Function at 0x1400e8290
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x14020a008]
xor rax, rsp
mov qword [rbp + 0x130], rax
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x140218470]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x522
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e8328
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x140218478]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x523
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8396
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x140218474]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x524
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e8408
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x140213b7c]
xor r8d, r8d
sub ecx, dword [0x14021846c]
movzx eax, byte [0x140211968]
shl rcx, 0xc
mov qword [rbp - 0x80], rcx
lea edx, [r8 + 1]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x10c
mov byte [rsp + 0x7a], al
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x525
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8476
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x140213b7c]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x526
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e84e8
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1402168f0]
nop
test rcx, rcx
je 0x1400e8545
movzx eax, byte [0x140211968]
xor r8d, r8d
mov qword [rbp - 0x80], rcx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x10c
mov byte [rsp + 0x7a], al
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x533
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8576
mov r9, rbx
jmp 0x1400e8563
mov rcx, qword [0x140216810]
mov edx, 0x533
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8576
lea r9, [0x1401c6820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x1402184e4]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x527
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e85e8
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x1402184cc]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x528
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8656
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x1402184ec]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x529
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e86c8
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x1402184e8]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x52a
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8736
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x1402184b0]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x52b
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e87a8
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402167cc], 1
nop
jbe 0x1400e8800
mov eax, dword [0x140216824]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], 0x10009
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x52d
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8836
mov r9, rbx
jmp 0x1400e8822
mov rcx, qword [0x140216810]
mov edx, 0x52d
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8836
lea r9, [0x1401c6820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402167cc], 1
jbe 0x1400e888b
mov eax, dword [0x14021692c]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], 0x10009
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x52e
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e88b9
mov r9, rbx
jmp 0x1400e88a9
mov rcx, qword [0x140216810]
mov edx, 0x52e
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e88b9
lea r9, [0x1401c6820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7a], al
xor r8d, r8d
mov eax, dword [0x1402184b4]
shl rax, 0xc
mov qword [rbp - 0x80], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x70], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x52f
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e8928
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402167cc], 1
nop
jbe 0x1400e8980
mov eax, dword [0x140216824]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], 0x10009
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x531
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e89b6
mov r9, rbx
jmp 0x1400e89a2
mov rcx, qword [0x140216810]
mov edx, 0x531
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e89b6
lea r9, [0x1401c6820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402167cc], 1
jbe 0x1400e8a08
mov eax, dword [0x140216844]
lea rcx, [rbp - 0x58]
xor r8d, r8d
mov dword [rbp - 0x58], 0x10009
mov qword [rbp - 0x48], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x532
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8a36
mov r9, rbx
jmp 0x1400e8a26
mov rcx, qword [0x140216810]
mov edx, 0x532
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8a36
lea r9, [0x1401c6820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x1402165dd], 0
mov qword [rsp + 0x258], rdi
je 0x1400e8c64
mov rdx, qword [0x140216910]
mov rax, qword [0x140216920]
test rdx, rdx
jne 0x1400e8a67
test rax, rax
je 0x1400e8c64
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x250], rsi
xor ebx, ebx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], rcx
mov rdi, rcx
lea rsi, [0x140123d40]
test rdx, rdx
je 0x1400e8b38
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
jae 0x1400e8b38
mov dword [rsp + 0x48], ebx
lea rax, [rbp - 0x68]
mov qword [rbp - 0x28], rax
lea r8, [0x140123af0]
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x38]
mov qword [rbp + 0x40], rax
xor r9d, r9d
mov dword [rsp + 0x38], 4
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x38], rcx
mov rcx, qword [0x140213db0]
mov qword [rbp - 0x30], rdx
xor edx, edx
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x20], 8
mov qword [rbp - 0x18], rbx
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x70], 2
mov qword [rbp + 0x38], rsi
mov dword [rbp + 0x48], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov rax, qword [0x140216920]
mov rcx, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x60]
test rax, rax
je 0x1400e8bd0
mov rcx, qword [0x140213db0]
lea r8, [0x140123af0]
mov qword [rbp], rax
xor r9d, r9d
mov dword [rsp + 0x48], ebx
lea rax, [rbp - 0x60]
mov qword [rbp + 8], rax
xor edx, edx
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 8]
mov qword [rbp + 0x68], rax
lea rax, [rbp - 0x6c]
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov qword [rbp - 8], 0xffffffffffffffff
mov qword [rbp + 0x10], 8
mov qword [rbp + 0x18], rbx
mov dword [rbp + 0x20], ebx
mov dword [rbp - 0x6c], 2
mov qword [rbp + 0x60], rsi
mov dword [rbp + 0x70], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov rcx, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x60]
mov rsi, qword [rsp + 0x250]
cmp rcx, 0xffffffffffffffff
je 0x1400e8c14
movzx eax, byte [0x140211968]
xor r8d, r8d
mov qword [rbp - 0x80], rcx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x10c
mov byte [rsp + 0x7a], al
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rbx, qword [rax + 8]
jmp 0x1400e8c1b
lea rbx, [0x1401b7c48]
cmp rdi, 0xffffffffffffffff
je 0x1400e8c5b
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x50], 0x10c
mov byte [rsp + 0x5a], al
mov qword [rsp + 0x60], rdi
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rdi, qword [rax + 8]
jmp 0x1400e8c7f
lea rdi, [0x1401b7c48]
jmp 0x1400e8c7f
cmp qword [0x140213db0], 0
lea rbx, str.no_driver
je 0x1400e8c7c
lea rbx, str.no_symbols
mov rdi, rbx
mov rcx, qword [0x140216810]
mov edx, 0x52c
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8cae
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x530
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8cd8
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402167cc], 1
jbe 0x1400e8d2a
mov eax, dword [0x14021691c]
lea rcx, [rbp - 0x58]
xor r8d, r8d
mov dword [rbp - 0x58], 0x10009
mov qword [rbp - 0x48], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x558
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8d58
mov r9, rbx
jmp 0x1400e8d48
mov rcx, qword [0x140216810]
mov edx, 0x558
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8d58
lea r9, [0x1401c6820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402167cc], 1
jbe 0x1400e8daa
mov eax, dword [0x14021681c]
lea rcx, [rbp - 0x58]
xor r8d, r8d
mov dword [rbp - 0x58], 0x10009
mov qword [rbp - 0x48], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x559
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8dd8
mov r9, rbx
jmp 0x1400e8dc8
mov rcx, qword [0x140216810]
mov edx, 0x559
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8dd8
lea r9, [0x1401c6820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402167cc], 1
jbe 0x1400e8e2a
mov eax, dword [0x1402167f4]
lea rcx, [rbp - 0x58]
xor r8d, r8d
mov dword [rbp - 0x58], 0x10009
mov qword [rbp - 0x48], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x55a
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8e58
mov r9, rbx
jmp 0x1400e8e48
mov rcx, qword [0x140216810]
mov edx, 0x55a
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8e58
lea r9, [0x1401c6820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402167cc], 1
jbe 0x1400e8eaa
mov eax, dword [0x14021682c]
lea rcx, [rbp - 0x58]
xor r8d, r8d
mov dword [rbp - 0x58], 0x10009
mov qword [rbp - 0x48], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x55b
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8ed8
mov r9, rbx
jmp 0x1400e8ec8
mov rcx, qword [0x140216810]
mov edx, 0x55b
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8ed8
lea r9, [0x1401c6820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402167cc], 1
jbe 0x1400e8f40
movzx eax, byte [0x140211968]
lea rcx, ds:[rsp + 0x50]
xor r8d, r8d
mov byte [rsp + 0x5a], al
mov rax, qword [0x140216978]
mov dword [rsp + 0x50], 0x10c
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x55c
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8f76
mov r9, rbx
jmp 0x1400e8f62
mov rcx, qword [0x140216810]
mov edx, 0x55c
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e8f76
lea r9, [0x1401c6820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402167cc], 1
jbe 0x1400e8fda
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov byte [rsp + 0x5a], al
mov rax, qword [0x140216800]
mov dword [rsp + 0x50], 0x10c
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x55e
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax]
test rax, rax
je 0x1400e900c
mov r9, rbx
jmp 0x1400e8ffc
mov rcx, qword [0x140216810]
mov edx, 0x55e
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax]
test rax, rax
je 0x1400e900c
lea r9, [0x1401c6820]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea rdx, [rbp + 0x80]
mov r8d, 0xb0
lea ecx, [r9 + 0x50]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1400e968b
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov rbx, qword [rbp + 0xe0]
xor r8d, r8d
add rbx, qword [rbp + 0xd8]
add rbx, qword [rbp + 0xd0]
add rbx, qword [rbp + 0xc8]
add rbx, qword [rbp + 0xc0]
lea edx, [r8 + 1]
add rbx, qword [rbp + 0xb8]
add rbx, qword [rbp + 0xb0]
add rbx, qword [rbp + 0xa8]
mov byte [rsp + 0x5a], al
mov rax, qword [rbp + 0x80]
shl rax, 0xc
mov dword [rsp + 0x50], 0x10c
mov qword [rsp + 0x60], rax
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x534
mov rdi, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e90d6
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x88]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x535
mov rdi, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9148
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x90]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x536
mov rdi, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e91b6
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x98]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x537
mov rdi, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9228
xor r8d, r8d
mov r9, rdi
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
xor r8d, r8d
shl rbx, 0xc
mov dword [rsp + 0x50], 0x10c
mov byte [rsp + 0x5a], al
mov qword [rsp + 0x60], rbx
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x539
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e928e
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xa8]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x542
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e92f8
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xb0]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x543
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9368
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xb8]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x544
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e93d6
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xc0]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x545
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9448
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xc8]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x554
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e94b6
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xd0]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x555
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9528
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xd8]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x556
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e9596
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0xe0]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x557
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9608
xor r8d, r8d
mov r9, rbx
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
nop
jb 0x1400e9681
movzx eax, byte [0x140211968]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5a], al
xor r8d, r8d
mov rax, qword [rbp + 0x128]
shl rax, 0xc
mov qword [rsp + 0x60], rax
lea edx, [r8 + 1]
mov dword [rsp + 0x50], 0x10c
call sym.ProcessHacker.exe_PhFormat
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov rcx, qword [0x140216810]
mov edx, 0x55d
mov rbx, qword [rax + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e99d6
mov r9, rbx
jmp 0x1400e99c0
mov edx, 0x55d
jmp 0x1400e999b
mov rcx, qword [0x140216810]
mov edx, 0x534
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e96b9
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x535
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e96ec
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x536
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1400e971a
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x537
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax]
test rax, rax
je 0x1400e9756
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x55d
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9796
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x539
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e97d6
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x542
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9816
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x543
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9856
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x544
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9896
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x545
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e98d6
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x554
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9916
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x555
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9956
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140216810]
mov edx, 0x556
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e9996
xor r8d, r8d
lea r9, [0x1401b7c48]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x557
mov rcx, qword [0x140216810]
call qword [sym.imp.USER32.dll_GetDlgItem]
nop dword [rax + rax]
test rax, rax
je 0x1400e99d6
lea r9, [0x1401b7c48]
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rsp + 0x258]
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.140161390
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rbp
ret