Function at 0x4625e0
Capabilities:
Check processdebugport

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbc
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 8]
mov dword [esp + 0x24], ecx
mov eax, dword [ecx + 0x10]
mov edi, dword [ecx + 0x28]
mov ecx, dword [ecx + 0x2c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x462640
mov ecx, dword [ecx + 4]
lea ebx, [esi + 0x10]
lea edx, [esi + 0x14]
push ebx
call fcn.004a1db0
test al, al
jne 0x46262d
mov dword [esi + 0x14], 0
mov dword [ebx], 0
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x2c]
push dword [eax + 4]
lea eax, [esi + 0x18]
push eax
call sym.ProcessHacker.exe_PhInitializeImageVersionInfo
test edi, edi
je 0x462a6a
push 0
push 4
lea eax, [esp + 0x30]
push eax
push 7
push edi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x462674
mov ecx, dword [esp + 0x28]
mov eax, dword [esi + 0x40]
neg ecx
sbb ecx, ecx
and eax, 0xffffffef
and ecx, 0x10
or ecx, eax
mov dword [esi + 0x40], ecx
xor ebx, ebx
mov byte [esp + 0x13], 0
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
mov dword [esp + 0x20], 0
jb 0x462699
mov eax, edi
mov ebx, 1
mov dword [esp + 0x20], eax
jmp 0x4626b7
mov edx, dword [sym.ProcessHacker.exe_ProcessQueryAccess]
lea ecx, [esp + 0x20]
push dword [esp + 0x1c]
or edx, 0x10
call fcn.004ad010
test eax, eax
js 0x462721
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push eax
call sym.ProcessHacker.exe_PhGetProcessCommandLine
test eax, eax
js 0x4626fe
mov edx, dword [esp + 0x18]
xor ecx, ecx
test dword [edx], 0xfffffffe
jbe 0x4626fb
lea edi, [ecx + 0x20]
jmp 0x4626e0
mov eax, dword [edx + 4]
cmp word [eax + ecx*2], 0
jne 0x4626ee
mov word [eax + ecx*2], di
mov eax, dword [edx]
inc ecx
shr eax, 1
cmp ecx, eax
jb 0x4626e0
mov edi, dword [esp + 0x14]
mov dword [esi + 0xc], edx
push 0
lea eax, [esp + 0x17]
push eax
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call sym.ProcessHacker.exe_PhGetProcessIsDotNetEx
movzx eax, byte [esp + 0x13]
xor eax, dword [esi + 0x40]
and eax, 1
xor dword [esi + 0x40], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x462734
test ebx, ebx
jne 0x462734
push eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp byte [0x5496b4], 0
lea eax, [esp + 0x18]
mov ebx, 8
push eax
jne 0x462768
push ebx
push edi
call dword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, 0xc0000022
jne 0x462771
cmp byte [0x5496b4], 0
je 0x462826
lea eax, [esp + 0x18]
push eax
mov edx, ebx
mov ecx, edi
call fcn.004b3d60
test eax, eax
js 0x462826
lea eax, [esp + 0x14]
push eax
push 4
lea ebx, [esi + 0x28]
push ebx
push 0x12
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x4627ab
mov eax, 2
xor ecx, ecx
cmp dword [ebx], eax
cmove ecx, eax
mov eax, dword [esi + 0x40]
and eax, 0xfffffffd
or ecx, eax
mov dword [esi + 0x40], ecx
lea eax, [esi + 0x30]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
lea ebx, [esi + 0x2c]
call sym.ProcessHacker.exe_PhGetTokenIntegrityLevelRID
test eax, eax
js 0x46281c
test ebx, ebx
je 0x46281c
mov eax, dword [esp + 0x14]
cmp eax, 0x3000
jg 0x462800
je 0x4627f9
test eax, eax
je 0x4627f5
cmp eax, 0x1000
je 0x4627ee
cmp eax, 0x2000
jne 0x46281c
mov eax, 2
jmp 0x46281a
mov eax, 1
jmp 0x46281a
xor eax, eax
jmp 0x46281a
mov eax, 3
jmp 0x46281a
cmp eax, 0x4000
je 0x462815
cmp eax, 0x5000
jne 0x46281c
mov eax, 5
jmp 0x46281a
mov eax, 4
mov dword [ebx], eax
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [0x5496ac]
push 0
test eax, eax
je 0x462927
push 0
push 0xc
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x38]
push ecx
push 0x999920d3
lea ecx, [esp + 0x64]
mov dword [esp + 0x40], edi
push ecx
push 0
push 0
push 0
push eax
mov dword [esp + 0x58], 4
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x46294c
cmp eax, 0x123
je 0x46294c
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x46294c
or dword [esi + 0x40], 4
lea ebx, [esi + 0x34]
push 0
push ebx
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
push 0
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
call sym.ProcessHacker.exe_PhGetHandleInformationEx
test eax, eax
js 0x4628df
cmp dword [esp + 0x14], 0
jge 0x4628df
test ebx, ebx
je 0x4628df
mov eax, dword [ebx]
mov dword [ebx], 0
test eax, eax
je 0x4628df
lea ecx, [eax - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4628df
call fcn.004a2a20
push 0
push 0x30
lea eax, [esp + 0xa0]
push eax
push 2
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtQueryInformationJobObject]
test eax, eax
js 0x46291b
xor ecx, ecx
mov eax, 8
cmp dword [esp + 0xa8], 0x1000
cmovne ecx, eax
mov eax, dword [esi + 0x40]
and eax, 0xfffffff7
or ecx, eax
mov dword [esi + 0x40], ecx
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x46294c
push edi
call dword [sym.imp.ntdll.dll_NtIsProcessInJob]
test eax, eax
js 0x46294c
xor ecx, ecx
mov edx, 4
cmp eax, 0x124
mov eax, dword [esi + 0x40]
cmove ecx, edx
and eax, 0xfffffffb
or ecx, eax
mov dword [esi + 0x40], ecx
push 0
push 4
lea eax, [esp + 0x1c]
push eax
push 0x31
push edi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x462969
mov eax, dword [esp + 0x14]
mov dword [esi + 0x38], eax
mov ebx, dword [0x54b7cc]
test ebx, ebx
je 0x462990
push edi
mov ecx, ebx
call dword [0x4fe8dc]
call ebx
mov ecx, dword [esi + 0x40]
neg eax
sbb eax, eax
and ecx, 0xffffffdf
and eax, 0x20
or ecx, eax
mov dword [esi + 0x40], ecx
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
jb 0x4629a9
test byte [esi + 0x40], 0x20
je 0x4629a9
mov ecx, edi
call fcn.004d0b00
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x24]
test byte [eax + 0x74], 0x80
je 0x462a6a
mov dword [esp + 0x24], 0
cmp edi, 0xffffffff
je 0x462a66
cmp edi, 0xfffffffe
je 0x462a66
mov ecx, dword [0x5496ac]
xor eax, eax
test ecx, ecx
jne 0x4629e3
mov dword [esp + 0x24], edi
mov eax, edi
cmovne eax, edi
test ecx, ecx
je 0x462a43
cmp byte [0x5496b4], 0
je 0x462a43
push 0
push 0
mov dword [esp + 0x44], eax
lea eax, [esp + 0x68]
push 0x18
mov dword [esp + 0x50], eax
lea eax, [esp + 0x44]
push eax
push 0x9999225f
lea eax, [esp + 0x6c]
mov dword [esp + 0x4c], 0xffffffff
push eax
push 0
push 0
push 0
push ecx
mov dword [esp + 0x68], 0
mov dword [esp + 0x70], 0x38
mov dword [esp + 0x74], 0
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
jmp 0x462a58
lea ecx, [esp + 0x14]
push ecx
push 0x38
lea ecx, [esp + 0x68]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQueryObject]
test eax, eax
js 0x462a66
test dword [esp + 0x64], 0x400
jne 0x462a6a
or dword [esi + 0x40], 0x40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret