Function at 0x140050c40
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf20]
mov eax, 0x1020
call fcn.14012b380
sub rsp, rax
mov edx, 0x577
mov r12, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rcx, str.SampleCount
mov r14, rax
call sym.ProcessHacker.exe_PhGetIntegerSetting
mov r8d, eax
xor r9d, r9d
mov edx, 0x500
mov rcx, r12
call qword [sym.imp.USER32.dll_SetDlgItemInt]
lea rax, str.SampleCountAutomatic
mov qword [rsp + 0x20], 0x28
mov qword [rsp + 0x28], rax
mov ecx, 5
xor eax, eax
lock cmpxchg qword [0x140193950], rcx
je 0x140050ccc
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x740]
mov qword [rsp + 0x1050], rbx
movups xmmword [rbp + 0x748], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
xor r13d, r13d
btr eax, 0x1f
dec ecx
mov r15d, eax
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140050d3e
nop
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x140050d36
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x740]
call qword [rdi + VariantCopy]
test al, al
jne 0x140050d41
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140050d10
mov rsi, r13
test rsi, rsi
je 0x140050d50
cmp dword [rsi], 1
jne 0x140050d50
mov edi, dword [rsi + 0x28]
jmp 0x140050d59
mov edi, dword [rbp + 0xf58]
mov rsi, r13
mov r15d, 5
mov eax, r15d
lock cmpxchg qword [0x140193950], r13
je 0x140050d79
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x140050d8a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test edi, edi
mov rbx, r13
mov edx, 0x551
mov rcx, r12
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
mov edx, 0xf1
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.SampleCountAutomatic
mov qword [rsp + 0x20], 0x28
mov qword [rsp + 0x28], rax
xor eax, eax
lock cmpxchg qword [0x140193950], r15
je 0x140050de2
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x770]
movups xmmword [rbp + 0x778], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140050e4e
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x140050e46
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x770]
call qword [rdi + VariantCopy]
test al, al
jne 0x140050e51
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140050e20
mov rsi, r13
test rsi, rsi
je 0x140050e60
cmp dword [rsi], 1
jne 0x140050e60
mov ebx, dword [rsi + 0x28]
jmp 0x140050e69
mov ebx, dword [rbp + 0xf58]
mov rsi, r13
mov eax, 5
lock cmpxchg qword [0x140193950], r13
je 0x140050e85
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x140050e96
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test ebx, ebx
je 0x140050eb3
mov edx, 0x500
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
lea rax, str.Allow_only_one_instance
mov dword [rbp - 0x68], r13d
mov r12d, 5
mov qword [rbp - 0x58], rax
lea r9, [rbp - 0x70]
mov qword [rbp - 0x70], r12
xor r8d, r8d
mov qword [rbp - 0x48], r13
mov edx, 0x104d
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Hide_when_closed
mov dword [rbp - 0x10], r12d
lea r9, [rbp - 0x10]
mov qword [rbp + 8], rax
xor r8d, r8d
mov qword [rbp - 0xc], 1
mov edx, 0x104d
mov qword [rbp + 0x18], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Hide_when_minimized
mov dword [rbp + 0x50], r12d
lea r9, [rbp + 0x50]
mov qword [rbp + 0x68], rax
xor r8d, r8d
mov qword [rbp + 0x54], 2
mov edx, 0x104d
mov qword [rbp + 0x78], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Start_when_I_log_on
mov dword [rbp + 0xb0], r12d
lea r9, [rbp + 0xb0]
mov qword [rbp + 0xc8], rax
xor r8d, r8d
mov qword [rbp + 0xb4], 3
mov edx, 0x104d
mov qword [rbp + 0xd8], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Start_hidden
mov dword [rbp + 0x170], r12d
lea r9, [rbp + 0x170]
mov qword [rbp + 0x188], rax
xor r8d, r8d
mov qword [rbp + 0x174], 4
mov edx, 0x104d
mov qword [rbp + 0x198], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_tray_information_window
mov dword [rbp + 0x1d0], r12d
lea r9, [rbp + 0x1d0]
mov qword [rbp + 0x1e8], rax
xor r8d, r8d
mov qword [rbp + 0x1d4], r12
mov edx, 0x104d
mov qword [rbp + 0x1f8], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_kernel_mode_driver
mov dword [rbp + 0x230], r12d
lea r9, [rbp + 0x230]
mov qword [rbp + 0x248], rax
xor r8d, r8d
mov qword [rbp + 0x234], 6
mov edx, 0x104d
mov qword [rbp + 0x258], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_warnings
mov dword [rbp + 0x290], r12d
lea r9, [rbp + 0x290]
mov qword [rbp + 0x2a8], rax
xor r8d, r8d
mov qword [rbp + 0x294], 7
mov edx, 0x104d
mov qword [rbp + 0x2b8], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_plugins
mov dword [rbp + 0x2f0], r12d
lea r9, [rbp + 0x2f0]
mov qword [rbp + 0x308], rax
xor r8d, r8d
mov qword [rbp + 0x2f4], 8
mov edx, 0x104d
mov qword [rbp + 0x318], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Resolve_network_addresses
mov dword [rbp + 0x350], r12d
lea r9, [rbp + 0x350]
mov qword [rbp + 0x368], rax
xor r8d, r8d
mov qword [rbp + 0x354], 9
mov edx, 0x104d
mov qword [rbp + 0x378], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Show_tooltips_instantly
mov dword [rsp + 0x30], r12d
lea r9, [rsp + 0x30]
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov qword [rsp + 0x34], 0xa
mov edx, 0x104d
mov qword [rsp + 0x58], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_cycle_based_CPU_usage
mov dword [rbp + 0x110], r12d
lea r9, [rbp + 0x110]
mov qword [rbp + 0x128], rax
xor r8d, r8d
mov qword [rbp + 0x114], 0xb
mov edx, 0x104d
mov qword [rbp + 0x138], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Check_images_for_digital_signatures
mov dword [rbp + 0x3b0], r12d
lea r9, [rbp + 0x3b0]
mov qword [rbp + 0x3c8], rax
xor r8d, r8d
mov qword [rbp + 0x3b4], 0xc
mov edx, 0x104d
mov qword [rbp + 0x3d8], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Collapse_services_on_start
mov dword [rbp + 0x410], r12d
lea r9, [rbp + 0x410]
mov qword [rbp + 0x428], rax
xor r8d, r8d
mov qword [rbp + 0x414], 0xd
mov edx, 0x104d
mov qword [rbp + 0x438], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Single_click_tray_icons
mov dword [rbp + 0x470], r12d
lea r9, [rbp + 0x470]
mov qword [rbp + 0x488], rax
xor r8d, r8d
mov qword [rbp + 0x474], 0xe
mov edx, 0x104d
mov qword [rbp + 0x498], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Icon_click_toggles_visibility
mov dword [rbp + 0x4d0], r12d
lea r9, [rbp + 0x4d0]
mov qword [rbp + 0x4e8], rax
xor r8d, r8d
mov qword [rbp + 0x4d4], 0xf
mov edx, 0x104d
mov qword [rbp + 0x4f8], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rbp + 0x530], r12d
lea rax, str.Include_usage_of_collapsed_processes
mov qword [rbp + 0x534], 0x10
lea r9, [rbp + 0x530]
mov qword [rbp + 0x548], rax
xor r8d, r8d
mov qword [rbp + 0x558], r13
mov edx, 0x104d
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Show_advanced_options
mov dword [rbp + 0x590], r12d
lea r9, [rbp + 0x590]
mov qword [rbp + 0x5a8], rax
xor r8d, r8d
mov qword [rbp + 0x594], 0x11
mov edx, 0x104d
mov qword [rbp + 0x5b8], r13
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.AllowOnlyOneInstance
mov dword [rbp + 0x870], 0xf000
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], 0x28
lock cmpxchg qword [0x140193950], r12
je 0x140051320
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x7a0]
movups xmmword [rbp + 0x7a8], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14005138e
nop dword [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x140051386
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x7a0]
call qword [rdi + VariantCopy]
test al, al
jne 0x140051391
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140051360
mov rsi, r13
test rsi, rsi
je 0x1400513a0
cmp dword [rsi], 1
jne 0x1400513a0
mov ebx, dword [rsi + 0x28]
jmp 0x1400513a9
mov ebx, dword [rbp + 0xf58]
mov rsi, r13
mov rax, r12
lock cmpxchg qword [0x140193950], r13
je 0x1400513c3
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x1400513d4
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov r15d, 0x1000
lea r9, [rbp + 0x860]
mov eax, r15d
test ebx, ebx
mov edi, 0x2000
mov rcx, r14
cmovne eax, edi
xor r8d, r8d
lea edx, [r15 + 0x2b]
mov dword [rbp + 0x86c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, str.HideOnClose
mov dword [rbp + 0x8d0], 0xf000
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
lea r9, [rbp + 0x8c0]
mov ecx, r15d
lea edx, [r15 + 0x2b]
cmovne ecx, edi
mov r8d, 1
mov dword [rbp + 0x8cc], ecx
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.HideOnMinimize
mov dword [rbp + 0x930], 0xf000
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], 0x1c
lock cmpxchg qword [0x140193950], r12
je 0x14005147a
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x7d0]
movups xmmword [rbp + 0x7d8], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r12d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x1400514ee
nop dword [rax]
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r12d
jne 0x1400514e6
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x7d0]
call qword [rdi + VariantCopy]
test al, al
jne 0x1400514f1
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x1400514c0
mov rsi, r13
test rsi, rsi
je 0x140051500
cmp dword [rsi], 1
jne 0x140051500
mov ebx, dword [rsi + 0x28]
jmp 0x140051509
mov ebx, dword [rbp + 0xf58]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140193950], r13
je 0x140051527
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x140051538
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov eax, r15d
lea r9, [rbp + 0x920]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 2
cmovne eax, ecx
mov rcx, r14
mov dword [rbp + 0x92c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.EnableWarnings
mov dword [rbp + 0x990], 0xf000
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], 0x1c
lock cmpxchg qword [0x140193950], rdi
je 0x14005159e
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x800]
movups xmmword [rbp + 0x808], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r12d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14005160e
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r12d
jne 0x140051606
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x800]
call qword [rdi + VariantCopy]
test al, al
jne 0x140051611
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x1400515e0
mov rsi, r13
test rsi, rsi
je 0x140051620
cmp dword [rsi], 1
jne 0x140051620
mov ebx, dword [rsi + 0x28]
jmp 0x140051629
mov ebx, dword [rbp + 0xf58]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140193950], r13
je 0x140051647
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x140051658
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test ebx, ebx
lea r9, [rbp + 0x980]
mov eax, r15d
mov ebx, 0x2000
cmovne eax, ebx
mov edx, 0x102b
mov r8d, 7
mov dword [rbp + 0x98c], eax
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, str.EnablePlugins
mov dword [rbp + 0x9f0], 0xf000
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
lea r9, [rbp + 0x9e0]
mov ecx, r15d
mov edx, 0x102b
cmovne ecx, ebx
mov r8d, 8
mov dword [rbp + 0x9ec], ecx
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.MiniInfoWindowEnabled
mov dword [rbp + 0xa50], 0xf000
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], 0x2a
lock cmpxchg qword [0x140193950], rdi
je 0x1400516fd
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x710]
movups xmmword [rbp + 0x718], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r12d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14005176e
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r12d
jne 0x140051766
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x710]
call qword [rdi + VariantCopy]
test al, al
jne 0x140051771
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140051740
mov rsi, r13
test rsi, rsi
je 0x140051780
cmp dword [rsi], 1
jne 0x140051780
mov ebx, dword [rsi + 0x28]
jmp 0x140051789
mov ebx, dword [rbp + 0xf58]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140193950], r13
je 0x1400517a7
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x1400517b8
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test ebx, ebx
lea r9, [rbp + 0xa40]
mov eax, r15d
mov ebx, 0x2000
cmovne eax, ebx
mov r8, rdi
mov edx, 0x102b
mov dword [rbp + 0xa4c], eax
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, str.EnableKph
mov dword [rbp + 0xab0], 0xf000
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
lea r9, [rbp + 0xaa0]
mov ecx, r15d
mov edx, 0x102b
cmovne ecx, ebx
mov r8d, 6
mov dword [rbp + 0xaac], ecx
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, str.EnableStage2
mov dword [rbp + 0xb10], 0xf000
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
lea r9, [rbp + 0xb00]
mov ecx, r15d
mov edx, 0x102b
cmovne ecx, ebx
mov r8d, 0xc
mov dword [rbp + 0xb0c], ecx
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.EnableNetworkResolve
mov dword [rbp + 0xb70], 0xf000
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], 0x28
lock cmpxchg qword [0x140193950], rdi
je 0x140051899
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x830]
movups xmmword [rbp + 0x838], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r12d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x1400518ff
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r12d
jne 0x1400518f7
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x830]
call qword [rdi + VariantCopy]
test al, al
jne 0x140051902
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x1400518d1
mov rsi, r13
test rsi, rsi
je 0x140051911
cmp dword [rsi], 1
jne 0x140051911
mov ebx, dword [rsi + 0x28]
jmp 0x14005191a
mov ebx, dword [rbp + 0xf58]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140193950], r13
je 0x140051938
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x140051949
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov eax, r15d
lea r9, [rbp + 0xb60]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 9
cmovne eax, ecx
mov rcx, r14
mov dword [rbp + 0xb6c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.PropagateCpuUsage
mov dword [rbp + 0xbd0], 0xf000
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], 0x22
lock cmpxchg qword [0x140193950], rdi
je 0x1400519af
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x5f0]
movups xmmword [rbp + 0x5f8], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r12d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140051a1e
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r12d
jne 0x140051a16
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x5f0]
call qword [rdi + VariantCopy]
test al, al
jne 0x140051a21
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x1400519f0
mov rsi, r13
test rsi, rsi
je 0x140051a30
cmp dword [rsi], 1
jne 0x140051a30
mov ebx, dword [rsi + 0x28]
jmp 0x140051a39
mov ebx, dword [rbp + 0xf58]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140193950], r13
je 0x140051a57
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x140051a68
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov eax, r15d
lea r9, [rbp + 0xbc0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0x10
cmovne eax, ecx
mov rcx, r14
mov dword [rbp + 0xbcc], eax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.EnableInstantTooltips
mov dword [rbp + 0xc30], 0xf000
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], 0x2a
lock cmpxchg qword [0x140193950], rdi
je 0x140051ace
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x620]
movups xmmword [rbp + 0x628], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r12d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140051b3e
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r12d
jne 0x140051b36
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x620]
call qword [rdi + VariantCopy]
test al, al
jne 0x140051b41
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140051b10
mov rsi, r13
test rsi, rsi
je 0x140051b50
cmp dword [rsi], 1
jne 0x140051b50
mov ebx, dword [rsi + 0x28]
jmp 0x140051b59
mov ebx, dword [rbp + 0xf58]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140193950], r13
je 0x140051b77
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x140051b88
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov eax, r15d
lea r9, [rbp + 0xc20]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xa
cmovne eax, ecx
mov rcx, r14
mov dword [rbp + 0xc2c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.EnableCycleCpuUsage
mov dword [rbp + 0xc90], 0xf000
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], 0x26
lock cmpxchg qword [0x140193950], rdi
je 0x140051bee
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x650]
movups xmmword [rbp + 0x658], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r12d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140051c5e
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r12d
jne 0x140051c56
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x650]
call qword [rdi + VariantCopy]
test al, al
jne 0x140051c61
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140051c30
mov rsi, r13
test rsi, rsi
je 0x140051c70
cmp dword [rsi], 1
jne 0x140051c70
mov ebx, dword [rsi + 0x28]
jmp 0x140051c79
mov ebx, dword [rbp + 0xf58]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140193950], r13
je 0x140051c97
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x140051ca8
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov eax, r15d
lea r9, [rbp + 0xc80]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xb
cmovne eax, ecx
mov rcx, r14
mov dword [rbp + 0xc8c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.CollapseServicesOnStart
mov dword [rbp + 0xcf0], 0xf000
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], 0x2e
lock cmpxchg qword [0x140193950], rdi
je 0x140051d0e
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x680]
movups xmmword [rbp + 0x688], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r12d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140051d7e
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r12d
jne 0x140051d76
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x680]
call qword [rdi + VariantCopy]
test al, al
jne 0x140051d81
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140051d50
mov rsi, r13
test rsi, rsi
je 0x140051d90
cmp dword [rsi], 1
jne 0x140051d90
mov ebx, dword [rsi + 0x28]
jmp 0x140051d99
mov ebx, dword [rbp + 0xf58]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140193950], r13
je 0x140051db7
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x140051dc8
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov eax, r15d
lea r9, [rbp + 0xce0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xd
cmovne eax, ecx
mov rcx, r14
mov dword [rbp + 0xcec], eax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.IconSingleClick
mov dword [rbp + 0xd50], 0xf000
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], 0x1e
lock cmpxchg qword [0x140193950], rdi
je 0x140051e2e
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x6b0]
movups xmmword [rbp + 0x6b8], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r12d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140051e9e
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r12d
jne 0x140051e96
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x6b0]
call qword [rdi + VariantCopy]
test al, al
jne 0x140051ea1
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140051e70
mov rsi, r13
test rsi, rsi
je 0x140051eb0
cmp dword [rsi], 1
jne 0x140051eb0
mov ebx, dword [rsi + 0x28]
jmp 0x140051eb9
mov ebx, dword [rbp + 0xf58]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140193950], r13
je 0x140051ed7
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x140051ee8
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov eax, r15d
lea r9, [rbp + 0xd40]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xe
cmovne eax, ecx
mov rcx, r14
mov dword [rbp + 0xd4c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.IconTogglesVisibility
mov dword [rbp + 0xdb0], 0xf000
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], 0x2a
lock cmpxchg qword [0x140193950], rdi
je 0x140051f4e
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x20]
mov rdi, qword [0x1401965a8]
lea rcx, [rbp + 0x6e0]
movups xmmword [rbp + 0x6e8], xmm0
call qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r12d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r12
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140051fbe
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r12d
jne 0x140051fb6
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x6e0]
call qword [rdi + VariantCopy]
test al, al
jne 0x140051fc1
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140051f90
mov rsi, r13
test rsi, rsi
je 0x140051fd0
cmp dword [rsi], 1
jne 0x140051fd0
mov ebx, dword [rsi + 0x28]
jmp 0x140051fd9
mov ebx, dword [rbp + 0xf58]
mov rsi, r13
mov eax, 5
lock cmpxchg qword [0x140193950], r13
je 0x140051ff5
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x140052006
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test ebx, ebx
lea r9, [rbp + 0xda0]
mov ebx, 0x2000
mov edx, 0x102b
cmovne r15d, ebx
mov r8d, 0xf
mov rcx, r14
mov dword [rbp + 0xdac], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x140194a34], r13b
mov edx, 0x102b
mov rcx, r14
je 0x140052091
lea r9, [rbp + 0xe00]
mov dword [rbp + 0xe10], 0xf000
mov r8d, 3
mov dword [rbp + 0xe0c], ebx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x1401946c7], r13b
je 0x1400520b5
mov dword [rbp + 0xe70], 0xf000
lea r9, [rbp + 0xe60]
mov dword [rbp + 0xe6c], ebx
mov edx, 0x102b
mov rcx, r14
jmp 0x1400520a9
mov dword [rbp + 0xed0], 0xf000
lea r9, [rbp + 0xec0]
mov dword [rbp + 0xecc], r13d
mov r8d, 4
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x1050]
lea r11, [rsp + 0x1020]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret