Function at 0x140027cb0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xe0
mov qword [rax + 0x18], rbp
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r14
xor r14d, r14d
test byte [0x1401978c0], 1
mov qword [rax - 0x28], r15
mov r15d, 5
jne 0x140027ee9
mov rcx, qword [0x1401978c8]
test rcx, rcx
je 0x140027d08
mov rcx, qword [rcx + 8]
xor edx, edx
call sym.ProcessHacker.exe_PhGetFullPath
mov rsi, rax
mov qword [0x140192538], rax
jmp 0x140027d0f
mov rsi, qword [0x140192538]
or ebp, 0xffffffff
test rsi, rsi
jne 0x140027dd3
mov rdi, qword [0x140192530]
mov rbx, qword [0x14018ad88]
mov rdx, qword [0x140196800]
add rbx, qword [rdi]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rsi, rax
mov qword [rax], rbx
add rax, 0x10
mov qword [rsi + 8], rax
mov word [rax + rbx], r14w
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov rcx, qword [rsi + 8]
call fcn.14010e700
mov rcx, qword [rsi + 8]
add rcx, qword [rdi]
mov r8, qword [0x14018ad88]
mov rdx, qword [str..settings.xml]
call fcn.14010e700
mov rcx, qword [rsi + 8]
call qword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
je 0x140027d90
mov qword [0x140192538], rsi
jmp 0x140027dac
lea rcx, [rsi - 0x10]
mov eax, ebp
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140027da5
call fcn.1400c8bc0
mov rsi, qword [0x140192538]
test rsi, rsi
jne 0x140027dd3
lea rdx, str.Process_Hacker_settings.xml
lea ecx, [rsi + 0x1a]
call sym.ProcessHacker.exe_PhGetKnownLocation
mov qword [0x140192538], rax
mov rsi, rax
test rax, rax
je 0x140027ee9
mov rcx, qword [rsi + 8]
call sym.ProcessHacker.exe_PhLoadSettings
cmp eax, 0xc0000102
jne 0x140027ee9
mov rcx, qword [sym.ProcessHacker.exe_PhMainWndHandle]
lea rax, str.If_you_select_No__the_settings_system_will_not_function_properly.
lea r9, str.Process_Hackers_settings_file_is_corrupt._Do_you_want_to_reset_it_
mov qword [rsp + 0x20], rax
mov edx, 6
mov r8d, 0xffff
call sym.ProcessHacker.exe_PhShowMessage2
cmp eax, 6
jne 0x140027ec8
mov eax, dword [0x14015db88]
lea rcx, [rsp + 0xf8]
mov rdx, qword [0x140192538]
xor r9d, r9d
movups xmm0, xmmword [str._settings___settings_]
mov dword [rsp + 0x80], eax
mov r8d, 0x120116
movzx eax, word [0x14015db8c]
mov rdx, qword [rdx + 8]
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x28], 4
movups xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x84], ax
mov dword [rsp + 0x20], r15d
call sym.ProcessHacker.exe_PhCreateFileWin32
test eax, eax
js 0x140027ee9
mov rcx, qword [rsp + 0xf8]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], r14
xor r8d, r8d
mov dword [rsp + 0x30], 0x15
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140027ee9
mov rcx, qword [0x140192538]
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], ebp
cmp ebp, 1
jne 0x140027ee2
call fcn.1400c8bc0
mov qword [0x140192538], r14
lea rcx, str.MaxSizeUnit
call sym.ProcessHacker.exe_PhGetIntegerSetting
mov dword [0x140190e48], eax
lea rax, str.SampleCountAutomatic
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x50], 0x28
lock cmpxchg qword [0x140193950], r15
je 0x140027f29
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
movups xmm0, xmmword [rsp + 0x50]
mov rsi, qword [0x1401965a8]
lea rcx, [rsp + 0x88]
movups xmmword [rsp + 0x90], xmm0
call qword [rsi + 0x10]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov ebp, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, rbp
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x140027f90
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], ebp
jne 0x140027f88
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rsp + 0x88]
call qword [rsi + VariantCopy]
test al, al
jne 0x140027f93
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x140027f62
mov rdi, r14
mov rsi, qword [rsp + 0xd8]
mov rbp, qword [rsp + 0x100]
test rdi, rdi
je 0x140027fb2
cmp dword [rdi], 1
jne 0x140027fb2
mov ebx, dword [rdi + 0x28]
jmp 0x140027fbc
mov ebx, dword [rsp + 0xf0]
mov rdi, r14
mov rax, r15
mov r15, qword [rsp + 0xc0]
lock cmpxchg qword [0x140193950], r14
mov r14, qword [rsp + 0xc8]
je 0x140027fe6
lea rcx, [0x140193950]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rdi, rdi
mov rdi, qword [rsp + 0xd0]
jne 0x140027fff
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test ebx, ebx
je 0x14002802d
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
inc eax
mov ecx, 0x800
cdq
sub eax, edx
sar eax, 1
cmp eax, ecx
cmova eax, ecx
lea rcx, str.SampleCount
mov edx, eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
add rsp, 0xe0
pop rbx
ret