Function at 0x14006a420
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x13d0]
mov eax, 0x14d0
call fcn.140182db0
sub rsp, rax
mov rax, qword [0x14020a008]
xor rax, rsp
mov qword [rbp + 0x13c0], rax
mov edx, 0x577
mov r15, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r12, rax
mov ecx, 5
xor eax, eax
lock cmpxchg qword [0x140213dc0], rcx
je 0x14006a488
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.SampleCount
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x1508], rbx
mov qword [rsp + 0x60], 0x16
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
xor r13d, r13d
btr eax, 0x1f
dec ecx
mov r14d, eax
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006a513
nop dword [rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x14006a50b
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rsp + 0x58]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006a549
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006a4e0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006a538
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006a558
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006a513
cmp dword [rsi], 1
jne 0x14006a513
mov ebx, dword [rsi + 0x28]
jmp 0x14006a51a
mov r8d, 0xa
lea rdx, [rbp + 0x13a0]
mov ecx, ebx
call fcn.1401659e8
mov edx, 0x500
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x14006a596
xor r8d, r8d
lea r9, [rbp + 0x13a0]
mov rcx, rax
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006a5af
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.SampleCountAutomatic
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x70], 0x28
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006a632
nop dword [rax]
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x14006a62a
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp - 0x78]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006a66a
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006a600
mov edi, dword [rsp + 0x20]
mov rsi, r13
mov r14d, 5
mov eax, r14d
lock cmpxchg qword [0x140213dc0], r13
je 0x14006a659
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006a679
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006a632
cmp dword [rsi], 1
jne 0x14006a632
mov edi, dword [rsi + 0x28]
jmp 0x14006a639
test edi, edi
mov rbx, r13
mov edx, 0x551
mov rcx, r15
setne bl
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
mov edx, 0xf1
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lock cmpxchg qword [0x140213dc0], r14
je 0x14006a6bf
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.SampleCountAutomatic
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x40], 0x28
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword ds:[rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006a746
nop word [rax + rax]
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x14006a73e
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp - 0x48]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006a77a
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006a710
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov eax, 5
lock cmpxchg qword [0x140213dc0], r13
je 0x14006a769
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006a789
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006a746
cmp dword [rsi], 1
jne 0x14006a746
mov ebx, dword [rsi + 0x28]
jmp 0x14006a74d
test ebx, ebx
je 0x14006a7a6
mov edx, 0x500
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
lea rax, str.Allow_only_one_instance
mov dword [rbp + 0x3e8], r13d
mov r15d, 5
mov qword [rbp + 0x3f8], rax
lea r9, [rbp + 0x3e0]
mov qword [rbp + 0x3e0], r15
xor r8d, r8d
mov qword [rbp + 0x408], r13
mov edx, 0x104d
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Hide_when_closed
mov dword [rbp + 0x440], r15d
lea r9, [rbp + 0x440]
mov qword [rbp + 0x458], rax
xor r8d, r8d
mov qword [rbp + 0x444], 1
mov edx, 0x104d
mov qword [rbp + 0x468], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Hide_when_minimized
mov dword ds:[rbp + 0x4a0], r15d
lea r9, [rbp + 0x4a0]
mov qword [rbp + 0x4b8], rax
xor r8d, r8d
mov qword [rbp + 0x4a4], 2
mov edx, 0x104d
mov qword [rbp + 0x4c8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Start_when_I_log_on
mov dword ds:[rbp + 0x500], r15d
lea r9, [rbp + 0x500]
mov qword [rbp + 0x518], rax
xor r8d, r8d
mov qword [rbp + 0x504], 3
mov edx, 0x104d
mov qword [rbp + 0x528], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Start_hidden
mov dword ds:[rbp + 0x560], r15d
lea r9, [rbp + 0x560]
mov qword [rbp + 0x578], rax
xor r8d, r8d
mov qword [rbp + 0x564], 4
mov edx, 0x104d
mov qword [rbp + 0x588], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_tray_information_window
mov dword ds:[rbp + 0x5c0], r15d
lea r9, [rbp + 0x5c0]
mov qword [rbp + 0x5d8], rax
xor r8d, r8d
mov qword [rbp + 0x5c4], r15
mov edx, 0x104d
mov qword [rbp + 0x5e8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_kernel_mode_driver
mov dword ds:[rbp + 0x620], r15d
lea r9, [rbp + 0x620]
mov qword [rbp + 0x638], rax
xor r8d, r8d
mov qword [rbp + 0x624], 6
mov edx, 0x104d
mov qword [rbp + 0x648], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_warnings
mov dword ds:[rbp + 0x680], r15d
lea r9, [rbp + 0x680]
mov qword [rbp + 0x698], rax
xor r8d, r8d
mov qword [rbp + 0x684], 7
mov edx, 0x104d
mov qword [rbp + 0x6a8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_plugins
mov dword ds:[rbp + 0x6e0], r15d
lea r9, [rbp + 0x6e0]
mov qword [rbp + 0x6f8], rax
xor r8d, r8d
mov qword [rbp + 0x6e4], 8
mov edx, 0x104d
mov qword [rbp + 0x708], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_undecorated_symbols
mov dword ds:[rbp + 0x740], r15d
lea r9, [rbp + 0x740]
mov qword [rbp + 0x758], rax
xor r8d, r8d
mov qword [rbp + 0x744], 9
mov edx, 0x104d
mov qword [rbp + 0x768], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_cycle_based_CPU_usage
mov dword ds:[rbp + 0x7a0], r15d
lea r9, [rbp + 0x7a0]
mov qword [rbp + 0x7b8], rax
xor r8d, r8d
mov qword [rbp + 0x7a4], 0xa
mov edx, 0x104d
mov qword [rbp + 0x7c8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_theme_support__experimental_
mov dword ds:[rbp + 0x800], r15d
lea r9, [rbp + 0x800]
mov qword [rbp + 0x818], rax
xor r8d, r8d
mov qword [rbp + 0x804], 0xb
mov edx, 0x104d
mov qword [rbp + 0x828], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Enable_start_as_admin__experimental_
mov dword ds:[rbp + 0x860], r15d
lea r9, [rbp + 0x860]
mov qword [rbp + 0x878], rax
xor r8d, r8d
mov qword [rbp + 0x864], 0xc
mov edx, 0x104d
mov qword [rbp + 0x888], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Resolve_network_addresses
mov dword ds:[rbp + 0x8c0], r15d
lea r9, [rbp + 0x8c0]
mov qword [rbp + 0x8d8], rax
xor r8d, r8d
mov qword [rbp + 0x8c4], 0xd
mov edx, 0x104d
mov qword [rbp + 0x8e8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Resolve_DNS_over_HTTPS__DoH_
mov dword ds:[rbp + 0x920], r15d
lea r9, [rbp + 0x920]
mov qword [rbp + 0x938], rax
xor r8d, r8d
mov qword [rbp + 0x924], 0xe
mov edx, 0x104d
mov qword [rbp + 0x948], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Show_tooltips_instantly
mov dword ds:[rbp + 0x980], r15d
lea r9, [rbp + 0x980]
mov qword [rbp + 0x998], rax
xor r8d, r8d
mov qword [rbp + 0x984], 0xf
mov edx, 0x104d
mov qword [rbp + 0x9a8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword ds:[rbp + 0x9e0], r15d
lea rax, str.Check_images_for_digital_signatures
mov qword [rbp + 0x9e4], 0x10
lea r9, [rbp + 0x9e0]
mov qword [rbp + 0x9f8], rax
xor r8d, r8d
mov qword [rbp + 0xa08], r13
mov edx, 0x104d
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Check_services_for_digital_signatures
mov dword ds:[rbp + 0xa40], r15d
lea r9, [rbp + 0xa40]
mov qword [rbp + 0xa58], rax
xor r8d, r8d
mov qword [rbp + 0xa44], 0x11
mov edx, 0x104d
mov qword [rbp + 0xa68], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Single_click_tray_icons
mov dword ds:[rbp + 0xaa0], r15d
lea r9, [rbp + 0xaa0]
mov qword [rbp + 0xab8], rax
xor r8d, r8d
mov qword [rbp + 0xaa4], 0x12
mov edx, 0x104d
mov qword [rbp + 0xac8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Icon_click_toggles_visibility
mov dword ds:[rbp + 0xb00], r15d
lea r9, [rbp + 0xb00]
mov qword [rbp + 0xb18], rax
xor r8d, r8d
mov qword [rbp + 0xb04], 0x13
mov edx, 0x104d
mov qword [rbp + 0xb28], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Include_usage_of_collapsed_processes
mov dword ds:[rbp + 0xb60], r15d
lea r9, [rbp + 0xb60]
mov qword [rbp + 0xb78], rax
xor r8d, r8d
mov qword [rbp + 0xb64], 0x14
mov edx, 0x104d
mov qword [rbp + 0xb88], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str.Show_advanced_options__experimental_
mov dword ds:[rbp + 0x380], r15d
lea r9, [rbp + 0x380]
mov qword [rbp + 0x398], rax
xor r8d, r8d
mov qword [rbp + 0x384], 0x15
mov edx, 0x104d
mov qword [rbp + 0x3a8], r13
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xbd0], 0xf000
lock cmpxchg qword [0x140213dc0], r15
je 0x14006ad49
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.AllowOnlyOneInstance
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x10], 0x28
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006adc6
nop dword [rax]
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r14d
jne 0x14006adbe
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp - 0x18]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006adf8
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006ad90
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov rax, r15
lock cmpxchg qword [0x140213dc0], r13
je 0x14006ade7
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006ae07
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006adc6
cmp dword [rsi], 1
jne 0x14006adc6
mov ebx, dword [rsi + 0x28]
jmp 0x14006adcd
mov r14d, 0x1000
lea r9, [rbp + 0xbc0]
mov eax, r14d
mov ecx, 0x2000
test ebx, ebx
cmovne eax, ecx
lea edx, [r14 + 0x2b]
xor r8d, r8d
mov dword [rbp + 0xbcc], eax
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xc30], 0xf000
lock cmpxchg qword [0x140213dc0], r15
je 0x14006ae5a
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.HideOnClose
mov qword ds:[rbp + 0x28], rax
lea rcx, [rbp + 0x18]
mov qword [rbp + 0x20], 0x16
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword ds:[rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006aee6
nop word [rax + rax]
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006aede
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x18]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006af1c
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006aeb0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006af0b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006af2f
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
nop dword [rax]
test rsi, rsi
je 0x14006aee6
cmp dword [rsi], 1
jne 0x14006aee6
mov ebx, dword [rsi + 0x28]
jmp 0x14006aeed
mov eax, r14d
lea r9, [rbp + 0xc20]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 1
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xc2c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xc90], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006af85
lea rcx, [0x140213dc0]
nop dword [rax + rax]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.HideOnMinimize
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x50], 0x1c
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006b006
nop dword [rax + rax]
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006affe
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x48]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006b03c
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006afd0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006b02b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006b04f
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
nop dword [rax]
test rsi, rsi
je 0x14006b006
cmp dword [rsi], 1
jne 0x14006b006
mov ebx, dword [rsi + 0x28]
jmp 0x14006b00d
mov eax, r14d
lea r9, [rbp + 0xc80]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 2
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xc8c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xcf0], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006b0a5
lea rcx, [0x140213dc0]
nop dword [rax + rax]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.StartHidden
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0x78]
mov qword [rbp + 0x80], 0x16
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006b126
nop
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006b11e
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x78]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006b15c
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006b0f0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006b14b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006b16f
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
nop dword [rax]
test rsi, rsi
je 0x14006b126
cmp dword [rsi], 1
jne 0x14006b126
mov ebx, dword [rsi + 0x28]
jmp 0x14006b12d
mov eax, r14d
lea r9, [rbp + 0xce0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 4
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xcec], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xd50], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006b1c5
lea rcx, [0x140213dc0]
nop dword [rax + rax]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.MiniInfoWindowEnabled
mov qword [rbp + 0xb8], rax
lea rcx, [rbp + 0xa8]
mov qword [rbp + 0xb0], 0x2a
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006b24c
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006b244
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0xa8]
call qword [case.0x140101f48.0]
nop dword [rax]
test al, al
jne 0x14006b287
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006b211
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006b271
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006b296
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006b24c
cmp dword [rsi], 1
jne 0x14006b24c
mov ebx, dword [rsi + 0x28]
jmp 0x14006b253
mov eax, r14d
lea r9, [rbp + 0xd40]
mov ecx, 0x2000
test ebx, ebx
mov r8, rdi
mov edx, 0x102b
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xd4c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xdb0], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006b2e9
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.EnableKph
mov qword [rbp + 0xe8], rax
lea rcx, [rbp + 0xd8]
mov qword [rbp + 0xe0], 0x12
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006b375
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006b36d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0xd8]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006b3ab
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006b340
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006b39a
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006b3ba
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006b375
cmp dword [rsi], 1
jne 0x14006b375
mov ebx, dword [rsi + 0x28]
jmp 0x14006b37c
mov eax, r14d
lea r9, [rbp + 0xda0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 6
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xdac], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xe10], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006b40b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.EnableWarnings
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x108]
mov qword [rbp + 0x110], 0x1c
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006b495
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006b48d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x108]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006b4cb
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006b460
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006b4ba
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006b4da
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006b495
cmp dword [rsi], 1
jne 0x14006b495
mov ebx, dword [rsi + 0x28]
jmp 0x14006b49c
mov eax, r14d
lea r9, [rbp + 0xe00]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 7
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xe0c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xe70], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006b52b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.EnablePlugins
mov qword [rbp + 0x148], rax
lea rcx, [rbp + 0x138]
mov qword [rbp + 0x140], 0x1a
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006b5b5
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006b5ad
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x138]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006b5eb
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006b580
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006b5da
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006b5fa
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006b5b5
cmp dword [rsi], 1
jne 0x14006b5b5
mov ebx, dword [rsi + 0x28]
jmp 0x14006b5bc
mov eax, r14d
lea r9, [rbp + 0xe60]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 8
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xe6c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xed0], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006b64b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.DbgHelpUndecorate
mov qword [rbp + 0x178], rax
lea rcx, [rbp + 0x168]
mov qword [rbp + 0x170], 0x22
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006b6d5
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006b6cd
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x168]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006b70b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006b6a0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006b6fa
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006b71a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006b6d5
cmp dword [rsi], 1
jne 0x14006b6d5
mov ebx, dword [rsi + 0x28]
jmp 0x14006b6dc
mov eax, r14d
lea r9, [rbp + 0xec0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 9
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xecc], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xf30], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006b76b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.EnableCycleCpuUsage
mov qword [rbp + 0x1a8], rax
lea rcx, [rbp + 0x198]
mov qword [rbp + 0x1a0], 0x26
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006b7f5
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006b7ed
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x198]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006b82b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006b7c0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006b81a
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006b83a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006b7f5
cmp dword [rsi], 1
jne 0x14006b7f5
mov ebx, dword [rsi + 0x28]
jmp 0x14006b7fc
mov eax, r14d
lea r9, [rbp + 0xf20]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xa
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xf2c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xf90], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006b88b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.EnableThemeSupport
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0x1c8]
mov qword [rbp + 0x1d0], 0x24
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006b915
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006b90d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x1c8]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006b94b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006b8e0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006b93a
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006b95a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006b915
cmp dword [rsi], 1
jne 0x14006b915
mov ebx, dword [rsi + 0x28]
jmp 0x14006b91c
mov eax, r14d
lea r9, [rbp + 0xf80]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xb
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xf8c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0xff0], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006b9ab
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.EnableStartAsAdmin
mov qword [rbp + 0x208], rax
lea rcx, [rbp + 0x1f8]
mov qword [rbp + 0x200], 0x24
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006ba35
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006ba2d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x1f8]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006ba6b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006ba00
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006ba5a
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006ba7a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006ba35
cmp dword [rsi], 1
jne 0x14006ba35
mov ebx, dword [rsi + 0x28]
jmp 0x14006ba3c
mov eax, r14d
lea r9, [rbp + 0xfe0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xc
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0xfec], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x1050], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006bacb
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.EnableNetworkResolve
mov qword [rbp + 0x238], rax
lea rcx, [rbp + 0x228]
mov qword [rbp + 0x230], 0x28
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006bb55
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006bb4d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x228]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006bb8b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006bb20
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006bb7a
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006bb9a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006bb55
cmp dword [rsi], 1
jne 0x14006bb55
mov ebx, dword [rsi + 0x28]
jmp 0x14006bb5c
mov eax, r14d
lea r9, [rbp + 0x1040]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xd
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x104c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x10b0], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006bbeb
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.EnableNetworkResolveDoH
mov qword [rbp + 0x268], rax
lea rcx, [rbp + 0x258]
mov qword [rbp + 0x260], 0x2e
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006bc75
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006bc6d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x258]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006bcab
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006bc40
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006bc9a
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006bcba
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006bc75
cmp dword [rsi], 1
jne 0x14006bc75
mov ebx, dword [rsi + 0x28]
jmp 0x14006bc7c
mov eax, r14d
lea r9, [rbp + 0x10a0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xe
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x10ac], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x1110], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006bd0b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.EnableInstantTooltips
mov qword [rbp + 0x298], rax
lea rcx, [rbp + 0x288]
mov qword [rbp + 0x290], 0x2a
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006bd95
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006bd8d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x288]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006bdcb
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006bd60
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006bdba
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006bdda
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006bd95
cmp dword [rsi], 1
jne 0x14006bd95
mov ebx, dword [rsi + 0x28]
jmp 0x14006bd9c
mov eax, r14d
lea r9, [rbp + 0x1100]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0xf
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x110c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x1170], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006be2b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.EnableStage2
mov qword [rbp + 0x2c8], rax
lea rcx, [rbp + 0x2b8]
mov qword [rbp + 0x2c0], 0x18
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006beb5
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006bead
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x2b8]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006beeb
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006be80
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006beda
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006befa
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006beb5
cmp dword [rsi], 1
jne 0x14006beb5
mov ebx, dword [rsi + 0x28]
jmp 0x14006bebc
mov eax, r14d
lea r9, [rbp + 0x1160]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0x10
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x116c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x11d0], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006bf4b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.EnableServiceStage2
mov qword [rbp + 0x2f8], rax
lea rcx, [rbp + 0x2e8]
mov qword [rbp + 0x2f0], 0x26
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006bfd5
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006bfcd
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x2e8]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006c00b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006bfa0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006bffa
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006c01a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006bfd5
cmp dword [rsi], 1
jne 0x14006bfd5
mov ebx, dword [rsi + 0x28]
jmp 0x14006bfdc
mov eax, r14d
lea r9, [rbp + 0x11c0]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0x11
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x11cc], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x1230], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006c06b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.IconSingleClick
mov qword [rbp + 0x328], rax
lea rcx, [rbp + 0x318]
mov qword [rbp + 0x320], 0x1e
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006c0f5
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006c0ed
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x318]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006c12b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006c0c0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006c11a
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006c13a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006c0f5
cmp dword [rsi], 1
jne 0x14006c0f5
mov ebx, dword [rsi + 0x28]
jmp 0x14006c0fc
mov eax, r14d
lea r9, [rbp + 0x1220]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0x12
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x122c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x1290], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006c18b
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.IconTogglesVisibility
mov qword [rbp + 0x358], rax
lea rcx, [rbp + 0x348]
mov qword [rbp + 0x350], 0x2a
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006c215
nop word [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006c20d
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rbp + 0x348]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006c24b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006c1e0
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov edi, 5
mov eax, edi
lock cmpxchg qword [0x140213dc0], r13
je 0x14006c23a
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006c25a
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rsi, rsi
je 0x14006c215
cmp dword [rsi], 1
jne 0x14006c215
mov ebx, dword [rsi + 0x28]
jmp 0x14006c21c
mov eax, r14d
lea r9, [rbp + 0x1280]
mov ecx, 0x2000
test ebx, ebx
mov edx, 0x102b
mov r8d, 0x13
cmovne eax, ecx
mov rcx, r12
mov dword [rbp + 0x128c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dword [rbp + 0x12f0], 0xf000
lock cmpxchg qword [0x140213dc0], rdi
je 0x14006c2ab
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rdi, qword [0x1402178b0]
lea rax, str.PropagateCpuUsage
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x30], 0x22
mov rax, qword [rdi + 0x10]
call qword [case.0x140101f48.0]
mov ecx, dword [rdi + 0x18]
btr eax, 0x1f
mov r15d, eax
dec ecx
mov rax, qword [rdi + 0x20]
and rcx, r15
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x14006c327
mov ebx, dword ds:[rdi]
add ebx, 8
imul ebx, edx
add rbx, qword [rdi + 0x30]
cmp dword [rbx], r15d
jne 0x14006c31f
mov rax, qword [rdi + 8]
lea rsi, [rbx + 8]
mov rcx, rsi
lea rdx, [rsp + 0x28]
call qword [case.0x140101f48.0]
test al, al
jne 0x14006c35b
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x14006c2f1
mov ebx, dword [rsp + 0x20]
mov rsi, r13
mov eax, 5
lock cmpxchg qword [0x140213dc0], r13
je 0x14006c34a
lea rcx, [0x140213dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rsi, rsi
jne 0x14006c36f
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
nop dword [rax + rax]
test rsi, rsi
je 0x14006c327
cmp dword [rsi], 1
jne 0x14006c327
mov ebx, dword [rsi + 0x28]
jmp 0x14006c32e
test ebx, ebx
lea r9, [rbp + 0x12e0]
mov ebx, 0x2000
mov edx, 0x102b
cmovne r14d, ebx
mov r8d, 0x14
mov rcx, r12
mov dword [rbp + 0x12ec], r14d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x14021467c], r13b
je 0x14006c3d0
lea r9, [rbp + 0x1340]
mov dword [rbp + 0x1350], 0xf000
mov edx, 0x102b
mov dword [rbp + 0x134c], ebx
mov r8d, 3
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x1508]
mov rcx, qword [rbp + 0x13c0]
xor rcx, rsp
call fcn.140161390
lea r11, [rsp + 0x14d0]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret