Function at 0x443459
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x62d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
lea eax, [esi - 0x9c41]
cmp eax, 0x138
ja case.0x443452.40011
movzx eax, byte [eax + 0x445ba8]
jmp dword [eax*4 + 0x445a0c]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x16
push eax
mov dword [ebp - 0x5c], str.HideOnClose
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4434a2
call fcn.0046fbe0
lea esp, [esp]
test al, al
je case.0x443452.40011
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x1a
push eax
mov dword [ebp - 0x5c], str.CloseOnEscape
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
lea esp, [esp]
test eax, eax
je case.0x443452.40011
push 0
push 0
push 0
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x633f80]
lea eax, ds:[ebp - 0x54]
push eax
push 0
push 5
push 0xfd
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443452.40011
push 0
push 0x4bb440
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
xor edx, edx
call fcn.004b8320
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x633f80]
xor eax, eax
cmp dword [0x636a80], eax
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x107
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443452.40011
push edi
push 0x4bcb40
push 0
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push 0
push 0
push 3
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
push 0
push 0
push 3
push 1
push 5
push str._v__newinstance
xor edx, edx
mov ecx, edi
call fcn.00413680
push 0
sar eax, 0x1f
push 0
and eax, 4
push eax
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov edi, edi
call sym.SystemInformer.exe_PhCreateSaveFileDialog
mov ecx, dword [0x634484]
mov ebx, eax
push 3
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x40], 0x20
mov dword [ebp - 0x3c], 0x5c9840
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
push 0x62e468
push ebx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x10], 8
mov dword [ebp - 0xc], str..txt
call sym.SystemInformer.exe_PhSetFileDialogFilter
push 0x3c
push 3
lea eax, [ebp - 0x50]
push eax
call sym.SystemInformer.exe_PhFormat
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push ebx
call sym.SystemInformer.exe_PhSetFileDialogFileName
push ebx
push edi
call sym.SystemInformer.exe_PhShowFileDialog
lea esp, [esp]
test al, al
je 0x44370d
push ebx
call sym.SystemInformer.exe_PhGetFileDialogFileName
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push ebx
mov esi, eax
call sym.SystemInformer.exe_PhGetFileDialogFilterIndex
push 0
push 5
push 1
push 0x120116
push dword [esi + 4]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x54]
push eax
call sym.SystemInformer.exe_PhCreateFileStream
test eax, eax
js 0x4436fc
mov edi, dword [ebp - 0x54]
push 2
push 0x617d60
push edi
call sym.SystemInformer.exe_PhWriteStringAsUtf8FileStreamEx
push edi
call sym.SystemInformer.exe__PhWritePhTextHeader_4
xor ecx, ecx
mov dword [ebp - 0x60], edi
mov eax, 2
cmp dword [ebp - 0x6c], eax
push ecx
cmovne eax, ecx
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [0x634484]
push 7
push eax
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5a28f0]
call esi
push edi
call sym.SystemInformer.exe_PhDereferenceObject
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push 0
push eax
push str.Unable_to_create_the_file
push edi
lfence
call sym.SystemInformer.exe_PhShowStatus
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp dword [0x634244], 0
jne 0x44378e
push 0
push 0x426500
push 0x634244
call sym.SystemInformer.exe_PhCreateThreadEx
test eax, eax
jns 0x443779
push str.Unable_to_create_the_window.
push 0x5cc39c
push 0x10
push dword [sym.SystemInformer.exe_PhMainWndHandle]
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
test byte [0x62e360], 1
jne 0x44378e
xor edx, edx
mov ecx, 0x62e360
call sym.SystemInformer.exe_PhfWaitForEvent
push 0
push 0
push 0x8321
push dword [0x634250]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call fcn.004753e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lfence
call fcn.004463c0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push 0
call sym.SystemInformer.exe__PhShowSystemInformationDialog_4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lfence
call fcn.00449700
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lfence
call fcn.00449bc0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x634650]
test eax, eax
jne 0x443856
push eax
push 0x464d20
push 0x634e2c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x634650], eax
jmp 0x44388b
push eax
push 0x634e2c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x634650], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x634e3c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x634e2c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x2c
cmp dword [0x634650], eax
mov dword [ebp - 0x5c], str.HideOtherUserProcesses
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x634694]
test eax, eax
jne 0x443923
cmp byte [0x636a4a], al
jne 0x44390b
push str.Enable_it_in_Options___General_and_restart_System_Informer.
push str.This_filter_cannot_function_because_digital_signature_checking_is_not_enabled._r_n_s
push eax
push 0xfffd
push 0x20
push dword [sym.SystemInformer.exe_PhMainWndHandle]
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push 0
push 0x464e00
push 0x634e2c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x634694], eax
jmp 0x443954
push eax
push 0x634e2c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x634694], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x634e3c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x634e2c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x26
cmp dword [0x634694], eax
mov dword [ebp - 0x5c], str.HideSignedProcesses
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x634674]
test eax, eax
jne 0x4439b6
push eax
push 0x464e20
push 0x634e2c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x634674], eax
jmp 0x4439eb
push eax
push 0x634e2c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x634674], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x634e3c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x634e2c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x2c
cmp dword [0x634674], eax
mov dword [ebp - 0x5c], str.HideMicrosoftProcesses
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x60], 0x28
cmp dword [0x636a58], eax
mov dword [ebp - 0x5c], str.ScrollToNewProcesses
sete al
push eax
mov dword [0x636a58], eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x60], 0x1e
cmp dword [0x636a4c], eax
mov dword [ebp - 0x5c], str.ShowCpuBelow001
sete al
push eax
mov dword [0x636a4c], eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
call sym.SystemInformer.exe__PhInvalidateAllProcessNodes_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x63472c]
test eax, eax
jne 0x443abc
push eax
push 0x468240
push 0x635304
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
jmp 0x443ac9
push eax
push 0x635304
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
push 0x635304
mov dword [0x63472c], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x24
cmp dword [0x63472c], eax
mov dword [ebp - 0x5c], str.HideDriverServices
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6346c8]
test eax, eax
je 0x443b29
push eax
push 0x635304
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x443b3a
push 0
push 0x468260
push 0x635304
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
push 0x635304
mov dword [0x6346c8], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x26
cmp dword [0x6346c8], eax
mov dword [ebp - 0x5c], str.HideDefaultServices
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6345ec]
test eax, eax
je 0x443b95
push eax
push 0x634768
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x443ba6
push 0
push 0x463ca0
push 0x634768
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
push 0x634768
mov dword [0x6345ec], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x2c
cmp dword [0x6345ec], eax
mov dword [ebp - 0x5c], str.HideWaitingConnections
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp byte [0x6341ee], 0
push 0x13
push 0
sete al
push 0
mov byte [0x6341ee], al
push 0
movzx eax, al
push 0
sub eax, 2
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
movzx eax, byte [0x6341ee]
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x2a
push eax
mov dword [ebp - 0x5c], str.MainWindowAlwaysOnTop
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov al, byte [0x6341ee]
xor edi, edi
mov byte [ebp - 0x6d], al
mov ecx, 0x635c6c
lock bts dword [ecx], 0
setb al
test al, al
je 0x443c4f
call sym.SystemInformer.exe_PhfAcquireQueuedLockExclusive
mov ebx, dword [0x635cb0]
mov ecx, dword [ebx + 0x24]
cmp edi, ecx
jae 0x443c84
mov edx, dword [ebx]
add edx, 8
mov eax, edx
imul eax, edi
add eax, dword [ebx + 0x18]
lea esp, [esp]
mov esi, eax
inc edi
add eax, edx
cmp dword [esi], 0xffffffff
jne 0x443cc9
mov edi, edi
cmp edi, ecx
jb 0x443c70
or edi, 0xffffffff
mov ecx, 0x635c6c
lock xadd dword [ecx], edi
mov eax, edi
and al, 6
cmp al, 2
jne case.0x443452.40011
dec edi
mov eax, edi
lea edx, [edi + 4]
mov esi, edx
lock cmpxchg dword [ecx], esi
cmp eax, edi
jne case.0x443452.40011
call fcn.00521000
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
test byte [esi + 0xc], 1
je 0x443c55
mov esi, dword [esi + 8]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0x13
push 0
xor eax, eax
cmp byte [ebp - 0x6d], al
push 0
push 0
setne al
push 0
add eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x443c4f
lea eax, ds:[esi + esi*4]
mov esi, 0x62066
add eax, eax
sub esi, eax
lea eax, [ebp - 0x60]
push esi
lfence
push eax
mov dword [ebp - 0x60], 0x22
mov dword [ebp - 0x5c], str.MainWindowOpacity
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov edx, esi
mov ecx, edi
call fcn.00413180
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push 0
push 0x6370c0
call sym.SystemInformer.exe_PhBoostProvider
push 0
push 0x6370a0
call sym.SystemInformer.exe_PhBoostProvider
cmp byte [0x637098], 0
mov edi, edi
je case.0x443452.40011
push 0
push 0x637080
call sym.SystemInformer.exe_PhBoostProvider
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
add esi, 0xffff6325
cmp esi, 4
ja case.default.0x443d8e
jmp dword [esi*4 + 0x445ce4]
mov esi, 0x1f4
jmp 0x443dbb
mov esi, 0x3e8
jmp 0x443dbb
mov esi, 0x7d0
jmp 0x443dbb
mov esi, 0x1388
jmp 0x443dbb
mov esi, 0x2710
jmp 0x443dbb
mov esi, dword [ebp - 0x54]
push esi
lea eax, [ebp - 0x60]
mov dword [0x636a54], esi
push eax
mov dword [ebp - 0x60], 0x1c
mov dword [ebp - 0x5c], str.UpdateInterval
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov ecx, dword [0x6370e4]
mov edi, 0x2710
mov dword [0x6370e8], esi
test ecx, ecx
je 0x443e13
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [ebp - 0x60], eax
adc edx, 0
push 0
lea eax, [ebp - 0x60]
neg edx
push eax
push ecx
mov dword [ebp - 0x5c], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ecx, dword [0x637104]
mov dword [0x637108], esi
nop
test ecx, ecx
je 0x443e49
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [ebp - 0x60], eax
adc edx, 0
push 0
lea eax, [ebp - 0x60]
neg edx
push eax
push ecx
mov dword [ebp - 0x5c], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ecx, dword [0x637124]
mov dword [0x637128], esi
test ecx, ecx
je case.0x443452.40011
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [ebp - 0x60], eax
adc edx, 0
push 0
lea eax, [ebp - 0x60]
neg edx
push eax
push ecx
mov dword [ebp - 0x5c], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp byte [0x62d94c], 0
push ecx
sete al
mov ecx, 9
movzx edx, al
mov byte [0x62d94c], al
call fcn.0044ac20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call fcn.004e60e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x633f80]
xor eax, eax
cmp dword [0x636a80], eax
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0xa8
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443452.40011
push 0
push 0x4c3640
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x634254]
test eax, eax
jne 0x443f76
mov esi, dword [0x633f80]
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x87
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x443f5e
xor eax, eax
jmp 0x443f71
push 0
push 0x429080
push 0
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [0x634254], eax
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
lea ecx, [ecx]
test eax, eax
jne 0x443fa3
push 5
push dword [0x634254]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push dword [0x634254]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe_PhCreateOpenFileDialog
push 2
mov ebx, eax
push 0x62e484
push ebx
call sym.SystemInformer.exe_PhSetFileDialogFilter
cmp byte ds:[ebx], 0
mov edx, dword [ebx + 4]
je 0x444084
mov ecx, dword [edx]
lea eax, [ebp - 0x6c]
push eax
push edx
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0x5a28f0]
call esi
lea ebx, [ebx]
test eax, eax
js 0x44409f
mov edx, dword [ebp - 0x6c]
xor eax, eax
test edx, edx
je 0x444050
jmp 0x444020
test dword [eax + 0x5d2f80], 0x600
mov ecx, dword [eax + 0x5d2f84]
je 0x444036
or edx, ecx
jmp 0x44403a
not ecx
and edx, ecx
add eax, 8
cmp eax, 0x58
jb 0x444020
jmp 0x44406a
test dword [eax + 0x5d2f80], 0x600
je 0x444062
or edx, dword [eax + 0x5d2f84]
add eax, 8
cmp eax, 0x58
jb 0x444050
mov eax, dword [ebx + 4]
mov dword [ebp - 0x6c], edx
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x5a28f0]
nop
call esi
jmp 0x44409f
mov eax, dword [edx + 0x34]
test eax, eax
je 0x444097
and eax, 0xefefc7fd
or eax, 0x2000100
jmp 0x44409c
mov eax, 0x2000100
mov dword [edx + 0x34], eax
push ebx
push edi
call sym.SystemInformer.exe_PhShowFileDialog
test al, al
je 0x4440cc
push str.Make_sure_the_PE_Viewer_executable_file_is_present.
push 0
push ebx
call sym.SystemInformer.exe_PhGetFileDialogFileName
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push str.ProgramInspectExecutables
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6335ec]
test eax, eax
jne 0x44414b
cmp dword [0x636a80], eax
mov esi, dword [0x633f80]
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x8a
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x44411a
xor eax, eax
jmp 0x44412c
push 0
push 0x47c840
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x6335ec], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x6335ec]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x6335ec]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x444177
push 9
push dword [0x6335ec]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push dword [0x6335ec]
lea ecx, [ecx]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call fcn.00438c40
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea eax, ds:[ebp - 0x60]
mov dword [ebp - 0x78], 0x18
push eax
mov dword [ebp - 0x74], str._taskmgr.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [ebp - 0x78]
push eax
push 0x630c10
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov esi, eax
mov dword [ebp - 0x60], 0x24
lea eax, [ebp - 0x60]
mov dword [ebp - 0x5c], str.TaskmgrWindowState
push eax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
neg eax
sbb ebx, ebx
and ebx, 0x600dc8
call fcn.00476700
test al, al
jne 0x44425b
lea eax, ds:[ebp - 0x60]
mov dword [ebp - 0x60], 0x44
push eax
mov dword [ebp - 0x5c], str.EnableShellExecuteSkipIfeoDebugger
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x44425b
test esi, esi
je 0x444236
mov eax, dword [esi + 4]
jmp 0x444238
xor eax, eax
push 0
push 0
push 0
push 5
push 0
push ebx
push eax
push edi
call sym.SystemInformer.exe_PhShellExecuteEx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp dword [0x62dbb0], 0x3e
jb 0x4442d6
lea eax, [ebp - 0x68]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x4442d6
push 0
push 0
push edi
call sym.SystemInformer.exe__PhUiConnectToPhSvcEx_12
test al, al
je case.0x443452.40011
test esi, esi
je 0x4442b6
mov ecx, dword [esi + 4]
mov edx, ebx
call fcn.0047ea80
nop
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, ebx
call fcn.0047ea80
nop
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4442f9
mov ecx, dword [esi + 4]
mov edx, ebx
call fcn.00413c00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, ebx
call fcn.00413c00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
mov dword [ebp - 0x80], 0x18
push eax
mov dword [ebp - 0x7c], str.perfmon.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [ebp - 0x80]
push eax
push 0x630c10
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov esi, eax
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 0x60]
mov dword [ebp - 0x5c], str.EnableShellExecuteSkipIfeoDebugger
push eax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
mov edi, edi
test eax, eax
je 0x44439a
test esi, esi
je 0x444371
mov eax, dword [esi + 4]
jmp 0x444373
xor eax, eax
push 0
push 0
push 0
push 5
push 0
push str.__res
push eax
push edi
call sym.SystemInformer.exe_PhShellExecuteEx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea eax, ds:[ebp - 0x68]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x44441b
push 0
push 0
push edi
call sym.SystemInformer.exe__PhUiConnectToPhSvcEx_12
lea esp, [esp]
test al, al
je case.0x443452.40011
test esi, esi
je 0x4443f6
mov ecx, dword [esi + 4]
mov edx, str.__res
call fcn.0047ea80
lea ecx, [ecx]
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, str.__res
call fcn.0047ea80
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
jmp 0x444420
test esi, esi
je 0x444449
mov ecx, dword [esi + 4]
mov edx, str.__res
call fcn.00413c00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, str.__res
call fcn.00413c00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
mov dword [ebp - 0x88], 0x10
push eax
mov dword [ebp - 0x84], str.wsl.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [ebp - 0x88]
push eax
push 0x630c10
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
test eax, eax
je 0x4444ae
mov eax, dword [eax + 4]
jmp 0x4444b0
xor eax, eax
push 0
push 0
push 0
push 5
push 0
push str.___shutdown
push eax
push edi
call sym.SystemInformer.exe_PhShellExecuteEx
test eax, eax
jns case.0x443452.40011
push 0
push eax
push str.Unable_to_shutdown_WSL_instances.
push edi
lfence
call sym.SystemInformer.exe_PhShowStatus
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push ecx
push 0
push 0x443300
push str.SCManager
mov edx, str.Service_Control_Manager
xor ecx, ecx
call fcn.00534a60
push eax
push 0x534980
call sym.SystemInformer.exe_PhCreateThread2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push ecx
push 0
push 0x443350
push str.PowerDefault
mov edx, str.Current_Power_Scheme
jmp 0x444508
push 0
push 0
push 0
push ecx
push 0
push 0x443350
push str.RdpDefault
mov edx, str.Terminal_Server_Listener
jmp 0x444508
push 0
push 0
push 0
push ecx
push 0
push 0x443350
push str.WmiDefault
mov edx, str.WMI_Root_Namespace
jmp 0x444508
push 0
push 0
push 0
push ecx
push 0x4433a0
push 0x443360
push str.Desktop
mov edx, str.Current_Window_Desktop
jmp 0x444508
push 0
push 0
push 0
push ecx
push 0x443400
push 0x4433c0
push str.WindowStation
mov edx, str.Current_Window_Station
jmp 0x444508
push dword [0x62e464]
push edi
call sym.SystemInformer.exe__PhUiConnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push dword [0x62e464]
push edi
call sym.SystemInformer.exe__PhUiDisconnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push dword [0x62e464]
push edi
call sym.SystemInformer.exe__PhUiLogoffSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x62e464]
lea eax, [ebp - 0x54]
push 0
push 4
push eax
push 0x18
push 0xffffffffffffffff
or esi, 0xffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
cmovns esi, dword [ebp - 0x54]
cmp ebx, esi
jne 0x44466f
push str.You_cannot_remote_control_the_current_session.
push 0x5cc39c
push str.Unable_to_shadow_session.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x633f80]
lea eax, [ebp - 0x6c]
push eax
push 0
push 5
push 0xc1
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443452.40011
push ebx
push 0x4c0ba0
push edi
push dword [ebp - 0x6c]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x633f80]
lea eax, [ebp - 0x54]
mov ebx, dword [0x62e464]
push eax
push 0
push 5
push 0x98
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443452.40011
push ebx
push 0x4c9d80
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x633f80]
xor eax, eax
cmp dword [0x636a80], eax
mov ebx, dword [0x62e464]
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x99
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443452.40011
push ebx
push 0x4c0580
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x63352c]
lea esp, [esp]
test eax, eax
jne 0x4447c4
mov esi, dword [0x633f80]
lea eax, ds:[ebp - 0x54]
push eax
push 0
push 5
push 0xb2
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x444790
xor eax, eax
jmp 0x4447a6
push 0
push 0x43df40
push 0
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x63352c], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x63352c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x63352c]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4447f7
push 9
push dword [0x63352c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push dword [0x63352c]
lea ecx, [ecx]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call fcn.0041ad20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x634168]
test eax, eax
jne 0x444898
cmp dword [0x636a80], eax
mov esi, dword [0x633f80]
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x79
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x444865
xor eax, eax
jmp 0x444877
push 0
push section..text
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x634168], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x634168]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x634168]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
nop
test eax, eax
je 0x4448c9
push 9
push dword [0x634168]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push dword [0x634168]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword ds:[ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x444914
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x444908
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiTerminateProcesses_12
lea esp, [esp]
test al, al
je 0x44493d
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x634e3c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test ebx, ebx
je 0x44496d
or esi, 0xffffffff
jmp 0x444950
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x444968
call fcn.004fbe40
inc edi
cmp edi, ebx
jb 0x444950
push dword [ebp - 0x6c]
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiTerminateTreeProcess_8
test al, al
je 0x4449c6
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x634e3c]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x444a0c
lea ebx, [ebx]
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x444a00
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiSuspendProcesses_12
xor edi, edi
test ebx, ebx
je 0x44496d
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x444a39
call fcn.004fbe40
inc edi
cmp edi, ebx
jb 0x444a21
mov edi, edi
jmp 0x44496d
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSuspendTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea eax, ds:[ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x444aa4
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x444a95
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiResumeProcesses_12
xor edi, edi
test ebx, ebx
je 0x44496d
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x444ad8
call fcn.004fbe40
inc edi
cmp edi, ebx
jb 0x444ac0
lea ecx, [ecx]
jmp 0x44496d
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiResumeTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiFreezeTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword ds:[esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiThawTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea esp, [esp]
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword ds:[esi - 4]
mov edx, dword fs:[0x18]
mov ecx, dword [esi + 0x10]
cmp ecx, dword [edx + 0x20]
jne 0x444bde
push 0
push 0
push 3
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
push 0
push 0
push 3
push 0
push 5
push 0
xor edx, edx
mov ecx, edi
call fcn.00413680
push 0
sar eax, 0x1f
push 0
and eax, 4
push eax
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
jmp 0x4449c6
push esi
push edi
call sym.SystemInformer.exe__PhUiRestartProcess_8
jmp 0x4449a9
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x443452.40011
lock inc dword [ebx - 4]
cmp dword [ebx + 0x10], 4
jne 0x444c91
cmp esi, 0x9c53
jne 0x444c4c
mov esi, dword [0x633f80]
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0xfe
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je 0x444d29
push 0
push 0x438980
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push ebx
jmp 0x4449c7
mov byte [ebp - 0x6d], 0x11
sub esi, 0x9c42
je 0x444c7d
lea esp, [esp]
sub esi, 3
jne 0x444c81
lea edx, [ebp - 0x6d]
mov byte [ebp - 0x6d], 0x35
mov ecx, edi
call fcn.004388e0
push ebx
jmp 0x4449c7
mov byte [ebp - 0x6d], 0x19
lea edx, [ebp - 0x6d]
mov ecx, edi
call fcn.004388e0
push ebx
jmp 0x4449c7
cmp esi, 0x9c53
jne 0x444cd5
mov esi, dword [0x633f80]
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x100
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je 0x444d29
push ebx
push 0x44dbc0
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push ebx
jmp 0x4449c7
add esi, 0xffff63be
cmp esi, 3
ja case.0x444ce9.40003
jmp dword [esi*4 + 0x445cf8]
mov eax, 0x21021
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044cca0
push ebx
jmp 0x4449c7
mov eax, 0x6fab67
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044cca0
push ebx
jmp 0x4449c7
mov eax, 0x421826
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044cca0
push ebx
jmp 0x4449c7
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDebugProcess_8
jmp 0x4449c6
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword [esi - 4]
cmp byte [0x637040], 0
sete cl
movzx ecx, cl
push ecx
push esi
push edi
call sym.SystemInformer.exe__PhUiSetVirtualizationProcess_12
jmp 0x4449c6
jmp 0x444d80
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword [esi - 4]
push 0
mov edx, esi
mov ecx, edi
call fcn.0040df20
mov edi, edi
jmp 0x4449c6
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetCriticalProcess_8
nop
jmp 0x4449c6
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDetachFromDebuggerProcess_8
nop
jmp 0x4449c6
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x443452.40011
lea esi, [ebx - 4]
lock inc dword [esi]
push 0x58
push 4
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x58
push 0
push eax
mov dword [ebp - 0x6c], eax
call fcn.00580ff0
add esp, 0xc
lock inc dword [esi]
mov eax, dword [ebp - 0x6c]
push dword [0x633f7c]
push 0xc
mov dword [eax + 8], ebx
call sym.SystemInformer.exe_PhCreateObject
push 0x50
mov esi, eax
push 4
push dword [0x633f94]
mov dword [esi], 0
mov dword [esi + 4], 0x14
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [eax + 0xc], esi
mov esi, dword [0x633f80]
mov dword [eax + 4], edi
xor eax, eax
cmp dword [0x636a80], eax
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0xaf
push esi
call sym.SystemInformer.exe_PhLoadResource
nop
test al, al
jne 0x444e8f
xor esi, esi
jmp 0x444ea8
mov eax, dword ds:[ebp - 0x6c]
push eax
push 0x426d80
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
jmp 0x4449c7
mov edi, edi
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword [esi - 4]
mov edx, esi
call fcn.004276c0
jmp 0x4449c6
nop
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x443452.40011
add esi, 0xffff62d1
cmp esi, 4
ja case.default.0x444f00
mov edi, edi
jmp dword [esi*4 + 0x445d08]
mov eax, 1
jmp 0x444f3c
mov eax, 2
jmp 0x444f3c
mov eax, 3
jmp 0x444f3c
mov eax, 4
jmp 0x444f3c
mov eax, 5
jmp 0x444f3c
mov eax, dword [ebp - 0x54]
lock inc dword [ebx - 4]
push eax
push ebx
push edi
call sym.SystemInformer.exe__PhUiSetPagePriorityProcess_12
push ebx
jmp 0x4449c7
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x444f7c
jmp 0x444f70
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x444f70
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiReduceWorkingSetProcesses_12
xor edi, edi
test ebx, ebx
je 0x44496d
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
sub ecx, 8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x444fae
call fcn.004fbe40
inc edi
cmp edi, ebx
jb 0x444f92
jmp 0x44496d
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
lea ecx, [ecx]
test eax, eax
je case.0x443452.40011
mov eax, dword [eax + 0x34]
test eax, eax
je case.0x443452.40011
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x18
push eax
mov dword [ebp - 0x5c], str.RunAsProgram
call sym.SystemInformer.exe_PhSetStringRefSetting
xor edx, edx
mov ecx, edi
call fcn.004b8320
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x443452.40011
mov edx, dword ds:[eax + 0x10]
mov ecx, edi
call fcn.004b8320
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword [esi - 4]
mov edx, esi
mov ecx, edi
call fcn.0043a080
jmp 0x4449c6
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445084
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445077
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiFlushHeapProcesses_12
xor edi, edi
test ebx, ebx
je 0x44496d
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4450bc
call fcn.004fbe40
inc edi
cmp edi, ebx
jb 0x4450a0
jmp 0x44496d
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
lfence
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x4450fc
lea esp, [esp]
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4450f0
push ebx
mov ecx, esi
call fcn.00464ec0
xor edi, edi
test ebx, ebx
je 0x44496d
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44512e
call fcn.004fbe40
inc edi
cmp edi, ebx
jb 0x445112
jmp 0x44496d
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
lfence
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445164
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445158
push ebx
mov ecx, esi
call fcn.00464f60
xor edi, edi
test ebx, ebx
je 0x44496d
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44519c
call fcn.004fbe40
inc edi
cmp edi, ebx
jb 0x445180
jmp 0x44496d
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword ds:[esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetEcoModeProcess_8
jmp 0x4449c6
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40055
lock inc dword ds:[esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetExecutionRequiredProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push dword [0x63703c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x443452.40011
xor eax, eax
mov dword [ebp - 0x34], 0x2c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x34]
push eax
push dword [0x63703c]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword ds:[ebp - 0x2c], 6
je 0x445277
push dword [0x63703c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push dword [0x63703c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x443452.40011
push 9
push dword [0x63703c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push dword [0x63703c]
lea ecx, [ecx]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x443452.40011
push 6
push dword [0x63703c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push dword [0x63703c]
call dword [sym.imp.USER32.dll_IsWindow]
lea esp, [esp]
test eax, eax
je case.0x443452.40011
push 3
push dword [0x63703c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push dword [0x63703c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x443452.40011
push 0
push 0
push 0x10
push dword [0x63703c]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
mov eax, dword [esi + 0x38]
test eax, eax
je case.0x443452.40011
cmp dword ds:[eax], 0
je case.0x443452.40011
push eax
call sym.SystemInformer.exe_PhDoesFileExist
test al, al
je case.0x443452.40011
lock inc dword [esi - 4]
mov eax, dword [esi + 0x34]
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [eax + 4]
push str.FileBrowseExecutable
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
jmp 0x4449c6
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
lea ebx, [ebx]
test eax, eax
je case.0x443452.40011
mov eax, dword [eax + 0x18]
push dword [eax + 4]
push edi
call sym.SystemInformer.exe__PhSearchOnlineString_8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x443452.40011
push eax
call fcn.00464cc0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push 0
push dword [0x634e3c]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x634e3c]
call sym.SystemInformer.exe_PhSetClipboardString
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne case.0x443452.40011
call fcn.004fbe40
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x443452.40011
push dword [eax + 0x2c]
call sym.SystemInformer.exe__PhFindProcessNode_4
mov esi, eax
test esi, esi
je 0x44548a
mov ecx, dword [0x637038]
mov ecx, dword [ecx + 0x14]
call fcn.0044abd0
push dword [0x637034]
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, 1
mov dword [ebp - 0x54], esi
lea ecx, [ebp - 0x54]
call fcn.0049f580
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push 0
push 0xc000000b
push str.The_process_does_not_exist.
push edi
call sym.SystemInformer.exe_PhShowStatus
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x4454dc
lea ebx, [ebx]
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4454d0
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiStartServices_12
xor edi, edi
test ebx, ebx
je 0x44496d
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44550e
call fcn.004fbe40
inc edi
cmp edi, ebx
jb 0x4454f2
jmp 0x44496d
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445544
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445535
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiContinueServices_12
xor edi, edi
test ebx, ebx
je 0x44496d
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44557c
call fcn.004fbe40
inc edi
cmp edi, ebx
jb 0x445560
jmp 0x44496d
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword ds:[ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x4455b4
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4455a8
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiPauseServices_12
xor edi, edi
test ebx, ebx
je 0x44496d
or esi, 0xffffffff
jmp 0x4455d0
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4455ec
call fcn.004fbe40
inc edi
cmp edi, ebx
jb 0x4455d0
jmp 0x44496d
lea eax, ds:[ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445624
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445615
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiStopServices_12
xor edi, edi
test ebx, ebx
je 0x44496d
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44565c
call fcn.004fbe40
inc edi
cmp edi, ebx
jb 0x445640
jmp 0x44496d
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lock inc dword ds:[esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDeleteService_8
test al, al
je 0x4449c6
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x635314]
jmp 0x4449c0
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x443452.40011
push dword ds:[eax + 8]
lea eax, [ebp - 0x54]
push 0x20019
push eax
call sym.SystemInformer.exe_PhOpenServiceKey
test eax, eax
js 0x445797
mov edx, dword [ebp - 0x54]
test edx, edx
je 0x445769
jmp 0x4456e0
cmp edx, 0xffffffff
je 0x445769
cmp edx, 0xfffffffe
je 0x445769
lea eax, ds:[ebp - 0x6c]
or esi, 0xffffffff
push eax
push 0
mov ecx, esi
call fcn.0052b640
test eax, eax
js 0x445769
mov ebx, dword [ebp - 0x6c]
push ebx
call sym.SystemInformer.exe_PhFormatNativeKeyName
mov dword ds:[ebp - 0x6c], eax
test ebx, ebx
je 0x44573f
lea ecx, [ebx - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x44573f
call fcn.004fbe40
mov eax, dword [ebp - 0x6c]
push eax
push edi
call sym.SystemInformer.exe__PhShellOpenKey2_8
push dword [ebp - 0x6c]
call sym.SystemInformer.exe_PhDereferenceObject
push dword [ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push 0
push 0xc0000034
push str.The_service_does_not_exist.
push edi
call sym.SystemInformer.exe_PhShowStatus
push dword ds:[ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
push 0
push 0xc0000034
push str.The_service_does_not_exist.
push edi
call sym.SystemInformer.exe_PhShowStatus
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
mov eax, dword [esi + 8]
test eax, eax
je 0x4457dc
mov eax, dword [eax + 4]
jmp 0x4457de
xor eax, eax
push eax
push 1
lea eax, [ebp - 0x54]
push eax
call sym.SystemInformer.exe_PhOpenService
test eax, eax
js case.0x443452.40011
mov ebx, dword [ebp - 0x54]
mov ecx, ebx
mov edx, dword [esi + 8]
call fcn.00522d60
mov esi, eax
test esi, esi
je 0x445825
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [esi + 4]
push str.FileBrowseExecutable
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea ecx, [ecx]
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x443452.40011
lea ecx, ds:[esi - 4]
lock inc dword [ecx]
lock inc dword [ecx]
push esi
push 0x4c6fe0
call sym.SystemInformer.exe_PhCreateThread2
jmp 0x4449c6
push 0
push dword [0x635314]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x635314]
jmp 0x445403
call fcn.0046bbc0
test eax, eax
je case.0x443452.40011
push dword [eax + 0x38]
jmp 0x445440
call fcn.0046bbc0
nop
test eax, eax
je case.0x443452.40011
mov eax, dword [eax + 0x48]
test eax, eax
je case.0x443452.40011
push dword [eax + 4]
call sym.SystemInformer.exe__PhReferenceServiceItem_4
mov esi, eax
test esi, esi
je case.0x443452.40011
mov ecx, dword [0x637018]
mov ecx, dword [ecx + 0x14]
call fcn.0044abd0
push dword [0x637014]
lea esp, [esp]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
push 0
push 0xc
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
jmp 0x4449c6
lea edx, ds:[ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.0046bc00
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445924
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445915
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiCloseConnections_12
test al, al
je 0x445949
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x634774]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test ebx, ebx
je 0x44496d
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x445972
call fcn.004fbe40
inc edi
cmp edi, ebx
jb 0x445956
jmp 0x44496d
push 0
push dword [0x634774]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x634774]
jmp 0x445403
push 0
push 0
push 0x130b
push dword [0x6344a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x6344a8]
xor esi, esi
mov edx, dword [ecx]
lea ecx, [eax + 1]
dec edx
cmp eax, edx
cmove ecx, esi
jmp 0x4459f2
push 0
push 0
push 0x130b
push dword [0x6344a4]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ebx, [ebx]
test eax, eax
jne 0x4459ef
mov eax, dword [0x6344a8]
mov eax, dword [eax]
dec eax
mov ecx, eax
call fcn.0044abd0
mov ecx, dword ds:[ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret