Function at 0x4794f0
Capabilities:
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
push ebx
xor eax, eax
mov ebx, edx
push esi
push edi
push 0x3e
push eax
mov dword [esp + 0xac], eax
mov esi, ecx
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov word [esp + 0xc4], ax
lea eax, [esp + 0xd0]
push eax
mov dword [esp + 0x8c], esi
call fcn.004dce30
add esp, 0xc
lea eax, [esp + 0xa4]
push 0xa
push eax
push dword [esi + 0xdc]
call fcn.004dec00
add esp, 0xc
mov dword [esp + 0x2c], 1
lea eax, [esp + 0xa4]
mov dword [esp + 0x30], 0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x34], 1
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [esi + 0xe8]
mov esi, dword [esi + 0xec]
push 0
push 0x2710
push esi
push edi
call fcn.004fcd60
push 0
push 0x3e8
push edx
push eax
call fcn.004fcdd0
push edx
push eax
push 0
push 0x989680
push esi
push edi
call fcn.004fcd60
push 0
push 0x3c
push edx
push eax
call fcn.004fcdd0
push edx
push eax
push 0
push 0x23c34600
push esi
push edi
call fcn.004fcd60
push 0
push 0x3c
push edx
push eax
call fcn.004fcdd0
push edx
push eax
push 8
push 0x61c46800
push esi
push edi
call fcn.004fcd60
push 0
push 0x18
push edx
push eax
call fcn.004fcdd0
push edx
push eax
push str._02I64u:_02I64u:_02I64u._03I64u
lea eax, [esp + 0xec]
push 0x1e
push eax
call fcn.004a4d00
add esp, 0x2c
mov dword [esp + 0x2c], 1
lea eax, [esp + 0xc8]
mov dword [esp + 0x30], 2
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x34], 1
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x80]
push 0
push 0x2710
mov edi, dword [esi + 0xf0]
mov esi, dword [esi + 0xf4]
push esi
push edi
call fcn.004fcd60
push 0
push 0x3e8
push edx
push eax
call fcn.004fcdd0
push edx
push eax
push 0
push 0x989680
push esi
push edi
call fcn.004fcd60
push 0
push 0x3c
push edx
push eax
call fcn.004fcdd0
push edx
push eax
push 0
push 0x23c34600
push esi
push edi
call fcn.004fcd60
push 0
push 0x3c
push edx
push eax
call fcn.004fcdd0
push edx
push eax
push 8
push 0x61c46800
push esi
push edi
call fcn.004fcd60
push 0
push 0x18
push edx
push eax
call fcn.004fcdd0
push edx
push eax
push str._02I64u:_02I64u:_02I64u._03I64u
lea eax, [esp + 0xec]
push 0x1e
push eax
call fcn.004a4d00
add esp, 0x2c
mov dword [esp + 0x2c], 1
lea eax, [esp + 0xc8]
mov dword [esp + 0x30], 3
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
mov dword [esp + 0x44], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x80]
push 0
push 0x2710
mov edi, dword [eax + 0xe8]
add edi, dword [eax + 0xf0]
mov esi, dword [eax + 0xec]
adc esi, dword [eax + 0xf4]
push esi
push edi
call fcn.004fcd60
push 0
push 0x3e8
push edx
push eax
call fcn.004fcdd0
push edx
push eax
push 0
push 0x989680
push esi
push edi
call fcn.004fcd60
push 0
push 0x3c
push edx
push eax
call fcn.004fcdd0
push edx
push eax
push 0
push 0x23c34600
push esi
push edi
call fcn.004fcd60
push 0
push 0x3c
push edx
push eax
call fcn.004fcdd0
push edx
push eax
push 8
push 0x61c46800
push esi
push edi
call fcn.004fcd60
push 0
push 0x18
push edx
push eax
call fcn.004fcdd0
push edx
push eax
push str._02I64u:_02I64u:_02I64u._03I64u
lea eax, [esp + 0xec]
push 0x1e
push eax
call fcn.004a4d00
add esp, 0x2c
mov dword [esp + 0x2c], 1
lea eax, [esp + 0xc8]
mov dword [esp + 0x30], 4
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x34], 1
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x68], 0x10c
movzx eax, byte [0x5484ac]
mov esi, dword [esp + 0x80]
mov byte [esp + 0x72], al
push 0
push 1
mov eax, dword [esi + 0x1d4]
mov dword [esp + 0x80], eax
lea eax, [esp + 0x70]
push eax
mov dword [esp + 0x88], 0
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 5
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x5484ac]
mov byte [esp + 0x72], al
mov eax, dword [esi + 0x1d8]
push 0
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x6c]
push 1
push eax
mov dword [esp + 0x74], 0x10c
mov dword [esp + 0x88], 0
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 6
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x5484ac]
mov byte [esp + 0x72], al
mov eax, dword [esi + 0x1b4]
push 0
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x6c]
push 1
push eax
mov dword [esp + 0x74], 0x10c
mov dword [esp + 0x88], 0
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 7
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x5484ac]
mov byte [esp + 0x72], al
mov eax, dword [esi + 0x1b0]
push 0
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x6c], 0x10c
mov dword [esp + 0x80], 0
push 1
push eax
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 8
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x1b8]
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10009
mov dword [esp + 0x30], 0
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 9
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x5484ac]
mov byte [esp + 0x72], al
mov eax, dword [esi + 0x1c0]
push 0
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x6c]
push 1
push eax
mov dword [esp + 0x74], 0x10c
mov dword [esp + 0x88], 0
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0xa
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x5484ac]
mov byte [esp + 0x72], al
mov eax, dword [esi + 0x1bc]
push 0
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x6c]
push 1
push eax
mov dword [esp + 0x74], 0x10c
mov dword [esp + 0x88], 0
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0xb
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x1e0]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x1e4]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10009
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x10
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x5484ac]
mov byte [esp + 0x72], al
mov eax, dword [esi + 0x1f8]
mov dword [esp + 0x78], eax
mov eax, dword [esi + 0x1fc]
push 0
mov dword [esp + 0x80], eax
lea eax, [esp + 0x6c]
push 1
push eax
mov dword [esp + 0x74], 0x10c
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x11
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x1e8]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x1ec]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10009
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x12
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x5484ac]
mov byte [esp + 0x72], al
mov eax, dword [esi + 0x200]
mov dword [esp + 0x78], eax
mov eax, dword [esi + 0x204]
mov dword [esp + 0x68], 0x10c
push 0
mov dword [esp + 0x80], eax
lea eax, [esp + 0x6c]
push 1
push eax
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x13
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x1f0]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x1f4]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10009
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [0x5484ac]
mov byte [esp + 0x72], al
mov eax, dword [esi + 0x208]
mov dword [esp + 0x78], eax
mov eax, dword [esi + 0x20c]
push 0
mov dword [esp + 0x80], eax
lea eax, [esp + 0x6c]
push 1
push eax
mov dword [esp + 0x74], 0x10c
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x15
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0xf8]
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10009
mov dword [esp + 0x30], 0
call sym.ProcessHacker.exe_PhFormat
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x17
mov dword [esp + 0x38], 1
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 0x10], 0
jl 0x47a3a2
xor eax, eax
mov dword [esp + 0x90], 0xffffffff
mov dword [esp + 0x9c], eax
or edi, 0xffffffff
mov dword [esp + 0xa0], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], al
mov eax, dword [esi + 0x28]
test eax, eax
je 0x479fb2
push 0
push 8
lea ecx, [esp + 0xc8]
push ecx
push 0x14
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x479eb6
mov eax, dword [esp + 0xc4]
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10009
mov dword [esp + 0x30], 0
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov dword [esp + 0x9c], eax
push 0
push dword [esi + 0x28]
mov dword [esp + 0x18], 0x10009
call dword [sym.imp.USER32.dll_GetGuiResources]
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x30], 0
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push 1
push dword [esi + 0x28]
mov dword [esp + 0xa8], eax
mov dword [esp + 0x18], 0x10009
call dword [sym.imp.USER32.dll_GetGuiResources]
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x30], 0
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push 0
push 0x10
mov dword [esp + 0x94], eax
lea eax, [esp + 0x70]
push eax
push 0x26
push dword [esi + 0x28]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x479f7a
mov eax, dword [esp + 0x68]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x6c]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10009
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov dword [esp + 0x80], eax
mov byte [esp + 0x2a], 1
push 0
push 4
lea eax, [esp + 0x8c]
push eax
push 0x27
push dword [esi + 0x28]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push 0
test eax, eax
lea eax, [esp + 0x94]
push 4
cmovns edi, dword [esp + 0x8c]
push eax
push 0x21
push dword [esi + 0x28]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x47a096
lea ecx, [esp + 0x68]
push ecx
push eax
call sym.ProcessHacker.exe_PhGetProcessWsCounters
test eax, eax
js 0x47a096
mov al, byte [0x5484ac]
mov ecx, 0x1000
mov byte [esp + 0x1a], al
mov eax, dword [esp + 0x6c]
mul ecx
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10c
mov dword [esp + 0x30], edx
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
movzx ecx, byte [0x5484ac]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x74]
mov byte [esp + 0x1a], cl
mov ecx, 0x1000
mul ecx
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10c
mov dword [esp + 0x30], edx
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
movzx ecx, byte [0x5484ac]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x70]
mov byte [esp + 0x1a], cl
mov ecx, 0x1000
mul ecx
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10c
mov dword [esp + 0x30], edx
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov dword [esp + 0x98], eax
mov byte [esp + 0x2b], 1
cmp byte [esp + 0x2a], 0
jne 0x47a0d4
mov eax, dword [esi + 0x1a4]
mov ecx, dword [esi + 0x1a0]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10009
mov dword [esp + 0x2c], ecx
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov dword [esp + 0x80], eax
cmp byte [esp + 0x2b], 0
jne 0x47a119
mov al, byte [0x5484ac]
mov byte [esp + 0x1a], al
mov eax, dword [esi + 0x210]
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10c
mov dword [esp + 0x30], 0
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x80]
test eax, eax
je 0x47a129
mov eax, dword [eax + 4]
jmp 0x47a12e
mov eax, 0x5077f0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 1
mov dword [esp + 0x44], 1
call dword [sym.imp.USER32.dll_SendMessageW]
cmp edi, 0xffffffff
je 0x47a176
cmp edi, 5
ja 0x47a176
mov eax, dword [edi*4 + 0x534954]
mov dword [esp + 0x40], eax
jmp 0x47a17e
mov dword [esp + 0x40], 0x5077f0
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 1
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x44], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x90]
cmp eax, 0xffffffff
je 0x47a1c9
cmp eax, 5
jge 0x47a1c9
mov eax, dword [eax*4 + 0x5347ac]
mov dword [esp + 0x40], eax
jmp 0x47a1d1
mov dword [esp + 0x40], 0x5077f0
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 1
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
mov dword [esp + 0x40], 0x16
mov dword [esp + 0x44], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x88]
test eax, eax
je 0x47a20e
mov eax, dword [eax + 4]
jmp 0x47a213
mov eax, 0x5077f0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0xc
mov dword [esp + 0x44], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x94]
test eax, eax
je 0x47a254
mov eax, dword [eax + 4]
jmp 0x47a259
mov eax, 0x5077f0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0xd
mov dword [esp + 0x44], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x98]
test eax, eax
je 0x47a29a
mov eax, dword [eax + 4]
jmp 0x47a29f
mov eax, 0x5077f0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0xe
mov dword [esp + 0x44], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x47a2e0
mov eax, dword [eax + 4]
jmp 0x47a2e5
mov eax, 0x5077f0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0x18
mov dword [esp + 0x44], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x47a326
mov eax, dword [eax + 4]
jmp 0x47a32b
mov eax, 0x5077f0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0x19
mov dword [esp + 0x44], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x47a36c
mov eax, dword [eax + 4]
jmp 0x47a371
mov eax, 0x5077f0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0x104c
push dword [ebx + 0x1c]
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0x1a
mov dword [esp + 0x44], 1
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x68
jb 0x47a5ac
cmp byte [0x54aeda], 0
jne 0x47a3f4
push 0
push 4
lea eax, [esp + 0x8c]
push eax
push 0x1a
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x47a3e1
cmp dword [esp + 0x84], 0
setne byte [0x54aed9]
xor ecx, ecx
lea eax, [esp + 0x8c]
lock or dword [eax], ecx
mov byte [0x54aeda], 1
cmp byte [0x54aed9], 0
jne 0x47a5ac
push 5
lea eax, [esp + 0x88]
push eax
call sym.ProcessHacker.exe_PhEnumProcessesEx
test eax, eax
js 0x47a5ac
push dword [esi + 0x10]
mov edi, dword [esp + 0x88]
push edi
call sym.ProcessHacker.exe_PhFindProcessInformation
test eax, eax
je 0x47a59d
mov esi, dword [eax + 4]
shl esi, 6
add esi, 0xb8
add esi, eax
je 0x47a59d
mov eax, dword [esi + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x2c]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10009
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push 0x1b
push dword [ebx + 0x1c]
call sym.ProcessHacker.exe_PhSetListViewSubItem
movzx eax, byte [0x5484ac]
mov byte [esp + 0x1a], al
mov eax, dword [esi]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 4]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10c
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push 0x1c
push dword [ebx + 0x1c]
call sym.ProcessHacker.exe_PhSetListViewSubItem
movzx eax, byte [0x5484ac]
mov byte [esp + 0x1a], al
mov eax, dword [esi + 8]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0xc]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10c
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push 0x1d
push dword [ebx + 0x1c]
call sym.ProcessHacker.exe_PhSetListViewSubItem
movzx eax, byte [0x5484ac]
mov byte [esp + 0x1a], al
mov eax, dword [esi + 0x98]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x9c]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], 0x10c
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push 0x1e
push dword [ebx + 0x1c]
call sym.ProcessHacker.exe_PhSetListViewSubItem
movzx eax, byte [0x5484ac]
mov dword [esp + 0x10], 0x10c
mov byte [esp + 0x1a], al
mov eax, dword [esi + 0xa0]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0xa4]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push 1
push eax
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push 0x1f
push dword [ebx + 0x1c]
call sym.ProcessHacker.exe_PhSetListViewSubItem
push edi
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret