Function at 0x42f0a0
Capabilities:
Check mutex on windows
Check processdebugflags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3e4
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x3e0], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x42f0ce
mov ecx, dword [ecx + 4]
jmp 0x42f0d3
mov ecx, 0x5d1e90
mov eax, dword [edi + 0x58]
mov dword [esp + 0x114], eax
lea eax, [esp + 0x110]
push eax
push 0
push 0x104c
push dword [edi]
mov dword [esp + 0x120], 1
mov dword [esp + 0x128], 1
mov dword [esp + 0x134], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x42f122
mov ecx, dword ds:[ecx + 4]
jmp 0x42f127
mov ecx, 0x5d1e90
mov eax, dword ds:[edi + 0x5c]
mov dword [esp + 0x114], eax
lea eax, [esp + 0x110]
push eax
push 0
push 0x104c
push dword [edi]
mov dword [esp + 0x120], 1
mov dword [esp + 0x128], 1
mov dword [esp + 0x134], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xc]
mov ebx, 0x78
mov eax, dword [eax + 0xc]
test eax, eax
je 0x42f1d8
push 0x10
lea ecx, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push ecx
push eax
call fcn.005880c8
mov eax, dword [edi + 0x60]
add esp, 0xc
mov dword [esp + 0x114], eax
lea eax, [esp + 0x178]
mov dword [esp + 0x124], eax
lea eax, [esp + 0x110]
mov dword [esp + 0x110], 1
push eax
push 0
push 0x104c
push dword [edi]
mov dword [esp + 0x128], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword ds:[edi + 0xc]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x42f1e9
mov eax, dword [eax + 4]
jmp 0x42f1ee
mov eax, 0x5d1e90
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1913
mov ecx, dword [edi + 0xc]
test al, al
je 0x42f2e8
push dword [esp + 0x14]
mov esi, dword [esp + 0x34]
push esi
push dword [ecx + 0x14]
call sym.SystemInformer.exe_Ordinal_1914
push eax
call sym.SystemInformer.exe_Ordinal_1238
cmp dword [eax], 0
je 0x42f27a
push dword [eax + 4]
mov eax, dword [edi + 0xc]
push dword [eax + 0x14]
push str.0x_x___s_
call sym.SystemInformer.exe_Ordinal_1378
add esp, 0xc
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov dword [esp + 0x110], 1
mov dword [esp + 0x114], 3
mov dword [esp + 0x118], 1
mov eax, dword [eax + 4]
mov dword [esp + 0x124], eax
lea eax, [esp + 0x110]
jmp 0x42f2c5
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x17c]
push 0x10
push ecx
mov eax, dword [eax + 0x14]
push eax
mov dword [esp + 0x184], 0x780030
call fcn.005880c8
lea eax, [esp + 0x184]
mov dword [esp + 0x5c], 1
mov dword [esp + 0x70], eax
add esp, 0xc
mov dword [esp + 0x54], 3
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 0
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x42f34f
mov eax, dword [ecx + 0x14]
lea ecx, [esp + 0x17c]
push 0x10
push ecx
push eax
mov dword [esp + 0x184], 0x780030
call fcn.005880c8
add esp, 0xc
mov dword [esp + 0x110], 1
lea eax, [esp + 0x178]
mov dword [esp + 0x114], 3
mov dword [esp + 0x124], eax
lea eax, [esp + 0x110]
mov dword [esp + 0x118], 1
push eax
push 0
push 0x104c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x635a54], 3
mov ecx, 0x1000
push dword [edi + 8]
mov eax, 0x40
cmovge eax, ecx
push eax
lea eax, [esp + 0x24]
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x42f506
mov eax, dword ds:[edi + 0xc]
lea ecx, [esp + 0x110]
push 0
push 0
push 0
push 0
push ecx
lea ecx, [esp + 0x28]
push ecx
push 0
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x40]
call sym.SystemInformer.exe_Ordinal_1854
test eax, eax
js 0x42f4f9
mov eax, dword [esp + 0x14]
test eax, eax
js 0x42f4f9
push 0xa
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x124]
call fcn.005880c8
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x178]
mov dword [esp + 0x54], 4
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x120]
call fcn.005880c8
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x178]
mov dword [esp + 0x54], 5
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x128]
call fcn.005880c8
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x178]
mov dword [esp + 0x54], 6
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x12c]
call fcn.005880c8
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x178]
mov dword [esp + 0x54], 7
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword ds:[esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x431e2e
cmp dword [eax], 0
je 0x431e2e
push 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x12
push ecx
push eax
mov dword [esp + 0x24], str.ALPC_Port
call sym.SystemInformer.exe_Ordinal_1351
nop word [eax + eax]
test al, al
je 0x4306e5
cmp dword [0x635a54], 3
jl 0x431e2e
push dword [edi + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431e2e
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x1c]
push 0
push 0x14
mov edx, dword [edx + 8]
push eax
push 0
call fcn.00525400
test eax, eax
js 0x42fc34
mov eax, dword [esp + 0x54]
mov esi, 0x100
push 0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], esi
call sym.SystemInformer.exe_Ordinal_1331
mov ebx, eax
xor eax, eax
mov dword [esp + 0x18], ebx
mov dword [ebx], 0
mov ecx, dword [ebx + 4]
mov word [ecx], ax
test dword [esp + 0x54], 0x1000
je 0x42f62a
mov eax, dword ds:[ebx]
add eax, 0x14
cmp eax, esi
jbe 0x42f5fd
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x14
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.LPC_mode_]
movups xmmword [ecx], xmm0
mov eax, dword [0x604bbc]
mov dword [ecx + 0x10], eax
add dword [ebx], 0x14
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xffffefff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x10000
je 0x42f69d
mov eax, dword [ebx]
add eax, 0x2a
cmp esi, eax
jae 0x42f656
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x2a
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Allow_impersonation_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604bd4]
movups xmmword [ecx + 0x10], xmm0
movq xmm0, qword [0x604be4]
movq qword [ecx + 0x20], xmm0
mov ax, word [0x604bec]
mov word [ecx + 0x28], ax
add dword [ebx], 0x2a
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfffeffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x20000
je 0x42f70a
mov eax, dword [ebx]
add eax, 0x28
cmp esi, eax
jae 0x42f6cd
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x28
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, dword [ebx + 4]
xor edx, edx
add eax, dword [ebx]
movups xmm0, xmmword [str.Allow_LPC_requests_]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x604c00]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [0x604c10]
movq qword [eax + 0x20], xmm0
add dword [ebx], 0x28
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfffdffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x40000
je 0x42f763
mov eax, dword [ebx]
add eax, 0x14
cmp esi, eax
jae 0x42f736
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x14
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Waitable_]
movups xmmword [ecx], xmm0
mov eax, dword [0x604c2c]
mov dword [ecx + 0x10], eax
add dword [ebx], 0x14
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfffbffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x80000
je 0x42f7d2
mov eax, dword [ebx]
add eax, 0x34
cmp esi, eax
jae 0x42f78f
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x34
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Allow_object_duplication_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604c44]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x604c54]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x604c64]
mov dword [ecx + 0x30], eax
add dword [ebx], 0x34
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfff7ffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x100000
je 0x42f845
mov eax, dword [ebx]
add eax, 0x2a
cmp esi, eax
jae 0x42f7fe
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x2a
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.System_process_only_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604c7c]
movups xmmword [ecx + 0x10], xmm0
movq xmm0, qword [0x604c8c]
movq qword [ecx + 0x20], xmm0
mov ax, word [0x604c94]
mov word [ecx + 0x28], ax
add dword [ebx], 0x2a
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xffefffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x200000
je 0x42f8ab
mov eax, dword [ebx]
add eax, 0x22
cmp esi, eax
jae 0x42f871
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x22
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Wake_policy__1__]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604ca8]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [0x604cb8]
mov word [ecx + 0x20], ax
add dword [ebx], 0x22
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xffdfffff
mov word [ecx + eax], dx
test dword [esp + 0x54], sym.SystemInformer.exe_Ordinal_1329
je 0x42f911
mov eax, dword [ebx]
add eax, 0x22
cmp esi, eax
jae 0x42f8d7
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x22
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Wake_policy__2__]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604ccc]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [0x604cdc]
mov word [ecx + 0x20], ax
add dword [ebx], 0x22
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xffbfffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x800000
je 0x42f977
mov eax, dword [ebx]
add eax, 0x22
cmp esi, eax
jae 0x42f93d
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x22
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Wake_policy__3__]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604cf0]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [0x604d00]
mov word [ecx + 0x20], ax
add dword [ebx], 0x22
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xff7fffff
mov word [ecx + eax], dx
test dword ds:[esp + 0x54], 0x1000000
je 0x42f9ec
mov eax, dword [ebx]
add eax, 0x38
cmp esi, eax
jae 0x42f9a4
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x38
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, dword [ebx + 4]
xor edx, edx
add eax, dword [ebx]
movups xmm0, xmmword [str.No_shared_section__direct__]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x604d14]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [0x604d24]
movups xmmword [eax + 0x20], xmm0
movq xmm0, qword [0x604d34]
movq qword [eax + 0x30], xmm0
add dword [ebx], 0x38
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfeffffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x2000000
je 0x42fa6e
mov eax, dword [ebx]
add eax, 0x3e
cmp esi, eax
jae 0x42fa14
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x3e
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Allow_multi_handle_attributes_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604d50]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x604d60]
movups xmmword [ecx + 0x20], xmm0
movq xmm0, qword [0x604d70]
movq qword [ecx + 0x30], xmm0
mov eax, dword [0x604d78]
mov dword [ecx + 0x38], eax
mov ax, word [0x604d7c]
mov word [ecx + 0x3c], ax
add dword [ebx], 0x3e
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfdffffff
mov word [ecx + eax], dx
mov ecx, dword [ebx]
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 0x5fc3c0
cmp ecx, 4
jb 0x42fae2
mov eax, dword [ebx + 4]
add ecx, 0xfffffffc
add eax, ecx
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x30]
push 0
push eax
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x42fae2
mov esi, dword [ebx]
mov eax, esi
mov ecx, dword [ebx + 4]
shr eax, 1
lea edx, [eax*2 - 4]
sub esi, edx
lea eax, [ecx + eax*2]
sub esi, 4
push esi
push eax
lea eax, [ecx + edx]
push eax
call fcn.00586330
add dword [ebx], 0xfffffffc
add esp, 0xc
mov ecx, dword [ebx]
xor edx, edx
mov eax, dword [ebx + 4]
mov word [ecx + eax], dx
cmp dword [esp + 0x54], 0
jne 0x42fb34
mov eax, dword [ebx]
add eax, 0xa
cmp dword [esp + 0x14], eax
jae 0x42fb09
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0xa
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx + 4]
add ecx, dword [ebx]
movq xmm0, qword [0x604d80]
movq qword [ecx], xmm0
mov ax, word [0x604d88]
mov word [ecx + 8], ax
add dword [ebx], 0xa
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
mov word [ecx + eax], dx
jmp 0x42fb73
push 0x10
lea eax, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push eax
push dword [esp + 0x5c]
call fcn.005880c8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x18]
push str.___s_
push eax
call sym.SystemInformer.exe_Ordinal_1288
mov ebx, dword [esp + 0x24]
add esp, 0xc
mov eax, dword [esp + 0x28]
test eax, eax
je 0x42fbb7
push 0x10
lea ecx, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push ecx
push eax
call fcn.005880c8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x18]
push str.__UNKNOWN:__s_
push eax
call sym.SystemInformer.exe_Ordinal_1288
mov ebx, dword [esp + 0x24]
add esp, 0xc
push dword [ebx + 4]
push 1
push dword [edi + 0x78]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
lea eax, [esp + 0x14]
push eax
call sym.SystemInformer.exe_Ordinal_1338
push 0xa
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x60]
call fcn.005880c8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
push 1
push dword [edi + 0x7c]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push 0x10
lea eax, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push eax
push dword [esp + 0x64]
call fcn.005880c8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
push 1
push dword [edi + 0x80]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x1c]
push eax
mov edx, dword [edx + 8]
call fcn.005254c0
mov edx, dword [edi + 0xc]
xor ecx, ecx
mov ebx, dword [esp + 0x14]
test eax, eax
push ecx
push 0x3c
mov edx, dword [edx + 8]
lea eax, [esp + 0x118]
push eax
cmovs ebx, ecx
mov ecx, dword [esp + 0x28]
push 1
call fcn.00525400
test eax, eax
js 0x42ff3b
mov eax, dword ds:[esp + 0x110]
test eax, eax
je 0x42fd4f
xor edx, edx
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], 0
call fcn.0052d320
mov esi, eax
mov dword [esp + 0x14], esi
test ebx, ebx
je 0x42fd37
movzx ecx, word [ebx]
mov edx, ecx
test cx, cx
je 0x42fd37
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xa8], eax
mov eax, edx
mov dword [esp + 0xd8], eax
mov dword [esp + 0x98], 1
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], 1
mov dword [esp + 0xc0], 6
mov dword [esp + 0xc4], 0x604dac
mov dword [esp + 0xc8], 1
mov eax, dword [ebx + 4]
push 0x104
mov dword [esp + 0xe0], eax
lea eax, [esp + 0x9c]
push 3
push eax
call sym.SystemInformer.exe_Ordinal_1375
push dword [esp + 0x14]
mov esi, eax
call sym.SystemInformer.exe_Ordinal_1244
push dword [esi + 4]
push 1
push dword [edi + 0xb8]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
mov eax, dword [esp + 0x124]
test eax, eax
je 0x42fe2b
xor edx, edx
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], 0
call fcn.0052d320
mov esi, eax
mov dword [esp + 0x14], esi
test ebx, ebx
je 0x42fe13
movzx ecx, word [ebx + 8]
mov edx, ecx
test cx, cx
je 0x42fe13
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xa8], eax
mov eax, edx
mov dword [esp + 0xd8], eax
mov dword [esp + 0x98], 1
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], 1
mov dword [esp + 0xc0], 6
mov dword [esp + 0xc4], 0x604dac
mov dword [esp + 0xc8], 1
mov eax, dword [ebx + 0xc]
push 0x104
mov dword [esp + 0xe0], eax
lea eax, [esp + 0x9c]
push 3
push eax
call sym.SystemInformer.exe_Ordinal_1375
push dword [esp + 0x14]
mov esi, eax
call sym.SystemInformer.exe_Ordinal_1244
push dword [esi + 4]
push 1
push dword [edi + 0xbc]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
mov eax, dword [esp + 0x138]
test eax, eax
je 0x42ff05
xor edx, edx
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], 0
call fcn.0052d320
mov esi, eax
mov dword [esp + 0x14], esi
test ebx, ebx
je 0x42feea
movzx ecx, word [ebx + 0x10]
mov edx, ecx
test cx, cx
je 0x42feea
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xa8], eax
mov eax, edx
mov dword [esp + 0xd8], eax
mov dword [esp + 0x98], 1
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], 1
mov dword [esp + 0xc0], 6
mov dword [esp + 0xc4], 0x604dac
mov dword [esp + 0xc8], 1
mov eax, dword [ebx + 0x14]
push 0x104
mov dword [esp + 0xe0], eax
lea eax, [esp + 0x9c]
push 3
push eax
call sym.SystemInformer.exe_Ordinal_1375
push dword [esp + 0x14]
mov esi, eax
call sym.SystemInformer.exe_Ordinal_1244
push dword [esi + 4]
push 1
push dword [edi + 0xc0]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
test ebx, ebx
je 0x42ff18
push ebx
push 0
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword ds:[esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret
push dword [edi + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x3c], 0
push 0x40
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431e2e
push 0
push 0
push 0x20000
lea eax, [esp + 0x44]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x431e2e
mov eax, dword [esp + 0x38]
test eax, eax
je 0x431e2e
push 0
push 0xc
lea ecx, [esp + 0x48]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x430694
mov eax, dword [esp + 0x40]
mov esi, 0x100
push 0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], esi
call sym.SystemInformer.exe_Ordinal_1331
mov ebx, eax
xor eax, eax
mov dword [esp + 0x18], ebx
mov dword [ebx], 0
mov ecx, dword [ebx + 4]
mov word [ecx], ax
mov eax, dword [esp + 0x40]
test eax, 0x1000
je 0x430051
mov eax, dword [ebx]
add eax, 0x14
cmp eax, esi
jbe 0x430020
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x14
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.LPC_mode_]
movups xmmword [ecx], xmm0
mov eax, dword [0x604bbc]
mov dword [ecx + 0x10], eax
add dword [ebx], 0x14
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xffffefff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, 0x10000
je 0x4300c8
mov eax, dword ds:[ebx]
add eax, 0x2a
cmp esi, eax
jae 0x43007d
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x2a
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Allow_impersonation_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604bd4]
movups xmmword [ecx + 0x10], xmm0
movq xmm0, qword [0x604be4]
movq qword [ecx + 0x20], xmm0
mov ax, word [0x604bec]
mov word [ecx + 0x28], ax
add dword [ebx], 0x2a
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xfffeffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, 0x20000
je 0x430136
mov eax, dword [ebx]
add eax, 0x28
cmp esi, eax
jae 0x4300f5
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x28
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, dword [ebx]
xor edx, edx
add eax, dword [ebx + 4]
movups xmm0, xmmword [str.Allow_LPC_requests_]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x604c00]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [0x604c10]
movq qword [eax + 0x20], xmm0
add dword [ebx], 0x28
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xfffdffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, 0x40000
je 0x430190
mov eax, dword [ebx]
add eax, 0x14
cmp esi, eax
jae 0x43015f
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x14
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Waitable_]
movups xmmword [ecx], xmm0
mov eax, dword [0x604c2c]
mov dword [ecx + 0x10], eax
add dword [ebx], 0x14
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xfffbffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, 0x80000
je 0x430204
mov eax, dword [ebx]
add eax, 0x34
cmp esi, eax
jae 0x4301bd
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x34
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Allow_object_duplication_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604c44]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x604c54]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x604c64]
mov dword [ecx + 0x30], eax
add dword [ebx], 0x34
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xfff7ffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, 0x100000
je 0x43027c
mov eax, dword [ebx]
add eax, 0x2a
cmp esi, eax
jae 0x430231
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x2a
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.System_process_only_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604c7c]
movups xmmword [ecx + 0x10], xmm0
movq xmm0, qword [0x604c8c]
movq qword [ecx + 0x20], xmm0
mov ax, word [0x604c94]
mov word [ecx + 0x28], ax
add dword [ebx], 0x2a
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xffefffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
nop dword [eax]
test eax, 0x200000
je 0x4302eb
mov eax, dword [ebx]
add eax, 0x22
cmp esi, eax
jae 0x4302ad
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x22
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Wake_policy__1__]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604ca8]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [0x604cb8]
mov word [ecx + 0x20], ax
add dword [ebx], 0x22
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xffdfffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, sym.SystemInformer.exe_Ordinal_1329
je 0x430352
mov eax, dword [ebx]
add eax, 0x22
cmp esi, eax
jae 0x430314
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x22
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Wake_policy__2__]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604ccc]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [0x604cdc]
mov word [ecx + 0x20], ax
add dword [ebx], 0x22
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xffbfffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, 0x800000
je 0x4303bd
mov eax, dword [ebx]
add eax, 0x22
cmp esi, eax
jae 0x43037f
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x22
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Wake_policy__3__]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604cf0]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [0x604d00]
mov word [ecx + 0x20], ax
add dword [ebx], 0x22
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xff7fffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
nop dword [eax]
test eax, 0x1000000
je 0x430439
mov eax, dword [ebx]
add eax, 0x38
cmp esi, eax
jae 0x4303ed
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x38
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, dword [ebx]
xor edx, edx
add eax, dword [ebx + 4]
movups xmm0, xmmword [str.No_shared_section__direct__]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x604d14]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [0x604d24]
movups xmmword [eax + 0x20], xmm0
movq xmm0, qword [0x604d34]
movq qword [eax + 0x30], xmm0
add dword [ebx], 0x38
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xfeffffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
nop dword [eax]
test eax, 0x2000000
je 0x4304c3
mov eax, dword [ebx]
add eax, 0x3e
cmp esi, eax
jae 0x430469
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x3e
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Allow_multi_handle_attributes_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604d50]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x604d60]
movups xmmword [ecx + 0x20], xmm0
movq xmm0, qword [0x604d70]
movq qword [ecx + 0x30], xmm0
mov eax, dword [0x604d78]
mov dword [ecx + 0x38], eax
mov ax, word [0x604d7c]
mov word [ecx + 0x3c], ax
add dword [ebx], 0x3e
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfdffffff
mov word [ecx + eax], dx
mov ecx, dword [ebx]
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 0x5fc3c0
cmp ecx, 4
jb 0x43053d
mov eax, dword ds:[ebx + 4]
add ecx, 0xfffffffc
add eax, ecx
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], eax
lea eax, [esp + 0x30]
push 0
push eax
lea eax, [esp + 0x28]
push eax
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x43053d
mov esi, dword [ebx]
mov eax, esi
mov ecx, dword [ebx + 4]
shr eax, 1
lea edx, [eax*2 - 4]
sub esi, edx
lea eax, [ecx + eax*2]
sub esi, 4
push esi
push eax
lea eax, [ecx + edx]
push eax
call fcn.00586330
add dword [ebx], 0xfffffffc
add esp, 0xc
mov ecx, dword [ebx]
xor edx, edx
mov eax, dword [ebx + 4]
mov word [ecx + eax], dx
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x430594
mov eax, dword [ebx]
add eax, 0xa
cmp dword [esp + 0x14], eax
jae 0x430569
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0xa
call fcn.005019c0
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx]
add ecx, dword [ebx + 4]
movq xmm0, qword [0x604d80]
movq qword [ecx], xmm0
mov ax, word [0x604d88]
mov word [ecx + 8], ax
add dword [ebx], 0xa
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
mov word [ecx + eax], dx
jmp 0x4305d0
push 0x10
lea ecx, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push ecx
push eax
call fcn.005880c8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x18]
push str.___s_
push eax
call sym.SystemInformer.exe_Ordinal_1288
mov ebx, dword [esp + 0x24]
add esp, 0xc
mov eax, dword [esp + 0x28]
test eax, eax
je 0x430614
push 0x10
lea ecx, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push ecx
push eax
call fcn.005880c8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x18]
push str.__UNKNOWN:__s_
push eax
call sym.SystemInformer.exe_Ordinal_1288
mov ebx, dword [esp + 0x24]
add esp, 0xc
push dword ds:[ebx + 4]
push 1
push dword [edi + 0x78]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
lea eax, [esp + 0x14]
push eax
call sym.SystemInformer.exe_Ordinal_1338
push 0xa
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x60]
call fcn.005880c8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
push 1
push dword [edi + 0x7c]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push 0x10
lea eax, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push eax
push dword [esp + 0x64]
call fcn.005880c8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
push 1
push dword [edi + 0x80]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
cmp dword [0x62db64], 0x6c
nop dword [eax + eax]
jb 0x43161f
push 0
push 8
lea eax, [esp + 0x1c]
push eax
push 0xc
push dword [esp + 0x48]
call dword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
nop dword [eax + eax]
test eax, eax
js 0x43161f
mov eax, dword ds:[esp + 0x18]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
jmp 0x4315fe
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0x1e
push dword [eax + 0x20]
mov dword [esp + 0x30], str.EtwRegistration
call sym.SystemInformer.exe_Ordinal_1351
mov ecx, dword [edi + 0xc]
test al, al
je 0x430736
mov eax, dword [ecx + 0x24]
test eax, eax
je 0x430726
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xd4]
jmp 0x431e27
xor eax, eax
push eax
push 1
push dword [edi + 0xd4]
jmp 0x431e27
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
push dword [ecx + 0x20]
mov dword [esp + 0x30], 0x602fe0
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x43119b
cmp dword [0x635a54], 3
jl 0x430ca9
push dword [edi + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_Ordinal_1560
nop dword [eax]
test eax, eax
js 0x430ca9
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x40]
push eax
push ecx
lea eax, [esp + 0x30]
xor bh, bh
mov edx, dword [edx + 8]
xor bl, bl
push eax
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.00525600
test eax, eax
js 0x4307ff
mov eax, dword [esp + 0x28]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x4307c2.9
movzx eax, byte [eax + 0x431e58]
jmp dword [eax*4 + 0x431e44]
push str.Pipe
jmp 0x4307f0
push str.Network
jmp 0x4307f0
mov bh, 1
push str.File_or_directory
jmp 0x4307f0
mov bl, 1
push str.Console
jmp 0x4307f0
push 0x604e04
push 1
push dword [edi + 0x84]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push 4
lea eax, [esp + 0x3c]
push eax
mov eax, dword [edi + 0xc]
push 0x10
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_Ordinal_1858
test eax, eax
js 0x43092b
mov eax, dword [esp + 0x38]
mov edx, eax
mov ecx, eax
and edx, 0xfeffffff
or ecx, 0x1000000
test al, 0x30
push 6
cmovne ecx, edx
push 0x5d6bd0
push ecx
call sym.SystemInformer.exe_Ordinal_1914
mov ecx, dword ds:[esp + 0x38]
mov esi, eax
push 0
mov dword [esp + 0x9c], 1
mov dword [esp + 0xac], 4
mov dword [esp + 0xb0], 0x5fd468
mov dword [esp + 0xb4], 0x108
mov dword [esp + 0xc4], ecx
mov byte [esp + 0xbe], 0x10
mov dword [esp + 0xcc], 1
mov dword [esp + 0xdc], 4
mov dword [esp + 0xe0], 0x603a3c
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xf4], eax
lea eax, [esp + 0x1e4]
push 0x208
push eax
push 5
lea eax, [esp + 0xa8]
mov dword [esp + 0xf0], 1
push eax
mov dword [esp + 0x108], ecx
mov dword [esp + 0x10c], 1
mov dword [esp + 0x11c], 2
mov dword [esp + 0x120], 0x604e10
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x430925
lea eax, ds:[esp + 0x1e0]
push eax
push 1
push dword [edi + 0x88]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
test bl, bl
jne 0x430b34
push 0x18
lea eax, [esp + 0x54]
push eax
mov eax, dword [edi + 0xc]
push 5
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_Ordinal_1858
test eax, eax
js 0x4309d0
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
push 0
mov dword [esp + 0x124], eax
lea eax, [esp + 0x9c]
push 0x64
push eax
push 1
lea eax, [esp + 0x120]
mov dword [esp + 0x120], 0xd
push eax
mov dword [esp + 0x138], ecx
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x4309aa
lea eax, [esp + 0x98]
push eax
push 1
push dword [edi + 0x90]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
test bh, bh
je 0x4309d0
cmp byte [esp + 0x65], 0
mov ecx, 0x602fe0
mov eax, 0x604e14
cmove eax, ecx
push eax
push 1
push dword [edi + 0x84]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push 8
lea eax, [esp + 0x24]
push eax
mov eax, dword [edi + 0xc]
push 0xe
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_Ordinal_1858
test eax, eax
js 0x430b34
mov ecx, dword ds:[esp + 0x20]
mov eax, ecx
mov edx, dword [esp + 0x24]
or eax, edx
je 0x430b34
mov esi, dword [esp + 0x58]
mov eax, esi
mov ebx, dword [esp + 0x5c]
or eax, ebx
je 0x430ae5
mov dword ds:[esp + 0x98], 0x10009
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
mov dword [esp + 0xb0], 1
mov dword [esp + 0xc0], 4
mov dword [esp + 0xc4], 0x603a3c
mov dword [esp + 0xc8], 0x4b
call fcn.005a7280
mov edx, ebx
movss dword [esp + 0x14], xmm0
mov ecx, esi
call fcn.005a7280
movss xmm1, dword [esp + 0x14]
mov eax, 1
divss xmm1, xmm0
push 0
mov word [esp + 0xd0], ax
mov dword [esp + 0xe4], eax
lea eax, [esp + 0x114]
push 0x64
push eax
push 4
lea eax, [esp + 0xa8]
mov dword [esp + 0x100], 4
push eax
mov dword [esp + 0x108], 0x604e28
mulss xmm1, dword [0x624548]
movss dword [esp + 0xec], xmm1
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x430b34
lea eax, [esp + 0x110]
jmp 0x430b24
push 0
push 0x64
lea eax, [esp + 0xa0]
mov dword [esp + 0x118], 0x10009
push eax
push 1
lea eax, [esp + 0x120]
mov dword [esp + 0x130], ecx
push eax
mov dword [esp + 0x138], edx
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x430b34
lea eax, [esp + 0x98]
push eax
push 1
push dword [edi + 0x8c]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push 8
lea eax, [esp + 0x94]
push eax
mov eax, dword [edi + 0xc]
push 0x2b
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_Ordinal_1858
test eax, eax
js case.default.0x430b65
mov eax, dword ds:[esp + 0x90]
cmp eax, 4
ja case.default.0x430b65
jmp dword [eax*4 + 0x431ea8]
push str.Very_Low
jmp 0x430b8e
push 0x604e44
jmp 0x430b8e
push 0x5fb6c8
nop
jmp 0x430b8e
push 0x5fb6d8
jmp 0x430b8e
push 0x604e4c
push 1
push dword [edi + 0x94]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x1c]
push 0
push 4
mov edx, dword [edx + 8]
push eax
push 8
call fcn.00524e80
test eax, eax
js 0x42ff18
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x14]
call fcn.005180c0
test eax, eax
js 0x430bf5
mov esi, dword [esp + 0x14]
test esi, esi
je 0x430bdd
mov eax, dword [esi + 4]
jmp 0x430bdf
xor eax, eax
push eax
push 1
push dword [edi + 0x98]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x14]
push eax
mov edx, 3
call fcn.00518000
test eax, eax
js 0x430c77
mov ebx, dword [esp + 0x14]
movzx eax, word [ebx]
mov ecx, eax
test ax, ax
jne 0x430c27
nop
call sym.SystemInformer.exe_Ordinal_1430
jmp 0x430c45
mov eax, dword ds:[ebx + 4]
mov dword [esp + 0x18], eax
mov eax, ecx
push 0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push 0
push eax
call sym.SystemInformer.exe_Ordinal_1331
push ebx
push 0
push dword [0x633a54]
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
je 0x430c5f
mov eax, dword [esi + 4]
jmp 0x430c61
xor eax, eax
push eax
push 1
push dword [edi + 0x9c]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
push dword ds:[esp + 0x30]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret
push dword ds:[edi + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 0
push 0x40
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431e2e
push 0
push 0
push 0x100001
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x430d52
push 0
push 0
push 0x100080
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x430d52
push 2
push 0
push 0
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push 0
push 0
push 0x100001
mov esi, eax
call fcn.0051c080
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
nop dword [eax]
test esi, esi
js 0x431e2e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x431e2e
push 4
push 8
lea ecx, [esp + 0x98]
xor bh, bh
push ecx
lea ecx, [esp + 0x4c]
xor bl, bl
push ecx
push eax
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x430de9
mov eax, dword [esp + 0x90]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x430dae.9
movzx eax, byte [eax + 0x431ed0]
jmp dword [eax*4 + 0x431ebc]
push str.Pipe
jmp 0x430dda
push str.Network
jmp 0x430dda
mov bh, 1
push str.File_or_directory
jmp 0x430dda
mov bl, 1
push str.Console
jmp 0x430dda
push 0x604e04
push 1
push dword [edi + 0x84]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x30]
push 4
push eax
mov edx, 0x10
call fcn.0052f8e0
nop
test eax, eax
js 0x430f0e
mov eax, dword [esp + 0x30]
mov edx, eax
mov ecx, eax
and edx, 0xfeffffff
or ecx, 0x1000000
test al, 0x30
push 6
cmovne ecx, edx
push 0x5d6bd0
push ecx
call sym.SystemInformer.exe_Ordinal_1914
mov ecx, dword [esp + 0x30]
mov esi, eax
push 0
mov dword [esp + 0x9c], 1
mov dword [esp + 0xac], 4
mov dword [esp + 0xb0], 0x5fd468
mov dword [esp + 0xb4], 0x108
mov dword [esp + 0xc4], ecx
mov byte [esp + 0xbe], 0x10
mov dword [esp + 0xcc], 1
mov dword [esp + 0xdc], 4
mov dword [esp + 0xe0], 0x603a3c
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xf4], eax
lea eax, [esp + 0x1e4]
push 0x208
push eax
push 5
lea eax, [esp + 0xa8]
mov dword [esp + 0xf0], 1
push eax
mov dword [esp + 0x108], ecx
mov dword [esp + 0x10c], 1
mov dword [esp + 0x11c], 2
mov dword [esp + 0x120], 0x604e10
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x430f08
lea eax, [esp + 0x1e0]
push eax
push 1
push dword [edi + 0x88]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
test bl, bl
jne 0x43110d
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x50]
push 0x18
push eax
mov edx, 5
call fcn.0052f8e0
test eax, eax
js 0x430fb0
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
push 0
mov dword [esp + 0x124], eax
lea eax, [esp + 0x9c]
push 0x64
push eax
push 1
lea eax, [esp + 0x120]
mov dword [esp + 0x120], 0xd
push eax
mov dword [esp + 0x138], ecx
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x430f8a
lea eax, [esp + 0x98]
push eax
push 1
push dword [edi + 0x90]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
test bh, bh
je 0x430fb0
cmp byte [esp + 0x65], 0
mov ecx, 0x602fe0
mov eax, 0x604e14
cmove eax, ecx
push eax
push 1
push dword [edi + 0x84]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x20]
push 8
push eax
mov edx, 0xe
call fcn.0052f8e0
test eax, eax
js 0x43110d
mov ecx, dword [esp + 0x20]
mov eax, ecx
mov edx, dword [esp + 0x24]
or eax, edx
je 0x43110d
mov esi, dword [esp + 0x58]
mov eax, esi
mov ebx, dword [esp + 0x5c]
or eax, ebx
je 0x4310be
mov dword [esp + 0x98], 0x10009
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
mov dword [esp + 0xb0], 1
mov dword [esp + 0xc0], 4
mov dword [esp + 0xc4], 0x603a3c
mov dword [esp + 0xc8], 0x4b
call fcn.005a7280
mov edx, ebx
movss dword [esp + 0x14], xmm0
mov ecx, esi
call fcn.005a7280
movss xmm1, dword [esp + 0x14]
mov eax, 1
divss xmm1, xmm0
push 0
mov word [esp + 0xd0], ax
mov dword [esp + 0xe4], eax
lea eax, [esp + 0x114]
push 0x64
push eax
push 4
lea eax, [esp + 0xa8]
mov dword [esp + 0x100], 4
push eax
mov dword [esp + 0x108], 0x604e28
mulss xmm1, dword [0x624548]
movss dword [esp + 0xec], xmm1
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x43110d
lea eax, [esp + 0x110]
jmp 0x4310fd
push 0
push 0x64
lea eax, [esp + 0xa0]
mov dword [esp + 0x118], 0x10009
push eax
push 1
lea eax, [esp + 0x120]
mov dword [esp + 0x130], ecx
push eax
mov dword [esp + 0x138], edx
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x43110d
lea eax, [esp + 0x98]
push eax
push 1
push dword [edi + 0x8c]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov ecx, dword ds:[esp + 0x28]
lea eax, [esp + 0x38]
push 8
push eax
mov edx, 0x2b
call fcn.0052f8e0
test eax, eax
js case.default.0x431140
mov eax, dword [esp + 0x38]
cmp eax, 4
ja case.default.0x431140
nop word [eax + eax]
jmp dword [eax*4 + 0x431f20]
push str.Very_Low
jmp 0x431168
push 0x604e44
jmp 0x431168
push 0x5fb6c8
jmp 0x431168
push 0x5fb6d8
jmp 0x431168
push 0x604e4c
push 1
push dword [edi + 0x94]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push dword ds:[esp + 0x28]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xe
push dword [eax + 0x20]
mov dword [esp + 0x30], 0x6042cc
call sym.SystemInformer.exe_Ordinal_1351
nop dword [eax]
test al, al
je 0x4314c5
xor ebx, ebx
cmp dword [0x635a54], 3
mov dword [esp + 0x30], ebx
jl 0x4312e8
push dword [edi + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x4312e8
push 0x100
push 4
push dword [0x633a54]
mov dword [esp + 0x44], ebx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [edi + 0xc]
mov esi, eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x40]
push ebx
push 0x10
mov edx, dword [edx + 8]
push eax
push 0xe
call fcn.00524e80
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
push eax
mov edx, dword [edx + 8]
push 0x100
push esi
push 0xf
call fcn.00524e80
cmp eax, 0x80000005
jne 0x43129d
cmp dword [esp + 0x38], ebx
jbe 0x4312d0
push esi
push ebx
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x38]
push esi
push 4
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x38]
push eax
mov edx, dword [edx + 8]
push esi
mov esi, dword [esp + 0x38]
push esi
push 0xf
call fcn.00524e80
nop dword [eax]
test eax, eax
js 0x4312d0
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4312b5
call sym.SystemInformer.exe_Ordinal_1430
jmp 0x4312ce
mov eax, dword [esi + 4]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x2c], ecx
call sym.SystemInformer.exe_Ordinal_1331
mov ebx, eax
push esi
push 0
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x1c]
jmp 0x43139b
push dword [edi + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], ebx
push 0x40
push eax
call sym.SystemInformer.exe_Ordinal_1560
nop dword [eax + eax]
test eax, eax
js 0x431e2e
push 0
push 0
push 5
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x43134b
push 0
push 0
push 1
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x431e2e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4313b1
push 0
push 0x10
lea ecx, [esp + 0x48]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQuerySection]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x30]
mov dword [esp + 0x14], eax
call fcn.0052d2a0
mov ebx, dword [esp + 0x30]
xor ecx, ecx
push dword [esp + 0x28]
test eax, eax
cmovs ebx, ecx
nop dword [eax + eax]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [esp + 0x14], 0
jl 0x431e2e
mov eax, dword ds:[esp + 0x44]
mov ecx, 0x5fb6ac
test eax, 0x8000000
je 0x4313d1
mov esi, 0x604e60
jmp 0x4313fb
test eax, 0x800000
je 0x4313df
mov esi, 0x602fe0
jmp 0x4313fb
nop
test eax, 0x1000000
je 0x4313ee
mov esi, 0x604e70
jmp 0x4313fb
test eax, 0x4000000
mov esi, str.Reserve
cmove esi, ecx
mov al, byte [0x6314bc]
mov ecx, dword [esp + 0x4c]
mov byte [esp + 0x5a], al
mov eax, dword [esp + 0x48]
push 0
mov dword [esp + 0x64], eax
lea eax, [esp + 0x54]
push 1
push eax
mov dword [esp + 0x5c], 0x10d
mov dword [esp + 0x70], ecx
call sym.SystemInformer.exe_Ordinal_1375
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x43146e
push ebx
call sym.SystemInformer.exe_Ordinal_1570
test eax, eax
je 0x431465
mov ecx, ebx
mov ebx, eax
test ecx, ecx
je 0x431465
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x431465
nop
call fcn.004fe1e0
test ebx, ebx
je 0x43146e
mov eax, dword [ebx + 4]
jmp 0x431473
mov eax, 0x604e8c
push eax
push 1
push dword [edi + 0xa4]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
push 1
push dword [edi + 0xa0]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4314ae
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xa8]
jmp 0x431e27
mov eax, 0x5fb6ac
push eax
push 1
push dword [edi + 0xa8]
jmp 0x431e27
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xc
push dword [eax + 0x20]
mov dword [esp + 0x30], 0x604ab8
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x43163e
push dword [edi + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x3c], 0
push 0x40
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431e2e
push 0
push 0
push 1
lea eax, [esp + 0x44]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x431e2e
mov eax, dword [esp + 0x38]
test eax, eax
je 0x431e2e
push 0
push 8
lea ecx, [esp + 0x28]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQueryMutant]
nop dword [eax]
test eax, eax
js 0x4315d2
mov eax, dword [esp + 0x20]
cdq
push 0
mov dword [esp + 0x124], eax
lea eax, [esp + 0x114]
push 1
push eax
mov dword [esp + 0x11c], 0x10009
mov dword [esp + 0x130], edx
call sym.SystemInformer.exe_Ordinal_1375
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xac]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
cmp byte [esp + 0x25], 0
mov ecx, str.False
mov eax, str.True
cmove eax, ecx
push eax
push 1
push dword [edi + 0xb0]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push 0
push 8
lea eax, [esp + 0x1c]
push eax
push 1
push dword [esp + 0x48]
call dword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x43161f
cmp dword [esp + 0x14], 0
je 0x43161f
lea eax, [esp + 0x14]
push eax
call sym.SystemInformer.exe_Ordinal_1037
mov esi, eax
push dword [esi + 4]
push 1
push dword [edi + 0xb4]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret
mov eax, dword ds:[edi + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xe
push dword [eax + 0x20]
mov dword [esp + 0x30], 0x602ef4
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x431a29
xor ebx, ebx
mov esi, 0x103
cmp dword [0x635a54], 3
mov dword [esp + 0x30], ebx
jl 0x4317f0
push dword [edi + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_Ordinal_1560
nop dword [eax + eax]
test eax, eax
js 0x4317f0
push 0x100
push 4
push dword [0x633a54]
mov dword [esp + 0x34], ebx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
push ebx
mov dword [esp + 0x34], eax
lea eax, [esp + 0x114]
mov edx, dword [edx + 8]
push 0x18
push eax
push 4
call fcn.00524e80
mov edx, dword [edi + 0xc]
test eax, eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x50]
cmovns esi, dword [esp + 0x110]
push ebx
mov edx, dword [edx + 8]
push 0x20
push eax
push 9
mov dword [esp + 0x24], esi
call fcn.00524e80
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
shr eax, 0x1f
mov dword [esp + 0x38], eax
lea eax, [esp + 0x28]
mov edx, dword [edx + 8]
push eax
push 0x100
push dword [esp + 0x38]
push 0xb
call fcn.00524e80
cmp eax, 0xc0000023
jne 0x43178e
nop word [eax + eax]
cmp dword [esp + 0x28], ebx
jbe 0x4317dd
push dword [esp + 0x30]
push ebx
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x28]
push esi
push 4
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [edi + 0xc]
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x20]
push esi
mov edx, dword [edx + 8]
push eax
push 0xb
mov dword [esp + 0x40], eax
call fcn.00524e80
mov esi, dword [esp + 0x14]
test eax, eax
js 0x4317dd
mov edx, dword ds:[esp + 0x30]
movzx eax, word [edx]
mov ecx, eax
test ax, ax
jne 0x4317af
call sym.SystemInformer.exe_Ordinal_1430
jmp 0x4317c8
mov eax, dword [edx + 4]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x2c], ecx
call sym.SystemInformer.exe_Ordinal_1331
push eax
mov dword [esp + 0x18], eax
call sym.SystemInformer.exe_Ordinal_1509
push dword [esp + 0x14]
mov ebx, eax
call sym.SystemInformer.exe_Ordinal_1244
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0x38]
jmp 0x4318d1
push dword ds:[edi + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], ebx
push 0x40
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431e2e
push 0
push 0
push 0x1000
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
nop dword [eax]
test esi, esi
js 0x431e2e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x431e2e
lea ecx, [esp + 0x30]
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1530
nop
test eax, eax
js 0x43187c
mov esi, dword [esp + 0x30]
push esi
call sym.SystemInformer.exe_Ordinal_1509
push esi
mov ebx, eax
call sym.SystemInformer.exe_Ordinal_1244
jmp 0x431880
mov ebx, dword [esp + 0x30]
push 0
push 0x18
lea eax, [esp + 0x118]
push eax
push 0
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push 0
test eax, eax
mov esi, 0x103
push 0x20
cmovns esi, dword [esp + 0x118]
lea eax, [esp + 0x58]
push eax
push 4
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push dword [esp + 0x28]
mov dword [esp + 0x3c], eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0x38]
shr eax, 0x1f
xor al, 1
mov dword [esp + 0x38], eax
test ebx, ebx
je 0x4318fb
push dword [ebx + 4]
push 1
push dword [edi + 0xc4]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push ebx
call sym.SystemInformer.exe_Ordinal_1244
mov eax, dword [esp + 0x38]
nop dword [eax + eax]
test al, al
je 0x431985
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_Ordinal_1675
lea eax, ds:[esp + 0x40]
push eax
call sym.SystemInformer.exe_Ordinal_1619
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xc8]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
nop
cmp esi, 0x103
je 0x431e2e
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_Ordinal_1675
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_Ordinal_1619
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xcc]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
nop
jmp 0x431991
cmp esi, 0x103
je 0x431e2e
push 0
push esi
call sym.SystemInformer.exe_Ordinal_1662
mov ebx, eax
test ebx, ebx
je 0x4319b0
mov eax, dword [ebx + 4]
jmp 0x4319b5
mov eax, 0x5fb6ac
push eax
push esi
push str.0x_x___s_
call sym.SystemInformer.exe_Ordinal_1378
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4319da
mov eax, dword [esi + 4]
jmp 0x4319df
mov eax, 0x5d1e90
push eax
push 1
push dword [edi + 0xd0]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
test ebx, ebx
je 0x431e2e
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x431e2e
call fcn.004fe1e0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xc
push dword [eax + 0x20]
mov dword [esp + 0x30], str.Thread
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x431e2e
xor eax, eax
mov byte [esp + 0x13], 0
cmp dword [0x635a54], 3
mov ebx, 0x103
mov dword [esp + 0x38], eax
mov dword [esp + 0x14], eax
jl 0x431c05
push dword [edi + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431c05
push 0x100
push 4
push dword [0x633a54]
mov dword [esp + 0x3c], 0
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [edi + 0xc]
mov esi, eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
push 0x100
mov edx, dword [edx + 8]
push esi
push 0xc
call fcn.00524e80
cmp eax, 0xc0000023
jne 0x431b1f
cmp dword [esp + 0x30], 0
jbe 0x431b62
push esi
push 0
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x30]
push esi
push 4
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x30]
push eax
mov edx, dword [edx + 8]
push esi
mov esi, dword [esp + 0x1c]
push esi
push 0xc
call fcn.00524e80
nop
test eax, eax
js 0x431b62
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x431b45
call sym.SystemInformer.exe_Ordinal_1430
nop dword [eax + eax]
jmp 0x431b5e
mov eax, dword [esi + 4]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x2c], ecx
call sym.SystemInformer.exe_Ordinal_1331
mov dword [esp + 0x38], eax
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x1c]
push 0
push 4
mov edx, dword [edx + 8]
push eax
push 0xd
call fcn.00524e80
nop dword [eax]
test eax, eax
js 0x431bc2
mov eax, dword [esp + 0x28]
test eax, eax
setne byte [esp + 0x13]
test eax, eax
je 0x431bc2
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x110]
mov ecx, dword [esp + 0x1c]
push 0
push 0x1c
mov edx, dword [edx + 8]
push eax
push 5
call fcn.00524e80
test eax, eax
cmovns ebx, dword [esp + 0x110]
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x1c]
push 0
push 0x20
mov edx, dword [edx + 8]
push eax
push 0xa
call fcn.00524e80
push esi
push 0
push dword [0x633a54]
mov dword [esp + 0x20], eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword ds:[esp + 0x38]
jmp 0x431d06
push dword [edi + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 0
push 0x40
push eax
call sym.SystemInformer.exe_Ordinal_1560
nop dword [eax]
test eax, eax
js 0x431e2e
push 0
push 0
push 0x800
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x431e2e
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x431dbf
lea edx, [esp + 0x14]
call fcn.00524260
mov esi, dword [esp + 0x14]
test eax, eax
js 0x431c85
push esi
call sym.SystemInformer.exe_Ordinal_1244
push 0
push 4
lea eax, [esp + 0x1c]
push eax
push 0x14
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
nop word [eax + eax]
test eax, eax
js 0x431cdd
mov eax, dword [esp + 0x14]
test eax, eax
setne byte [esp + 0x13]
test eax, eax
je 0x431cdd
push 0
push 0x1c
lea eax, [esp + 0x118]
push eax
push 0
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
cmovns ebx, dword [esp + 0x110]
push 0
push 0x20
lea eax, [esp + 0x58]
push eax
push 1
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
push dword ds:[esp + 0x28]
mov dword [esp + 0x18], eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x431d2b
push dword ds:[esi + 4]
push 1
push dword [edi + 0xc4]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
cmp byte [esp + 0x13], 0
je 0x431db4
push 0
push ebx
call sym.SystemInformer.exe_Ordinal_1662
mov esi, eax
test esi, esi
je 0x431d50
mov eax, dword [esi + 4]
jmp 0x431d55
mov eax, 0x5fb6ac
push eax
push ebx
push str.0x_x___s_
call sym.SystemInformer.exe_Ordinal_1378
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x431d7a
mov eax, dword [ebx + 4]
jmp 0x431d7f
mov eax, 0x5d1e90
push eax
push 1
push dword [edi + 0xd0]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push ebx
call sym.SystemInformer.exe_Ordinal_1244
test esi, esi
je 0x431db4
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x431db4
call fcn.004fe1e0
cmp dword [esp + 0x14], 0
jl 0x431e2e
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_Ordinal_1675
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_Ordinal_1619
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xc8]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
cmp byte [esp + 0x13], 0
je 0x431e2e
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_Ordinal_1675
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_Ordinal_1619
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xcc]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov ecx, dword [esp + 0x3ec]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret