Function at 0x140060c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x240
xor eax, eax
xor r15d, r15d
mov rdi, rcx
movabs rcx, 0x41002f004e
mov qword [r11 - 0x1a0], rax
mov qword [r11 - 0x198], rax
mov qword [r11 - 0x1a8], rcx
mov qword [r11 - 0x168], rcx
mov qword [r11 - 0x1e8], rcx
mov qword [r11 - 0x1c8], rcx
mov qword [rsp + 0x70], rcx
mov qword [r11 - 0x190], rax
mov qword [r11 - 0x188], rax
mov qword [r11 - 0x180], rax
mov qword [r11 - 0x178], rax
mov qword [r11 - 0x160], rax
mov qword [r11 - 0x158], rax
mov qword [r11 - 0x150], rax
mov qword [r11 - 0x148], rax
mov qword [r11 - 0x140], rax
mov qword [r11 - 0x138], rax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x78], rax
mov qword [r11 - 0x1e0], rax
mov qword [r11 - 0x1d8], rax
mov qword [r11 - 0x1c0], rax
mov qword [r11 - 0x1b8], rax
mov qword [r11 - 0x1f8], rax
mov rcx, rdi
mov edx, 0x425
mov r14, r15
mov r12, r15
mov dword [rsp + 0x108], eax
mov word [rsp + 0x10c], ax
mov dword [rsp + 0x148], eax
mov word [rsp + 0x14c], ax
mov rsi, r15
mov r13, r15
mov rbx, r15
mov word [rsp + 0xa8], ax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov word [rsp + 0x68], ax
mov word [rsp + 0xc8], ax
mov word [rsp + 0x88], ax
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x1032
mov qword [rsp + 0x298], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rbp, [0x1400b62d0]
cmp eax, 1
je 0x140060d9d
cmp byte [rsp + 0x288], bl
je 0x1400611ac
jmp 0x14006108f
mov rcx, qword [rsp + 0x298]
call sym.ProcessHacker.exe_PhGetSelectedListViewItemParam
mov rsi, rax
test rax, rax
je 0x1400611ac
mov r14, qword [rax + 0x50]
mov eax, dword [rax + 8]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x40], eax
mov eax, dword [rsi + 0xc]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rcx, [rsp + 0x150]
call sym.ProcessHacker.exe_PhFormatDateTime
mov r12, rax
test rax, rax
je 0x140060e08
mov rcx, rax
call sym.ProcessHacker.exe_PhaDereferenceObject
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0xd0]
mov r8d, 1
call sym.ProcessHacker.exe_PhPrintTimeSpan
mov rdx, qword [rsi + 0x18]
lea rcx, [rsp + 0x110]
mov r8d, 1
call sym.ProcessHacker.exe_PhPrintTimeSpan
mov r9d, dword [rsi + 0x20]
lea r8, str._I64u
lea rcx, [rsp + 0x160]
mov edx, 0x32
call fcn.140094c64
lea rcx, [rsp + 0x160]
mov r8b, 1
xor edx, edx
call sym.ProcessHacker.exe_PhFormatDecimal
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140060e77
mov rcx, rax
call sym.ProcessHacker.exe_PhaDereferenceObject
cmp dword [0x1400d8fc0], 0x3c
jb 0x140060ebf
mov r9, qword [rsi + 0x28]
lea r8, str._I64u
lea rcx, [rsp + 0x1d0]
mov edx, 0x32
call fcn.140094c64
lea rcx, [rsp + 0x1d0]
mov r8b, 1
xor edx, edx
call sym.ProcessHacker.exe_PhFormatDecimal
mov r13, rax
test rax, rax
je 0x140060ebf
mov rcx, rax
call sym.ProcessHacker.exe_PhaDereferenceObject
mov ecx, dword [rsi + 0x5c]
cmp ecx, 5
je 0x140060eec
cmp ecx, 9
jae 0x140060f8f
lea rax, [0x140000000]
mov rcx, qword [rax + rcx*8 + 0xd4670]
call sym.ProcessHacker.exe_PhaCreateString
mov rbx, rax
jmp 0x140060f8f
mov eax, dword [rsi + 0x60]
cmp eax, 0x25
jae 0x140060f1f
mov rdx, rax
lea rax, [0x140000000]
lea rcx, str.Wait:
mov rdx, qword [rax + rdx*8 + 0xd46c0]
call sym.ProcessHacker.exe_PhConcatStrings2
mov rbx, rax
test rax, rax
je 0x140060f8f
mov rcx, rax
jmp 0x140060f8a
mov rbx, qword [0x1400d91a8]
xor r8d, r8d
lea edx, [r8 + 0x20]
mov rcx, rbx
call fcn.14001fbe0
lock add dword [rbx + 0x18], 1
mov qword [rax + 0x10], rbx
mov dword [rax], 1
mov qword [rax + 8], 0x20
lea rbx, [rax + 0x20]
mov eax, 0xe
mov word [rbx], ax
mov word [rbx + 2], ax
lea rcx, [rbx + 0x10]
mov qword [rbx + 8], rcx
mov word [rbx + 0x1e], r15w
mov rax, qword [str.Waiting]
mov qword [rcx], rax
mov eax, dword [0x1400aabf8]
mov dword [rcx + 8], eax
movzx eax, word [0x1400aabfc]
mov word [rcx + 0xc], ax
mov rcx, rbx
call sym.ProcessHacker.exe_PhaDereferenceObject
mov r9d, dword [rsi + 0x38]
lea r8, [0x1400b78d0]
lea rcx, [rsp + 0x90]
mov edx, 0xc
call fcn.140094c64
mov r9d, dword [rsi + 0x3c]
lea r8, [0x1400b78d0]
lea rcx, [rsp + 0x50]
mov edx, 0xc
call fcn.140094c64
mov r8, qword [rsi]
mov edx, dword [0x1400d8ff4]
lea rcx, [rsp + 0x38]
call sym.ProcessHacker.exe_PhOpenThread
test eax, eax
js 0x140061077
mov rcx, qword [rsp + 0x38]
mov r9d, 4
lea r8, [rsp + 0x290]
lea edx, [r9 + 0x12]
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x140061028
mov r9d, dword [rsp + 0x290]
lea r8, [0x1400b2340]
lea rcx, [rsp + 0xb0]
mov edx, 0xc
call fcn.140094c64
mov rcx, qword [rsp + 0x38]
mov r9d, 4
lea r8, [rsp + 0x298]
lea edx, [r9 + 0x14]
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14006106c
mov r9d, dword [rsp + 0x298]
lea r8, [0x1400b2340]
lea rcx, [rsp + 0x70]
mov edx, 0xc
call fcn.140094c64
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtClose]
mov rsi, qword [rsp + 0x30]
cmp byte [rsp + 0x288], r15b
je 0x1400610e0
lea r8, [r14 + 0x10]
test r14, r14
jne 0x140061096
lea r8, [0x1400aa7c0]
mov edx, 0x460
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
test r14, r14
mov edx, 0x461
mov rcx, rdi
setne r15b
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, r15d
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
lea r8, [r12 + 0x10]
test r12, r12
jne 0x1400610d2
mov r8, rbp
mov edx, 0x3ff
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [rsp + 0xd0]
mov edx, 0x462
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [rsp + 0x110]
mov edx, 0x463
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [rsi + 0x10]
test rsi, rsi
jne 0x140061118
mov r8, rbp
mov edx, 0x464
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [r13 + 0x10]
test r13, r13
jne 0x140061132
mov r8, rbp
mov edx, 0x465
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
test rbx, rbx
je 0x140061149
lea rbp, [rbx + 0x10]
mov r8, rbp
mov edx, 0x457
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [rsp + 0x90]
mov edx, 0x466
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [rsp + 0x50]
mov edx, 0x467
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [rsp + 0xb0]
mov edx, 0x468
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [rsp + 0x70]
mov edx, 0x469
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rbx, qword [rsp + 0x280]
add rsp, 0x240
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret