Function at 0x14009b260
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov edx, 0x577
mov r14, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x500
mov rcx, r14
mov rdi, rax
call sym.SystemInformer.exe_QiGetDialogItemValue
lea r15, str.SampleCountAutomatic
mov qword [rsp + 0x28], 0x28
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x30], r15
mov esi, eax
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x551
mov rcx, r14
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
sete al
cmp al, bl
je 0x14009b2f7
mov byte [0x1402c52ee], 1
movzx edx, al
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 0x28
mov qword [rsp + 0x40], r15
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
test esi, esi
mov qword [rsp + 0x48], 0x16
mov r12d, 1
lea rbx, str.SampleCount
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x50], rbx
cmove esi, r12d
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
nop dword [rax]
cmp esi, eax
je 0x14009b34b
mov byte [0x1402c52ee], r12b
mov edx, esi
mov qword [rsp + 0x58], 0x16
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x60], rbx
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x477
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r8, ds:[rbp + 0x2e8]
xor edx, edx
mov rcx, rax
call sym.SystemInformer.exe_QiGetWindowTextEx
mov rcx, qword [rbp + 0x2e8]
call sym.SystemInformer.exe_QiAutoDereferenceObject
lea rcx, str.SearchEngine
mov qword [rsp + 0x68], 0x18
mov qword [rsp + 0x70], rcx
mov rdx, rax
lea rcx, [rsp + 0x68]
call sym.SystemInformer.exe_QiSetStringRefSetting
mov edx, 0x47f
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r8, [rbp + 0x2f0]
xor edx, edx
mov rcx, rax
call sym.SystemInformer.exe_QiGetWindowTextEx
mov rcx, qword ds:[rbp + 0x2f0]
call sym.SystemInformer.exe_QiAutoDereferenceObject
lea rcx, str.ProgramInspectExecutables
mov qword [rsp + 0x78], 0x32
mov qword [rbp - 0x80], rcx
mov rdx, rax
lea rcx, [rsp + 0x78]
call sym.SystemInformer.exe_QiSetStringRefSetting
mov edx, 0x478
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, str.MaxSizeUnit
mov qword [rbp - 0x78], 0x16
mov qword [rbp - 0x70], rcx
mov edx, eax
lea rcx, [rbp - 0x78]
mov dword [0x1402c222c], eax
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x4e0
mov rcx, r14
call sym.SystemInformer.exe_QiGetDialogItemValue
lea rcx, str.IconProcesses
mov qword [rbp - 0x68], 0x1a
mov qword [rbp - 0x60], rcx
mov edx, eax
lea rcx, [rbp - 0x68]
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea rsi, str.DbgHelpSearchPath
mov qword [rbp - 0x58], 0x22
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x50], rsi
call sym.SystemInformer.exe_QiGetStringRefSetting
mov edx, 0x4c2
mov rcx, r14
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r8, [rbp + 0x2f8]
xor edx, edx
mov rcx, rax
call sym.SystemInformer.exe_QiGetWindowTextEx
mov rcx, rbx
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov rcx, qword [rbp + 0x2f8]
mov rbx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
movzx r8d, r12b
mov rdx, rbx
mov rcx, rax
call sym.SystemInformer.exe_QiEqualStringRef
nop dword [rax]
test al, al
jne 0x14009b52e
mov edx, 0x4c2
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r8, ds:[rsp + 0x20]
xor edx, edx
mov rcx, rax
call sym.SystemInformer.exe_QiGetWindowTextEx
mov rcx, qword [rsp + 0x20]
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov rdx, rax
mov qword [rbp - 0x48], 0x22
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x40], rsi
call sym.SystemInformer.exe_QiSetStringRefSetting
mov byte [0x1402c52ee], r12b
mov r9d, 0xf000
xor r8d, r8d
mov edx, 0x102c
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
mov qword [rbp - 0x38], 0x28
and eax, 0xfffff000
lea rcx, [rbp - 0x38]
cmp eax, 0x2000
mov edx, esi
lea rax, str.AllowOnlyOneInstance
sete dl
mov qword [rbp - 0x30], rax
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov r9d, 0xf000
mov r8, r12
mov edx, 0x102c
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x28], 0x16
and eax, 0xfffff000
lea rcx, [rbp - 0x28]
cmp eax, 0x2000
lea rax, str.HideOnClose
mov qword [rbp - 0x20], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
lea r8d, [rsi + 2]
mov r9d, 0xf000
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 0x18], 0x1c
and eax, 0xfffff000
lea rcx, [rbp - 0x18]
cmp eax, 0x2000
lea rax, str.HideOnMinimize
mov qword [rbp - 0x10], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
lea r8d, [rsi + 4]
mov r9d, 0xf000
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp - 8], 0x16
and eax, 0xfffff000
lea rcx, [rbp - 8]
cmp eax, 0x2000
lea rax, str.StartHidden
mov qword [rbp], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r14, str.MiniInfoWindowEnabled
mov qword [rbp + 8], 0x2a
lea rcx, [rbp + 8]
mov qword [rbp + 0x10], r14
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
lea r8d, [rsi + 0xd]
mov edx, 0x102c
mov r9d, 0xf000
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009b68c
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0x18]
mov qword [rbp + 0x18], 0x2a
mov qword [rbp + 0x20], r14
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xe
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp + 0x28], 0x36
and eax, 0xfffff000
lea rcx, [rbp + 0x28]
cmp eax, 0x2000
lea rax, str.MainWindowTabRestoreEnabled
mov qword [rbp + 0x30], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r14, str.KsiEnable
mov qword [rbp + 0x38], 0x12
lea rcx, [rbp + 0x38]
mov qword [rbp + 0x40], r14
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 6
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009b73e
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x48], 0x12
mov qword [rbp + 0x50], r14
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 5
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp + 0x58], 0x1c
and eax, 0xfffff000
lea rcx, [rbp + 0x58]
cmp eax, 0x2000
lea rax, str.EnableWarnings
mov qword [rbp + 0x60], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r14, str.EnablePlugins
mov qword [rbp + 0x68], 0x1a
lea rcx, [rbp + 0x68]
mov qword [rbp + 0x70], r14
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 8
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009b7ee
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0x78]
mov qword [rbp + 0x78], 0x1a
mov qword [rbp + 0x80], r14
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 9
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp + 0x88], 0x22
and eax, 0xfffff000
lea rcx, [rbp + 0x88]
cmp eax, 0x2000
lea rax, str.DbgHelpUndecorate
mov qword [rbp + 0x90], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r14, str.TreeListEnableHeaderTotals
mov qword [rbp + 0x98], 0x34
lea rcx, [rbp + 0x98]
mov qword [rbp + 0xa0], r14
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xa
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009b8b6
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0xa8]
mov qword [rbp + 0xa8], 0x34
mov qword [rbp + 0xb0], r14
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r14, str.EnableGraphMaxScale
mov qword [rbp + 0xb8], 0x26
lea rcx, [rbp + 0xb8]
mov qword [rbp + 0xc0], r14
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xc
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009b933
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0xc8]
mov qword [rbp + 0xc8], 0x26
mov qword [rbp + 0xd0], r14
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r14, str.EnableCycleCpuUsage
mov qword [rbp + 0xd8], 0x26
lea rcx, [rbp + 0xd8]
mov qword [rbp + 0xe0], r14
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xb
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009b9b0
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0xe8]
mov qword [rbp + 0xe8], 0x26
mov qword [rbp + 0xf0], r14
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r15, str.EnableThemeSupport
mov qword [rbp + 0xf8], 0x24
lea rcx, [rbp + 0xf8]
mov qword [rbp + 0x100], r15
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0xf
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009ba2d
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0x108]
mov qword [rbp + 0x108], 0x24
mov qword [rbp + 0x110], r15
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x10
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp + 0x118], 0x24
and eax, 0xfffff000
lea rcx, [rbp + 0x118]
cmp eax, 0x2000
lea rax, str.EnableStartAsAdmin
mov qword [rbp + 0x120], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r14, str.EnableStreamerMode
mov qword ds:[rbp + 0x128], 0x24
lea rcx, [rbp + 0x128]
mov qword [rbp + 0x130], r14
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x11
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009bafe
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0x138]
mov qword [rbp + 0x138], 0x24
mov qword [rbp + 0x140], r14
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x12
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp + 0x148], 0x2e
and eax, 0xfffff000
lea rcx, [rbp + 0x148]
cmp eax, 0x2000
lea rax, str.EnableSilentCrashNotify
mov qword [rbp + 0x150], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 7
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp + 0x158], 0x26
and eax, 0xfffff000
lea rcx, [rbp + 0x158]
cmp eax, 0x2000
lea rax, str.EnableMonospaceFont
mov qword [rbp + 0x160], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r14, str.EnableNetworkResolve
mov qword ds:[rbp + 0x168], 0x28
lea rcx, ds:[rbp + 0x168]
mov qword [rbp + 0x170], r14
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x13
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009bc1e
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0x178]
mov qword [rbp + 0x178], 0x28
mov qword [rbp + 0x180], r14
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r14, str.EnableNetworkResolveDoH
mov qword ds:[rbp + 0x188], 0x2e
lea rcx, [rbp + 0x188]
mov qword [rbp + 0x190], r14
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x14
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009bc9e
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0x198]
mov qword [rbp + 0x198], 0x2e
mov qword [rbp + 0x1a0], r14
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x15
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp + 0x1a8], 0x2a
and eax, 0xfffff000
lea rcx, [rbp + 0x1a8]
cmp eax, 0x2000
lea rax, str.EnableInstantTooltips
mov qword [rbp + 0x1b0], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r14, str.EnableImageCoherencySupport
mov qword [rbp + 0x1b8], 0x36
lea rcx, [rbp + 0x1b8]
mov qword [rbp + 0x1c0], r14
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x16
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009bd6b
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0x1c8]
mov qword [rbp + 0x1c8], 0x36
mov qword [rbp + 0x1d0], r14
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r14, str.EnableStage2
mov qword [rbp + 0x1d8], 0x18
lea rcx, [rbp + 0x1d8]
mov qword [rbp + 0x1e0], r14
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x17
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009bdeb
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0x1e8]
mov qword [rbp + 0x1e8], 0x18
mov qword [rbp + 0x1f0], r14
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea r14, str.EnableServiceStage2
mov qword [rbp + 0x1f8], 0x26
lea rcx, [rbp + 0x1f8]
mov qword [rbp + 0x200], r14
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x18
mov rcx, rdi
setne bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x14009be6b
mov byte [0x1402c52ee], r12b
movzx edx, al
lea rcx, [rbp + 0x208]
mov qword [rbp + 0x208], 0x26
mov qword [rbp + 0x210], r14
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x19
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp + 0x218], 0x1e
and eax, 0xfffff000
lea rcx, [rbp + 0x218]
cmp eax, 0x2000
lea rax, str.IconSingleClick
mov qword [rbp + 0x220], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x1a
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp + 0x228], 0x2a
and eax, 0xfffff000
lea rcx, [rbp + 0x228]
cmp eax, 0x2000
lea rax, str.IconTogglesVisibility
mov qword [rbp + 0x230], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x1b
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, esi
mov qword [rbp + 0x238], 0x22
and eax, 0xfffff000
lea rcx, [rbp + 0x238]
cmp eax, 0x2000
lea rax, str.PropagateCpuUsage
mov qword [rbp + 0x240], rax
sete dl
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 0x1c
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbp + 0x248]
mov qword [rbp + 0x248], 0x2a
and eax, 0xfffff000
cmp eax, 0x2000
lea rax, str.EnableAdvancedOptions
mov qword [rbp + 0x250], rax
sete sil
mov edx, esi
call sym.SystemInformer.exe_QiSetIntegerStringRefSetting
lea rcx, [rbp + 0x258]
mov qword [rbp + 0x258], 0x24
mov qword [rbp + 0x260], r15
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
je 0x14009c096
lock bts qword [0x1402c5160], 0
jae 0x14009c007
lea rcx, [0x1402c5160]
call sym.SystemInformer.exe_QifAcquireQueuedLockExclusive
mov rcx, qword [0x1402c9270]
lea rax, str.GraphColorMode
lea rdx, [rbp + 0x268]
mov qword [rbp + 0x278], rax
mov qword [rbp + 0x270], 0x1c
call sym.SystemInformer.exe_QiFindEntryHashtable
mov rbx, rax
test rax, rax
je 0x14009c049
nop dword [rax + rax]
cmp dword [rax], r12d
jne 0x14009c049
mov dword [rax + 0x28], r12d
mov rax, 0xffffffffffffffff
lock xadd qword [0x1402c5160], rax
movzx edx, al
and dl, 6
cmp dl, 2
jne 0x14009c085
dec rax
lea rdx, [rax + 4]
lock cmpxchg qword [0x1402c5160], rdx
jne 0x14009c085
lea rcx, [0x1402c5160]
nop
call fcn.140170e20
test rbx, rbx
jne 0x14009c096
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov edx, 0x102c
mov r9d, 0xf000
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x102c
mov r9d, 0xf000
and eax, 0xfffff000
mov r8d, 3
cmp eax, 0x2000
mov rcx, rdi
sete bl
call qword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
movzx edx, bl
cmp eax, 0x2000
sete cl
call fcn.140098f80
xor edx, edx
lea r8, [0x14009ae80]
lea ecx, [rdx + 0x10]
add rsp, 0x3a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
jmp sym.SystemInformer.exe_QiPluginInvokeWindowCallback