Function at 0x7ff7c002a420
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x13d0]
mov eax, 0x14d0
call fcn.7ff7c0142db0
sub rsp, rax
mov rax, qword [0x7ff7c01ca008]
xor rax, rsp
mov qword [rbp + 0x13c0], rax
mov edx, 0x577
mov r15, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r12, rax
mov ecx, 5
xor eax, eax
lock cmpxchg qword [0x7ff7c01d3dc0], rcx
je 0x7ff7c002a488
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c0179c58]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x1508], rbx
mov qword [rsp + 0x60], 0x16
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
xor r13d, r13d
btr eax, 0x1f
dec ecx
mov r14d, eax
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002a513
nop dword [rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x7ff7c002a50b
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rsp + 0x58]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002a549
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002a4e0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002a538
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002a558
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002a513
cmp dword [rsi], 1
jne 0x7ff7c002a513
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002a51a
mov r8d, 0xa
lea rdx, [rbp + 0x13a0]
mov ecx, ebx
call fcn.7ff7c01259e8
mov edx, 0x500
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x7ff7c002a596
xor r8d, r8d
lea r9, [rbp + 0x13a0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002a5af
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c0179c28]
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x70], 0x28
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002a632
nop dword [rax]
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x7ff7c002a62a
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp - 0x78]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002a66a
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002a600
mov edi, dword [rsp + 0x20]
mov rsi, r13
mov r14d, 5
mov eax, r14d
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002a659
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002a679
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002a632
cmp dword [rsi], 1
jne 0x7ff7c002a632
mov edi, dword [rsi + 0x28]
jmp 0x7ff7c002a639
test edi, edi
mov rbx, r13
mov edx, 0x551
mov rcx, r15
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
mov edx, 0xf1
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lock cmpxchg qword [0x7ff7c01d3dc0], r14
je 0x7ff7c002a6bf
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c0179c28]
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x40], 0x28
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword ds:[rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002a746
nop word [rax + rax]
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x7ff7c002a73e
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp - 0x48]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002a77a
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002a710
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov eax, 5
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002a769
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002a789
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002a746
cmp dword [rsi], 1
jne 0x7ff7c002a746
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002a74d
test ebx, ebx
je 0x7ff7c002a7a6
mov edx, 0x500
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
lea rax, [0x7ff7c017e7e0]
mov dword [rbp + 0x3e8], r13d
mov r15d, 5
mov qword [rbp + 0x3f8], rax
lea r9, [rbp + 0x3e0]
mov qword [rbp + 0x3e0], r15
xor r8d, r8d
mov qword [rbp + 0x408], r13
mov edx, 0x104d
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017e810]
mov dword [rbp + 0x440], r15d
lea r9, [rbp + 0x440]
mov qword [rbp + 0x458], rax
xor r8d, r8d
mov qword [rbp + 0x444], 1
mov edx, 0x104d
mov qword [rbp + 0x468], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017e838]
mov dword ds:[rbp + 0x4a0], r15d
lea r9, [rbp + 0x4a0]
mov qword [rbp + 0x4b8], rax
xor r8d, r8d
mov qword [rbp + 0x4a4], 2
mov edx, 0x104d
mov qword [rbp + 0x4c8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017e860]
mov dword ds:[rbp + 0x500], r15d
lea r9, [rbp + 0x500]
mov qword [rbp + 0x518], rax
xor r8d, r8d
mov qword [rbp + 0x504], 3
mov edx, 0x104d
mov qword [rbp + 0x528], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017e888]
mov dword ds:[rbp + 0x560], r15d
lea r9, [rbp + 0x560]
mov qword [rbp + 0x578], rax
xor r8d, r8d
mov qword [rbp + 0x564], 4
mov edx, 0x104d
mov qword [rbp + 0x588], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017e8a8]
mov dword ds:[rbp + 0x5c0], r15d
lea r9, [rbp + 0x5c0]
mov qword [rbp + 0x5d8], rax
xor r8d, r8d
mov qword [rbp + 0x5c4], r15
mov edx, 0x104d
mov qword [rbp + 0x5e8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017e8e8]
mov dword ds:[rbp + 0x620], r15d
lea r9, [rbp + 0x620]
mov qword [rbp + 0x638], rax
xor r8d, r8d
mov qword [rbp + 0x624], 6
mov edx, 0x104d
mov qword [rbp + 0x648], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017e920]
mov dword ds:[rbp + 0x680], r15d
lea r9, [rbp + 0x680]
mov qword [rbp + 0x698], rax
xor r8d, r8d
mov qword [rbp + 0x684], 7
mov edx, 0x104d
mov qword [rbp + 0x6a8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017e940]
mov dword ds:[rbp + 0x6e0], r15d
lea r9, [rbp + 0x6e0]
mov qword [rbp + 0x6f8], rax
xor r8d, r8d
mov qword [rbp + 0x6e4], 8
mov edx, 0x104d
mov qword [rbp + 0x708], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017e960]
mov dword ds:[rbp + 0x740], r15d
lea r9, [rbp + 0x740]
mov qword [rbp + 0x758], rax
xor r8d, r8d
mov qword [rbp + 0x744], 9
mov edx, 0x104d
mov qword [rbp + 0x768], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017e998]
mov dword ds:[rbp + 0x7a0], r15d
lea r9, [rbp + 0x7a0]
mov qword [rbp + 0x7b8], rax
xor r8d, r8d
mov qword [rbp + 0x7a4], 0xa
mov edx, 0x104d
mov qword [rbp + 0x7c8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017e9e0]
mov dword ds:[rbp + 0x800], r15d
lea r9, [rbp + 0x800]
mov qword [rbp + 0x818], rax
xor r8d, r8d
mov qword [rbp + 0x804], 0xb
mov edx, 0x104d
mov qword [rbp + 0x828], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017ea30]
mov dword ds:[rbp + 0x860], r15d
lea r9, [rbp + 0x860]
mov qword [rbp + 0x878], rax
xor r8d, r8d
mov qword [rbp + 0x864], 0xc
mov edx, 0x104d
mov qword [rbp + 0x888], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017ea80]
mov dword ds:[rbp + 0x8c0], r15d
lea r9, [rbp + 0x8c0]
mov qword [rbp + 0x8d8], rax
xor r8d, r8d
mov qword [rbp + 0x8c4], 0xd
mov edx, 0x104d
mov qword [rbp + 0x8e8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017eab8]
mov dword ds:[rbp + 0x920], r15d
lea r9, [rbp + 0x920]
mov qword [rbp + 0x938], rax
xor r8d, r8d
mov qword [rbp + 0x924], 0xe
mov edx, 0x104d
mov qword [rbp + 0x948], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017eaf8]
mov dword ds:[rbp + 0x980], r15d
lea r9, [rbp + 0x980]
mov qword [rbp + 0x998], rax
xor r8d, r8d
mov qword [rbp + 0x984], 0xf
mov edx, 0x104d
mov qword [rbp + 0x9a8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword ds:[rbp + 0x9e0], r15d
lea rax, [0x7ff7c017eb30]
mov qword [rbp + 0x9e4], 0x10
lea r9, [rbp + 0x9e0]
mov qword [rbp + 0x9f8], rax
xor r8d, r8d
mov qword [rbp + 0xa08], r13
mov edx, 0x104d
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017eb80]
mov dword ds:[rbp + 0xa40], r15d
lea r9, [rbp + 0xa40]
mov qword [rbp + 0xa58], rax
xor r8d, r8d
mov qword [rbp + 0xa44], 0x11
mov edx, 0x104d
mov qword [rbp + 0xa68], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017ebd0]
mov dword ds:[rbp + 0xaa0], r15d
lea r9, [rbp + 0xaa0]
mov qword [rbp + 0xab8], rax
xor r8d, r8d
mov qword [rbp + 0xaa4], 0x12
mov edx, 0x104d
mov qword [rbp + 0xac8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017ec00]
mov dword ds:[rbp + 0xb00], r15d
lea r9, [rbp + 0xb00]
mov qword [rbp + 0xb18], rax
xor r8d, r8d
mov qword [rbp + 0xb04], 0x13
mov edx, 0x104d
mov qword [rbp + 0xb28], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017ec40]
mov dword ds:[rbp + 0xb60], r15d
lea r9, [rbp + 0xb60]
mov qword [rbp + 0xb78], rax
xor r8d, r8d
mov qword [rbp + 0xb64], 0x14
mov edx, 0x104d
mov qword [rbp + 0xb88], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x7ff7c017ec90]
mov dword ds:[rbp + 0x380], r15d
lea r9, [rbp + 0x380]
mov qword [rbp + 0x398], rax
xor r8d, r8d
mov qword [rbp + 0x384], 0x15
mov edx, 0x104d
mov qword [rbp + 0x3a8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xbd0], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], r15
je 0x7ff7c002ad49
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c01794f0]
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x10], 0x28
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002adc6
nop dword [rax]
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x7ff7c002adbe
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp - 0x18]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002adf8
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002ad90
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov rax, r15
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002ade7
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002ae07
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002adc6
cmp dword [rsi], 1
jne 0x7ff7c002adc6
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002adcd
mov r14d, 0x1000
lea r9, [rbp + 0xbc0]
mov eax, r14d
mov ecx, 0x2000
test ebx, ebx
cmovne eax, ecx
lea edx, [r14 + 0x2b]
xor r8d, r8d
mov dword [rbp + 0xbcc], eax
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xc30], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], r15
je 0x7ff7c002ae5a
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017a4f8]
mov qword ds:[rbp + 0x28], rax
lea rcx, [rbp + 0x18]
mov qword [rbp + 0x20], 0x16
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword ds:[rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002aee6
nop word [rax + rax]
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002aede
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x18]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002af1c
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002aeb0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002af0b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002af2f
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
nop dword [rax]
test rsi, rsi
je 0x7ff7c002aee6
cmp dword [rsi], 1
jne 0x7ff7c002aee6
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002aeed
mov eax, r14d
lea r9, [rbp + 0xc20]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 1
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xc2c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xc90], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002af85
lea rcx, [0x7ff7c01d3dc0]
nop dword [rax + rax]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017a968]
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x50], 0x1c
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002b006
nop dword [rax + rax]
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002affe
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x48]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002b03c
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002afd0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002b02b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002b04f
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
nop dword [rax]
test rsi, rsi
je 0x7ff7c002b006
cmp dword [rsi], 1
jne 0x7ff7c002b006
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002b00d
mov eax, r14d
lea r9, [rbp + 0xc80]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 2
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xc8c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xcf0], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002b0a5
lea rcx, [0x7ff7c01d3dc0]
nop dword [rax + rax]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017a248]
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0x78]
mov qword [rbp + 0x80], 0x16
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002b126
nop
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002b11e
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x78]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002b15c
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002b0f0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002b14b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002b16f
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
nop dword [rax]
test rsi, rsi
je 0x7ff7c002b126
cmp dword [rsi], 1
jne 0x7ff7c002b126
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002b12d
mov eax, r14d
lea r9, [rbp + 0xce0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 4
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xcec], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xd50], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002b1c5
lea rcx, [0x7ff7c01d3dc0]
nop dword [rax + rax]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017df48]
mov qword [rbp + 0xb8], rax
lea rcx, [rbp + 0xa8]
mov qword [rbp + 0xb0], 0x2a
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002b24c
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002b244
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0xa8]
call qword [case.0x7ff7c00c1f48.0]
nop dword [rax]
test al, al
jne 0x7ff7c002b287
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002b211
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002b271
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002b296
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002b24c
cmp dword [rsi], 1
jne 0x7ff7c002b24c
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002b253
mov eax, r14d
lea r9, [rbp + 0xd40]
mov ecx, 0x2000
test ebx, ebx
mov r8, rdi
mov edx, 0x102b
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xd4c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xdb0], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002b2e9
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c0179578]
mov qword [rbp + 0xe8], rax
lea rcx, [rbp + 0xd8]
mov qword [rbp + 0xe0], 0x12
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002b375
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002b36d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0xd8]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002b3ab
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002b340
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002b39a
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002b3ba
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002b375
cmp dword [rsi], 1
jne 0x7ff7c002b375
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002b37c
mov eax, r14d
lea r9, [rbp + 0xda0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 6
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xdac], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xe10], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002b40b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c0152628]
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x108]
mov qword [rbp + 0x110], 0x1c
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002b495
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002b48d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x108]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002b4cb
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002b460
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002b4ba
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002b4da
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002b495
cmp dword [rsi], 1
jne 0x7ff7c002b495
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002b49c
mov eax, r14d
lea r9, [rbp + 0xe00]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 7
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xe0c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xe70], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002b52b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c0179bf0]
mov qword [rbp + 0x148], rax
lea rcx, [rbp + 0x138]
mov qword [rbp + 0x140], 0x1a
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002b5b5
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002b5ad
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x138]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002b5eb
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002b580
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002b5da
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002b5fa
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002b5b5
cmp dword [rsi], 1
jne 0x7ff7c002b5b5
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002b5bc
mov eax, r14d
lea r9, [rbp + 0xe60]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 8
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xe6c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xed0], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002b64b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c0174498]
mov qword [rbp + 0x178], rax
lea rcx, [rbp + 0x168]
mov qword [rbp + 0x170], 0x22
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002b6d5
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002b6cd
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x168]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002b70b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002b6a0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002b6fa
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002b71a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002b6d5
cmp dword [rsi], 1
jne 0x7ff7c002b6d5
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002b6dc
mov eax, r14d
lea r9, [rbp + 0xec0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 9
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xecc], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xf30], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002b76b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017a9e8]
mov qword [rbp + 0x1a8], rax
lea rcx, [rbp + 0x198]
mov qword [rbp + 0x1a0], 0x26
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002b7f5
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002b7ed
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x198]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002b82b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002b7c0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002b81a
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002b83a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002b7f5
cmp dword [rsi], 1
jne 0x7ff7c002b7f5
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002b7fc
mov eax, r14d
lea r9, [rbp + 0xf20]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xa
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xf2c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xf90], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002b88b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017aab8]
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0x1c8]
mov qword [rbp + 0x1d0], 0x24
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002b915
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002b90d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x1c8]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002b94b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002b8e0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002b93a
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002b95a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002b915
cmp dword [rsi], 1
jne 0x7ff7c002b915
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002b91c
mov eax, r14d
lea r9, [rbp + 0xf80]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xb
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xf8c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xff0], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002b9ab
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c0179520]
mov qword [rbp + 0x208], rax
lea rcx, [rbp + 0x1f8]
mov qword [rbp + 0x200], 0x24
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002ba35
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002ba2d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x1f8]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002ba6b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002ba00
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002ba5a
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002ba7a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002ba35
cmp dword [rsi], 1
jne 0x7ff7c002ba35
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002ba3c
mov eax, r14d
lea r9, [rbp + 0xfe0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xc
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xfec], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x1050], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002bacb
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017aa40]
mov qword [rbp + 0x238], rax
lea rcx, [rbp + 0x228]
mov qword [rbp + 0x230], 0x28
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002bb55
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002bb4d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x228]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002bb8b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002bb20
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002bb7a
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002bb9a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002bb55
cmp dword [rsi], 1
jne 0x7ff7c002bb55
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002bb5c
mov eax, r14d
lea r9, [rbp + 0x1040]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xd
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x104c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x10b0], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002bbeb
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017ece0]
mov qword [rbp + 0x268], rax
lea rcx, [rbp + 0x258]
mov qword [rbp + 0x260], 0x2e
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002bc75
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002bc6d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x258]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002bcab
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002bc40
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002bc9a
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002bcba
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002bc75
cmp dword [rsi], 1
jne 0x7ff7c002bc75
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002bc7c
mov eax, r14d
lea r9, [rbp + 0x10a0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xe
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x10ac], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x1110], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002bd0b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017ed10]
mov qword [rbp + 0x298], rax
lea rcx, [rbp + 0x288]
mov qword [rbp + 0x290], 0x2a
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002bd95
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002bd8d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x288]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002bdcb
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002bd60
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002bdba
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002bdda
