Function at 0x14007a9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rdi, rdx
mov r14, r9
xor dl, dl
mov rsi, r8
cmp ecx, 0xd
ja case.0x14007aa24.5
lea r15, [0x140000000]
movsxd rax, ecx
mov eax, dword [r15 + rax*4 + 0x7c0f4]
add rax, r15
jmp rax
test byte [rdi], 1
je 0x14007c0d4
xor ebx, ebx
test rsi, rsi
je 0x14007aac1
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x26]
mov qword [rbp - 0x30], 0x14
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rbp - 0x28], rcx
mov qword [rax], 0x14
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x14], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, [0x140163380]
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, [0x140163380]
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
cmp byte [rdi + 4], bl
je 0x14007aaba
lea rcx, str.__permanent_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.__permanent_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov rax, qword [rbp - 0x28]
mov qword [rsi], rax
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0x44
mov qword [rbp - 0x30], 0x32
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
lea r8, [0x14013ca58]
mov qword [rbp - 0x28], rcx
lea rdx, str.Data_Execution_Prevention__DEP__is_s_enabled_for_this_process._r_n
mov qword [rax], 0x32
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x32], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, [rbp - 0x30]
mov word [rax], bx
lea rax, str._permanently
cmp byte [rdi + 4], bl
cmovne r8, rax
call sym.ProcessHacker.exe_PhAppendFormatStringBuilder
test byte [rdi], 2
je 0x14007ab51
lea rcx, str.ATL_thunk_emulation_is_disabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.ATL_thunk_emulation_is_disabled._r_n
lea r8, [rax + rax]
lea rcx, [rbp - 0x30]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov rax, qword [rbp - 0x28]
mov qword [r14], rax
mov dl, 1
jmp 0x14007c0d4
test byte [rdi], 7
je 0x14007c0d4
xor ebx, ebx
test rsi, rsi
je 0x14007ad2e
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x26]
mov qword [rbp - 0x30], 0x14
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rbp - 0x28], rcx
mov qword [rax], 0x14
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x14], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.ASLR
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.ASLR
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 4
jne 0x14007abe1
test al, 2
jne 0x14007abe1
mov r15, qword [rbp - 0x28]
jmp 0x14007ad2b
lea rcx, [0x14015bff8]
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, [0x14015bff8]
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 4
je 0x14007ac29
lea rcx, str.high_entropy_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.high_entropy_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14007ac4f
lea rcx, str.force_relocate_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.force_relocate_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 8
je 0x14007ac73
lea rcx, str.disallow_stripped_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.disallow_stripped_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov r15, qword [rbp - 0x28]
lea rax, [0x140159cd8]
mov qword [rbp - 0x20], 4
mov qword [rbp - 0x18], rax
mov rcx, qword [r15]
cmp rcx, 4
jb 0x14007acf2
mov rax, qword [r15 + 8]
lea rdx, [rbp - 0x20]
add rax, 0xfffffffffffffffc
mov qword [rbp - 0x10], 4
add rcx, rax
xor r8d, r8d
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x10]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14007acf2
mov r8, qword [r15]
mov rcx, qword [r15 + 8]
mov rdx, r8
and rdx, 0xfffffffffffffffe
sub rdx, 4
sub r8, rdx
add rcx, rdx
sub r8, 4
lea rdx, [rcx + 4]
call fcn.14010e700
add qword [r15], 0xfffffffffffffffc
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov word [rcx + rax], bx
mov rdx, qword [r15]
add rdx, 2
cmp qword [rbp - 0x30], rdx
jae 0x14007ad0c
lea rcx, [rbp - 0x30]
call fcn.1400ccb80
mov r15, qword [rbp - 0x28]
mov rcx, qword [r15 + 8]
mov edx, 0x29
mov rax, qword [r15]
mov word [rcx + rax], dx
add qword [r15], 2
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov word [rcx + rax], bx
mov qword [rsi], r15
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0x76
mov qword [rbp - 0x30], 0x64
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rbp - 0x28], rcx
mov qword [rax], 0x64
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x64], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Address_Space_Layout_Randomization_is_enabled_for_this_process._r_n
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Address_Space_Layout_Randomization_is_enabled_for_this_process._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 4
je 0x14007adbc
lea rcx, str.High_entropy_randomization_is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.High_entropy_randomization_is_enabled._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14007ade2
lea rcx, str.All_images_are_being_forcibly_relocated__regardless_of_whether_they_support_ASLR_._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.All_images_are_being_forcibly_relocated__regardless_of_whether_they_support_ASLR_._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 8
je 0x14007ab51
lea rcx, str.Images_with_stripped_relocation_data_are_disallowed._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Images_with_stripped_relocation_data_are_disallowed._r_n
jmp 0x14007ab44
xor ebx, ebx
test byte [rdi], 1
je 0x14007aef7
test rsi, rsi
je 0x14007ae74
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x40]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x2e
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x2e], bx
movups xmm0, xmmword [str.Dynamic_code_prohibited]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140163740]
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [0x140163750]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [0x140163758]
mov dword [rcx + 0x28], eax
movzx eax, word [0x14016375c]
mov word [rcx + 0x2c], ax
test r14, r14
je 0x14007aef5
mov rdx, qword [0x140196800]
mov ecx, 0x7a
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x68
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x68], bx
movups xmm0, xmmword [str.Dynamically_loaded_code_is_not_allowed_to_execute._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140163770]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x140163780]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [0x140163790]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [0x1401637a0]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [0x1401637b0]
movups xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [0x1401637c0]
movsd qword [rcx + 0x60], xmm0
mov qword [r14], rdx
mov dl, 1
test byte [rdi], 2
je 0x14007b019
test rsi, rsi
je 0x14007af6b
mov rdx, qword [0x140196800]
mov ecx, 0x5a
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x48
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x48], bx
movups xmm0, xmmword [str.Dynamic_code_prohibited__per_thread_]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401637e0]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401637f0]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [0x140163800]
movups xmmword [rcx + 0x30], xmm1
movsd xmm0, qword [0x140163810]
movsd qword [rcx + 0x40], xmm0
test r14, r14
je 0x14007b017
mov rdx, qword [0x140196800]
mov ecx, 0xbe
call sym.ProcessHacker.exe_PhCreateObject
lea rcx, [r15 + 0x163820]
mov r8, rax
mov qword [rax], 0xac
add rax, 0x10
mov qword [r8 + 8], rax
mov word [rax + 0xac], bx
mov rdx, qword [r8 + 8]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
sub rdx, 0xffffffffffffff80
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx + 0x10], xmm1
mov rax, qword [rcx + 0xa0]
mov qword [rdx + 0x20], rax
mov eax, dword [rcx + 0xa8]
mov dword [rdx + 0x28], eax
mov qword [r14], r8
mov dl, 1
test byte [rdi], 4
je 0x14007c0d4
test rsi, rsi
je 0x14007b080
mov rdx, qword [0x140196800]
mov ecx, 0x44
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x32
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x32], bx
movups xmm0, xmmword [str.Dynamic_code_downgradable]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401638e0]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401638f0]
movups xmmword [rcx + 0x20], xmm0
movzx eax, word [0x140163900]
mov word [rcx + 0x30], ax
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0x16c
call sym.ProcessHacker.exe_PhCreateObject
mov r9, rax
lea rdx, str.Allow_non_AppContainer_processes_to_modify_all_of_the_dynamic_code_settings_for_the_calling_process__including_relaxing_dynamic_code_restrictions_after_they_have_been_set._r_n
mov r8d, 2
mov qword [rax], 0x15a
add rax, 0x10
mov qword [r9 + 8], rax
mov word [rax + 0x15a], bx
mov rcx, qword [r9 + 8]
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rdx]
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rdx + 0x70]
sub rdx, 0xffffffffffffff80
movups xmmword [rcx - 0x10], xmm1
sub r8, 1
jne 0x14007b0d0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov rax, qword [rdx + 0x50]
mov qword [rcx + 0x50], rax
movzx eax, word [rdx + 0x58]
mov dl, 1
mov word [rcx + 0x58], ax
mov qword [r14], r9
jmp 0x14007c0d4
test byte [rdi], 1
je 0x14007c0d4
xor ebx, ebx
test rsi, rsi
je 0x14007b1be
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x3a]
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rsi], rcx
mov qword [rax], 0x28
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x28], bx
movups xmm0, xmmword [str.Strict_handle_checks]
mov rax, qword [rcx + 8]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140163a80]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140163a90]
movsd qword [rax + 0x20], xmm0
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0xa0
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x8e
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x8e], bx
mov rcx, qword [rdx + 8]
movups xmm0, xmmword [str.An_exception_is_raised_when_an_invalid_handle_is_used_by_the_process._r_n]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140163ab0]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x140163ac0]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [0x140163ad0]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [0x140163ae0]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [0x140163af0]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [0x140163b00]
movups xmmword [rcx + 0x60], xmm0
movups xmm1, xmmword [0x140163b10]
movups xmmword [rcx + 0x70], xmm1
movsd xmm0, qword [0x140163b20]
movsd qword [rcx + 0x80], xmm0
mov eax, dword [0x140163b28]
mov dword [rcx + 0x88], eax
movzx eax, word [0x140163b2c]
mov word [rcx + 0x8c], ax
mov qword [r14], rdx
mov dl, 1
jmp 0x14007c0d4
xor ebx, ebx
test byte [rdi], 1
je 0x14007b36a
test rsi, rsi
je 0x14007b2e9
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x4a]
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rsi], rcx
mov qword [rax], 0x38
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x38], bx
movups xmm0, xmmword [str.Win32k_system_calls_disabled]
mov rax, qword [rcx + 8]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140163b40]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140163b50]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [0x140163b60]
movsd qword [rax + 0x30], xmm1
test r14, r14
je 0x14007b368
mov rdx, qword [0x140196800]
mov ecx, 0x74
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x62
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x62], bx
movups xmm0, xmmword [str.Win32k__GDI_USER__system_calls_are_not_allowed._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140163b80]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x140163b90]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [0x140163ba0]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [0x140163bb0]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [0x140163bc0]
movups xmmword [rcx + 0x50], xmm1
movzx eax, word [0x140163bd0]
mov word [rcx + 0x60], ax
mov qword [r14], rdx
mov dl, 1
test byte [rdi], 2
je 0x14007c0d4
test rsi, rsi
je 0x14007b3da
mov rdx, qword [0x140196800]
mov ecx, 0x48
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x36
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x36], bx
movups xmm0, xmmword [str.Win32k_system_calls__Audit_]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140163be8]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x140163bf8]
movups xmmword [rcx + 0x20], xmm0
mov eax, dword [0x140163c08]
mov dword [rcx + 0x30], eax
movzx eax, word [0x140163c0c]
mov word [rcx + 0x34], ax
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0x88
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x76
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x76], bx
mov rcx, qword [rdx + 8]
movups xmm0, xmmword [str.Win32k__GDI_USER__system_calls_will_trigger_an_ETW_event._r_n]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140163c20]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x140163c30]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [0x140163c40]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [0x140163c50]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [0x140163c60]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [0x140163c70]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [0x140163c80]
mov dword [rcx + 0x70], eax
movzx eax, word [0x140163c84]
mov word [rcx + 0x74], ax
mov qword [r14], rdx
mov dl, 1
jmp 0x14007c0d4
test byte [rdi], 1
je 0x14007c0d4
xor ebx, ebx
test rsi, rsi
je 0x14007b4df
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x44]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x32
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x32], bx
movups xmm0, xmmword [str.Extension_points_disabled]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140163c98]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x140163ca8]
movups xmmword [rcx + 0x20], xmm0
movzx eax, word [0x140163cb8]
mov word [rcx + 0x30], ax
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0x92
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x80
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x80], bx
mov rcx, qword [rdx + 8]
movups xmm0, xmmword [str.Legacy_extension_point_DLLs_cannot_be_loaded_into_the_process._r_n]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140163cd0]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x140163ce0]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [0x140163cf0]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [0x140163d00]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [0x140163d10]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [0x140163d20]
movups xmmword [rcx + 0x60], xmm0
movups xmm1, xmmword [0x140163d30]
movups xmmword [rcx + 0x70], xmm1
mov qword [r14], rdx
mov dl, 1
jmp 0x14007c0d4
test byte [rdi], 1
je 0x14007c0d4
xor ebx, ebx
test rsi, rsi
je 0x14007b612
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x44]
mov qword [rbp - 0x30], 0x32
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rbp - 0x28], rcx
mov qword [rax], 0x32
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x32], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
mov word [rax], bx
test byte [rdi], 4
je 0x14007b5eb
lea rcx, str.Strict
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Strict
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
lea rcx, str.CF_Guard
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.CF_Guard
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov rax, qword [rbp - 0x28]
mov qword [rsi], rax
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0x76
mov qword [rbp - 0x30], 0x64
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rbp - 0x28], rcx
mov qword [rax], 0x64
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x64], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Control_Flow_Guard__CFG__is_enabled_for_the_process._r_n
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Control_Flow_Guard__CFG__is_enabled_for_the_process._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 4
je 0x14007b6a0
lea rcx, str.Strict_CFG_:_only_CFG_modules_can_be_loaded._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Strict_CFG_:_only_CFG_modules_can_be_loaded._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14007ab51
lea rcx, str.Dll_Exports_can_be_marked_as_CFG_invalid_targets._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Dll_Exports_can_be_marked_as_CFG_invalid_targets._r_n
jmp 0x14007ab44
test byte [rdi], 3
je 0x14007c0d4
xor ebx, ebx
test rsi, rsi
je 0x14007b836
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x44]
mov qword [rbp - 0x30], 0x32
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rbp - 0x28], rcx
mov qword [rax], 0x32
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x32], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Signatures_restricted__
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Signatures_restricted__
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 1
je 0x14007b757
lea rcx, str.Microsoft_only_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Microsoft_only_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14007b77b
lea rcx, str.Store_only_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Store_only_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov r15, qword [rbp - 0x28]
lea rax, [0x140159cd8]
mov qword [rbp - 0x10], 4
mov qword [rbp - 8], rax
mov rcx, qword [r15]
cmp rcx, 4
jb 0x14007b7fa
mov rax, qword [r15 + 8]
lea rdx, [rbp - 0x10]
add rax, 0xfffffffffffffffc
mov qword [rbp - 0x20], 4
add rcx, rax
xor r8d, r8d
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14007b7fa
mov r8, qword [r15]
mov rcx, qword [r15 + 8]
mov rdx, r8
and rdx, 0xfffffffffffffffe
sub rdx, 4
sub r8, rdx
add rcx, rdx
sub r8, 4
lea rdx, [rcx + 4]
call fcn.14010e700
add qword [r15], 0xfffffffffffffffc
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov word [rcx + rax], bx
mov rdx, qword [r15]
add rdx, 2
cmp qword [rbp - 0x30], rdx
jae 0x14007b814
lea rcx, [rbp - 0x30]
call fcn.1400ccb80
mov r15, qword [rbp - 0x28]
mov rcx, qword [r15 + 8]
mov edx, 0x29
mov rax, qword [r15]
mov qword [rsi], r15
mov word [rcx + rax], dx
add qword [r15], 2
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov word [rcx + rax], bx
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0x76
mov qword [rbp - 0x30], 0x64
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rbp - 0x28], rcx
mov qword [rax], 0x64
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x64], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Image_signature_restrictions_are_enabled_for_this_process._r_n
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Image_signature_restrictions_are_enabled_for_this_process._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 1
je 0x14007b8c4
lea rcx, str.Only_Microsoft_signatures_are_allowed._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Only_Microsoft_signatures_are_allowed._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14007b8ea
lea rcx, str.Only_Windows_Store_signatures_are_allowed._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Only_Windows_Store_signatures_are_allowed._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 4
je 0x14007ab51
lea rcx, str.This_is_an_opt_in_restriction._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.This_is_an_opt_in_restriction._r_n
jmp 0x14007ab44
test byte [rdi], 1
je 0x14007c0d4
xor ebx, ebx
test rsi, rsi
je 0x14007b971
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x44]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x32
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x32], bx
movups xmm0, xmmword [str.Non_system_fonts_disabled]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401640a8]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401640b8]
movups xmmword [rcx + 0x20], xmm0
movzx eax, word [0x1401640c8]
mov word [rcx + 0x30], ax
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0x76
mov qword [rbp - 0x30], 0x64
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rbp - 0x28], rcx
mov qword [rax], 0x64
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x64], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Non_system_fonts_cannot_be_used_in_this_process._r_n
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Non_system_fonts_cannot_be_used_in_this_process._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
test byte [rdi], 2
je 0x14007ab51
lea rcx, str.Loading_a_non_system_font_in_this_process_will_trigger_an_ETW_event._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Loading_a_non_system_font_in_this_process_will_trigger_an_ETW_event._r_n
jmp 0x14007ab44
xor ebx, ebx
test byte [rdi], 3
je 0x14007bc09
test rsi, rsi
je 0x14007bb6e
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x44]
mov qword [rbp - 0x30], 0x32
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rbp - 0x28], rcx
mov qword [rax], 0x32
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x32], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Images_restricted__
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Images_restricted__
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 1
je 0x14007ba8f
lea rcx, str.remote_images_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.remote_images_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14007bab3
lea rcx, str.low_mandatory_label_images_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.low_mandatory_label_images_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov r15, qword [rbp - 0x28]
lea rax, [0x140159cd8]
mov qword [rbp - 0x10], 4
mov qword [rbp - 8], rax
mov rcx, qword [r15]
cmp rcx, 4
jb 0x14007bb32
mov rax, qword [r15 + 8]
lea rdx, [rbp - 0x10]
add rax, 0xfffffffffffffffc
mov qword [rbp - 0x20], 4
add rcx, rax
xor r8d, r8d
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14007bb32
mov r8, qword [r15]
mov rcx, qword [r15 + 8]
mov rdx, r8
and rdx, 0xfffffffffffffffe
sub rdx, 4
sub r8, rdx
add rcx, rdx
sub r8, 4
lea rdx, [rcx + 4]
call fcn.14010e700
add qword [r15], 0xfffffffffffffffc
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov word [rcx + rax], bx
mov rdx, qword [r15]
add rdx, 2
cmp qword [rbp - 0x30], rdx
jae 0x14007bb4c
lea rcx, [rbp - 0x30]
call fcn.1400ccb80
mov r15, qword [rbp - 0x28]
mov rcx, qword [r15 + 8]
mov edx, 0x29
mov rax, qword [r15]
mov qword [rsi], r15
mov word [rcx + rax], dx
add qword [r15], 2
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov word [rcx + rax], bx
test r14, r14
je 0x14007bc07
mov rdx, qword [0x140196800]
mov ecx, 0x44
mov qword [rbp - 0x30], 0x32
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rbp - 0x28], rcx
mov qword [rax], 0x32
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x32], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
mov word [rax], bx
mov eax, dword [rdi]
test al, 1
je 0x14007bbdc
lea rcx, str.Remotely_located_images_cannot_be_loaded_into_the_process._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Remotely_located_images_cannot_be_loaded_into_the_process._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14007bc00
lea rcx, str.Images_with_a_Low_mandatory_label_cannot_be_loaded_into_the_process._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Images_with_a_Low_mandatory_label_cannot_be_loaded_into_the_process._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov rax, qword [rbp - 0x28]
mov qword [r14], rax
mov dl, 1
test byte [rdi], 4
je 0x14007c0d4
test rsi, rsi
je 0x14007bc70
mov rdx, qword [0x140196800]
mov ecx, 0x3e
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x2c
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x2c], bx
movups xmm0, xmmword [str.Prefer_system32_images]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140164380]
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [0x140164390]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [0x140164398]
mov dword [rcx + 0x28], eax
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0x150
call sym.ProcessHacker.exe_PhCreateObject
mov r9, rax
lea rdx, str.Forces_images_to_load_from_the_System32_folder_in_which_Windows_is_installed_first__then_from_the_application_directory_before_the_standard_DLL_search_order._r_n
mov r8d, 2
mov qword [rax], 0x13e
add rax, 0x10
mov qword [r9 + 8], rax
mov word [rax + 0x13e], bx
mov rcx, qword [r9 + 8]
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rdx]
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rdx + 0x70]
sub rdx, 0xffffffffffffff80
movups xmmword [rcx - 0x10], xmm1
sub r8, 1
jne 0x14007bcc0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rdx + 0x30]
mov qword [rcx + 0x30], rax
mov eax, dword [rdx + 0x38]
mov dword [rcx + 0x38], eax
movzx eax, word [rdx + 0x3c]
mov dl, 1
mov word [rcx + 0x3c], ax
mov qword [r14], r9
jmp 0x14007c0d4
test byte [rdi], 0xf
je 0x14007c0d4
xor ebx, ebx
test rsi, rsi
je 0x14007bdaf
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x3c]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x2a
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x2a], bx
movups xmm0, xmmword [str.System_call_filtering]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401644f0]
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [0x140164500]
movsd qword [rcx + 0x20], xmm0
movzx eax, word [0x140164508]
mov word [rcx + 0x28], ax
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0x56
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x44
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x44], bx
mov rcx, qword [rdx + 8]
movups xmm0, xmmword [str.System_call_filtering_is_active._r_n]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140164520]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x140164530]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [0x140164540]
movups xmmword [rcx + 0x30], xmm1
mov eax, dword [0x140164550]
mov dword [rcx + 0x40], eax
mov qword [r14], rdx
mov dl, 1
jmp 0x14007c0d4
test dword [rdi], 0x555
je 0x14007c0d4
xor ebx, ebx
test rsi, rsi
je 0x14007be82
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x3a]
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rsi], rcx
mov qword [rax], 0x28
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x28], bx
movups xmm0, xmmword [str.Payload_restrictions]
mov rax, qword [rcx + 8]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140164568]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140164578]
movsd qword [rax + 0x20], xmm0
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0x76
mov qword [rbp - 0x30], 0x64
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rbp - 0x28], rcx
mov qword [rax], 0x64
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x64], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Payload_restrictions_are_enabled_for_this_process._r_n
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Payload_restrictions_are_enabled_for_this_process._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 1
je 0x14007bf10
lea rcx, str.Export_Address_Filtering_is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Export_Address_Filtering_is_enabled._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 4
je 0x14007bf36
lea rcx, str.Export_Address_Filtering__Plus__is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Export_Address_Filtering__Plus__is_enabled._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 0x10
je 0x14007bf5c
lea rcx, str.Import_Address_Filtering_is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Import_Address_Filtering_is_enabled._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 0x40
je 0x14007bf82
lea rcx, str.StackPivot_is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.StackPivot_is_enabled._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
bt eax, 8
jae 0x14007bfaa
lea rcx, str.CallerCheck_is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.CallerCheck_is_enabled._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
bt eax, 0xa
jae 0x14007ab51
lea rcx, str.SimExec_is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.SimExec_is_enabled._r_n
jmp 0x14007ab44
test byte [rdi], 1
je 0x14007c0d4
xor ebx, ebx
test rsi, rsi
je 0x14007c049
mov rdx, qword [0x140196800]
lea ecx, [rbx + 0x50]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x3e
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x3e], bx
movups xmm0, xmmword [str.Child_process_creation_disabled]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401647b0]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401647c0]
movups xmmword [rcx + 0x20], xmm0
movsd xmm1, qword [0x1401647d0]
movsd qword [rcx + 0x30], xmm1
mov eax, dword [0x1401647d8]
mov dword [rcx + 0x38], eax
movzx eax, word [0x1401647dc]
mov word [rcx + 0x3c], ax
test r14, r14
je 0x14007ab58
mov rdx, qword [0x140196800]
mov ecx, 0x7a
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x68
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x68], bx
mov rcx, qword [rdx + 8]
movups xmm0, xmmword [str.Child_processes_cannot_be_created_by_this_process._r_n]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401647f0]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x140164800]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [0x140164810]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [0x140164820]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [0x140164830]
movups xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [0x140164840]
movsd qword [rcx + 0x60], xmm0
mov qword [r14], rdx
mov dl, 1
jmp 0x14007c0d4
xor dl, dl
mov rbx, qword [rsp + 0x70]
movzx eax, dl
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret