Function at 0x14009c390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rdi, rdx
mov r14, r9
xor dl, dl
mov rsi, r8
cmp ecx, 0xf
ja case.0x14009c3d4.5
lea r15, [0x140000000]
movsxd rax, ecx
mov eax, dword [r15 + rax*4 + 0x9e040]
add rax, r15
jmp rax
test byte [rdi], 1
je case.0x14009c3d4.5
xor ebx, ebx
test rsi, rsi
je 0x14009c46a
mov rdx, qword [0x140213b58]
lea ecx, [rbx + 0x26]
mov qword [rbp - 0x30], 0x14
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
add rax, 0x10
mov qword [rbp - 0x28], rcx
mov qword [rcx + 8], rax
mov word [rax + 0x14], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, [0x1401c0d40]
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, [0x1401c0d40]
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
cmp byte [rdi + 4], bl
je 0x14009c463
lea rcx, str.__permanent_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.__permanent_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov rax, qword [rbp - 0x28]
mov qword [rsi], rax
nop word [rax + rax]
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x44
mov qword [rbp - 0x30], 0x32
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
lea r8, [0x140192200]
add rax, 0x10
mov qword [rbp - 0x28], rcx
lea rdx, str.Data_Execution_Prevention__DEP__is_s_enabled_for_this_process._r_n
mov qword [rcx + 8], rax
mov word [rax + 0x32], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, [rbp - 0x30]
mov word [rax], bx
lea rax, str._permanently
cmp byte [rdi + 4], bl
cmovne r8, rax
call sym.ProcessHacker.exe_PhAppendFormatStringBuilder
test byte [rdi], 2
je 0x14009c4fc
lea rcx, str.ATL_thunk_emulation_is_disabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.ATL_thunk_emulation_is_disabled._r_n
lea r8, [rax + rax]
lea rcx, [rbp - 0x30]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov rax, qword [rbp - 0x28]
mov qword [r14], rax
jmp 0x14009e01d
test byte ds:[rdi], 7
je case.0x14009c3d4.5
xor ebx, ebx
test rsi, rsi
je 0x14009c6db
mov rdx, qword [0x140213b58]
lea ecx, [rbx + 0x26]
mov qword [rbp - 0x30], 0x14
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
add rax, 0x10
mov qword [rbp - 0x28], rcx
mov qword [rcx + 8], rax
mov word [rax + 0x14], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.ASLR
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.ASLR
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 4
jne 0x14009c588
test al, 2
jne 0x14009c588
mov r15, qword [rbp - 0x28]
jmp 0x14009c6d8
lea rcx, [0x1401b6954]
nop
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, [0x1401b6954]
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 4
je 0x14009c5d1
lea rcx, str.high_entropy_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.high_entropy_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14009c5f7
lea rcx, str.force_relocate_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.force_relocate_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 8
je 0x14009c61b
lea rcx, str.disallow_stripped_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.disallow_stripped_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov r15, qword [rbp - 0x28]
lea rax, [0x1401b4e40]
mov qword [rbp - 0x20], 4
mov qword [rbp - 0x18], rax
mov rcx, qword [r15]
cmp rcx, 4
jb 0x14009c69a
mov rax, qword [r15 + 8]
lea rdx, [rbp - 0x20]
add rax, 0xfffffffffffffffc
mov qword [rbp - 0x10], 4
add rcx, rax
xor r8d, r8d
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x10]
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x14009c69a
mov r8, qword [r15]
mov rcx, qword [r15 + 8]
mov rdx, r8
and rdx, 0xfffffffffffffffe
sub rdx, 4
sub r8, rdx
add rcx, rdx
sub r8, 4
lea rdx, [rcx + 4]
call fcn.140165120
add qword [r15], 0xfffffffffffffffc
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov word [rcx + rax], bx
mov rdx, qword [r15]
add rdx, 2
cmp qword [rbp - 0x30], rdx
jae 0x14009c6b9
lea rcx, ds:[rbp - 0x30]
call fcn.140109d40
mov r15, qword [rbp - 0x28]
mov rcx, qword [r15 + 8]
mov edx, 0x29
mov rax, qword [r15]
mov word [rcx + rax], dx
add qword [r15], 2
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov word [rcx + rax], bx
mov qword [rsi], r15
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x76
mov qword [rbp - 0x30], 0x64
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
add rax, 0x10
mov qword [rbp - 0x28], rcx
mov qword [rcx + 8], rax
mov word [rax + 0x64], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Address_Space_Layout_Randomization_is_enabled_for_this_process._r_n
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Address_Space_Layout_Randomization_is_enabled_for_this_process._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 4
je 0x14009c762
lea rcx, str.High_entropy_randomization_is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.High_entropy_randomization_is_enabled._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14009c78b
lea rcx, str.All_images_are_being_forcibly_relocated__regardless_of_whether_they_support_ASLR_._r_n
nop dword [rax]
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.All_images_are_being_forcibly_relocated__regardless_of_whether_they_support_ASLR_._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
nop dword [rax + rax]
test al, 8
je 0x14009c4fc
lea rcx, str.Images_with_stripped_relocation_data_are_disallowed._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Images_with_stripped_relocation_data_are_disallowed._r_n
nop dword [rax + rax]
jmp 0x14009c4ef
xor ebx, ebx
test byte [rdi], 1
je 0x14009c8b7
test rsi, rsi
je 0x14009c828
mov rdx, qword [0x140213b58]
lea ecx, ds:[rbx + 0x40]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x2e
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x2e], bx
movups xmm0, xmmword [str.Dynamic_code_prohibited]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c1100]
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [0x1401c1110]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [0x1401c1118]
mov dword [rcx + 0x28], eax
movzx eax, word [0x1401c111c]
mov word [rcx + 0x2c], ax
nop dword [rax + rax]
test r14, r14
je 0x14009c8b5
mov rdx, qword [0x140213b58]
mov ecx, 0x7a
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x68
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x68], bx
movaps xmm0, xmmword [str.Dynamically_loaded_code_is_not_allowed_to_execute._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c1130]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c1140]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c1150]
movups xmmword [rcx + 0x30], xmm1
movaps xmm0, xmmword [0x1401c1160]
movups xmmword [rcx + 0x40], xmm0
movaps xmm1, xmmword [0x1401c1170]
movups xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [0x1401c1180]
movsd qword [rcx + 0x60], xmm0
mov qword [r14], rdx
mov dl, 1
test byte [rdi], 2
je 0x14009c9e7
test rsi, rsi
je 0x14009c92b
mov rdx, qword [0x140213b58]
mov ecx, 0x5a
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x48
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x48], bx
movaps xmm0, xmmword [str.Dynamic_code_prohibited__per_thread_]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c11a0]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c11b0]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c11c0]
movups xmmword [rcx + 0x30], xmm1
movsd xmm0, qword [0x1401c11d0]
movsd qword [rcx + 0x40], xmm0
nop dword [rax + rax]
test r14, r14
je 0x14009c9e5
mov rdx, qword [0x140213b58]
mov ecx, 0xbe
call sym.ProcessHacker.exe_PhCreateObject
lea rcx, [r15 + 0x1c11e0]
mov r8, rax
mov qword [rax], 0xac
add rax, 0x10
mov qword [r8 + 8], rax
mov word [rax + 0xac], bx
movups xmm0, xmmword [rcx]
mov rdx, qword [r8 + 8]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx + 0x70], xmm1
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx + 0x80], xmm0
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx + 0x90], xmm1
mov rax, qword [rcx + 0xa0]
mov qword [rdx + 0xa0], rax
mov eax, dword [rcx + 0xa8]
mov dword [rdx + 0xa8], eax
mov qword [r14], r8
mov dl, 1
test byte ds:[rdi], 4
je case.0x14009c3d4.5
test rsi, rsi
je 0x14009ca54
mov rdx, qword [0x140213b58]
mov ecx, 0x44
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x32
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x32], bx
movups xmm0, xmmword [str.Dynamic_code_downgradable]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c12a0]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401c12b0]
movups xmmword [rcx + 0x20], xmm0
movzx eax, word [0x1401c12c0]
mov word [rcx + 0x30], ax
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x16c
call sym.ProcessHacker.exe_PhCreateObject
mov r9, rax
lea rdx, str.Allow_non_AppContainer_processes_to_modify_all_of_the_dynamic_code_settings_for_the_calling_process__including_relaxing_dynamic_code_restrictions_after_they_have_been_set._r_n
mov r8d, 2
mov qword [rax], 0x15a
add rax, 0x10
mov qword [r9 + 8], rax
mov word [rax + 0x15a], bx
mov rcx, qword [r9 + 8]
nop dword [rax + rax]
lea rcx, ds:[rcx + 0x80]
movups xmm0, xmmword [rdx]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rdx - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub r8, 1
jne 0x14009caa0
movups xmm0, xmmword ds:[rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov rax, qword [rdx + 0x50]
mov qword [rcx + 0x50], rax
movzx eax, word [rdx + 0x58]
mov word [rcx + 0x58], ax
mov qword [r14], r9
jmp 0x14009e01d
test byte [rdi], 1
je case.0x14009c3d4.5
xor ebx, ebx
test rsi, rsi
je 0x14009cb94
mov rdx, qword [0x140213b58]
lea ecx, ds:[rbx + 0x3a]
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rsi], rcx
mov qword [rax], 0x28
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x28], bx
movups xmm0, xmmword [str.Strict_handle_checks]
mov rax, qword [rcx + 8]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1401c1440]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1401c1450]
movsd qword [rax + 0x20], xmm0
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0xa0
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x8e
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x8e], bx
movaps xmm0, xmmword [str.An_exception_is_raised_when_an_invalid_handle_is_used_by_the_process._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c1470]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c1480]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c1490]
movups xmmword [rcx + 0x30], xmm1
movaps xmm0, xmmword [0x1401c14a0]
movups xmmword [rcx + 0x40], xmm0
movaps xmm1, xmmword [0x1401c14b0]
movups xmmword [rcx + 0x50], xmm1
movaps xmm0, xmmword [0x1401c14c0]
movups xmmword [rcx + 0x60], xmm0
movaps xmm1, xmmword [0x1401c14d0]
movups xmmword [rcx + 0x70], xmm1
movsd xmm0, qword [0x1401c14e0]
movsd qword [rcx + 0x80], xmm0
mov eax, dword [0x1401c14e8]
mov dword [rcx + 0x88], eax
movzx eax, word [0x1401c14ec]
mov word [rcx + 0x8c], ax
mov qword [r14], rdx
jmp 0x14009e01d
xor ebx, ebx
test byte [rdi], 1
je 0x14009cd44
test rsi, rsi
je 0x14009ccbf
mov rdx, qword [0x140213b58]
lea ecx, ds:[rbx + 0x4a]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x38
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x38], bx
movups xmm0, xmmword [str.Win32k_system_calls_disabled]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c1500]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401c1510]
movups xmmword [rcx + 0x20], xmm0
movsd xmm1, qword [0x1401c1520]
movsd qword [rcx + 0x30], xmm1
test r14, r14
je 0x14009cd42
mov rdx, qword [0x140213b58]
mov ecx, 0x74
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x62
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x62], bx
movaps xmm0, xmmword [str.Win32k__GDI_USER__system_calls_are_not_allowed._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c1540]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c1550]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c1560]
movups xmmword [rcx + 0x30], xmm1
movaps xmm0, xmmword [0x1401c1570]
movups xmmword [rcx + 0x40], xmm0
movaps xmm1, xmmword [0x1401c1580]
movups xmmword [rcx + 0x50], xmm1
movzx eax, word [0x1401c1590]
mov word [rcx + 0x60], ax
mov qword [r14], rdx
mov dl, 1
test byte [rdi], 2
je case.0x14009c3d4.5
nop dword [rax]
test rsi, rsi
je 0x14009cdb7
mov rdx, qword [0x140213b58]
mov ecx, 0x48
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x36
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x36], bx
movups xmm0, xmmword [str.Win32k_system_calls__Audit_]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c15a8]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401c15b8]
movups xmmword [rcx + 0x20], xmm0
mov eax, dword [0x1401c15c8]
mov dword [rcx + 0x30], eax
movzx eax, word [0x1401c15cc]
mov word [rcx + 0x34], ax
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x88
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x76
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x76], bx
movaps xmm0, xmmword [str.Win32k__GDI_USER__system_calls_will_trigger_an_ETW_event._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c15e0]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c15f0]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c1600]
movups xmmword [rcx + 0x30], xmm1
movaps xmm0, xmmword [0x1401c1610]
movups xmmword [rcx + 0x40], xmm0
movaps xmm1, xmmword [0x1401c1620]
movups xmmword [rcx + 0x50], xmm1
movaps xmm0, xmmword [0x1401c1630]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [0x1401c1640]
mov dword [rcx + 0x70], eax
movzx eax, word [0x1401c1644]
mov word [rcx + 0x74], ax
mov qword [r14], rdx
jmp 0x14009e01d
test byte [rdi], 1
je case.0x14009c3d4.5
xor ebx, ebx
test rsi, rsi
je 0x14009cebe
mov rdx, qword [0x140213b58]
lea ecx, [rbx + 0x44]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x32
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x32], bx
movups xmm0, xmmword [str.Extension_points_disabled]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c1658]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401c1668]
movups xmmword [rcx + 0x20], xmm0
movzx eax, word [0x1401c1678]
mov word [rcx + 0x30], ax
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x92
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x80
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x80], bx
movaps xmm0, xmmword [str.Legacy_extension_point_DLLs_cannot_be_loaded_into_the_process._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c1690]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c16a0]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c16b0]
movups xmmword [rcx + 0x30], xmm1
movaps xmm0, xmmword [0x1401c16c0]
movups xmmword [rcx + 0x40], xmm0
movaps xmm1, xmmword [0x1401c16d0]
movups xmmword [rcx + 0x50], xmm1
movaps xmm0, xmmword [0x1401c16e0]
movups xmmword [rcx + 0x60], xmm0
movaps xmm1, xmmword [0x1401c16f0]
movups xmmword [rcx + 0x70], xmm1
mov qword [r14], rdx
jmp 0x14009e01d
test byte [rdi], 1
je case.0x14009c3d4.5
xor ebx, ebx
test rsi, rsi
je 0x14009cfe9
mov rdx, qword [0x140213b58]
lea ecx, [rbx + 0x44]
mov qword [rbp - 0x30], 0x32
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
add rax, 0x10
mov qword [rbp - 0x28], rcx
mov qword [rcx + 8], rax
mov word [rax + 0x32], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
mov word [rax], bx
test byte [rdi], 4
je 0x14009cfc2
lea rcx, str.Strict
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Strict
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
lea rcx, str.CF_Guard
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.CF_Guard
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov rax, qword [rbp - 0x28]
mov qword [rsi], rax
nop dword [rax]
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x76
mov qword [rbp - 0x30], 0x64
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
add rax, 0x10
mov qword [rbp - 0x28], rcx
mov qword [rcx + 8], rax
mov word [rax + 0x64], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Control_Flow_Guard__CFG__is_enabled_for_the_process._r_n
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Control_Flow_Guard__CFG__is_enabled_for_the_process._r_n
lea rcx, ds:[rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 4
je 0x14009d07d
lea rcx, str.Strict_CFG_:_only_CFG_modules_can_be_loaded._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Strict_CFG_:_only_CFG_modules_can_be_loaded._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14009c4fc
lea rcx, str.Dll_Exports_can_be_marked_as_CFG_invalid_targets._r_n
nop dword [rax]
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Dll_Exports_can_be_marked_as_CFG_invalid_targets._r_n
jmp 0x14009c4ef
test byte [rdi], 3
je case.0x14009c3d4.5
xor ebx, ebx
test rsi, rsi
je 0x14009d225
mov rdx, qword [0x140213b58]
lea ecx, ds:[rbx + 0x44]
mov qword [rbp - 0x30], 0x32
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
add rax, 0x10
mov qword [rbp - 0x28], rcx
mov qword [rcx + 8], rax
mov word [rax + 0x32], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Signatures_restricted__
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Signatures_restricted__
lea rcx, ds:[rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 1
je 0x14009d13d
lea rcx, str.Microsoft_only_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Microsoft_only_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14009d161
lea rcx, str.Store_only_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Store_only_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov r15, qword [rbp - 0x28]
lea rax, [0x1401b4e40]
mov qword [rbp - 0x10], 4
mov qword [rbp - 8], rax
mov rcx, qword [r15]
cmp rcx, 4
jb 0x14009d1e8
mov rax, qword [r15 + 8]
lea rdx, [rbp - 0x10]
add rax, 0xfffffffffffffffc
mov qword [rbp - 0x20], 4
add rcx, rax
xor r8d, r8d
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x14009d1e8
mov r8, qword [r15]
mov rcx, qword [r15 + 8]
mov rdx, r8
and rdx, 0xfffffffffffffffe
sub rdx, 4
sub r8, rdx
add rcx, rdx
sub r8, 4
lea rdx, [rcx + 4]
call fcn.140165120
add qword [r15], 0xfffffffffffffffc
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov word [rcx + rax], bx
mov rdx, qword ds:[r15]
add rdx, 2
cmp qword [rbp - 0x30], rdx
jae 0x14009d203
lea rcx, [rbp - 0x30]
call fcn.140109d40
mov r15, qword [rbp - 0x28]
mov rcx, qword [r15 + 8]
mov edx, 0x29
mov rax, qword [r15]
mov qword [rsi], r15
mov word [rcx + rax], dx
add qword [r15], 2
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov word [rcx + rax], bx
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x76
mov qword [rbp - 0x30], 0x64
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
add rax, 0x10
mov qword [rbp - 0x28], rcx
mov qword [rcx + 8], rax
mov word [rax + 0x64], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Image_signature_restrictions_are_enabled_for_this_process._r_n
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Image_signature_restrictions_are_enabled_for_this_process._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 1
je 0x14009d2b1
lea rcx, str.Only_Microsoft_signatures_are_allowed._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Only_Microsoft_signatures_are_allowed._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14009d2d7
lea rcx, str.Only_Windows_Store_signatures_are_allowed._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Only_Windows_Store_signatures_are_allowed._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 4
je 0x14009c4fc
lea rcx, str.This_is_an_opt_in_restriction._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.This_is_an_opt_in_restriction._r_n
jmp 0x14009c4ef
test byte [rdi], 1
je case.0x14009c3d4.5
xor ebx, ebx
test rsi, rsi
je 0x14009d35e
mov rdx, qword [0x140213b58]
lea ecx, [rbx + 0x44]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x32
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x32], bx
movups xmm0, xmmword [str.Non_system_fonts_disabled]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c1a68]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401c1a78]
movups xmmword [rcx + 0x20], xmm0
movzx eax, word [0x1401c1a88]
mov word [rcx + 0x30], ax
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x76
mov qword [rbp - 0x30], 0x64
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
add rax, 0x10
mov qword [rbp - 0x28], rcx
mov qword [rcx + 8], rax
mov word [rax + 0x64], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Non_system_fonts_cannot_be_used_in_this_process._r_n
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Non_system_fonts_cannot_be_used_in_this_process._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
test byte [rdi], 2
je 0x14009c4fc
lea rcx, str.Loading_a_non_system_font_in_this_process_will_trigger_an_ETW_event._r_n
nop dword [rax]
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Loading_a_non_system_font_in_this_process_will_trigger_an_ETW_event._r_n
jmp 0x14009c4ef
xor ebx, ebx
test byte [rdi], 3
je 0x14009d5fe
nop dword [rax]
test rsi, rsi
je 0x14009d565
mov rdx, qword [0x140213b58]
lea ecx, ds:[rbx + 0x44]
mov qword [rbp - 0x30], 0x32
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
add rax, 0x10
mov qword [rbp - 0x28], rcx
mov qword [rcx + 8], rax
mov word [rax + 0x32], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Images_restricted__
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Images_restricted__
lea rcx, ds:[rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 1
je 0x14009d47d
lea rcx, str.remote_images_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.remote_images_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 2
je 0x14009d4a1
lea rcx, str.low_mandatory_label_images_
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.low_mandatory_label_images_
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov r15, qword [rbp - 0x28]
lea rax, [0x1401b4e40]
mov qword [rbp - 0x10], 4
mov qword [rbp - 8], rax
mov rcx, qword [r15]
cmp rcx, 4
jb 0x14009d528
mov rax, qword [r15 + 8]
lea rdx, [rbp - 0x10]
add rax, 0xfffffffffffffffc
mov qword [rbp - 0x20], 4
add rcx, rax
xor r8d, r8d
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x20]
call sym.ProcessHacker.exe_PhEqualStringRef
nop dword [rax]
test al, al
je 0x14009d528
mov r8, qword [r15]
mov rcx, qword [r15 + 8]
mov rdx, r8
and rdx, 0xfffffffffffffffe
sub rdx, 4
sub r8, rdx
add rcx, rdx
sub r8, 4
lea rdx, [rcx + 4]
call fcn.140165120
add qword [r15], 0xfffffffffffffffc
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov word [rcx + rax], bx
mov rdx, qword ds:[r15]
add rdx, 2
cmp qword [rbp - 0x30], rdx
jae 0x14009d543
lea rcx, [rbp - 0x30]
call fcn.140109d40
mov r15, qword [rbp - 0x28]
mov rcx, qword [r15 + 8]
mov edx, 0x29
mov rax, qword [r15]
mov qword [rsi], r15
mov word [rcx + rax], dx
add qword [r15], 2
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov word [rcx + rax], bx
test r14, r14
je 0x14009d5fc
mov rdx, qword [0x140213b58]
mov ecx, 0x44
mov qword [rbp - 0x30], 0x32
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
add rax, 0x10
mov qword [rbp - 0x28], rcx
mov qword [rcx + 8], rax
mov word [rax + 0x32], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
mov word [rax], bx
mov eax, dword [rdi]
test al, 1
je 0x14009d5cc
lea rcx, str.Remotely_located_images_cannot_be_loaded_into_the_process._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Remotely_located_images_cannot_be_loaded_into_the_process._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
nop dword [rax]
test al, 2
je 0x14009d5f5
lea rcx, str.Images_with_a_Low_mandatory_label_cannot_be_loaded_into_the_process._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Images_with_a_Low_mandatory_label_cannot_be_loaded_into_the_process._r_n
lea rcx, ds:[rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov rax, qword [rbp - 0x28]
mov qword [r14], rax
mov dl, 1
test byte [rdi], 4
je case.0x14009c3d4.5
nop word [rax + rax]
test rsi, rsi
je 0x14009d672
mov rdx, qword [0x140213b58]
mov ecx, 0x3e
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x2c
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x2c], bx
movups xmm0, xmmword [str.Prefer_system32_images]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c1d40]
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [0x1401c1d50]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [0x1401c1d58]
mov dword [rcx + 0x28], eax
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x150
call sym.ProcessHacker.exe_PhCreateObject
mov r9, rax
lea rdx, str.Forces_images_to_load_from_the_System32_folder_in_which_Windows_is_installed_first__then_from_the_application_directory_before_the_standard_DLL_search_order._r_n
mov r8d, 2
mov qword [rax], 0x13e
add rax, 0x10
mov qword [r9 + 8], rax
mov word [rax + 0x13e], bx
mov rcx, qword [r9 + 8]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rdx - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub r8, 1
jne 0x14009d6b6
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rdx + 0x30]
mov qword [rcx + 0x30], rax
mov eax, dword [rdx + 0x38]
mov dword [rcx + 0x38], eax
movzx eax, word [rdx + 0x3c]
mov word [rcx + 0x3c], ax
mov qword [r14], r9
jmp 0x14009e01d
test byte [rdi], 0xf
je case.0x14009c3d4.5
xor ebx, ebx
test rsi, rsi
je 0x14009d7b2
mov rdx, qword [0x140213b58]
lea ecx, [rbx + 0x3c]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x2a
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x2a], bx
movups xmm0, xmmword [str.System_call_filtering]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c1eb0]
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [0x1401c1ec0]
movsd qword [rcx + 0x20], xmm0
movzx eax, word [0x1401c1ec8]
mov word [rcx + 0x28], ax
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x56
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x44
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x44], bx
movaps xmm0, xmmword [str.System_call_filtering_is_active._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c1ee0]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c1ef0]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c1f00]
movups xmmword [rcx + 0x30], xmm1
mov eax, dword [0x1401c1f10]
mov dword [rcx + 0x40], eax
mov qword [r14], rdx
jmp 0x14009e01d
test dword [rdi], 0x555
je case.0x14009c3d4.5
xor ebx, ebx
test rsi, rsi
je 0x14009d887
mov rdx, qword [0x140213b58]
lea ecx, [rbx + 0x3a]
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rsi], rcx
mov qword [rax], 0x28
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x28], bx
movups xmm0, xmmword [str.Payload_restrictions]
mov rax, qword [rcx + 8]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1401c1f28]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1401c1f38]
movsd qword [rax + 0x20], xmm0
nop word [rax + rax]
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x76
mov qword [rbp - 0x30], 0x64
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
add rax, 0x10
mov qword [rbp - 0x28], rcx
mov qword [rcx + 8], rax
mov word [rax + 0x64], bx
mov qword [rcx], rbx
mov rax, qword [rcx + 8]
lea rcx, str.Payload_restrictions_are_enabled_for_this_process._r_n
mov word [rax], bx
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Payload_restrictions_are_enabled_for_this_process._r_n
lea rcx, ds:[rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 1
je 0x14009d91d
lea rcx, str.Export_Address_Filtering_is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Export_Address_Filtering_is_enabled._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 4
je 0x14009d943
lea rcx, str.Export_Address_Filtering__Plus__is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Export_Address_Filtering__Plus__is_enabled._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 0x10
je 0x14009d96b
lea rcx, str.Import_Address_Filtering_is_enabled._r_n
nop
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.Import_Address_Filtering_is_enabled._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
test al, 0x40
je 0x14009d991
lea rcx, str.StackPivot_is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.StackPivot_is_enabled._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
bt eax, 8
jae 0x14009d9b9
lea rcx, str.CallerCheck_is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.CallerCheck_is_enabled._r_n
lea rcx, [rbp - 0x30]
lea r8, [rax + rax]
call sym.ProcessHacker.exe_PhAppendStringBuilderEx
mov eax, dword [rdi]
bt eax, 0xa
jae 0x14009c4fc
lea rcx, str.SimExec_is_enabled._r_n
call sym.ProcessHacker.exe_PhCountStringZ
lea rdx, str.SimExec_is_enabled._r_n
jmp 0x14009c4ef
test byte [rdi], 1
je case.0x14009c3d4.5
xor ebx, ebx
test rsi, rsi
je 0x14009da5c
mov rdx, qword [0x140213b58]
lea ecx, [rbx + 0x50]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x3e
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x3e], bx
movaps xmm0, xmmword [str.Child_process_creation_disabled]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c2170]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c2180]
movups xmmword [rcx + 0x20], xmm0
movsd xmm1, qword [0x1401c2190]
movsd qword [rcx + 0x30], xmm1
mov eax, dword [0x1401c2198]
mov dword [rcx + 0x38], eax
movzx eax, word [0x1401c219c]
mov word [rcx + 0x3c], ax
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x7a
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x68
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x68], bx
movaps xmm0, xmmword [str.Child_processes_cannot_be_created_by_this_process._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c21b0]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c21c0]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c21d0]
movups xmmword [rcx + 0x30], xmm1
movaps xmm0, xmmword [0x1401c21e0]
movups xmmword [rcx + 0x40], xmm0
movaps xmm1, xmmword [0x1401c21f0]
movups xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [0x1401c2200]
movsd qword [rcx + 0x60], xmm0
mov qword [r14], rdx
jmp 0x14009e01d
xor ebx, ebx
test byte [rdi], 1
je 0x14009dc0c
test rsi, rsi
je 0x14009db5f
mov rdx, qword [0x140213b58]
lea ecx, [rbx + 0x56]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x44
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x44], bx
movaps xmm0, xmmword [str.SMT_thread_branch_target_isolation]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c2220]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c2230]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c2240]
movups xmmword [rcx + 0x30], xmm1
mov eax, dword [0x1401c2250]
mov dword [rcx + 0x40], eax
test r14, r14
je 0x14009dc0a
mov rdx, qword [0x140213b58]
mov ecx, 0x98
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x86
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x86], bx
movaps xmm0, xmmword [str.Branch_target_pollution_cross_SMT_thread_in_user_mode_is_enabled._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c2270]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c2280]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c2290]
movups xmmword [rcx + 0x30], xmm1
movaps xmm0, xmmword [0x1401c22a0]
movups xmmword [rcx + 0x40], xmm0
movaps xmm1, xmmword [0x1401c22b0]
movups xmmword [rcx + 0x50], xmm1
movaps xmm0, xmmword [0x1401c22c0]
movups xmmword [rcx + 0x60], xmm0
movaps xmm1, xmmword [0x1401c22d0]
movups xmmword [rcx + 0x70], xmm1
mov eax, dword [0x1401c22e0]
mov dword [rcx + 0x80], eax
movzx eax, word [0x1401c22e4]
mov word [rcx + 0x84], ax
mov qword [r14], rdx
mov dl, 1
test byte ds:[rdi], 2
je 0x14009dcec
test rsi, rsi
je 0x14009dc72
mov rdx, qword [0x140213b58]
mov ecx, 0x42
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, rax
mov qword [rsi], rcx
mov qword [rax], 0x30
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rax + 0x30], bx
movups xmm0, xmmword [str.Distinct_security_domain]
mov rax, qword [rcx + 8]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1401c22f8]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1401c2308]
movups xmmword [rax + 0x20], xmm0
test r14, r14
je 0x14009dcea
mov rdx, qword [0x140213b58]
mov ecx, 0x5e
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x4c
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x4c], bx
movaps xmm0, xmmword [str.Isolated_security_domain_is_enabled._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c2330]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c2340]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c2350]
movups xmmword [rcx + 0x30], xmm1
movsd xmm0, qword [0x1401c2360]
movsd qword [rcx + 0x40], xmm0
mov eax, dword [0x1401c2368]
mov dword [rcx + 0x48], eax
mov qword [r14], rdx
mov dl, 1
test byte ds:[rdi], 4
je 0x14009dded
test rsi, rsi
je 0x14009dd5d
mov rdx, qword [0x140213b58]
mov ecx, 0x44
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x32
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x32], bx
movups xmm0, xmmword [str.Restricted_page_combining]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c2380]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401c2390]
movups xmmword [rcx + 0x20], xmm0
movzx eax, word [0x1401c23a0]
mov word [rcx + 0x30], ax
test r14, r14
je 0x14009ddeb
mov rdx, qword [0x140213b58]
mov ecx, 0x70
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x5e
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x5e], bx
movaps xmm0, xmmword [str.Disables_all_page_combining_for_this_process._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c23c0]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c23d0]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c23e0]
movups xmmword [rcx + 0x30], xmm1
movaps xmm0, xmmword [0x1401c23f0]
movups xmmword [rcx + 0x40], xmm0
movsd xmm1, qword [0x1401c2400]
movsd qword [rcx + 0x50], xmm1
mov eax, dword [0x1401c2408]
mov dword [rcx + 0x58], eax
movzx eax, word [0x1401c240c]
mov word [rcx + 0x5c], ax
mov qword [r14], rdx
mov dl, 1
test byte [rdi], 8
je case.0x14009c3d4.5
test rsi, rsi
je 0x14009de5f
mov rdx, qword [0x140213b58]
mov ecx, 0x4a
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x38
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x38], bx
movups xmm0, xmmword [str.Memory_disambiguation__SSBD_]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c2420]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401c2430]
movups xmmword [rcx + 0x20], xmm0
movsd xmm1, qword [0x1401c2440]
movsd qword [rcx + 0x30], xmm1
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0x7a
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rax], 0x68
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x68], bx
movaps xmm0, xmmword [str.Memory_disambiguation_is_enabled_for_this_process._r_n]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x1401c2460]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1401c2470]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1401c2480]
movups xmmword [rcx + 0x30], xmm1
movaps xmm0, xmmword [0x1401c2490]
movups xmmword [rcx + 0x40], xmm0
movaps xmm1, xmmword [0x1401c24a0]
movups xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [0x1401c24b0]
movsd qword [rcx + 0x60], xmm0
mov qword [r14], rdx
jmp 0x14009e01d
test byte ds:[rdi], 1
je case.0x14009c3d4.5
xor ebx, ebx
test rsi, rsi
je 0x14009df66
mov rdx, qword [0x140213b58]
lea ecx, ds:[rbx + 0x48]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov qword [rsi], rdx
mov qword [rax], 0x36
add rax, 0x10
mov qword [rdx + 8], rax
mov word [rax + 0x36], bx
movups xmm0, xmmword [str.Stack_protection_is_enabled]
mov rcx, qword [rdx + 8]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c24d0]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401c24e0]
movups xmmword [rcx + 0x20], xmm0
mov eax, dword [0x1401c24f0]
mov dword [rcx + 0x30], eax
movzx eax, word [0x1401c24f4]
mov word [rcx + 0x34], ax
test r14, r14
je 0x14009e01d
mov rdx, qword [0x140213b58]
mov ecx, 0xde
call sym.ProcessHacker.exe_PhCreateObject
lea rcx, [r15 + 0x1c2500]
mov r8, rax
lea rcx, [rcx + 0x80]
mov qword [rax], 0xcc
add rax, 0x10
mov qword [r8 + 8], rax
mov word [rax + 0xcc], bx
movups xmm0, xmmword [rcx - 0x80]
mov rdx, qword [r8 + 8]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x60], xmm0
sub rdx, 0xffffffffffffff80
movups xmm0, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm0
movups xmm1, xmmword [rcx]
movups xmmword [rdx], xmm1
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm1
movups xmm0, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm0
mov rax, qword [rcx + 0x40]
mov qword [rdx + 0x40], rax
mov eax, dword [rcx + 0x48]
mov dword [rdx + 0x48], eax
mov qword [r14], r8
mov dl, 1
mov rbx, qword [rsp + 0x70]
movzx eax, dl
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret