Function at 0x42f320
Capabilities:
Check mutex on windows
Check processdebugflags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3ec
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x3e8], eax
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x42f34e
mov ecx, dword [ecx + 4]
jmp 0x42f353
mov ecx, 0x5caac0
mov eax, dword [ebx + 0x58]
mov dword [esp + 0x11c], eax
lea eax, [esp + 0x118]
push eax
push 0
push 0x104c
push dword [ebx]
mov dword [esp + 0x128], 1
mov dword [esp + 0x130], 1
mov dword [esp + 0x13c], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x42f3a2
mov ecx, dword ds:[ecx + 4]
jmp 0x42f3a7
mov ecx, 0x5caac0
mov eax, dword ds:[ebx + 0x5c]
mov dword [esp + 0x11c], eax
lea eax, [esp + 0x118]
push eax
push 0
push 0x104c
push dword [ebx]
mov dword [esp + 0x128], 1
mov dword [esp + 0x130], 1
mov dword [esp + 0x13c], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x42f453
push 0x10
lea ecx, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push ecx
push eax
call fcn.00582eea
mov eax, dword [ebx + 0x60]
add esp, 0xc
mov dword [esp + 0x11c], eax
lea eax, [esp + 0x180]
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x118]
mov dword [esp + 0x118], 1
push eax
push 0
push 0x104c
push dword [ebx]
mov dword [esp + 0x130], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x42f462
mov eax, dword [eax + 4]
jmp 0x42f467
mov eax, 0x5caac0
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x24]
push ecx
push eax
call sym.SystemInformer.exe_PhGetAccessEntries
mov ecx, dword ds:[ebx + 0xc]
test al, al
je 0x42f568
push dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push esi
push dword [ecx + 0x14]
call sym.SystemInformer.exe_PhGetAccessString
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
cmp dword [eax], 0
je 0x42f4f9
push dword [eax + 4]
mov eax, dword [ebx + 0xc]
push dword [eax + 0x14]
push str.0x_x___s_
call sym.SystemInformer.exe_PhFormatString
add esp, 0xc
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov dword [esp + 0x118], 1
mov dword [esp + 0x11c], 3
mov dword [esp + 0x120], 1
mov eax, dword [eax + 4]
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x118]
jmp 0x42f544
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x184]
push 0x10
push ecx
mov eax, dword [eax + 0x14]
push eax
mov dword [esp + 0x18c], 0x780030
call fcn.00582eea
lea eax, [esp + 0x18c]
mov dword [esp + 0x5c], 1
mov dword [esp + 0x70], eax
add esp, 0xc
mov dword [esp + 0x54], 3
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x42f5cf
mov eax, dword [ecx + 0x14]
lea ecx, [esp + 0x184]
push 0x10
push ecx
push eax
mov dword [esp + 0x18c], 0x780030
call fcn.00582eea
add esp, 0xc
mov dword [esp + 0x118], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x11c], 3
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x118]
mov dword [esp + 0x120], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x635f50], 3
mov ecx, 0x1000
push dword [ebx + 8]
mov eax, 0x40
cmovge eax, ecx
push eax
lea eax, [esp + 0x24]
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x42f786
mov eax, dword ds:[ebx + 0xc]
lea ecx, [esp + 0x118]
push 0
push 0
push 0
push 0
push ecx
lea ecx, [esp + 0x3c]
push ecx
push 0
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x40]
call sym.SystemInformer.exe_PhGetHandleInformationEx
test eax, eax
js 0x42f779
mov eax, dword [esp + 0x28]
test eax, eax
js 0x42f779
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x12c]
call fcn.00582eea
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x54], 4
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x128]
call fcn.00582eea
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x54], 5
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x130]
call fcn.00582eea
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x54], 6
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x134]
call fcn.00582eea
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x54], 7
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword ds:[esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x43214e
cmp dword [eax], 0
je 0x43214e
push 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x12
push ecx
push eax
mov dword [esp + 0x20], str.ALPC_Port
call sym.SystemInformer.exe_PhEqualStringRef
lea ebx, [ebx]
test al, al
je 0x4308ce
cmp dword [0x635f50], 3
jl 0x43214e
push dword [ebx + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43214e
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x1c]
push 0
push 0x14
mov edx, dword [edx + 8]
push eax
push 0
call fcn.00524600
test eax, eax
js 0x42fe67
mov edi, dword [esp + 0x54]
lea eax, [esp + 0x28]
push 0
push 0
mov esi, 0x100
mov dword [esp + 0x38], edi
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], esi
call sym.SystemInformer.exe_PhCreateString3
mov edx, eax
xor eax, eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], edx
mov dword [edx], 0
mov ecx, dword [edx + 4]
mov word [ecx], ax
test dword [esp + 0x54], 0x1000
je 0x42f8cc
mov eax, dword [edx]
add eax, 0x14
cmp eax, esi
jbe 0x42f884
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x14
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], edx
mov ecx, dword [edx + 4]
xor edi, edi
add ecx, dword [edx]
mov eax, dword [str.LPC_mode_]
mov dword [ecx], eax
mov eax, dword [0x5fd248]
mov dword [ecx + 4], eax
mov eax, dword [0x5fd24c]
mov dword [ecx + 8], eax
mov eax, dword [0x5fd250]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5fd254]
mov dword [ecx + 0x10], eax
add dword [edx], 0x14
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], di
mov edi, dword [esp + 0x30]
and edi, 0xffffefff
mov dword [esp + 0x30], edi
test dword [esp + 0x54], 0x10000
je 0x42f927
mov eax, dword [edx]
add eax, 0x2a
cmp esi, eax
jae 0x42f8f8
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x2a
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 0xa
add edi, dword [edx]
mov esi, str.Allow_impersonation_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x2a
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xfffeffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x20000
je 0x42f982
mov eax, dword [edx]
add eax, 0x28
