Function at 0x1400252c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rbx
push r13
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rbx, rcx
mov edx, 6
xor ecx, ecx
mov r13d, r9d
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, 0x8003
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rdx, rbx
call fcn.1400cf480
test eax, eax
jns 0x14002530f
mov eax, 1
add rsp, 0x3a0
pop r13
pop rbx
pop rbp
ret
call fcn.140026be0
test al, al
je 0x140025326
xor eax, eax
add rsp, 0x3a0
pop r13
pop rbx
pop rbp
ret
call fcn.140027680
test al, al
je 0x1400252fe
mov qword [rsp + 0x3c0], rsi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x3c8], rdi
mov qword [rsp + 0x3d0], r12
mov qword [rsp + 0x398], r14
mov qword [rsp + 0x390], r15
mov dword [rsp + 0x50], 8
mov dword [rsp + 0x54], 0x8029
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea rcx, [rbp + 0x240]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov rcx, qword [rax]
test rcx, rcx
je 0x1400253c8
lea r8, [rbp + 0xb0]
mov edx, 1
call fcn.1400d55f0
test eax, eax
js 0x1400253c8
mov rbx, qword [rbp + 0xb0]
xor r8d, r8d
mov dl, 1
mov rcx, qword [rbx]
call sym.ProcessHacker.exe_PhGetSidFullName
mov rcx, qword [0x140196670]
mov r8, rbx
xor edx, edx
mov qword [0x140192510], rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor r8d, r8d
lea rcx, [0x14018e2c0]
mov dl, 1
call sym.ProcessHacker.exe_PhGetSidFullName
xor edi, edi
mov qword [0x140192540], rax
test rax, rax
jne 0x14002543d
mov rdx, qword [0x140196800]
lea ecx, [rax + 0x38]
call sym.ProcessHacker.exe_PhCreateObject
mov qword [rax], 0x26
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + 0x26], di
mov rdx, qword [rax + 8]
movups xmm0, xmmword [str.NT_AUTHORITYSYSTEM]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [0x14015d4b0]
movups xmmword [rdx + 0x10], xmm1
mov ecx, dword [0x14015d4c0]
mov dword [rdx + 0x20], ecx
movzx ecx, word [0x14015d4c4]
mov word [rdx + 0x24], cx
mov qword [0x140192540], rax
call sym.ProcessHacker.exe_PhGetApplicationFileName
mov qword [0x140192530], rax
mov rbx, rdi
call sym.ProcessHacker.exe_PhGetApplicationFileName
or r14, 0xffffffffffffffff
mov rsi, rax
test rax, rax
je 0x1400254cc
lea edx, [r14 + 0x5d]
xor r8d, r8d
mov rcx, rax
call sym.ProcessHacker.exe_PhFindLastCharInStringRef
cmp rax, r14
je 0x1400254b6
add rax, 1
je 0x1400254b6
mov rdx, qword [0x140196800]
lea r15, [rax + rax]
mov r12, qword [rsi + 8]
lea rcx, [r15 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], r15
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + r15], di
test r12, r12
je 0x1400254b6
mov rcx, qword [rax + 8]
mov r8, r15
mov rdx, r12
call fcn.14010e700
lea rcx, [rsi - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400254cc
call fcn.1400c8bc0
cmp qword [0x140192530], rdi
mov qword [0x140192528], rbx
jne 0x140025532
mov rdx, qword [0x140196800]
mov ecx, 0x34
call sym.ProcessHacker.exe_PhCreateObject
mov qword [rax], 0x22
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + 0x22], di
mov rdx, qword [rax + 8]
movups xmm0, xmmword [0x14015d4c8]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [0x14015d4d8]
movups xmmword [rdx + 0x10], xmm1
movzx ecx, word [0x14015d4e8]
mov word [rdx + 0x20], cx
mov rbx, qword [0x140192528]
mov qword [0x140192530], rax
test rbx, rbx
jne 0x140025543
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov qword [0x140192528], rax
call fcn.140028640
mov r9d, 0x100
lea r8, [0x1400dde90]
lea rdx, [0x1400ddde0]
mov ecx, 0x30
call sym.ProcessHacker.exe_PhCreateHashtable
mov rdx, qword [0x1401967f8]
mov ecx, 0x10
mov qword [0x1401965a8], rax
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, qword [0x140196670]
mov edx, 4
mov rbx, rax
mov dword [rax], edi
lea r8d, [rdx + 0x1c]
mov dword [rax + 4], 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 8], rax
mov qword [0x1401965a0], rbx
call fcn.1400a0c30
call sym.ProcessHacker.exe_PhUpdateCachedSettings
lea r8, [rsp + 0x58]
mov edx, 0x20
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov r12d, 0x14
lea r9d, [r12 - 6]
lea r15d, [r12 - 2]
lea r8d, [r12 - 1]
test eax, eax
js 0x140025683
mov dword [rbp + 0x150], 8
mov edx, edi
mov eax, edx
inc edx
lea rcx, [rax + rax*2]
mov dword [rbp + rcx*4 + 0x15c], 2
mov dword [rbp + rcx*4 + 0x158], edi
cmp edx, dword [rbp + 0x150]
jb 0x1400255f1
mov rcx, qword [rsp + 0x58]
xor edx, edx
mov dword [rbp + 0x160], r9d
xor r9d, r9d
mov dword [rbp + 0x19c], r8d
lea r8, [rbp + 0x150]
mov qword [rsp + 0x28], rdi
mov dword [rbp + 0x154], r12d
mov dword [rbp + 0x16c], 0x21
mov dword [rbp + 0x178], 0xa
mov dword [rbp + 0x184], 0xd
mov dword [rbp + 0x190], r15d
mov dword [rbp + 0x1a8], 9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtAdjustPrivilegesToken]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [0x140197900]
test rcx, rcx
je 0x14002569d
call fcn.14009efa0
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
call fcn.140027cb0
lea rcx, str.AllowOnlyOneInstance
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400256d5
test dword [0x1401978c0], 0xb08
jne 0x1400256d5
call fcn.1400c8020
mov rcx, rax
lea rdx, [0x140026a30]
xor r8d, r8d
call sym.ProcessHacker.exe_PhEnumDirectoryObjects
lea rcx, str.EnableKph
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400256f3
test byte [0x1401978c0], 0x18
jne 0x1400256f3
call fcn.140027210
test byte [0x1401978c0], 8
je 0x140025742
cmp qword [0x1401978e0], rdi
je 0x140025742
cmp qword [0x1401978f0], rdi
je 0x140025742
call fcn.14000fdd0
mov ebx, eax
test eax, eax
jns 0x140025739
test dword [0x1401978c0], 0x2000
jne 0x140025739
xor r9d, r9d
lea rdx, str.Unable_to_execute_the_command.
mov r8d, eax
xor ecx, ecx
call sym.ProcessHacker.exe_PhShowStatus
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
mov ecx, dword [0x140196214]
mov dword [0x1401943b0], edi
mov qword [0x1401945b8], rdi
mov qword [0x1401945c0], rdi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x140196214]
lea rdx, [0x1401943b0]
mov qword [0x1401945c8], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140025790
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
lea rax, [0x140192270]
mov r9d, 0xa
mov qword [0x140192278], rax
lea r8, [0x1400e38f0]
mov qword [0x140192270], rax
lea rdx, [0x1400e38d0]
lea rax, [0x140192290]
mov qword [0x140192298], rax
lea ecx, [r9 + 0xe]
mov qword [0x140192290], rax
lea rax, [0x1401922b0]
mov qword [0x1401922b8], rax
mov qword [0x1401922b0], rax
lea rax, [0x1401922d0]
mov qword [0x1401922d8], rax
mov qword [0x1401922d0], rax
lea rax, [0x1401922f0]
mov qword [0x1401922f8], rax
mov qword [0x1401922f0], rax
lea rax, [0x140192310]
mov qword [0x140192318], rax
mov qword [0x140192310], rax
lea rax, [0x140192330]
mov qword [0x140192338], rax
mov qword [0x140192330], rax
lea rax, [0x140192350]
mov qword [0x140192358], rax
mov qword [0x140192350], rax
lea rax, [0x140192370]
mov qword [0x140192378], rax
mov qword [0x140192370], rax
lea rax, [0x140192390]
mov qword [0x140192398], rax
mov qword [0x140192390], rax
lea rax, [0x1401923b0]
mov qword [0x1401923b8], rax
mov qword [0x1401923b0], rax
lea rax, [0x1401923d0]
mov qword [0x1401923d8], rax
mov qword [0x1401923d0], rax
lea rax, [0x1401923f0]
mov qword [0x1401923f8], rax
mov qword [0x1401923f0], rax
lea rax, [0x140192410]
mov qword [0x140192418], rax
mov qword [0x140192410], rax
lea rax, [0x140192430]
mov qword [0x140192438], rax
mov qword [0x140192430], rax
lea rax, [0x140192450]
mov qword [0x140192458], rax
mov qword [0x140192450], rax
lea rax, [0x140192470]
mov qword [0x140192478], rax
mov qword [0x140192470], rax
lea rax, [0x140192490]
mov qword [0x140192498], rax
mov qword [0x140192490], rax
lea rax, [0x1401924b0]
mov qword [0x1401924b8], rax
mov qword [0x1401924b0], rax
lea rax, [0x1401924d0]
mov qword [0x1401924d8], rax
mov qword [0x1401924d0], rax
call sym.ProcessHacker.exe_PhCreateHashtable
xor ecx, ecx
mov qword [0x140193988], rax
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
test rax, rax
je 0x140025987
mov edx, 0x5a
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rbx
xor ecx, ecx
mov dword [sym.ProcessHacker.exe_PhGlobalDpi], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.shlwapi.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
mov rsi, rax
jb 0x140025a3c
lea rax, [0x140158ac8]
mov dword [rbp + 0xe0], 0x160014
lea r9, [rbp + 0xb8]
mov qword [rbp + 0xe8], rax
lea r8, [rbp + 0xe0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
test eax, eax
js 0x140025a32
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x140025a32
lea rax, str.IsImmersiveProcess
mov dword [rbp + 0xf0], 0x130012
lea r9, [rbp + 0xc0]
mov qword [rbp + 0xf8], rax
xor r8d, r8d
lea rdx, [rbp + 0xf0]
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0xc0]
test eax, eax
cmovs rcx, rdi
jmp 0x140025a35
mov rcx, rdi
mov qword [0x140196590], rcx
xor edx, edx
lea r9, [rbp + 0xc8]
mov rcx, rbx
lea r8d, [rdx + 0x3d]
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0xc8]
lea r9, [rbp + 0xd0]
test eax, eax
mov dword [rbp + 0x100], 0xf000e
lea rax, str.SHAutoComplete
cmovs rcx, rdi
mov qword [rbp + 0x108], rax
mov qword [0x140196598], rcx
lea rdx, [rbp + 0x100]
mov rcx, rsi
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp + 0xd0]
mov edx, 0x7f00
test eax, eax
mov dword [rsp + 0x70], 0x50
cmovs rcx, rdi
xor eax, eax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov dword [rbp - 0x44], eax
lea rax, [0x1400f4540]
mov qword [rsp + 0x78], rax
mov rax, qword [sym.ProcessHacker.exe_PhInstanceHandle]
mov qword [0x140196588], rcx
xor ecx, ecx
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x74], 0x4008
mov dword [rbp - 0x80], edi
mov dword [rbp - 0x7c], 8
mov qword [rbp - 0x70], rdi
call qword [sym.imp.USER32.dll_LoadCursorW]
xorps xmm0, xmm0
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x68], rax
lea rcx, [rsp + 0x70]
lea rax, [0x14015e430]
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x140025baa
lea rax, str.comctl32.dll
mov dword [rbp + 0x110], 0x1a0018
lea r9, [rbp + 0xd8]
mov qword [rbp + 0x118], rax
lea r8, [rbp + 0x110]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
test eax, eax
mov rcx, rdi
cmovns rcx, qword [rbp + 0xd8]
mov qword [0x140196468], rcx
mov ecx, 0x31
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x32
mov dword [0x14019627c], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1401964e8], eax
xor eax, eax
mov dword [rbp - 0x40], 0x50
mov qword [rbp - 0x3c], rax
mov edx, 0x7f00
mov qword [rbp - 0x34], rax
xor ecx, ecx
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov dword [rbp + 0xc], eax
lea rax, [0x1400f38b0]
mov qword [rbp - 0x38], rax
mov rax, qword [sym.ProcessHacker.exe_PhInstanceHandle]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x3c], 0x4008
mov dword [rbp - 0x30], edi
mov dword [rbp - 0x2c], 8
mov qword [rbp - 0x20], rdi
call qword [sym.imp.USER32.dll_LoadCursorW]
xorps xmm0, xmm0
mov qword [rbp + 8], rdi
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x40]
lea rax, str.PhGraph
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
xor eax, eax
mov dword [rbp + 0x10], 0x50
mov qword [rbp + 0x14], rax
mov edx, 0x7f00
mov qword [rbp + 0x1c], rax
xor ecx, ecx
mov qword [rbp + 0x24], rax
mov qword [rbp + 0x2c], rax
mov qword [rbp + 0x34], rax
mov qword [rbp + 0x3c], rax
mov qword [rbp + 0x44], rax
mov qword [rbp + 0x4c], rax
mov qword [rbp + 0x54], rax
mov dword [rbp + 0x5c], eax
lea rax, [0x1400eff80]
mov qword [rbp + 0x18], rax
mov rax, qword [sym.ProcessHacker.exe_PhInstanceHandle]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x14], 0x4000
mov dword [rbp + 0x20], edi
mov dword [rbp + 0x24], 8
mov qword [rbp + 0x30], rdi
call qword [sym.imp.USER32.dll_LoadCursorW]
xorps xmm0, xmm0
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x38], rax
lea rcx, [rbp + 0x10]
lea rax, str.PhHexEdit
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
xor eax, eax
mov dword [rbp + 0x60], 0x50
mov qword [rbp + 0x64], rax
mov qword [rbp + 0x6c], rax
mov qword [rbp + 0x74], rax
mov qword [rbp + 0x7c], rax
mov qword [rbp + 0x84], rax
mov qword [rbp + 0x8c], rax
mov qword [rbp + 0x94], rax
mov qword [rbp + 0x9c], rax
mov qword [rbp + 0xa4], rax
mov dword [rbp + 0xac], eax
lea rax, [0x1400efc00]
mov qword [rbp + 0x68], rax
mov rax, qword [sym.ProcessHacker.exe_PhInstanceHandle]
mov qword [rbp + 0x78], rax
mov dword [rbp + 0x64], 0x4000
mov dword [rbp + 0x70], edi
mov dword [rbp + 0x74], 8
mov edx, 0x7f00
mov qword [rbp + 0x80], rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
xorps xmm0, xmm0
mov qword [rbp + 0xa8], rdi
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0x60]
lea rax, [0x14016d1a0]
movdqu xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov ecx, 0x31
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x32
mov dword [0x14018b060], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0xb
mov dword [0x14018b064], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0xc
mov dword [0x14018adb8], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test dword [0x1401978c0], 0x100
mov dword [0x14018adbc], eax
je 0x140025dd7
mov rcx, qword [0x1401978d0]
call fcn.14004f0a0
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
lea rcx, str.EnablePlugins
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x1400262f5
test dword [0x1401978c0], 0x400
jne 0x1400262f5
lea rax, [0x140194d20]
mov byte [0x140192236], 1
mov qword [0x140194d28], rax
mov qword [0x140194d20], rax
lea rax, [0x140194d40]
mov qword [0x140194d48], rax
mov qword [0x140194d40], rax
lea rax, [0x140194d60]
mov qword [0x140194d68], rax
mov qword [0x140194d60], rax
lea rax, [0x140194d80]
mov qword [0x140194d88], rax
mov qword [0x140194d80], rax
lea rax, [0x140194da0]
mov qword [0x140194da8], rax
mov qword [0x140194da0], rax
lea rax, [0x140194dc0]
mov qword [0x140194dc8], rax
mov qword [0x140194dc0], rax
lea rax, [0x140194de0]
mov qword [0x140194de8], rax
mov qword [0x140194de0], rax
lea rax, [0x140194e00]
mov qword [0x140194e08], rax
mov qword [0x140194e00], rax
lea rax, [0x140194e20]
mov qword [0x140194e28], rax
mov qword [0x140194e20], rax
lea rax, [0x140194e40]
mov qword [0x140194e48], rax
mov qword [0x140194e40], rax
lea rax, [0x140194e60]
mov qword [0x140194e68], rax
mov qword [0x140194e60], rax
lea rax, [0x140194e80]
mov qword [0x140194e88], rax
mov qword [0x140194e80], rax
lea rax, [0x140194ea0]
mov qword [0x140194ea8], rax
mov qword [0x140194ea0], rax
lea rax, [0x140194ec0]
mov qword [0x140194ec8], rax
mov qword [0x140194ec0], rax
lea rax, [0x140194ee0]
mov qword [0x140194ee8], rax
mov qword [0x140194ee0], rax
lea rax, [0x140194f00]
mov qword [0x140194f08], rax
mov qword [0x140194f00], rax
mov qword [0x140194d30], rdi
mov qword [0x140194d38], rdi
mov qword [0x140194d50], rdi
mov qword [0x140194d58], rdi
mov qword [0x140194d70], rdi
mov qword [0x140194d78], rdi
mov qword [0x140194d90], rdi
mov qword [0x140194d98], rdi
mov qword [0x140194db0], rdi
mov qword [0x140194db8], rdi
mov qword [0x140194dd0], rdi
mov qword [0x140194dd8], rdi
mov qword [0x140194df0], rdi
mov qword [0x140194df8], rdi
mov qword [0x140194e10], rdi
mov qword [0x140194e18], rdi
mov qword [0x140194e30], rdi
mov qword [0x140194e38], rdi
mov qword [0x140194e50], rdi
mov qword [0x140194e58], rdi
mov qword [0x140194e70], rdi
mov qword [0x140194e78], rdi
mov qword [0x140194e90], rdi
mov qword [0x140194e98], rdi
mov qword [0x140194eb0], rdi
mov qword [0x140194eb8], rdi
mov qword [0x140194ed0], rdi
mov qword [0x140194ed8], rdi
mov qword [0x140194ef0], rdi
mov qword [0x140194ef8], rdi
mov qword [0x140194f10], rdi
mov qword [0x140194f18], rdi
lea rax, [0x140194f20]
mov qword [0x140194f30], rdi
mov qword [0x140194f28], rax
mov qword [0x140194f20], rax
lea rax, [0x140194f40]
mov qword [0x140194f48], rax
mov qword [0x140194f40], rax
lea rax, [0x140194f60]
mov qword [0x140194f68], rax
mov qword [0x140194f60], rax
lea rax, [0x140194f80]
mov qword [0x140194f88], rax
mov qword [0x140194f80], rax
lea rax, [0x140194fa0]
mov qword [0x140194fa8], rax
mov qword [0x140194fa0], rax
lea rax, [0x140194fc0]
mov qword [0x140194fc8], rax
mov qword [0x140194fc0], rax
lea rax, [0x140194fe0]
mov qword [0x140194fe8], rax
mov qword [0x140194fe0], rax
lea rax, [0x140195000]
mov qword [0x140195008], rax
mov qword [0x140195000], rax
lea rax, [0x140195020]
mov qword [0x140195028], rax
mov qword [0x140195020], rax
lea rax, [0x140195040]
mov qword [0x140195048], rax
mov qword [0x140195040], rax
lea rax, [0x140195060]
mov qword [0x140195068], rax
mov qword [0x140195060], rax
lea rax, [0x140195080]
mov qword [0x140195088], rax
mov qword [0x140195080], rax
lea rax, [0x1401950a0]
mov qword [0x1401950a8], rax
mov qword [0x1401950a0], rax
lea rax, [0x1401950c0]
mov qword [0x1401950c8], rax
mov qword [0x1401950c0], rax
lea rax, [0x1401950e0]
mov qword [0x1401950e8], rax
mov qword [0x1401950e0], rax
lea rax, [0x140195100]
mov qword [0x140195108], rax
mov qword [0x140195100], rax
lea rax, [0x140195120]
mov qword [0x140194f38], rdi
mov qword [0x140194f50], rdi
mov qword [0x140194f58], rdi
mov qword [0x140194f70], rdi
mov qword [0x140194f78], rdi
mov qword [0x140194f90], rdi
mov qword [0x140194f98], rdi
mov qword [0x140194fb0], rdi
mov qword [0x140194fb8], rdi
mov qword [0x140194fd0], rdi
mov qword [0x140194fd8], rdi
mov qword [0x140194ff0], rdi
mov qword [0x140194ff8], rdi
mov qword [0x140195010], rdi
mov qword [0x140195018], rdi
mov qword [0x140195030], rdi
mov qword [0x140195038], rdi
mov qword [0x140195050], rdi
mov qword [0x140195058], rdi
mov qword [0x140195070], rdi
mov qword [0x140195078], rdi
mov qword [0x140195090], rdi
mov qword [0x140195098], rdi
mov qword [0x1401950b0], rdi
mov qword [0x1401950b8], rdi
mov qword [0x1401950d0], rdi
mov qword [0x1401950d8], rdi
mov qword [0x1401950f0], rdi
mov qword [0x1401950f8], rdi
mov qword [0x140195110], rdi
mov qword [0x140195118], rdi
mov qword [0x140195128], rax
mov qword [0x140195120], rax
lea rax, [0x140195140]
mov qword [0x140195148], rax
mov qword [0x140195140], rax
lea rax, [0x140195160]
mov qword [0x140195168], rax
mov qword [0x140195160], rax
lea rax, [0x140195180]
mov qword [0x140195188], rax
mov qword [0x140195180], rax
mov qword [0x140195130], rdi
mov qword [0x140195138], rdi
mov qword [0x140195150], rdi
mov qword [0x140195158], rdi
mov qword [0x140195170], rdi
mov qword [0x140195178], rdi
mov qword [0x140195190], rdi
mov qword [0x140195198], rdi
call fcn.140076620
jmp 0x1400262fc
mov byte [0x140192236], dil
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x64
jb 0x14002632d
mov r9d, 8
mov dword [rsp + 0x60], 8
lea r8, [rsp + 0x60]
mov dword [rsp + 0x64], 1
mov rcx, r14
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
test dword [0x1401978c0], 0x200
je 0x140026373
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
lea rcx, [rbp + 0x260]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140075cd0
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3
lea rax, str.PhMutant_
mov dword [rbp + 0x200], 1
mov qword [rbp + 0x218], rax
mov edx, 2
mov rax, qword gs:[0x30]
mov qword [rbp + 0x210], r15
mov dword [rbp + 0x220], 8
lea r8d, [rdx + 0xe]
mov ecx, dword [rax + 0x40]
mov dword [rbp + 0x230], ecx
lea rcx, [rbp + 0x200]
call sym.ProcessHacker.exe_PhFormat
mov rbx, rax
movzx ecx, word [rax]
mov word [rbp + 0x120], cx
movzx ecx, word [rax]
add cx, 2
mov word [rbp + 0x122], cx
mov rcx, qword [rax + 8]
mov qword [rbp + 0x128], rcx
mov dword [rbp + 0x1c8], 0x30
call fcn.1400c8020
mov qword [rbp + 0x1d0], rax
lea r8, [rbp + 0x1c8]
lea rax, [rbp + 0x120]
mov dword [rbp + 0x1e0], 0x40
xorps xmm0, xmm0
mov qword [rbp + 0x1d8], rax
xor r9d, r9d
lea rcx, [rbp + 0x1c0]
mov edx, 0x1f0001
movdqu xmmword [rbp + 0x1e8], xmm0
call qword [sym.imp.ntdll.dll_NtCreateMutant]
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140026454
call fcn.1400c8bc0
mov al, 3
mov byte [rsp + 0x30], dil
movzx r8d, al
mov r9d, 2
mov eax, dword [0x14019790c]
mov edx, r15d
movzx ecx, al
test eax, eax
cmovne r8d, ecx
mov rcx, r14
mov byte [rsp + 0x31], r8b
lea r8, [rsp + 0x30]
movzx eax, word [rsp + 0x30]
mov word [rsp + 0x30], ax
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rax, qword gs:[0x30]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov rbx, rdi
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x20]
lea rcx, [rbp + 0x130]
movzx eax, word [rdx + 0x70]
mov qword [rbp + 0x130], rax
mov rax, qword [rdx + 0x78]
lea rdx, [rbp + 0x250]
mov qword [rbp + 0x138], rax
call sym.ProcessHacker.exe_PhParseCommandLineFuzzy
test al, al
je 0x1400265c5
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x1400265a0
mov rcx, qword [0x14018ada8]
mov r15, qword [rsp + 0x48]
cmp rcx, rsi
ja 0x140026552
mov qword [rbp + 0x140], rcx
lea rdx, [0x14018ada8]
mov rax, r15
xor r8d, r8d
sub rax, rcx
lea rcx, [rbp + 0x140]
add rax, rsi
mov qword [rbp + 0x148], rax
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x140026552
mov r8d, 2
lea rdx, [0x14018ada8]
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhTrimStringRef
mov r15, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
test rsi, rsi
jne 0x140026561
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x140026597
mov rdx, qword [0x140196800]
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rsi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rsi + rax], di
test r15, r15
je 0x140026597
mov rcx, qword [rbx + 8]
mov r8, rsi
mov rdx, r15
call fcn.14010e700
test rbx, rbx
je 0x1400265a0
mov rdi, qword [rbx + 8]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
test rbx, rbx
je 0x1400265c5
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x1400265c5
call fcn.1400c8bc0
mov ecx, r13d
call fcn.1400288c0
test al, al
jne 0x14002661d
lea r8, str.Unable_to_initialize_the_main_window.
mov edx, 0x10
xor ecx, ecx
call sym.ProcessHacker.exe_PhShowMessage
mov r14, qword [rsp + 0x398]
mov eax, 1
mov r12, qword [rsp + 0x3d0]
mov rdi, qword [rsp + 0x3c8]
mov rsi, qword [rsp + 0x3c0]
mov r15, qword [rsp + 0x390]
add rsp, 0x3a0
pop r13
pop rbx
pop rbp
ret
lea rcx, [0x1401943b0]
call sym.ProcessHacker.exe_PhDrainAutoPool
call fcn.140026640
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
int3