Function at 0x427320
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x4d9694]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x454], eax
push edi
mov dword [ebp - 0x458], ebx
call fcn.00405d20
mov ecx, eax
test ecx, ecx
je 0x427933
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edx, str.SymbolicLink
lea esi, [eax + 0x10]
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x450], esi
mov ecx, eax
nop
mov di, word [ecx]
cmp di, word [edx]
jne 0x427396
test di, di
je 0x427392
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x427396
add ecx, 4
add edx, 4
test di, di
jne 0x427370
xor ecx, ecx
jmp 0x42739b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x4274c3
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push str.Symbolic_Link_Info
push 0x6e
push dword [ebx + 4]
call edi
push str.Creation_Time:
push 0x66
push dword [ebx + 4]
call edi
mov ecx, dword [ebp - 0x454]
mov eax, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x34]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x45c]
mov dword [ebp - 0x458], ecx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0x414]
push eax
movzx eax, word [ebp - 0x40e]
push eax
movzx eax, word [ebp - 0x412]
push eax
movzx eax, word [ebp - 0x406]
push eax
movzx eax, word [ebp - 0x408]
push eax
movzx eax, word [ebp - 0x40a]
push eax
movzx eax, word [ebp - 0x40c]
push eax
lea eax, [ebp - 0x450]
push str._d:_02d:_02d._03d___d__d__d
push eax
call fcn.00405b90
mov esi, dword [ebp - 0x450]
add esp, 0x24
push esi
push 0x71
push dword [ebx + 4]
call edi
push str.Link:
push 0x67
push dword [ebx + 4]
call edi
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00464ad0
add esp, 0xc
lea ecx, [ebp - 0x44c]
mov eax, 0x3fe
mov word [ebp - 0x44a], ax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x448], eax
mov eax, dword [0x4ddd3c]
push 0
push ecx
push dword [ebx + 0x58]
call eax
test eax, eax
jne 0x427908
lea eax, [ebp - 0x404]
push eax
push 0x72
push dword [ebx + 4]
call edi
jmp 0x427908
mov edx, str.Semaphore
mov ecx, eax
nop word [eax + eax]
mov di, word [ecx]
cmp di, word [edx]
jne 0x4274f6
test di, di
je 0x4274f2
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x4274f6
add ecx, 4
add edx, 4
test di, di
jne 0x4274d0
xor ecx, ecx
jmp 0x4274fb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x427586
mov eax, dword [0x4ddd68]
push ecx
push 8
lea ecx, [ebp - 0x44c]
push ecx
push 0
push dword [ebx + 0x58]
call eax
test eax, eax
js 0x427908
push str.Semaphore_Info
push 0x6e
push dword [ebx + 4]
mov ebx, dword [sym.imp.USER32.dll_SetDlgItemTextW]
call ebx
mov edi, dword [ebp - 0x458]
push str.Count:
push 0x66
push dword [edi + 4]
call ebx
push 1
push dword [ebp - 0x44c]
push 0x71
push dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_SetDlgItemInt]
call edi
mov eax, dword [ebp - 0x458]
push str.Limit:
push 0x67
push dword [eax + 4]
call ebx
mov eax, dword [ebp - 0x458]
push 1
push dword [ebp - 0x448]
push 0x72
push dword [eax + 4]
call edi
jmp 0x427908
mov edx, str.Event
mov ecx, eax
nop dword [eax]
mov di, word [ecx]
cmp di, word [edx]
jne 0x4275b6
test di, di
je 0x4275b2
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x4275b6
add ecx, 4
add edx, 4
test di, di
jne 0x427590
xor ecx, ecx
jmp 0x4275bb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x427648
mov eax, dword [0x4ddd70]
push ecx
push 8
lea ecx, [ebp - 0x44c]
push ecx
push 0
push dword [ebx + 0x58]
call eax
test eax, eax
js 0x427908
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push str.Event_Info
push 0x6e
push dword [ebx + 4]
call edi
push 0x4bd14c
push 0x66
push dword [ebx + 4]
call edi
cmp dword [ebp - 0x44c], 0
mov ecx, str.Synchronization__Auto_Reset_
mov eax, str.Notification__Manual_Reset_
cmovne eax, ecx
push eax
push 0x71
push dword [ebx + 4]
call edi
push str.Signaled:
push 0x67
push dword [ebx + 4]
call edi
cmp dword [ebp - 0x448], 0
mov ecx, str.FALSE
mov eax, str.TRUE
cmove eax, ecx
push eax
push 0x72
push dword [ebx + 4]
call edi
jmp 0x427908
mov edx, str.Mutant
mov ecx, eax
nop
mov di, word [ecx]
cmp di, word [edx]
jne 0x427676
test di, di
je 0x427672
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x427676
add ecx, 4
add edx, 4
test di, di
jne 0x427650
xor ecx, ecx
jmp 0x42767b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x4276ff
mov eax, dword [0x4ddd34]
push ecx
push 8
lea ecx, [ebp - 0x44c]
push ecx
push 0
push dword [ebx + 0x58]
call eax
test eax, eax
js 0x427908
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push str.Mutant__Mutex__Info
push 0x6e
push dword [ebx + 4]
call edi
push str.Hold_Count:
push 0x66
push dword [ebx + 4]
call edi
push 1
push dword [ebp - 0x44c]
push 0x71
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push str.Abandoned:
push 0x67
push dword [ebx + 4]
call edi
cmp byte [ebp - 0x447], 0
mov ecx, str.FALSE
mov eax, str.TRUE
cmove eax, ecx
push eax
push 0x72
push dword [ebx + 4]
call edi
jmp 0x427908
mov edx, str.Section
mov ecx, eax
mov di, word [ecx]
cmp di, word [edx]
jne 0x42772c
test di, di
je 0x427728
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x42772c
add ecx, 4
add edx, 4
test di, di
jne 0x427706
xor ecx, ecx
jmp 0x427731
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x427803
mov eax, dword [0x4ddd2c]
push ecx
push 0x10
lea ecx, [ebp - 0x414]
push ecx
push 0
push dword [ebx + 0x58]
call eax
test eax, eax
js 0x427908
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push str.Section_Info
push 0x6e
push dword [ebx + 4]
call edi
push str.Size:
push 0x66
push dword [ebx + 4]
call edi
push str.Attributes:
push 0x67
push dword [ebx + 4]
call edi
mov ecx, dword [ebp - 0x40c]
mov eax, dword [ebp - 0x408]
shrd ecx, eax, 0xa
sar eax, 0xa
push eax
push ecx
lea eax, [ebp - 0x450]
push str._lld_KB
push eax
call fcn.00405b90
add esp, 0x10
push dword [ebp - 0x450]
push 0x71
push dword [ebx + 4]
call edi
push dword [ebp - 0x410]
lea eax, [ebp - 0x454]
push eax
call fcn.00427e60
push dword [eax]
lea eax, [ebp - 0x450]
push dword [ebp - 0x410]
push str.0x_X___s_
push eax
call fcn.00405b90
add esp, 0x18
lea ecx, [ebp - 0x454]
call fcn.00404ae0
mov esi, dword [ebp - 0x450]
push esi
push 0x72
push dword [ebx + 4]
call edi
jmp 0x427908
mov ecx, 0x4bd2d4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42782e
test dx, dx
je 0x42782a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42782e
add eax, 4
add ecx, 4
test dx, dx
jne 0x427808
xor eax, eax
jmp 0x427833
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4278f4
push eax
push 0x30
lea eax, [ebp - 0x444]
push eax
push 1
push dword [ebx + 0x58]
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x427908
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push str.Job_Info
push 0x6e
push dword [ebx + 4]
call edi
push str.Processes:
push 0x66
push dword [ebx + 4]
call edi
push 1
push dword [ebp - 0x41c]
push 0x71
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push str.CPU_Time:
push 0x67
push dword [ebx + 4]
call edi
mov ecx, dword [ebp - 0x444]
add ecx, dword [ebp - 0x43c]
mov eax, dword [ebp - 0x440]
adc eax, dword [ebp - 0x438]
push 0
push 0x989680
push eax
push ecx
call fcn.00449960
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x44c]
push str._D._H:_M:_S
lea eax, [ebp - 0x454]
mov dword [ebp - 0x448], edx
push eax
call fcn.00427940
push dword [eax]
push 0x72
push dword [ebx + 4]
call edi
lea ecx, [ebp - 0x454]
call fcn.00404ae0
jmp 0x427908
push 0x6e
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x427920
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448f14
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004059f0
int3