cmp dword [esp + 0x10], eax
jae 0x42f955
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x28
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 0xa
add edi, dword [edx]
mov esi, str.Allow_LPC_requests_
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x28
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xfffdffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x40000
je 0x42f9f4
mov eax, dword [edx]
add eax, 0x14
cmp dword [esp + 0x10], eax
jae 0x42f9b0
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x14
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov ecx, dword [edx + 4]
xor esi, esi
add ecx, dword [edx]
mov eax, dword [str.Waitable_]
mov dword [ecx], eax
mov eax, dword [0x5fd2b8]
mov dword [ecx + 4], eax
mov eax, dword [0x5fd2bc]
mov dword [ecx + 8], eax
mov eax, dword [0x5fd2c0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5fd2c4]
mov dword [ecx + 0x10], eax
add dword [edx], 0x14
and edi, 0xfffbffff
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x80000
je 0x42fa4f
mov eax, dword [edx]
add eax, 0x34
cmp dword [esp + 0x10], eax
jae 0x42fa22
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x34
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 0xd
add edi, dword [edx]
mov esi, str.Allow_object_duplication_
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x34
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xfff7ffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x100000
je 0x42faae
mov eax, dword ds:[edx]
add eax, 0x2a
cmp dword [esp + 0x10], eax
jae 0x42fa7f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x2a
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 0xa
add edi, dword [edx]
mov esi, str.System_process_only_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x2a
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xffefffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x200000
je 0x42fb0e
mov eax, dword ds:[edx]
add eax, 0x22
cmp dword [esp + 0x10], eax
jae 0x42fadf
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x22
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 8
add edi, dword [edx]
mov esi, str.Wake_policy__1__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xffdfffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x400000
je 0x42fb6e
mov eax, dword ds:[edx]
add eax, 0x22
cmp dword [esp + 0x10], eax
jae 0x42fb3f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x22
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 8
add edi, dword [edx]
mov esi, str.Wake_policy__2__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xffbfffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x800000
je 0x42fbce
mov eax, dword ds:[edx]
add eax, 0x22
cmp dword [esp + 0x10], eax
jae 0x42fb9f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x22
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 8
add edi, dword [edx]
mov esi, str.Wake_policy__3__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xff7fffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x1000000
je 0x42fc2c
mov eax, dword ds:[edx]
add eax, 0x38
cmp dword [esp + 0x10], eax
jae 0x42fbff
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x38
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 0xe
add edi, dword [edx]
mov esi, str.No_shared_section__direct__
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x38
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xfeffffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x2000000
je 0x42fc8a
mov eax, dword ds:[edx]
add eax, 0x3e
cmp dword [esp + 0x10], eax
jae 0x42fc5f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x3e
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 0xf
add edi, dword [edx]
mov esi, str.Allow_multi_handle_attributes_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x3e
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xfdffffff
mov word [ecx + eax], si
mov ecx, dword ds:[edx]
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], 0x5cff30
cmp ecx, 4
jb 0x42fd14
mov eax, dword [edx + 4]
add ecx, 0xfffffffc
add eax, ecx
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], eax
lea eax, [esp + 0x28]
push 0
push eax
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x42fd10
mov ecx, dword [esp + 0x20]
mov esi, dword [ecx]
mov eax, esi
mov ecx, dword [ecx + 4]
shr eax, 1
lea edx, [eax*2 - 4]
sub esi, edx
lea eax, [ecx + eax*2]
sub esi, 4
push esi
push eax
lea eax, [ecx + edx]
push eax
call fcn.00581150
mov edx, dword [esp + 0x2c]
add esp, 0xc
add dword [edx], 0xfffffffc
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], si
jmp 0x42fd14
mov edx, dword [esp + 0x20]
cmp dword [esp + 0x54], 0
jne 0x42fd69
mov eax, dword [edx]
add eax, 0xa
cmp dword [esp + 0x10], eax
jae 0x42fd3b
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0xa
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 4]
add ecx, dword [edx]
mov eax, dword [0x5fd418]
mov dword [ecx], eax
mov eax, dword [0x5fd41c]
mov dword [ecx + 4], eax
mov ax, word [0x5fd420]
mov word [ecx + 8], ax
add dword [edx], 0xa
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], si
jmp 0x42fdac
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push dword [esp + 0x5c]
call fcn.00582eea
add esp, 0xc
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x14]
push str.___s_
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov edx, dword [esp + 0x20]
add esp, 0xc
test edi, edi
je 0x42fdec
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push edi
call fcn.00582eea
add esp, 0xc
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x14]
push str.__UNKNOWN:__s_
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov edx, dword [esp + 0x20]
add esp, 0xc
push dword [edx + 4]
push 1
push dword [ebx + 0x78]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe_PhDeleteBytesBuilder
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x60]
call fcn.00582eea
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 1
push dword [ebx + 0x7c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push dword [esp + 0x64]
call fcn.00582eea
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 1
