240c50], rax
lea rax, [0x140240c70]
mov qword [0x140240c78], rax
mov qword [0x140240c70], rax
lea rax, [0x140240c90]
mov qword [0x140240c98], rax
mov qword [0x140240c90], rax
lea rax, [0x140240cb0]
mov qword [0x140240cb8], rax
mov qword [0x140240cb0], rax
lea rax, [0x140240cd0]
mov qword [0x140240cd8], rax
mov qword [0x140240cd0], rax
lea rax, [0x140240cf0]
mov qword [0x140240cf8], rax
mov qword [0x140240cf0], rax
lea rax, [0x140240d10]
mov qword [0x140240d18], rax
mov qword [0x140240d10], rax
lea rax, [0x140240d30]
mov qword [0x140240d38], rax
mov qword [0x140240d30], rax
lea rax, [0x140240d50]
mov qword [0x140240d58], rax
mov qword [0x140240d50], rax
lea rax, [0x140240d70]
mov qword [0x140240d78], rax
mov qword [0x140240d70], rax
lea rax, [0x140240d90]
mov qword [0x140240d98], rax
mov qword [0x140240d90], rax
lea rax, [0x140240db0]
mov qword [0x140240db8], rax
mov qword [0x140240db0], rax
lea rax, [0x140240dd0]
mov qword [0x140240dd8], rax
mov qword [0x140240dd0], rax
lea rax, [0x140240df0]
mov qword [0x140240df8], rax
mov qword [0x140240df0], rax
mov qword [0x140240b98], r10
mov qword [0x140240b90], r10
je 0x14003dee7
mov rcx, qword [0x140246938]
call fcn.140071260
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
cmp byte [0x140240b74], r14b
je 0x14003df05
test dword [0x140246920], 0x200
jne 0x14003df05
nop dword [rax]
call fcn.1400817c0
cmp dword [0x140237d34], 0x64
jb 0x14003df46
call fcn.140072e80
test al, al
je 0x14003df46
mov r9d, 8
mov dword [rbp + 0x160], 8
lea r8, [rbp + 0x160]
mov dword [rbp + 0x164], 1
mov rcx, rdi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
test dword [0x140246920], 0x100
je 0x14003df8e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
lea rcx, [rbp + 0x190]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
xor edx, edx
xor ecx, ecx
call fcn.140080960
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
mov al, 3
mov byte [rbp + 0x140], r14b
movzx r10d, al
mov r9d, 2
mov eax, dword [0x14024694c]
mov rcx, rdi
movzx r8d, al
test eax, eax
cmovne r10d, r8d
lea edx, [r9 + 0x10]
mov byte [rbp + 0x141], r10b
lea r8, [rbp + 0x140]
movzx eax, word [rbp + 0x140]
mov word [rbp + 0x140], ax
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov ecx, esi
call fcn.140041180
test al, al
jne 0x14003e00a
lea r9, str.Unable_to_initialize_the_main_window.
mov edx, 0x10
lea r8, [0x1401b8d58]
xor ecx, ecx
call sym.ProcessHacker.exe_PhShowMessage
jmp 0x14003d513
lea rcx, [0x140241da0]
call sym.ProcessHacker.exe_PhDrainAutoPool
call fcn.14003e040
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3