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002bd95
cmp dword [rsi], 1
jne 0x7ff7c002bd95
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002bd9c
mov eax, r14d
lea r9, [rbp + 0x1100]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xf
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x110c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x1170], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002be2b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017aa70]
mov qword [rbp + 0x2c8], rax
lea rcx, [rbp + 0x2b8]
mov qword [rbp + 0x2c0], 0x18
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002beb5
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002bead
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x2b8]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002beeb
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002be80
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002beda
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002befa
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002beb5
cmp dword [rsi], 1
jne 0x7ff7c002beb5
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002bebc
mov eax, r14d
lea r9, [rbp + 0x1160]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0x10
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x116c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x11d0], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002bf4b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017aa90]
mov qword [rbp + 0x2f8], rax
lea rcx, [rbp + 0x2e8]
mov qword [rbp + 0x2f0], 0x26
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002bfd5
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002bfcd
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x2e8]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002c00b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002bfa0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002bffa
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002c01a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002bfd5
cmp dword [rsi], 1
jne 0x7ff7c002bfd5
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002bfdc
mov eax, r14d
lea r9, [rbp + 0x11c0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0x11
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x11cc], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x1230], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002c06b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017e0d8]
mov qword [rbp + 0x328], rax
lea rcx, [rbp + 0x318]
mov qword [rbp + 0x320], 0x1e
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002c0f5
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002c0ed
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x318]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002c12b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002c0c0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002c11a
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002c13a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002c0f5
cmp dword [rsi], 1
jne 0x7ff7c002c0f5
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002c0fc
mov eax, r14d
lea r9, [rbp + 0x1220]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0x12
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x122c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x1290], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002c18b
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017a988]
mov qword [rbp + 0x358], rax
lea rcx, [rbp + 0x348]
mov qword [rbp + 0x350], 0x2a
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002c215
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002c20d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x348]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002c24b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002c1e0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002c23a
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002c25a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x7ff7c002c215
cmp dword [rsi], 1
jne 0x7ff7c002c215
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002c21c
mov eax, r14d
lea r9, [rbp + 0x1280]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0x13
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x128c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x12f0], 0xf000
lock cmpxchg qword [0x7ff7c01d3dc0], rdi
je 0x7ff7c002c2ab
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x7ff7c01d78b0]
lea rax, [0x7ff7c017ed40]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x30], 0x22
mov rax, qword [rdi + 0x10]
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7c002c327
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x7ff7c002c31f
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rsp + 0x28]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7c002c35b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7c002c2f1
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov eax, 5
lock cmpxchg qword [0x7ff7c01d3dc0], r13
je 0x7ff7c002c34a
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x7ff7c002c36f
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
nop dword [rax + rax]
test rsi, rsi
je 0x7ff7c002c327
cmp dword [rsi], 1
jne 0x7ff7c002c327
mov ebx, dword [rsi + 0x28]
jmp 0x7ff7c002c32e
test ebx, ebx
lea r9, [rbp + 0x12e0]
mov ebx, 0x2000
mov edx, 0x102b
cmovne r14d, ebx
mov r8d, 0x14
mov rcx, r12
mov dword [rbp + 0x12ec], r14d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x7ff7c01d467c], r13b
je 0x7ff7c002c3d0
lea r9, [rbp + 0x1340]
mov dword [rbp + 0x1350], 0xf000
mov edx, 0x102b
mov dword [rbp + 0x134c], ebx
mov r8d, 3
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x1508]
mov rcx, qword [rbp + 0x13c0]
xor rcx, rsp
call fcn.7ff7c0121390
lea r11, [rsp + 0x14d0]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret