Function at 0x14009d1f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x228]
sub rsp, 0x328
mov r14, rcx
mov r15, rdx
mov rcx, qword [rcx + 0xc0]
nop dword [rax]
xor r13d, r13d
cmp qword [r15 + 0x50], rcx
je 0x14009d243
mov eax, dword [r15]
test eax, eax
je 0x14009d235
add r15, rax
jne 0x14009d220
lea r15, [rbp + 0xc0]
mov dword [rbp + 0xc4], r13d
mov r12d, dword [r15 + 4]
test rcx, rcx
jne 0x14009d270
test r12d, r12d
je 0x14009d270
mov rax, r13
lea rcx, [r15 + 0x130]
mov edx, r12d
nop
mov qword [rcx], rax
lea rcx, [rcx + 0x50]
inc rax
sub rdx, 1
jne 0x14009d260
mov rbx, r13
mov esi, r13d
mov rax, qword [r14]
mov ecx, dword [rax + 0x40]
cmp esi, ecx
jae 0x14009d2a6
mov edx, dword [rax]
mov r8, qword [rax + 0x30]
add edx, 8
mov eax, edx
imul eax, esi
nop
mov edi, eax
inc esi
add rdi, r8
add eax, edx
cmp dword [rdi], 0xffffffff
jne 0x14009d33f
cmp esi, ecx
jb 0x14009d290
test rbx, rbx
je 0x14009d459
lea rcx, [r14 + 8]
call sym.ProcessHacker.exe_PhfAcquireFastLockExclusive
mov esi, r13d
cmp dword [rbx], r13d
jbe 0x14009d310
mov rax, qword [rbx + 8]
lea rdx, [rbp + 0x288]
mov ecx, esi
mov rcx, qword [rax + rcx*8]
mov qword [rbp + 0x288], rcx
mov rcx, qword [r14]
call sym.ProcessHacker.exe_PhRemoveEntryHashtable
mov rcx, qword [rbp + 0x288]
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009d2fd
call fcn.1400ae580
inc esi
cmp esi, dword [rbx]
jb 0x14009d2c0
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14 + 8]
test eax, 0xffc00000
je 0x14009d410
lea ecx, [rax - 0x3fffff]
lock cmpxchg dword [r14 + 8], ecx
jne 0x14009d42b
mov rcx, qword [r14 + 0x10]
mov edx, 1
jmp 0x14009d43a
mov edx, r13d
test r12d, r12d
je 0x14009d36e
mov rax, qword [rdi + 8]
mov r8, qword [rax]
nop
mov eax, edx
lea rcx, [rax + rax*4]
add rcx, rcx
cmp r8, qword [r15 + rcx*8 + 0x130]
je 0x14009d276
inc edx
cmp edx, r12d
jb 0x14009d350
mov rdx, qword [rdi + 8]
lea rcx, [r14 + 0x60]
call sym.ProcessHacker.exe_PhInvokeCallback
test rbx, rbx
jne 0x14009d3ce
mov rbx, qword [0x14015f250]
mov edx, 0x10
mov rcx, rbx
call fcn.1400ae4a0
lock inc dword [rbx + 4]
mov dword [rax + 8], 1
mov edx, 4
movzx ecx, byte [rbx + 2]
lea rbx, [rax + 0x10]
mov word [rax], cx
mov dword [rbx], r13d
mov dword [rbx + 4], 2
lea r8d, [rdx + 0xc]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 8], rax
mov eax, dword [rbx + 4]
mov rdi, qword [rdi + 8]
cmp dword [rbx], eax
jne 0x14009d3ff
mov r8, qword [rbx + 8]
add eax, eax
mov r9d, eax
mov edx, 4
mov dword [rbx + 4], eax
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
shl r9, 3
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov qword [rbx + 8], rax
mov ecx, dword [rbx]
mov rax, qword [rbx + 8]
mov qword [rax + rcx*8], rdi
inc dword [rbx]
jmp 0x14009d276
mov edx, eax
mov ecx, eax
shr edx, 0xc
and edx, 0x3ff
and ecx, 0xffc00ffe
lock cmpxchg dword [r14 + 8], ecx
je 0x14009d432
pause
jmp 0x14009d310
test edx, edx
je 0x14009d443
mov rcx, qword [r14 + 0x18]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtReleaseSemaphore]
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009d459
call fcn.1400ae580
lea rcx, [r14 + 0xe0]
call qword [sym.imp.ntdll.dll_RtlInterlockedFlushSList]
mov rdi, rax
test rax, rax
je 0x14009d54f
mov rbx, rdi
mov rdi, qword [rdi]
cmp dword [rbx + 0x30], r13d
jne 0x14009d4bf
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14009d4bf
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax + 0x70]
mov qword [rax + 0x70], rcx
lock inc dword [rcx - 8]
test rdx, rdx
je 0x14009d4b2
lea rcx, [rdx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009d4b2
call fcn.1400ae580
mov rcx, qword [rbx + 0x18]
mov eax, dword [rbx + 0x30]
mov dword [rcx + 0x80], eax
mov rax, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x38]
mov rdx, qword [rax + 0x90]
mov qword [rax + 0x90], rcx
test rdx, rdx
je 0x14009d4f0
lea rcx, [rdx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009d4f0
call fcn.1400ae580
mov rax, qword [rbx + 0x18]
mov byte [rax + 0xa1], 1
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14009d51a
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009d51a
call fcn.1400ae580
mov rcx, qword [rbx + 0x18]
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009d534
call fcn.1400ae580
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test rdi, rdi
jne 0x14009d472
test r12d, r12d
je 0x14009df7b
movaps xmmword [rsp + 0x310], xmm6
add r15, 0x130
movss xmm6, dword [0x1401391e4]
nop
mov rdx, qword [r15]
mov rcx, r14
call fcn.14009cbe0
mov qword [rbp + 0x278], rax
mov rcx, rax
test rax, rax
jne 0x14009dab6
mov rdx, qword [0x14015ac98]
mov rbx, qword [0x14015fae0]
add rdx, 0xc0
mov rdi, qword [r15]
mov rcx, rbx
mov qword [rbp + 0x280], r13
mov qword [0x14015ac90], 0xc0
call fcn.1400ae4a0
lock inc dword [rbx + 4]
mov esi, 1
mov r8d, 0xc0
mov dword [rax + 8], esi
movzx edx, byte [rbx + 2]
lea rbx, [rax + 0x10]
mov word [rax], dx
mov rcx, rbx
xor edx, edx
call fcn.1400e3c20
lea rdx, [rbx + 0xa2]
mov qword [rbx], rdi
lea r8d, [rsi + 9]
mov ecx, edi
call fcn.1400e5040
xor r8d, r8d
lea ecx, [rsi + 5]
mov rdx, rbx
call fcn.1400131e0
mov rax, qword [r15 - 0x20]
lea edx, [rsi + 0x3f]
mov qword [rbp + 0x278], rbx
mov qword [rbx + 8], rax
mov rax, qword [rbp + 0x278]
mov rcx, qword [r15 - 0x30]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x278]
mov rcx, qword [r15 - 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rbp + 0x278]
mov eax, dword [r15 + 0x10]
sub eax, dword [rcx + 0x48]
mov dword [rcx + 0x4c], eax
mov ecx, dword [r15 + 0x10]
mov rax, qword [rbp + 0x278]
mov dword [rax + 0x48], ecx
mov ecx, dword [r15 + 8]
mov rax, qword [rbp + 0x278]
mov dword [rax + 0x60], ecx
mov ecx, dword [r15 + 0xc]
mov rax, qword [rbp + 0x278]
mov dword [rax + 0x64], ecx
mov ecx, dword [r15 + 0x14]
mov rax, qword [rbp + 0x278]
mov dword [rax + 0x84], ecx
mov ecx, dword [r15 + 0x18]
mov rax, qword [rbp + 0x278]
mov dword [rax + 0x88], ecx
mov r8, qword [rbp + 0x278]
lea rcx, [r8 + 0x98]
mov r8, qword [r8]
call sym.ProcessHacker.exe_PhOpenThread
test eax, eax
jns 0x14009d6cd
mov r8, qword [rbp + 0x278]
mov edx, dword [sym.ProcessHacker.exe_ThreadQueryAccess]
lea rcx, [r8 + 0x98]
mov r8, qword [r8]
call sym.ProcessHacker.exe_PhOpenThread
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
jb 0x14009d750
cmp qword [r14 + 0xc0], r13
je 0x14009d71b
mov rax, qword [rbp + 0x278]
lea r8, [rbp + 0x50]
mov r9d, 0x10
mov qword [rsp + 0x20], r13
mov rcx, qword [rax + 0x98]
lea edx, [r9 + 7]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14009d750
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x278]
jmp 0x14009d73a
mov rdx, qword [rbp + 0x278]
movsx eax, byte [0x14015f058]
mov ecx, dword [rdx]
cmp ecx, eax
jae 0x14009d757
mov rax, qword [0x14015fdc8]
mov rcx, qword [rax + rcx*8]
mov rax, rcx
sub rax, qword [rdx + 0x50]
mov qword [rdx + 0x58], rax
mov rax, qword [rbp + 0x278]
mov qword [rax + 0x50], rcx
mov rdx, qword [rbp + 0x278]
mov rax, qword [rdx + 0x10]
sub rax, qword [rdx + 0x28]
mov qword [rdx + 0x30], rax
mov rcx, qword [rbp + 0x278]
mov rax, qword [rcx + 0x10]
mov qword [rcx + 0x28], rax
mov rcx, qword [rbp + 0x278]
mov rax, qword [rcx + 0x18]
sub rax, qword [rcx + 0x38]
mov qword [rcx + 0x40], rax
mov rcx, qword [rbp + 0x278]
mov rax, qword [rcx + 0x18]
mov qword [rcx + 0x38], rax
mov rdx, qword [rbp + 0x278]
mov rcx, qword [rdx + 0x98]
test rcx, rcx
je 0x14009d7ca
mov r9d, 8
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x280]
lea edx, [r9 + 1]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov rdx, qword [rbp + 0x278]
mov rax, qword [rbp + 0x280]
test rax, rax
jne 0x14009d7e1
mov rax, qword [r15 - 0x10]
mov qword [rbp + 0x280], rax
mov qword [rdx + 0x68], rax
mov edi, 0x30
mov rax, qword [rbp + 0x278]
mov rcx, qword [rax + 0x98]
test rcx, rcx
je 0x14009d831
mov r9d, edi
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x70]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14009d82a
mov rcx, qword [rbp + 0x278]
mov eax, dword [rbp + 0x9c]
mov dword [rcx + 0x8c], eax
jmp 0x14009d83b
mov rax, qword [rbp + 0x278]
mov dword [rax + 0x8c], 0x7fffffff
cmp qword [r14 + 0x108], r13
je 0x14009d869
mov rdx, qword [rbp + 0x278]
mov rcx, r14
lea r8, [rdx + 0x80]
mov rdx, qword [rdx + 0x68]
call fcn.14009cf50
mov rcx, qword [rbp + 0x278]
mov qword [rcx + 0x70], rax
mov rbx, qword [rbp + 0x278]
cmp qword [rbx + 0x70], r13
jne 0x14009d90a
mov dword [rbx + 0x80], 2
mov edx, 0x42
mov rbx, qword [0x14015f258]
mov rcx, rbx
call fcn.1400ae4a0
lock inc dword [rbx + 4]
mov dword [rax + 8], esi
lea rdx, [rax + 0x10]
movzx ecx, byte [rbx + 2]
mov r8d, 0x10
mov word [rax], cx
lea rax, [rdx + 0x10]
mov qword [rdx + 8], rax
mov qword [rdx], rdi
mov word [rax + 0x30], r13w
mov rax, qword [rbp + 0x278]
mov qword [rax + 0x70], rdx
mov rax, qword [rbp + 0x278]
mov rdx, qword [rdx + 8]
mov rcx, qword [rax + 0x68]
mov dword [rdx], 0x780030
add rdx, 4
call fcn.1400e501c
mov rax, qword [rbp + 0x278]
mov rbx, qword [rax + 0x70]
mov rcx, qword [rbx + 8]
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rbx], rax
mov rbx, qword [rbp + 0x278]
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov edx, 4
lea r8d, [rdx + 0x3c]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, rax
xor eax, eax
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rax
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x38], rax
mov qword [rdx + 0x10], r14
lock inc dword [r14 - 8]
mov qword [rdx + 0x18], rbx
test rbx, rbx
je 0x14009d956
lock inc dword [rbx - 8]
mov rax, qword [r14 + 0x100]
mov qword [rdx + 0x20], rax
call fcn.14009c3c0
mov rax, qword [rbp + 0x278]
mov rdx, qword [rax + 0x98]
test rdx, rdx
je 0x14009d9e8
mov rcx, qword [0x14015c480]
test rcx, rcx
je 0x14009d9e8
mov dword [rsp + 0x48], r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r13
xor r9d, r9d
mov qword [rbp + 0x10], rax
xor r8d, r8d
mov dword [rsp + 0x38], 0x28
lea rax, [rbp]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xa0]
mov qword [rbp], rdx
xor edx, edx
mov dword [rsp + 0x28], 0x999921af
mov qword [rsp + 0x20], rax
mov dword [rbp + 8], esi
mov dword [rbp + 0x18], 8
mov qword [rbp + 0x20], r13
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x14009da38
cmp qword [rsp + 0x50], r13
jmp 0x14009da28
xor ecx, ecx
mov dword [rsp + 0x60], 0x48
mov qword [rsp + 0x64], rcx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x6c], rcx
mov qword [rsp + 0x74], rcx
mov qword [rsp + 0x7c], rcx
mov qword [rbp - 0x7c], rcx
mov qword [rbp - 0x74], rcx
mov qword [rbp - 0x6c], rcx
mov qword [rbp - 0x64], rcx
mov dword [rbp - 0x5c], ecx
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
mov rax, qword [rbp + 0x278]
setne cl
mov byte [rax + 0xa0], cl
lea rcx, [r14 + 8]
call sym.ProcessHacker.exe_PhfAcquireFastLockExclusive
mov rcx, qword [r14]
lea rdx, [rbp + 0x278]
call sym.ProcessHacker.exe_PhAddEntryHashtable
mov eax, dword [r14 + 8]
test eax, 0xffc00000
je 0x14009da71
lea ecx, [rax - 0x3fffff]
lock cmpxchg dword [r14 + 8], ecx
jne 0x14009da8c
mov rcx, qword [r14 + 0x10]
mov edx, esi
jmp 0x14009da98
mov edx, eax
mov ecx, eax
shr edx, 0xc
and edx, 0x3ff
and ecx, 0xffc00ffe
lock cmpxchg dword [r14 + 8], ecx
je 0x14009da90
pause
jmp 0x14009da50
test edx, edx
je 0x14009daa1
mov rcx, qword [r14 + 0x18]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtReleaseSemaphore]
mov rdx, qword [rbp + 0x278]
lea rcx, [r14 + 0x20]
call sym.ProcessHacker.exe_PhInvokeCallback
jmp 0x14009df65
xor al, al
mov esi, 1
cmp byte [rcx + 0xa1], al
movzx edi, al
mov rax, qword [r15 - 0x30]
cmovne edi, esi
mov qword [rcx + 0x10], rax
mov rcx, qword [r15 - 0x28]
mov rax, qword [rbp + 0x278]
mov qword [rax + 0x18], rcx
mov ecx, dword [r15 + 8]
mov rax, qword [rbp + 0x278]
mov dword [rax + 0x60], ecx
mov ecx, dword [r15 + 0xc]
mov rax, qword [rbp + 0x278]
mov dword [rax + 0x64], ecx
mov rax, qword [rbp + 0x278]
mov ecx, dword [r15 + 0x14]
mov dword [rax + 0x84], ecx
mov rcx, qword [rbp + 0x278]
mov eax, dword [r15 + 0x18]
cmp dword [rcx + 0x88], eax
je 0x14009db31
mov dword [rcx + 0x88], eax
movzx edi, sil
mov rcx, qword [rbp + 0x278]
lea r8, [rcx + 0x80]
cmp dword [r8], 2
jne 0x14009db87
cmp qword [r14 + 0x108], r13
je 0x14009db87
mov rdx, qword [rcx + 0x68]
mov rcx, r14
call fcn.14009cf50
mov rcx, qword [rbp + 0x278]
mov rdx, qword [rcx + 0x70]
mov qword [rcx + 0x70], rax
test rdx, rdx
je 0x14009db7c
lea rcx, [rdx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, esi
jne 0x14009db7c
call fcn.1400ae580
mov rcx, qword [rbp + 0x278]
movzx edi, sil
cmp byte [rcx + 0xa1], r13b
je 0x14009dc1d
cmp dword [rcx + 0x80], 2
jne 0x14009dc1d
mov rax, qword [r15 - 0x10]
cmp qword [rcx + 0x68], rax
je 0x14009dc1d
mov qword [rcx + 0x68], rax
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov rbx, qword [rbp + 0x278]
lea r8d, [rdx + 0x3c]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, rax
xor eax, eax
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rax
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x38], rax
mov qword [rdx + 0x10], r14
lock inc dword [r14 - 8]
mov qword [rdx + 0x18], rbx
test rbx, rbx
je 0x14009dc06
lock inc dword [rbx - 8]
mov rax, qword [r14 + 0x100]
mov qword [rdx + 0x20], rax
call fcn.14009c3c0
mov rcx, qword [rbp + 0x278]
mov eax, dword [r15 + 0x10]
sub eax, dword [rcx + 0x48]
mov edx, dword [rcx + 0x4c]
mov dword [rcx + 0x4c], eax
mov rax, qword [rbp + 0x278]
mov ecx, dword [r15 + 0x10]
movzx ebx, dil
mov dword [rax + 0x48], ecx
mov r10, qword [rbp + 0x278]
cmp dword [r10 + 0x4c], edx
cmovne ebx, esi
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
jb 0x14009dcd5
mov rdi, qword [r10 + 0x58]
cmp qword [r14 + 0xc0], r13
je 0x14009dc95
mov rcx, qword [r10 + 0x98]
lea r8, [rbp + 0x60]
mov r9d, 0x10
mov qword [rsp + 0x20], r13
lea edx, [r9 + 7]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov r10, qword [rbp + 0x278]
test eax, eax
js 0x14009dcd5
mov rcx, qword [rbp + 0x60]
jmp 0x14009dcae
mov ecx, dword [r10]
movsx eax, byte [0x14015f058]
cmp ecx, eax
jae 0x14009dcd5
mov rax, qword [0x14015fdc8]
mov rcx, qword [rax + rcx*8]
mov rax, rcx
movzx ebx, bl
sub rax, qword [r10 + 0x50]
mov qword [r10 + 0x58], rax
mov rax, qword [rbp + 0x278]
mov qword [rax + 0x50], rcx
mov r10, qword [rbp + 0x278]
cmp qword [r10 + 0x58], rdi
cmovne ebx, esi
mov rax, qword [r10 + 0x10]
sub rax, qword [r10 + 0x28]
mov qword [r10 + 0x30], rax
mov rcx, qword [rbp + 0x278]
mov rax, qword [rcx + 0x10]
mov qword [rcx + 0x28], rax
mov rcx, qword [rbp + 0x278]
mov rax, qword [rcx + 0x18]
sub rax, qword [rcx + 0x38]
mov qword [rcx + 0x40], rax
mov rcx, qword [rbp + 0x278]
mov rax, qword [rcx + 0x18]
mov qword [rcx + 0x38], rax
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
mov r8, qword [rbp + 0x278]
jb 0x14009dd66
cmp byte [0x140153aeb], r13b
je 0x14009dd66
cmp qword [r14 + 0xc0], r13
je 0x14009dd3d
cmp qword [r8 + 0x98], r13
je 0x14009dd66
mov rax, qword [r8 + 0x58]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
test rax, rax
jns 0x14009dd52
addss xmm0, xmm6
mov rax, qword [0x14015fd90]
xorps xmm1, xmm1
test rax, rax
cvtsi2ss xmm1, rax
jmp 0x14009dd99
mov rax, qword [r8 + 0x40]
xorps xmm0, xmm0
add rax, qword [r8 + 0x30]
cvtsi2ss xmm0, rax
jns 0x14009dd7c
addss xmm0, xmm6
mov rdx, qword [0x14015fd18]
xorps xmm1, xmm1
add rdx, qword [0x14015fda8]
add rdx, qword [0x14015fdb8]
cvtsi2ss xmm1, rdx
jns 0x14009dd9f
addss xmm1, xmm6
divss xmm0, xmm1
movss dword [r8 + 0x20], xmm0
mov rax, qword [rbp + 0x278]
mov rcx, qword [rax + 0x98]
mov esi, dword [rax + 0x8c]
test rcx, rcx
je 0x14009ddf9
mov r9d, 0x30
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x70]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14009ddf2
mov rcx, qword [rbp + 0x278]
mov eax, dword [rbp + 0x9c]
mov dword [rcx + 0x8c], eax
jmp 0x14009de03
mov rax, qword [rbp + 0x278]
mov dword [rax + 0x8c], 0x7fffffff
mov rax, qword [rbp + 0x278]
movzx edi, bl
cmp dword [rax + 0x8c], esi
mov esi, 1
mov rdx, qword [rax + 0x98]
cmovne edi, esi
test rdx, rdx
je 0x14009decc
mov rcx, qword [0x14015c480]
test rcx, rcx
je 0x14009decc
mov dword [rsp + 0x48], r13d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], r13
xor r9d, r9d
mov qword [rbp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x38], 0x28
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb0]
mov qword [rbp + 0x28], rdx
xor edx, edx
mov dword [rsp + 0x28], 0x999921af
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x30], esi
mov dword [rbp + 0x40], 8
mov qword [rbp + 0x48], r13
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x14009df26
cmp qword [rsp + 0x58], r13
mov rcx, qword [rbp + 0x278]
setne al
movzx edx, byte [rcx + 0xa0]
mov byte [rcx + 0xa0], al
mov rax, qword [rbp + 0x278]
cmp byte [rax + 0xa0], dl
je 0x14009df26
movzx edi, sil
jmp 0x14009df26
xor ecx, ecx
mov dword [rbp - 0x50], 0x48
mov qword [rbp - 0x4c], rcx
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x44], rcx
mov qword [rbp - 0x3c], rcx
mov qword [rbp - 0x34], rcx
mov qword [rbp - 0x2c], rcx
mov qword [rbp - 0x24], rcx
mov qword [rbp - 0x1c], rcx
mov qword [rbp - 0x14], rcx
mov dword [rbp - 0xc], ecx
mov ecx, dword [rax]
movzx ebx, byte [rax + 0xa0]
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
movzx edi, dil
mov rax, qword [rbp + 0x278]
setne cl
cmp cl, bl
cmovne edi, esi
mov byte [rax + 0xa0], cl
mov rax, qword [rbp + 0x278]
mov byte [rax + 0xa1], r13b
test dil, dil
je 0x14009df49
mov rdx, qword [rbp + 0x278]
lea rcx, [r14 + 0x40]
call sym.ProcessHacker.exe_PhInvokeCallback
mov rcx, qword [rbp + 0x278]
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, esi
jne 0x14009df65
call fcn.1400ae580
add r15, 0x50
sub r12, 1
jne 0x14009d570
movaps xmm6, xmmword [rsp + 0x310]
lea rcx, [r14 + 0x80]
xor edx, edx
call sym.ProcessHacker.exe_PhInvokeCallback
inc qword [r14 + 0x100]
add rsp, 0x328
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret