Function at 0x7ff7c00a8290
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x7ff7c01ca008]
xor rax, rsp
mov qword [rbp + 0x130], rax
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x7ff7c01d8470]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x522
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a8328
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x7ff7c01d8478]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x523
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8396
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x7ff7c01d8474]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x524
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a8408
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x7ff7c01d3b7c]
xor r8d, r8d
sub ecx, dword [0x7ff7c01d846c]
movzx eax, byte [0x7ff7c01d1968]
shl rcx, 0xc
mov qword [rbp - 0x80], rcx
lea edx, [r8 + 1]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x10c
mov byte [rsp + 0x7a], al
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x525
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8476
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x7ff7c01d3b7c]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x526
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a84e8
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d68f0]
nop
test rcx, rcx
je 0x7ff7c00a8545
movzx eax, byte [0x7ff7c01d1968]
xor r8d, r8d
mov qword [rbp - 0x80], rcx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x10c
mov byte [rsp + 0x7a], al
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x533
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8576
mov r9, rbx
jmp 0x7ff7c00a8563
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x533
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8576
lea r9, [0x7ff7c0186820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x7ff7c01d84e4]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x527
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a85e8
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x7ff7c01d84cc]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x528
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8656
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x7ff7c01d84ec]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x529
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a86c8
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x7ff7c01d84e8]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x52a
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8736
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x7ff7c01d84b0]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x52b
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a87a8
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x7ff7c01d67cc], 1
nop
jbe 0x7ff7c00a8800
mov eax, dword [0x7ff7c01d6824]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], 0x10009
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x52d
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8836
mov r9, rbx
jmp 0x7ff7c00a8822
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x52d
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8836
lea r9, [0x7ff7c0186820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x7ff7c01d67cc], 1
jbe 0x7ff7c00a888b
mov eax, dword [0x7ff7c01d692c]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], 0x10009
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x52e
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a88b9
mov r9, rbx
jmp 0x7ff7c00a88a9
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x52e
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a88b9
lea r9, [0x7ff7c0186820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x7ff7c01d84b4]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x52f
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a8928
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x7ff7c01d67cc], 1
nop
jbe 0x7ff7c00a8980
mov eax, dword [0x7ff7c01d6824]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], 0x10009
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x531
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a89b6
mov r9, rbx
jmp 0x7ff7c00a89a2
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x531
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a89b6
lea r9, [0x7ff7c0186820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x7ff7c01d67cc], 1
jbe 0x7ff7c00a8a08
mov eax, dword [0x7ff7c01d6844]
lea rcx, [rbp - 0x58]
xor r8d, r8d
mov dword [rbp - 0x58], 0x10009
mov qword [rbp - 0x48], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x532
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8a36
mov r9, rbx
jmp 0x7ff7c00a8a26
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x532
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8a36
lea r9, [0x7ff7c0186820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x7ff7c01d65dd], 0
mov qword [rsp + 0x258], rdi
je 0x7ff7c00a8c64
mov rdx, qword [0x7ff7c01d6910]
mov rax, qword [0x7ff7c01d6920]
test rdx, rdx
jne 0x7ff7c00a8a67
test rax, rax
je 0x7ff7c00a8c64
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x250], rsi
xor ebx, ebx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], rcx
mov rdi, rcx
lea rsi, [0x7ff7c00e3d40]
test rdx, rdx
je 0x7ff7c00a8b38
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
jae 0x7ff7c00a8b38
mov dword [rsp + 0x48], ebx
lea rax, [rbp - 0x68]
mov qword [rbp - 0x28], rax
lea r8, [0x7ff7c00e3af0]
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x38]
mov qword [rbp + 0x40], rax
xor r9d, r9d
mov dword [rsp + 0x38], 4
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x38], rcx
mov rcx, qword [0x7ff7c01d3db0]
mov qword [rbp - 0x30], rdx
xor edx, edx
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x20], 8
mov qword [rbp - 0x18], rbx
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x70], 2
mov qword [rbp + 0x38], rsi
mov dword [rbp + 0x48], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov rax, qword [0x7ff7c01d6920]
mov rcx, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x60]
test rax, rax
je 0x7ff7c00a8bd0
mov rcx, qword [0x7ff7c01d3db0]
lea r8, [0x7ff7c00e3af0]
mov qword [rbp], rax
xor r9d, r9d
mov dword [rsp + 0x48], ebx
lea rax, [rbp - 0x60]
mov qword [rbp + 8], rax
xor edx, edx
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 8]
mov qword [rbp + 0x68], rax
lea rax, [rbp - 0x6c]
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov qword [rbp - 8], 0xffffffffffffffff
mov qword [rbp + 0x10], 8
mov qword [rbp + 0x18], rbx
mov dword [rbp + 0x20], ebx
mov dword [rbp - 0x6c], 2
mov qword [rbp + 0x60], rsi
mov dword [rbp + 0x70], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov rcx, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x60]
mov rsi, qword [rsp + 0x250]
cmp rcx, 0xffffffffffffffff
je 0x7ff7c00a8c14
movzx eax, byte [0x7ff7c01d1968]
xor r8d, r8d
mov qword [rbp - 0x80], rcx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x10c
mov byte [rsp + 0x7a], al
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rbx, qword [rax + 8]
jmp 0x7ff7c00a8c1b
lea rbx, [0x7ff7c0177c48]
cmp rdi, 0xffffffffffffffff
je 0x7ff7c00a8c5b
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], 0x10c
mov byte [rsp + 0x5a], al
mov qword [rsp + 0x60], rdi
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rdi, qword [rax + 8]
jmp 0x7ff7c00a8c7f
lea rdi, [0x7ff7c0177c48]
jmp 0x7ff7c00a8c7f
cmp qword [0x7ff7c01d3db0], 0
lea rbx, [0x7ff7c0186878]
je 0x7ff7c00a8c7c
lea rbx, [0x7ff7c0186890]
mov rdi, rbx
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x52c
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8cae
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x530
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8cd8
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x7ff7c01d67cc], 1
jbe 0x7ff7c00a8d2a
mov eax, dword [0x7ff7c01d691c]
lea rcx, [rbp - 0x58]
xor r8d, r8d
mov dword [rbp - 0x58], 0x10009
mov qword [rbp - 0x48], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x558
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8d58
mov r9, rbx
jmp 0x7ff7c00a8d48
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x558
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8d58
lea r9, [0x7ff7c0186820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x7ff7c01d67cc], 1
jbe 0x7ff7c00a8daa
mov eax, dword [0x7ff7c01d681c]
lea rcx, [rbp - 0x58]
xor r8d, r8d
mov dword [rbp - 0x58], 0x10009
mov qword [rbp - 0x48], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x559
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8dd8
mov r9, rbx
jmp 0x7ff7c00a8dc8
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x559
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8dd8
lea r9, [0x7ff7c0186820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x7ff7c01d67cc], 1
jbe 0x7ff7c00a8e2a
mov eax, dword [0x7ff7c01d67f4]
lea rcx, [rbp - 0x58]
xor r8d, r8d
mov dword [rbp - 0x58], 0x10009
mov qword [rbp - 0x48], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x55a
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8e58
mov r9, rbx
jmp 0x7ff7c00a8e48
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x55a
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8e58
lea r9, [0x7ff7c0186820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x7ff7c01d67cc], 1
jbe 0x7ff7c00a8eaa
mov eax, dword [0x7ff7c01d682c]
lea rcx, [rbp - 0x58]
xor r8d, r8d
mov dword [rbp - 0x58], 0x10009
mov qword [rbp - 0x48], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x55b
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8ed8
mov r9, rbx
jmp 0x7ff7c00a8ec8
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x55b
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8ed8
lea r9, [0x7ff7c0186820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x7ff7c01d67cc], 1
jbe 0x7ff7c00a8f40
movzx eax, byte [0x7ff7c01d1968]
lea rcx, ds:[rsp + 0x50]
xor r8d, r8d
mov byte [rsp + 0x5a], al
mov rax, qword [0x7ff7c01d6978]
mov dword [rsp + 0x50], 0x10c
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x55c
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8f76
mov r9, rbx
jmp 0x7ff7c00a8f62
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x55c
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a8f76
lea r9, [0x7ff7c0186820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x7ff7c01d67cc], 1
jbe 0x7ff7c00a8fda
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov byte [rsp + 0x5a], al
mov rax, qword [0x7ff7c01d6800]
mov dword [rsp + 0x50], 0x10c
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x55e
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax]
test rax, rax
je 0x7ff7c00a900c
mov r9, rbx
jmp 0x7ff7c00a8ffc
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x55e
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax]
test rax, rax
je 0x7ff7c00a900c
lea r9, [0x7ff7c0186820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea rdx, [rbp + 0x80]
mov r8d, 0xb0
lea ecx, [r9 + 0x50]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x7ff7c00a968b
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov rbx, qword [rbp + 0xe0]
xor r8d, r8d
add rbx, qword [rbp + 0xd8]
add rbx, qword [rbp + 0xd0]
add rbx, qword [rbp + 0xc8]
add rbx, qword [rbp + 0xc0]
lea edx, [r8 + 1]
add rbx, qword [rbp + 0xb8]
add rbx, qword [rbp + 0xb0]
add rbx, qword [rbp + 0xa8]
mov byte [rsp + 0x5a], al
mov rax, qword [rbp + 0x80]
shl rax, 0xc
mov dword [rsp + 0x50], 0x10c
mov qword [rsp + 0x60], rax
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x534
mov rdi, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a90d6
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x88]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x535
mov rdi, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9148
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x90]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x536
mov rdi, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a91b6
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x98]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x537
mov rdi, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9228
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
xor r8d, r8d
shl rbx, 0xc
mov dword [rsp + 0x50], 0x10c
mov byte [rsp + 0x5a], al
mov qword [rsp + 0x60], rbx
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x539
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a928e
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xa8]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x542
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a92f8
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xb0]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x543
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9368
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xb8]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x544
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a93d6
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xc0]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x545
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9448
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xc8]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x554
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a94b6
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xd0]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x555
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9528
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xd8]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x556
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a9596
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xe0]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x557
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9608
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
nop
jb 0x7ff7c00a9681
movzx eax, byte [0x7ff7c01d1968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x128]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x55d
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a99d6
mov r9, rbx
jmp 0x7ff7c00a99c0
mov edx, 0x55d
jmp 0x7ff7c00a999b
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x534
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a96b9
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x535
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a96ec
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x536
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c00a971a
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x537
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax]
test rax, rax
je 0x7ff7c00a9756
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x55d
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9796
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x539
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a97d6
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x542
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9816
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x543
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9856
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x544
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9896
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x545
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a98d6
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x554
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9916
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x555
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9956
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x7ff7c01d6810]
mov edx, 0x556
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a9996
xor r8d, r8d
lea r9, [0x7ff7c0177c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x557
mov rcx, qword [0x7ff7c01d6810]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00a99d6
lea r9, [0x7ff7c0177c48]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rsp + 0x258]
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.7ff7c0121390
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rbp
ret