push dword [ebx + 0x80]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x1c]
push eax
mov edx, dword [edx + 8]
call fcn.005246e0
mov edx, dword ds:[ebx + 0xc]
xor ecx, ecx
mov edi, dword [esp + 0x28]
test eax, eax
push ecx
push 0x3c
mov edx, dword [edx + 8]
lea eax, [esp + 0x120]
push eax
cmovs edi, ecx
mov ecx, dword [esp + 0x28]
push 1
call fcn.00524600
test eax, eax
js 0x430172
mov eax, dword [esp + 0x118]
test eax, eax
je 0x42ff8b
xor edx, edx
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.0052c5c0
mov esi, eax
mov dword [esp + 0x28], esi
test edi, edi
je 0x42ff72
movzx ecx, word [edi]
mov edx, ecx
test cx, cx
je 0x42ff72
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xb0], eax
mov eax, edx
mov dword [esp + 0xe0], eax
mov dword [esp + 0xa0], 1
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], 1
mov dword [esp + 0xc8], 6
mov dword [esp + 0xcc], 0x5fd444
mov dword [esp + 0xd0], 1
mov eax, dword [edi + 4]
push 0x104
mov dword [esp + 0xe8], eax
lea eax, [esp + 0xa4]
push 3
push eax
call sym.SystemInformer.exe_PhFormat
push dword [esp + 0x28]
mov esi, eax
call sym.SystemInformer.exe_PhDereferenceObject
push dword ds:[esi + 4]
push 1
push dword [ebx + 0xb8]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
mov eax, dword [esp + 0x12c]
test eax, eax
je 0x430065
xor edx, edx
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.0052c5c0
mov esi, eax
mov dword [esp + 0x28], esi
test edi, edi
je 0x43004a
movzx ecx, word [edi + 8]
mov edx, ecx
test cx, cx
je 0x43004a
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xb0], eax
mov eax, edx
mov dword [esp + 0xe0], eax
mov dword [esp + 0xa0], 1
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], 1
mov dword [esp + 0xc8], 6
mov dword [esp + 0xcc], 0x5fd444
mov dword [esp + 0xd0], 1
mov eax, dword [edi + 0xc]
push 0x104
mov dword [esp + 0xe8], eax
lea eax, [esp + 0xa4]
push 3
push eax
call sym.SystemInformer.exe_PhFormat
push dword [esp + 0x28]
mov esi, eax
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esi + 4]
push 1
push dword [ebx + 0xbc]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
mov eax, dword [esp + 0x140]
test eax, eax
je 0x43013d
xor edx, edx
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.0052c5c0
mov esi, eax
mov dword [esp + 0x28], esi
test edi, edi
je 0x430125
movzx ecx, word ds:[edi + 0x10]
mov edx, ecx
test cx, cx
je 0x430125
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xb0], eax
mov eax, edx
mov dword [esp + 0xe0], eax
mov dword [esp + 0xa0], 1
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], 1
mov dword [esp + 0xc8], 6
mov dword [esp + 0xcc], 0x5fd444
mov dword [esp + 0xd0], 1
mov eax, dword [edi + 0x14]
push 0x104
mov dword [esp + 0xe8], eax
lea eax, [esp + 0xa4]
push 3
push eax
call sym.SystemInformer.exe_PhFormat
push dword [esp + 0x28]
mov esi, eax
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esi + 4]
push 1
push dword [ebx + 0xc0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
lea ecx, [ecx]
test edi, edi
je 0x430153
push edi
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push dword [ebx + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 0
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43214e
push 0
push 0
push 0x20000
lea eax, [esp + 0x34]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [ecx]
test esi, esi
js 0x43214e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x43214e
push 0
push 0xc
lea ecx, [esp + 0x48]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x43088b
mov edi, dword [esp + 0x40]
lea eax, [esp + 0x20]
push 0
push 0
mov esi, 0x100
mov dword [esp + 0x38], edi
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], esi
call sym.SystemInformer.exe_PhCreateString3
mov edx, eax
xor eax, eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], edx
mov dword [edx], 0
mov ecx, dword [edx + 4]
mov word [ecx], ax
mov eax, dword [esp + 0x40]
test eax, 0x1000
je 0x4302bd
mov eax, dword [edx]
add eax, 0x14
cmp eax, esi
jbe 0x430271
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x14
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], edx
mov ecx, dword [edx]
xor edi, edi
add ecx, dword [edx + 4]
mov eax, dword [str.LPC_mode_]
mov dword [ecx], eax
mov eax, dword [0x5fd248]
mov dword [ecx + 4], eax
mov eax, dword [0x5fd24c]
mov dword [ecx + 8], eax
mov eax, dword [0x5fd250]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5fd254]
mov dword [ecx + 0x10], eax
add dword [edx], 0x14
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov word [ecx + eax], di
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x40]
and edi, 0xffffefff
mov dword [esp + 0x30], edi
lea ecx, [ecx]
test eax, 0x10000
je 0x430320
mov eax, dword [edx]
add eax, 0x2a
cmp esi, eax
jae 0x4302ed
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x2a
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 0xa
add edi, dword [edx + 4]
mov esi, str.Allow_impersonation_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x2a
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xfffeffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x20000
je 0x430380
mov eax, dword [edx]
add eax, 0x28
cmp dword [esp + 0x10], eax
jae 0x43034f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x28
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 0xa
add edi, dword [edx + 4]
mov esi, str.Allow_LPC_requests_
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x28
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xfffdffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x40000
je 0x4303f7
mov eax, dword [edx]
add eax, 0x14
cmp dword [esp + 0x10], eax
jae 0x4303af
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x14
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov ecx, dword [edx]
xor esi, esi
add ecx, dword [edx + 4]
mov eax, dword [str.Waitable_]
mov dword [ecx], eax
mov eax, dword [0x5fd2b8]
mov dword [ecx + 4], eax
mov eax, dword [0x5fd2bc]
mov dword [ecx + 8], eax
mov eax, dword [0x5fd2c0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5fd2c4]
mov dword [ecx + 0x10], eax
add dword [edx], 0x14
and edi, 0xfffbffff
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
jmp 0x430400
test eax, 0x80000
je 0x430460
mov eax, dword [edx]
add eax, 0x34
cmp dword [esp + 0x10], eax
jae 0x43042f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x34
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 0xd
add edi, dword [edx + 4]
mov esi, str.Allow_object_duplication_
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x34
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xfff7ffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x100000
je 0x4304c2
mov eax, dword [edx]
add eax, 0x2a
cmp dword [esp + 0x10], eax
jae 0x43048f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x2a
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 0xa
add edi, dword [edx + 4]
mov esi, str.System_process_only_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x2a
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xffefffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x200000
je 0x430524
mov eax, dword [edx]
add eax, 0x22
cmp dword [esp + 0x10], eax
jae 0x4304f1
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x22
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 8
add edi, dword [edx + 4]
mov esi, str.Wake_policy__1__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xffdfffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x400000
je 0x430586
mov eax, dword [edx]
add eax, 0x22
cmp dword [esp + 0x10], eax
jae 0x430553
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x22
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 8
add edi, dword [edx + 4]
mov esi, str.Wake_policy__2__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xffbfffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x800000
je 0x4305e8
mov eax, dword [edx]
add eax, 0x22
cmp dword [esp + 0x10], eax
jae 0x4305b5
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x22
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 8
add edi, dword [edx + 4]
mov esi, str.Wake_policy__3__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xff7fffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x1000000
je 0x430648
mov eax, dword [edx]
add eax, 0x38
cmp dword [esp + 0x10], eax
jae 0x430617
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x38
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 0xe
add edi, dword [edx + 4]
mov esi, str.No_shared_section__direct__
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x38
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xfeffffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x2000000
je 0x4306a2
mov eax, dword [edx]
add eax, 0x3e
cmp dword [esp + 0x10], eax
jae 0x430677
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x3e
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 0xf
add edi, dword [edx + 4]
mov esi, str.Allow_multi_handle_attributes_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x3e
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xfdffffff
mov word [ecx + eax], si
mov ecx, dword [edx]
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 0x5cff30
cmp ecx, 4
jb 0x43072f
mov eax, dword ds:[edx + 4]
add ecx, 0xfffffffc
add eax, ecx
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x30]
push 0
push eax
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x43072b
mov ecx, dword [esp + 0x20]
mov esi, dword [ecx]
mov eax, esi
mov ecx, dword [ecx + 4]
shr eax, 1
lea edx, [eax*2 - 4]
sub esi, edx
lea eax, [ecx + eax*2]
sub esi, 4
push esi
push eax
lea eax, [ecx + edx]
push eax
call fcn.00581150
mov edx, dword [esp + 0x2c]
add esp, 0xc
add dword [edx], 0xfffffffc
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], si
jmp 0x43072f
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x43078c
mov eax, dword [edx]
add eax, 0xa
cmp dword [esp + 0x10], eax
jae 0x43075b
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0xa
call fcn.004ff6b0
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
add ecx, dword [edx + 4]
mov eax, dword [0x5fd418]
mov dword [ecx], eax
mov eax, dword [0x5fd41c]
mov dword [ecx + 4], eax
mov ax, word [0x5fd420]
mov word [ecx + 8], ax
add dword [edx], 0xa
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], si
jmp 0x4307cc
push 0x10
lea ecx, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push ecx
push eax
call fcn.00582eea
add esp, 0xc
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x14]
push str.___s_
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov edx, dword [esp + 0x20]
add esp, 0xc
test edi, edi
je 0x430810
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push edi
call fcn.00582eea
add esp, 0xc
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x14]
push str.__UNKNOWN:__s_
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov edx, dword [esp + 0x20]
add esp, 0xc
push dword [edx + 4]
push 1
push dword [ebx + 0x78]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe_PhDeleteBytesBuilder
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x60]
call fcn.00582eea
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 1
push dword [ebx + 0x7c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push dword [esp + 0x64]
call fcn.00582eea
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 1
push dword [ebx + 0x80]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp dword [0x62dbb0], 0x6c
jb 0x43194b
push 0
push 8
lea eax, [esp + 0x18]
push eax
push 0xc
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x43194b
mov eax, dword [esp + 0x14]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x3c], 0
jmp 0x43192a
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x38]
push 1
push ecx
mov dword [esp + 0x40], 0x1e
push dword [eax + 0x20]
mov dword [esp + 0x48], str.EtwRegistration
call sym.SystemInformer.exe_PhEqualStringRef
mov ecx, dword [ebx + 0xc]
test al, al
je 0x43091f
mov eax, dword [ecx + 0x24]
test eax, eax
je 0x43090f
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xd4]
jmp 0x432147
xor eax, eax
push eax
push 1
push dword [ebx + 0xd4]
jmp 0x432147
push 1
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 8
push eax
push dword [ecx + 0x20]
mov dword [esp + 0x48], 0x5fb678
call sym.SystemInformer.exe_PhEqualStringRef
mov edi, edi
test al, al
je 0x431449
cmp dword [0x635f50], 3
jl 0x430f0f
push dword [ebx + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x430f0f
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x40]
push eax
push ecx
lea eax, [esp + 0x98]
mov byte [esp + 0x17], 0
mov edx, dword [edx + 8]
push eax
push ecx
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x1e], 0
call fcn.00524820
test eax, eax
js 0x430a05
mov eax, dword [esp + 0x90]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x4309c0.6
movzx eax, byte [eax + 0x432178]
lea esp, [esp]
jmp dword [eax*4 + 0x432164]
push str.Pipe
jmp 0x4309f3
push str.Network
jmp 0x4309f3
mov byte ds:[esp + 0xf], 1
push str.File_or_directory
jmp 0x4309f3
mov byte [esp + 0xe], 1
push str.Console
jmp 0x4309f3
push 0x5fd49c
push 1
push dword [ebx + 0x84]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 4
lea eax, [esp + 0x34]
push eax
mov eax, dword [ebx + 0xc]
push 0x10
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
lea ecx, [ecx]
test eax, eax
js 0x430b2e
mov eax, dword [esp + 0x30]
mov edx, eax
mov ecx, eax
and edx, 0xfeffffff
or ecx, 0x1000000
test al, 0x30
push 6
cmovne ecx, edx
push 0x5d28f8
push ecx
call sym.SystemInformer.exe_PhGetAccessString
mov ecx, dword [esp + 0x30]
mov esi, eax
push 0
mov dword [esp + 0xa4], 1
mov dword [esp + 0xb4], 4
mov dword [esp + 0xb8], 0x5f5ba0
mov dword [esp + 0xbc], 0x108
mov dword [esp + 0xcc], ecx
mov byte [esp + 0xc6], 0x10
mov dword [esp + 0xd4], 1
mov dword [esp + 0xe4], 4
mov dword [esp + 0xe8], 0x5fc09c
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xfc], eax
lea eax, [esp + 0x1ec]
push 0x208
push eax
push 5
lea eax, [esp + 0xb0]
mov dword [esp + 0xf8], 1
push eax
mov dword [esp + 0x110], ecx
mov dword [esp + 0x114], 1
mov dword [esp + 0x124], 2
mov dword [esp + 0x128], 0x5fd4a8
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x430b28
lea eax, [esp + 0x1e8]
push eax
push 1
push dword [ebx + 0x88]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
cmp byte [esp + 0xe], 0
jne 0x430d27
push 0x18
lea eax, [esp + 0x54]
push eax
mov eax, dword [ebx + 0xc]
push 5
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
test eax, eax
js 0x430bd9
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
push 0
mov dword [esp + 0x12c], eax
lea eax, [esp + 0xa4]
push 0x64
push eax
push 1
lea eax, [esp + 0x128]
mov dword [esp + 0x128], 0xc
push eax
mov dword [esp + 0x140], ecx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x430bb0
lea eax, [esp + 0xa0]
push eax
push 1
push dword [ebx + 0x90]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [esp + 0xf], 0
je 0x430bd9
cmp byte [esp + 0x65], 0
mov ecx, 0x5fb678
mov eax, 0x5fd4ac
cmove eax, ecx
push eax
push 1
push dword [ebx + 0x84]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 8
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0xc]
push 0xe
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
test eax, eax
js 0x430d27
mov ecx, dword [esp + 0x10]
mov eax, ecx
mov edx, dword [esp + 0x14]
or eax, edx
je 0x430d27
mov eax, dword [esp + 0x58]
or eax, dword [esp + 0x5c]
push 0
push 0x64
je 0x430cdc
fild qword [esp + 0x18]
mov dword [esp + 0xa8], 0x10009
mov eax, 1
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbc], edx
mov dword [esp + 0xc0], 1
mov dword [esp + 0xd0], 4
mov dword [esp + 0xd4], 0x5fc09c
mov dword [esp + 0xd8], 0x4b
fstp qword [esp + 0x40]
fld qword [esp + 0x40]
fild qword [esp + 0x60]
fstp qword [esp + 0x40]
fdiv qword [esp + 0x40]
mov word [esp + 0xdc], ax
mov dword [esp + 0xf0], eax
lea eax, [esp + 0x120]
push eax
push 4
lea eax, [esp + 0xb0]
mov dword [esp + 0x108], 4
push eax
mov dword [esp + 0x110], 0x5fd4c0
fmul qword [0x61c8a0]
fstp qword [esp + 0xf4]
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x430d27
lea eax, [esp + 0x118]
jmp 0x430d17
lea eax, [esp + 0xa8]
mov dword [esp + 0x120], 0x10009
push eax
push 1
lea eax, [esp + 0x128]
mov dword [esp + 0x138], ecx
push eax
mov dword [esp + 0x140], edx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x430d27
lea eax, [esp + 0xa0]
push eax
push 1
push dword [ebx + 0x8c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 8
lea eax, [esp + 0x9c]
push eax
mov eax, dword [ebx + 0xc]
push 0x2b
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
test eax, eax
js case.default.0x430d60
mov eax, dword [esp + 0x98]
cmp eax, 4
ja case.default.0x430d60
lea ecx, [ecx]
jmp dword [eax*4 + 0x4321c8]
push str.Very_Low
jmp 0x430d88
push 0x5fd4dc
jmp 0x430d88
push 0x5cf250
jmp 0x430d88
push 0x5cf260
jmp 0x430d88
push 0x5fd4e4
push 1
push dword [ebx + 0x94]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push 0
push 4
mov edx, dword [edx + 8]
push eax
push 8
call fcn.00524040
test eax, eax
js 0x430153
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x28]
call fcn.005156a0
test eax, eax
js 0x430df3
mov esi, dword [esp + 0x28]
test esi, esi
je 0x430ddb
mov eax, dword [esi + 4]
jmp 0x430ddd
xor eax, eax
push eax
push 1
push dword [ebx + 0x98]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
push 0
push 0
mov edx, 3
mov dword [esp + 0x34], 0
mov ecx, esi
call fcn.005241e0
push dword [esp + 0x28]
push 4
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov edx, 3
lea eax, [esp + 0x28]
mov ecx, esi
push eax
push dword [esp + 0x2c]
push edi
call fcn.005241e0
lfence
test eax, eax
js 0x430ed4
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x430e5a
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x430e75
mov eax, dword [edi + 4]
mov dword [esp + 0x3c], eax
mov eax, ecx
push 0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push 0
push eax
call sym.SystemInformer.exe_PhCreateString3
push edi
push 0
push dword [0x633f94]
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
je 0x430e8f
mov eax, dword [esi + 4]
jmp 0x430e91
xor eax, eax
push eax
push 1
push dword [ebx + 0x9c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push edi
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push dword [ebx + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43214e
push 0
push 0
push 0x100001
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x430fbe
push 0
push 0
push 0x100080
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x430fbe
push 2
push 0
push 0
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push 0
push 0
push 0x100001
mov esi, eax
call fcn.0051ad40
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x43214e
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43214e
push 4
push 8
lea ecx, [esp + 0xa0]
mov byte [esp + 0x16], 0
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1b], 0
push ecx
push eax
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov edi, edi
test eax, eax
js 0x43106c
mov eax, dword [esp + 0x98]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x431022.9
movzx eax, byte [eax + 0x4321f0]
jmp dword [eax*4 + 0x4321dc]
push str.Pipe
jmp 0x43105d
push str.Network
jmp 0x43105d
mov byte [esp + 0xe], 1
push str.File_or_directory
jmp 0x43105d
mov byte [esp + 0xf], 1
push str.Console
jmp 0x43105d
push 0x5fd49c
push 1
push dword [ebx + 0x84]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov ecx, dword ds:[esp + 0x20]
lea eax, [esp + 0x28]
push 4
push eax
mov edx, 0x10
call fcn.0052eb50
test eax, eax
js 0x431197
mov eax, dword [esp + 0x28]
mov edx, eax
mov ecx, eax
and edx, 0xfeffffff
or ecx, 0x1000000
test al, 0x30
push 6
cmovne ecx, edx
push 0x5d28f8
push ecx
call sym.SystemInformer.exe_PhGetAccessString
mov ecx, dword [esp + 0x28]
mov esi, eax
push 0
mov dword [esp + 0xa4], 1
mov dword [esp + 0xb4], 4
mov dword [esp + 0xb8], 0x5f5ba0
mov dword [esp + 0xbc], 0x108
mov dword [esp + 0xcc], ecx
mov byte [esp + 0xc6], 0x10
mov dword [esp + 0xd4], 1
mov dword [esp + 0xe4], 4
mov dword [esp + 0xe8], 0x5fc09c
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xfc], eax
lea eax, [esp + 0x1ec]
push 0x208
push eax
push 5
lea eax, [esp + 0xb0]
mov dword [esp + 0xf8], 1
push eax
mov dword [esp + 0x110], ecx
mov dword [esp + 0x114], 1
mov dword [esp + 0x124], 2
mov dword [esp + 0x128], 0x5fd4a8
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x431191
lea eax, [esp + 0x1e8]
push eax
push 1
push dword [ebx + 0x88]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
cmp byte ds:[esp + 0xf], 0
jne 0x4313b4
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x50]
push 0x18
push eax
mov edx, 5
call fcn.0052eb50
jmp 0x4311c0
test eax, eax
js 0x431252
mov eax, dword ds:[esp + 0x58]
mov ecx, dword [esp + 0x5c]
push 0
mov dword [esp + 0x12c], eax
lea eax, [esp + 0xa4]
push 0x64
push eax
push 1
lea eax, [esp + 0x128]
mov dword [esp + 0x128], 0xc
push eax
mov dword [esp + 0x140], ecx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x431225
lea eax, ds:[esp + 0xa0]
push eax
push 1
push dword [ebx + 0x90]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [esp + 0xe], 0
je 0x431252
cmp byte [esp + 0x65], 0
mov ecx, 0x5fb678
mov eax, 0x5fd4ac
cmove eax, ecx
push eax
push 1
push dword [ebx + 0x84]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push 8
push eax
mov edx, 0xe
call fcn.0052eb50
test eax, eax
js 0x4313b4
mov ecx, dword ds:[esp + 0x10]
mov eax, ecx
mov edx, dword [esp + 0x14]
or eax, edx
je 0x4313b4
mov eax, dword [esp + 0x58]
or eax, dword [esp + 0x5c]
push 0
push 0x64
je 0x431365
fild qword [esp + 0x18]
mov dword [esp + 0xa8], 0x10009
mov eax, 1
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbc], edx
mov dword [esp + 0xc0], 1
mov dword [esp + 0xd0], 4
mov dword [esp + 0xd4], 0x5fc09c
mov dword [esp + 0xd8], 0x4b
fstp qword [esp + 0x98]
fld qword [esp + 0x98]
fild qword [esp + 0x60]
fstp qword [esp + 0x98]
fdiv qword [esp + 0x98]
mov word [esp + 0xdc], ax
mov dword [esp + 0xf0], eax
lea eax, [esp + 0x120]
push eax
push 4
lea eax, [esp + 0xb0]
mov dword [esp + 0x108], 4
push eax
mov dword [esp + 0x110], 0x5fd4c0
fmul qword [0x61c8a0]
fstp qword [esp + 0xf4]
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x4313b4
lea eax, ds:[esp + 0x118]
jmp 0x4313a4
lea eax, [esp + 0xa8]
mov dword [esp + 0x120], 0x10009
push eax
push 1
lea eax, [esp + 0x128]
mov dword [esp + 0x138], ecx
push eax
mov dword [esp + 0x140], edx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x4313b4
lea eax, [esp + 0xa0]
push eax
push 1
push dword [ebx + 0x8c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x38]
push 8
push eax
mov edx, 0x2b
call fcn.0052eb50
test eax, eax
js case.default.0x4313e0
mov eax, dword [esp + 0x38]
cmp eax, 4
ja case.default.0x4313e0
mov edi, edi
jmp dword [eax*4 + 0x432240]
push str.Very_Low
jmp 0x431414
push 0x5fd4dc
jmp 0x431414
push 0x5cf250
jmp 0x431414
push 0x5cf260
jmp 0x431414
push 0x5fd4e4
push 1
push dword [ebx + 0x94]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x38]
push 1
push ecx
mov dword [esp + 0x40], 0xe
push dword [eax + 0x20]
mov dword [esp + 0x48], 0x5fc92c
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x4317ec
xor edi, edi
cmp dword [0x635f50], 3
mov dword [esp + 0x28], edi
jl 0x4315bf
push dword [ebx + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
jmp 0x4314a0
test eax, eax
js 0x4315bf
push 0x100
push 4
push dword [0x633f94]
mov dword [esp + 0x34], edi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov esi, eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x40]
push edi
push 0x10
mov edx, dword [edx + 8]
push eax
push 0xe
call fcn.00524040
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
mov edx, dword [edx + 8]
push 0x100
push esi
push 0xf
call fcn.00524040
lea ebx, [ebx]
cmp eax, 0x80000005
jne 0x431559
cmp dword [esp + 0x28], edi
jbe 0x4315a7
push esi
push edi
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x28]
push esi
push 4
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push eax
mov edx, dword [edx + 8]
push esi
mov esi, dword [esp + 0x28]
push esi
push 0xf
call fcn.00524040
lea esp, [esp]
test eax, eax
js 0x4315a7
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x431585
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x431580
jmp 0x4315a5
mov eax, dword ds:[esi + 4]
mov dword [esp + 0x3c], eax
mov eax, ecx
push 0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push 0
push eax
call sym.SystemInformer.exe_PhCreateString3
mov edi, eax
push esi
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x1c]
jmp 0x43167a
push dword [ebx + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x24], edi
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43214e
push 0
push 0
push 5
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x431628
push 0
push 0
push 1
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x43214e
mov eax, dword ds:[esp + 0x20]
test eax, eax
je 0x431691
push 0
push 0x10
lea ecx, [esp + 0x48]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQuerySection]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x28]
mov dword [esp + 0x30], eax
call fcn.0052c520
mov edi, dword [esp + 0x28]
xor ecx, ecx
push dword [esp + 0x20]
test eax, eax
cmovs edi, ecx
lea ebx, [ebx]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [esp + 0x30], 0
jl 0x43214e
mov eax, dword ds:[esp + 0x44]
mov ecx, 0x5cf234
test eax, 0x8000000
je 0x4316b5
mov esi, 0x5fd4f8
jmp 0x431702
jmp 0x4316c0
test eax, 0x800000
je 0x4316d5
mov esi, 0x5fb678
jmp 0x431702
jmp 0x4316e0
test eax, 0x1000000
je 0x4316f5
mov esi, 0x5fd508
jmp 0x431702
test eax, 0x4000000
mov esi, str.Reserve
cmove esi, ecx
mov al, byte [0x6319a8]
mov ecx, dword [esp + 0x4c]
mov byte [esp + 0x5a], al
mov eax, dword [esp + 0x48]
push 0
mov dword [esp + 0x64], eax
lea eax, [esp + 0x54]
push 1
push eax
mov dword [esp + 0x5c], 0x10c
mov dword [esp + 0x70], ecx
call sym.SystemInformer.exe_PhFormat
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov dword ds:[esp + 0x28], eax
test edi, edi
je 0x431790
push edi
call sym.SystemInformer.exe_PhResolveDevicePrefix
test eax, eax
je 0x43177f
mov ecx, edi
mov edi, eax
test ecx, ecx
je 0x43177f
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x43177f
call fcn.004fbe40
nop
test edi, edi
je 0x431790
mov eax, dword [edi + 4]
jmp 0x431795
mov eax, 0x5fd524
push eax
push 1
push dword [ebx + 0xa4]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
push 1
push dword [ebx + 0xa0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov eax, dword ds:[esp + 0x28]
test eax, eax
je 0x4317d9
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xa8]
jmp 0x432147
mov eax, 0x5cf234
push eax
push 1
push dword [ebx + 0xa8]
jmp 0x432147
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x38]
push 1
push ecx
mov dword [esp + 0x40], 0xc
push dword [eax + 0x20]
mov dword [esp + 0x48], 0x5fd150
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x43196a
push dword [ebx + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 0
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43214e
push 0
push 0
push 1
lea eax, [esp + 0x34]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov edi, edi
test esi, esi
js 0x43214e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x43214e
push 0
push 8
lea ecx, [esp + 0x40]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x4318fa
mov eax, dword [esp + 0x38]
cdq
push 0
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x11c]
push 1
push eax
mov dword [esp + 0x124], 0x10009
mov dword [esp + 0x138], edx
call sym.SystemInformer.exe_PhFormat
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xac]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [esp + 0x3d], 0
mov ecx, str.False
mov eax, str.True
cmove eax, ecx
push eax
push 1
push dword [ebx + 0xb0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 0
push 8
lea eax, [esp + 0x18]
push eax
push 1
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x43194b
cmp dword ds:[esp + 0x10], 0
je 0x43194b
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetClientIdName_4
mov esi, eax
push dword [esi + 4]
push 1
push dword [ebx + 0xb4]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x38]
push 1
push ecx
mov dword [esp + 0x40], 0xe
push dword [eax + 0x20]
mov dword [esp + 0x48], 0x5fb58c
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x431d41
xor esi, esi
mov edi, 0x103
cmp dword [0x635f50], 3
mov dword [esp + 0x28], esi
jl 0x431b18
push dword [ebx + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
mov edi, edi
test eax, eax
js 0x431b18
push 0x100
push 4
push dword [0x633f94]
mov dword [esp + 0x34], esi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x1c]
push esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x11c]
mov edx, dword [edx + 8]
push 0x18
push eax
push 4
call fcn.00524040
mov edx, dword ds:[ebx + 0xc]
test eax, eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x50]
cmovns edi, dword [esp + 0x118]
push esi
mov edx, dword [edx + 8]
push 0x20
push eax
push 9
call fcn.00524040
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x1c]
shr eax, 0x1f
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
mov edx, dword [edx + 8]
push eax
push 0x100
push dword [esp + 0x28]
push 0xb
call fcn.00524040
cmp eax, 0xc0000023
jne 0x431aac
jmp 0x431a60
cmp dword [esp + 0x28], esi
jbe 0x431b05
push dword [esp + 0x20]
push esi
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x28]
push esi
push 4
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x20]
push esi
mov edx, dword [edx + 8]
push eax
push 0xb
mov dword [esp + 0x30], eax
call fcn.00524040
xor esi, esi
test eax, eax
js 0x431b05
mov edx, dword ds:[esp + 0x20]
movzx eax, word [edx]
mov ecx, eax
test ax, ax
jne 0x431ad3
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x431aec
mov eax, dword [edx + 4]
push 0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x3c]
push 0
push eax
mov dword [esp + 0x44], ecx
call sym.SystemInformer.exe_PhCreateString3
push eax
mov dword [esp + 0x24], eax
call sym.SystemInformer.exe_PhGetFileName
push dword ds:[esp + 0x20]
mov esi, eax
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0x30]
jmp 0x431bed
push dword [ebx + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x24], esi
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43214e
push 0
push 0
push 0x1000
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
nop
test esi, esi
js 0x43214e
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43214e
lea ecx, [esp + 0x28]
push ecx
push eax
call sym.SystemInformer.exe_PhGetProcessImageFileName
mov esi, dword [esp + 0x28]
test eax, eax
js 0x431b9f
push esi
call sym.SystemInformer.exe_PhGetFileName
push esi
mov dword [esp + 0x2c], eax
call sym.SystemInformer.exe_PhDereferenceObject
mov esi, dword [esp + 0x28]
push 0
push 0x18
lea eax, [esp + 0x120]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push 0
test eax, eax
lea eax, [esp + 0x54]
push 0x20
cmovns edi, dword [esp + 0x120]
push eax
push 4
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push dword ds:[esp + 0x20]
mov dword [esp + 0x34], eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0x30]
shr eax, 0x1f
xor al, 1
mov dword [esp + 0x30], eax
test esi, esi
je 0x431c17
push dword [esi + 4]
push 1
push dword [ebx + 0xc4]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
mov eax, dword [esp + 0x30]
test al, al
je 0x431c94
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhFormatDateTime
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xc8]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp edi, 0x103
je 0x43214e
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhFormatDateTime
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xcc]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
jmp 0x431cac
jmp 0x431ca0
cmp edi, 0x103
je 0x43214e
push 0
push edi
call sym.SystemInformer.exe_PhGetStatusMessage
mov esi, eax
test esi, esi
je 0x431cc6
mov eax, dword [esi + 4]
jmp 0x431ccb
mov eax, 0x5cf234
push eax
push edi
push str.0x_x___s_
call sym.SystemInformer.exe_PhFormatString
mov edi, eax
add esp, 0xc
test edi, edi
je 0x431cf0
mov eax, dword [edi + 4]
jmp 0x431cf5
mov eax, 0x5caac0
push eax
push 1
push dword [ebx + 0xd0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push edi
call sym.SystemInformer.exe_PhDereferenceObject
test esi, esi
je 0x43214e
lea ecx, ds:[esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x43214e
call fcn.004fbe40
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword ds:[ebx + 0xc]
lea ecx, [esp + 0x38]
push 1
push ecx
mov dword [esp + 0x40], 0xc
push dword [eax + 0x20]
mov dword [esp + 0x48], str.Thread
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x43214e
xor eax, eax
mov byte [esp + 0xe], 0
cmp dword [0x635f50], 3
mov edi, 0x103
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
jl 0x431f25
push dword ds:[ebx + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x431f25
push 0x100
push 4
push dword [0x633f94]
mov dword [esp + 0x34], 0
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov esi, eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
push 0x100
mov edx, dword [edx + 8]
push esi
push 0xc
call fcn.00524040
cmp eax, 0xc0000023
jne 0x431e3e
cmp dword [esp + 0x28], 0
jbe 0x431e82
push esi
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x28]
push esi
push 4
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
mov edx, dword [edx + 8]
push esi
mov esi, dword [esp + 0x38]
push esi
push 0xc
call fcn.00524040
mov edi, edi
test eax, eax
js 0x431e82
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x431e65
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x431e60
jmp 0x431e7e
mov eax, dword [esi + 4]
push 0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x3c]
push 0
push eax
mov dword [esp + 0x44], ecx
call sym.SystemInformer.exe_PhCreateString3
mov dword [esp + 0x20], eax
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x1c]
push 0
push 4
mov edx, dword [edx + 8]
push eax
push 0xd
call fcn.00524040
lea esp, [esp]
test eax, eax
js 0x431ee2
mov eax, dword [esp + 0x10]
test eax, eax
setne byte [esp + 0xe]
test eax, eax
je 0x431ee2
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x118]
mov ecx, dword [esp + 0x1c]
push 0
push 0x1c
mov edx, dword [edx + 8]
push eax
push 5
call fcn.00524040
test eax, eax
cmovns edi, dword [esp + 0x118]
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x1c]
push 0
push 0x20
mov edx, dword [edx + 8]
push eax
push 0xa
call fcn.00524040
push esi
push 0
push dword [0x633f94]
mov dword [esp + 0x3c], eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword ds:[esp + 0x20]
jmp 0x432026
push dword [ebx + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
lea esp, [esp]
test eax, eax
js 0x43214e
push 0
push 0
push 0x800
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x43214e
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x4320df
lea edx, [esp + 0x28]
call fcn.0051cca0
mov esi, dword [esp + 0x28]
test eax, eax
js 0x431fa5
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push 0
push 4
lea eax, [esp + 0x18]
push eax
push 0x14
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
lea ebx, [ebx]
test eax, eax
js 0x431ffd
mov eax, dword [esp + 0x10]
test eax, eax
setne byte [esp + 0xe]
test eax, eax
je 0x431ffd
push 0
push 0x1c
lea eax, [esp + 0x120]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
cmovns edi, dword [esp + 0x118]
push 0
push 0x20
lea eax, [esp + 0x58]
push eax
push 1
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
push dword ds:[esp + 0x20]
mov dword [esp + 0x34], eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x43204b
push dword ds:[esi + 4]
push 1
push dword [ebx + 0xc4]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
cmp byte [esp + 0xe], 0
je 0x4320d4
push 0
push edi
call sym.SystemInformer.exe_PhGetStatusMessage
mov esi, eax
test esi, esi
je 0x432070
mov eax, dword [esi + 4]
jmp 0x432075
mov eax, 0x5cf234
push eax
push edi
push str.0x_x___s_
call sym.SystemInformer.exe_PhFormatString
mov edi, eax
add esp, 0xc
test edi, edi
je 0x43209a
mov eax, dword [edi + 4]
jmp 0x43209f
mov eax, 0x5caac0
push eax
push 1
push dword [ebx + 0xd0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push edi
call sym.SystemInformer.exe_PhDereferenceObject
test esi, esi
je 0x4320d4
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4320d4
call fcn.004fbe40
cmp dword [esp + 0x30], 0
jl 0x43214e
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhFormatDateTime
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xc8]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [esp + 0xe], 0
je 0x43214e
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhFormatDateTime
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xcc]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov ecx, dword [esp + 0x3f4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret