Function at 0x443499
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x62e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
lea eax, [esi - 0x9c41]
cmp eax, 0x138
ja case.0x443492.40011
movzx eax, byte [eax + 0x445be8]
jmp dword [eax*4 + 0x445a4c]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x16
push eax
mov dword [ebp - 0x5c], str.HideOnClose
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4434e2
call fcn.0046fbe0
lea esp, [esp]
test al, al
je case.0x443492.40011
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x1a
push eax
mov dword [ebp - 0x5c], str.CloseOnEscape
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
lea esp, [esp]
test eax, eax
je case.0x443492.40011
push 0
push 0
push 0
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov esi, dword [0x634f14]
lea eax, ds:[ebp - 0x54]
push eax
push 0
push 5
push 0xfd
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443492.40011
push 0
push 0x4bb2c0
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
xor edx, edx
call fcn.004b81a0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov esi, dword [0x634f14]
xor eax, eax
cmp dword [0x6379a0], eax
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x107
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443492.40011
push edi
push 0x4bc9c0
push 0
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push 0
push 0
push 3
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
push 0
push 0
push 3
push 1
push 5
push str._v__newinstance
xor edx, edx
mov ecx, edi
call fcn.00413680
push 0
sar eax, 0x1f
push 0
and eax, 4
push eax
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov edi, edi
call sym.SystemInformer.exe_PhCreateSaveFileDialog
mov ecx, dword [0x635414]
mov ebx, eax
push 3
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x40], 0x20
mov dword [ebp - 0x3c], 0x5caa10
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
push 0x62f468
push ebx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x10], 8
mov dword [ebp - 0xc], str..txt
call sym.SystemInformer.exe_PhSetFileDialogFilter
push 0x3c
push 3
lea eax, [ebp - 0x50]
push eax
call sym.SystemInformer.exe_PhFormat
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push ebx
call sym.SystemInformer.exe_PhSetFileDialogFileName
push ebx
push edi
call sym.SystemInformer.exe_PhShowFileDialog
lea esp, [esp]
test al, al
je 0x44374d
push ebx
call sym.SystemInformer.exe_PhGetFileDialogFileName
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push ebx
mov esi, eax
call sym.SystemInformer.exe_PhGetFileDialogFilterIndex
push 0
push 5
push 1
push 0x120116
push dword [esi + 4]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x54]
push eax
call sym.SystemInformer.exe_PhCreateFileStream
test eax, eax
js 0x44373c
mov edi, dword [ebp - 0x54]
push 2
push 0x618fb0
push edi
call sym.SystemInformer.exe_PhWriteStringAsUtf8FileStreamEx
push edi
call sym.SystemInformer.exe__PhWritePhTextHeader_4
xor ecx, ecx
mov dword [ebp - 0x60], edi
mov eax, 2
cmp dword [ebp - 0x6c], eax
push ecx
cmovne eax, ecx
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [0x635414]
push 7
push eax
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5a38f4]
call esi
push edi
call sym.SystemInformer.exe_PhDereferenceObject
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push 0
push eax
push str.Unable_to_create_the_file
push edi
lfence
call sym.SystemInformer.exe_PhShowStatus
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
cmp dword [0x6351d8], 0
jne 0x4437ce
push 0
push 0x426560
push 0x6351d8
call sym.SystemInformer.exe_PhCreateThreadEx
test eax, eax
jns 0x4437b9
push str.Unable_to_create_the_window.
push 0x5cd56c
push 0x10
push dword [sym.SystemInformer.exe_PhMainWndHandle]
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
test byte [0x62f360], 1
jne 0x4437ce
xor edx, edx
mov ecx, 0x62f360
call sym.SystemInformer.exe_PhfWaitForEvent
push 0
push 0
push 0x8321
push dword [0x6351e8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call fcn.004753e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lfence
call fcn.00446400
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push 0
call sym.SystemInformer.exe__PhShowSystemInformationDialog_4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lfence
call fcn.00449760
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lfence
call fcn.00449c20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6355e0]
test eax, eax
jne 0x443896
push eax
push 0x464ca0
push 0x635d9c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x6355e0], eax
jmp 0x4438cb
push eax
push 0x635d9c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x6355e0], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x635dac]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x635d9c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x2c
cmp dword [0x6355e0], eax
mov dword [ebp - 0x5c], str.HideOtherUserProcesses
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword [0x635624]
test eax, eax
jne 0x443963
cmp byte [0x63796a], al
jne 0x44394b
push str.Enable_it_in_Options___General_and_restart_System_Informer.
push str.This_filter_cannot_function_because_digital_signature_checking_is_not_enabled._r_n_s
push eax
push 0xfffd
push 0x20
push dword [sym.SystemInformer.exe_PhMainWndHandle]
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push 0
push 0x464d80
push 0x635d9c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x635624], eax
jmp 0x443994
push eax
push 0x635d9c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x635624], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x635dac]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x635d9c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x26
cmp dword [0x635624], eax
mov dword [ebp - 0x5c], str.HideSignedProcesses
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword [0x635604]
test eax, eax
jne 0x4439f6
push eax
push 0x464da0
push 0x635d9c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x635604], eax
jmp 0x443a2b
push eax
push 0x635d9c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x635604], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x635dac]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x635d9c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x2c
cmp dword [0x635604], eax
mov dword [ebp - 0x5c], str.HideMicrosoftProcesses
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x60], 0x28
cmp dword [0x637978], eax
mov dword [ebp - 0x5c], str.ScrollToNewProcesses
sete al
push eax
mov dword [0x637978], eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x60], 0x1e
cmp dword [0x63796c], eax
mov dword [ebp - 0x5c], str.ShowCpuBelow001
sete al
push eax
mov dword [0x63796c], eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
call sym.SystemInformer.exe__PhInvalidateAllProcessNodes_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6356bc]
test eax, eax
jne 0x443afc
push eax
push 0x4681a0
push 0x636264
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
jmp 0x443b09
push eax
push 0x636264
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
push 0x636264
mov dword [0x6356bc], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x24
cmp dword [0x6356bc], eax
mov dword [ebp - 0x5c], str.HideDriverServices
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword [0x635658]
test eax, eax
je 0x443b69
push eax
push 0x636264
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x443b7a
push 0
push 0x4681c0
push 0x636264
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
push 0x636264
mov dword [0x635658], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x26
cmp dword [0x635658], eax
mov dword [ebp - 0x5c], str.HideDefaultServices
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword [0x63557c]
test eax, eax
je 0x443bd5
push eax
push 0x6356f8
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x443be6
push 0
push 0x463c20
push 0x6356f8
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
push 0x6356f8
mov dword [0x63557c], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x2c
cmp dword [0x63557c], eax
mov dword [ebp - 0x5c], str.HideWaitingConnections
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
cmp byte [0x6351ba], 0
push 0x13
push 0
sete al
push 0
mov byte [0x6351ba], al
push 0
movzx eax, al
push 0
sub eax, 2
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
movzx eax, byte [0x6351ba]
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x2a
push eax
mov dword [ebp - 0x5c], str.MainWindowAlwaysOnTop
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov al, byte [0x6351ba]
xor edi, edi
mov byte [ebp - 0x6d], al
mov ecx, 0x636ba8
lock bts dword [ecx], 0
setb al
test al, al
je 0x443c8f
call sym.SystemInformer.exe_PhfAcquireQueuedLockExclusive
mov ebx, dword [0x636bec]
mov ecx, dword [ebx + 0x24]
cmp edi, ecx
jae 0x443cc4
mov edx, dword [ebx]
add edx, 8
mov eax, edx
imul eax, edi
add eax, dword [ebx + 0x18]
lea esp, [esp]
mov esi, eax
inc edi
add eax, edx
cmp dword [esi], 0xffffffff
jne 0x443d09
mov edi, edi
cmp edi, ecx
jb 0x443cb0
or edi, 0xffffffff
mov ecx, 0x636ba8
lock xadd dword [ecx], edi
mov eax, edi
and al, 6
cmp al, 2
jne case.0x443492.40011
dec edi
mov eax, edi
lea edx, [edi + 4]
mov esi, edx
lock cmpxchg dword [ecx], esi
cmp eax, edi
jne case.0x443492.40011
call fcn.00521b80
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
test byte [esi + 0xc], 1
je 0x443c95
mov esi, dword [esi + 8]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0x13
push 0
xor eax, eax
cmp byte [ebp - 0x6d], al
push 0
push 0
setne al
push 0
add eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x443c8f
lea eax, ds:[esi + esi*4]
mov esi, 0x62066
add eax, eax
sub esi, eax
lea eax, [ebp - 0x60]
push esi
lfence
push eax
mov dword [ebp - 0x60], 0x22
mov dword [ebp - 0x5c], str.MainWindowOpacity
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov edx, esi
mov ecx, edi
call fcn.00413180
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push 0
push 0x637fe0
call sym.SystemInformer.exe_PhBoostProvider
push 0
push 0x637fc0
call sym.SystemInformer.exe_PhBoostProvider
cmp byte [0x637fb8], 0
mov edi, edi
je case.0x443492.40011
push 0
push 0x637fa0
call sym.SystemInformer.exe_PhBoostProvider
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
add esi, 0xffff6325
cmp esi, 4
ja case.default.0x443dce
jmp dword [esi*4 + 0x445d24]
mov esi, 0x1f4
jmp 0x443dfb
mov esi, 0x3e8
jmp 0x443dfb
mov esi, 0x7d0
jmp 0x443dfb
mov esi, 0x1388
jmp 0x443dfb
mov esi, 0x2710
jmp 0x443dfb
mov esi, dword [ebp - 0x54]
push esi
lea eax, [ebp - 0x60]
mov dword [0x637974], esi
push eax
mov dword [ebp - 0x60], 0x1c
mov dword [ebp - 0x5c], str.UpdateInterval
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov ecx, dword [0x638004]
mov edi, 0x2710
mov dword [0x638008], esi
test ecx, ecx
je 0x443e53
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [ebp - 0x60], eax
adc edx, 0
push 0
lea eax, [ebp - 0x60]
neg edx
push eax
push ecx
mov dword [ebp - 0x5c], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ecx, dword [0x638024]
mov dword [0x638028], esi
nop
test ecx, ecx
je 0x443e89
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [ebp - 0x60], eax
adc edx, 0
push 0
lea eax, [ebp - 0x60]
neg edx
push eax
push ecx
mov dword [ebp - 0x5c], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ecx, dword [0x638044]
mov dword [0x638048], esi
test ecx, ecx
je case.0x443492.40011
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [ebp - 0x60], eax
adc edx, 0
push 0
lea eax, [ebp - 0x60]
neg edx
push eax
push ecx
mov dword [ebp - 0x5c], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
cmp byte [0x62e94c], 0
push ecx
sete al
mov ecx, 9
movzx edx, al
mov byte [0x62e94c], al
call fcn.0044ac80
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call fcn.004e6000
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov esi, dword [0x634f14]
xor eax, eax
cmp dword [0x6379a0], eax
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0xa8
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443492.40011
push 0
push 0x4c3540
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6351ec]
test eax, eax
jne 0x443fb6
mov esi, dword [0x634f14]
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x87
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x443f9e
xor eax, eax
jmp 0x443fb1
push 0
push 0x4290e0
push 0
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [0x6351ec], eax
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
lea ecx, [ecx]
test eax, eax
jne 0x443fe3
push 5
push dword [0x6351ec]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push dword [0x6351ec]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe_PhCreateOpenFileDialog
push 2
mov ebx, eax
push 0x62f484
push ebx
call sym.SystemInformer.exe_PhSetFileDialogFilter
cmp byte ds:[ebx], 0
mov edx, dword [ebx + 4]
je 0x4440c4
mov ecx, dword [edx]
lea eax, [ebp - 0x6c]
push eax
push edx
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0x5a38f4]
call esi
lea ebx, [ebx]
test eax, eax
js 0x4440df
mov edx, dword [ebp - 0x6c]
xor eax, eax
test edx, edx
je 0x444090
jmp 0x444060
test dword [eax + 0x5d4248], 0x600
mov ecx, dword [eax + 0x5d424c]
je 0x444076
or edx, ecx
jmp 0x44407a
not ecx
and edx, ecx
add eax, 8
cmp eax, 0x58
jb 0x444060
jmp 0x4440aa
test dword [eax + 0x5d4248], 0x600
je 0x4440a2
or edx, dword [eax + 0x5d424c]
add eax, 8
cmp eax, 0x58
jb 0x444090
mov eax, dword [ebx + 4]
mov dword [ebp - 0x6c], edx
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x5a38f4]
nop
call esi
jmp 0x4440df
mov eax, dword [edx + 0x34]
test eax, eax
je 0x4440d7
and eax, 0xefefc7fd
or eax, 0x2000100
jmp 0x4440dc
mov eax, 0x2000100
mov dword [edx + 0x34], eax
push ebx
push edi
call sym.SystemInformer.exe_PhShowFileDialog
test al, al
je 0x44410c
push str.Make_sure_the_PE_Viewer_executable_file_is_present.
push 0
push ebx
call sym.SystemInformer.exe_PhGetFileDialogFileName
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push str.ProgramInspectExecutables
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword [0x634580]
test eax, eax
jne 0x44418b
cmp dword [0x6379a0], eax
mov esi, dword [0x634f14]
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x8a
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x44415a
xor eax, eax
jmp 0x44416c
push 0
push 0x47c840
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x634580], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x634580]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x634580]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4441b7
push 9
push dword [0x634580]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push dword [0x634580]
lea ecx, [ecx]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call fcn.00438c80
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lea eax, ds:[ebp - 0x60]
mov dword [ebp - 0x78], 0x18
push eax
mov dword [ebp - 0x74], str._taskmgr.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [ebp - 0x78]
push eax
push 0x631bac
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov esi, eax
mov dword [ebp - 0x60], 0x24
lea eax, [ebp - 0x60]
mov dword [ebp - 0x5c], str.TaskmgrWindowState
push eax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
neg eax
sbb ebx, ebx
and ebx, 0x602078
call fcn.00476700
test al, al
jne 0x44429b
lea eax, ds:[ebp - 0x60]
mov dword [ebp - 0x60], 0x44
push eax
mov dword [ebp - 0x5c], str.EnableShellExecuteSkipIfeoDebugger
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x44429b
test esi, esi
je 0x444276
mov eax, dword [esi + 4]
jmp 0x444278
xor eax, eax
push 0
push 0
push 0
push 5
push 0
push ebx
push eax
push edi
call sym.SystemInformer.exe_PhShellExecuteEx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
cmp dword [0x62ebb0], 0x3e
jb 0x444316
lea eax, [ebp - 0x68]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x444316
push 0
push 0
push edi
call sym.SystemInformer.exe__PhUiConnectToPhSvcEx_12
test al, al
je case.0x443492.40011
test esi, esi
je 0x4442f6
mov ecx, dword [esi + 4]
mov edx, ebx
call fcn.0047e9e0
nop
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, ebx
call fcn.0047e9e0
nop
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x444339
mov ecx, dword [esi + 4]
mov edx, ebx
call fcn.00413c00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, ebx
call fcn.00413c00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
mov dword [ebp - 0x80], 0x18
push eax
mov dword [ebp - 0x7c], str.perfmon.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [ebp - 0x80]
push eax
push 0x631bac
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov esi, eax
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 0x60]
mov dword [ebp - 0x5c], str.EnableShellExecuteSkipIfeoDebugger
push eax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
mov edi, edi
test eax, eax
je 0x4443da
test esi, esi
je 0x4443b1
mov eax, dword [esi + 4]
jmp 0x4443b3
xor eax, eax
push 0
push 0
push 0
push 5
push 0
push str.__res
push eax
push edi
call sym.SystemInformer.exe_PhShellExecuteEx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lea eax, ds:[ebp - 0x68]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x44445b
push 0
push 0
push edi
call sym.SystemInformer.exe__PhUiConnectToPhSvcEx_12
lea esp, [esp]
test al, al
je case.0x443492.40011
test esi, esi
je 0x444436
mov ecx, dword [esi + 4]
mov edx, str.__res
call fcn.0047e9e0
lea ecx, [ecx]
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, str.__res
call fcn.0047e9e0
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
jmp 0x444460
test esi, esi
je 0x444489
mov ecx, dword [esi + 4]
mov edx, str.__res
call fcn.00413c00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, str.__res
call fcn.00413c00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
mov dword [ebp - 0x88], 0x10
push eax
mov dword [ebp - 0x84], str.wsl.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [ebp - 0x88]
push eax
push 0x631bac
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
test eax, eax
je 0x4444ee
mov eax, dword [eax + 4]
jmp 0x4444f0
xor eax, eax
push 0
push 0
push 0
push 5
push 0
push str.___shutdown
push eax
push edi
call sym.SystemInformer.exe_PhShellExecuteEx
test eax, eax
jns case.0x443492.40011
push 0
push eax
push str.Unable_to_shutdown_WSL_instances.
push edi
lfence
call sym.SystemInformer.exe_PhShowStatus
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push ecx
push 0
push 0x443340
push str.SCManager
mov edx, str.Service_Control_Manager
xor ecx, ecx
call fcn.005356e0
push eax
push 0x535600
call sym.SystemInformer.exe_PhCreateThread2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push ecx
push 0
push 0x443390
push str.PowerDefault
mov edx, str.Current_Power_Scheme
jmp 0x444548
push 0
push 0
push 0
push ecx
push 0
push 0x443390
push str.RdpDefault
mov edx, str.Terminal_Server_Listener
jmp 0x444548
push 0
push 0
push 0
push ecx
push 0
push 0x443390
push str.WmiDefault
mov edx, str.WMI_Root_Namespace
jmp 0x444548
push 0
push 0
push 0
push ecx
push 0x4433e0
push 0x4433a0
push str.Desktop
mov edx, str.Current_Window_Desktop
jmp 0x444548
push 0
push 0
push 0
push ecx
push 0x443440
push 0x443400
push str.WindowStation
mov edx, str.Current_Window_Station
jmp 0x444548
push dword [0x62f464]
push edi
call sym.SystemInformer.exe__PhUiConnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push dword [0x62f464]
push edi
call sym.SystemInformer.exe__PhUiDisconnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push dword [0x62f464]
push edi
call sym.SystemInformer.exe__PhUiLogoffSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x62f464]
lea eax, [ebp - 0x54]
push 0
push 4
push eax
push 0x18
push 0xffffffffffffffff
or esi, 0xffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
cmovns esi, dword [ebp - 0x54]
cmp ebx, esi
jne 0x4446af
push str.You_cannot_remote_control_the_current_session.
push 0x5cd56c
push str.Unable_to_shadow_session.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov esi, dword [0x634f14]
lea eax, [ebp - 0x6c]
push eax
push 0
push 5
push 0xc1
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443492.40011
push ebx
push 0x4c0a80
push edi
push dword [ebp - 0x6c]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov esi, dword [0x634f14]
lea eax, [ebp - 0x54]
mov ebx, dword [0x62f464]
push eax
push 0
push 5
push 0x98
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443492.40011
push ebx
push 0x4c9c80
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov esi, dword [0x634f14]
xor eax, eax
cmp dword [0x6379a0], eax
mov ebx, dword [0x62f464]
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x99
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443492.40011
push ebx
push 0x4c0460
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6344cc]
lea esp, [esp]
test eax, eax
jne 0x444804
mov esi, dword [0x634f14]
lea eax, ds:[ebp - 0x54]
push eax
push 0
push 5
push 0xb2
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x4447d0
xor eax, eax
jmp 0x4447e6
push 0
push 0x43df60
push 0
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x6344cc], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x6344cc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x6344cc]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x444837
push 9
push dword [0x6344cc]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push dword [0x6344cc]
lea ecx, [ecx]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call fcn.0041adc0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6350fc]
test eax, eax
jne 0x4448d8
cmp dword [0x6379a0], eax
mov esi, dword [0x634f14]
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x79
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x4448a5
xor eax, eax
jmp 0x4448b7
push 0
push section..text
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x6350fc], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x6350fc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x6350fc]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
nop
test eax, eax
je 0x444909
push 9
push dword [0x6350fc]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push dword [0x6350fc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword ds:[ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x444954
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x444948
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiTerminateProcesses_12
lea esp, [esp]
test al, al
je 0x44497d
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x635dac]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test ebx, ebx
je 0x4449ad
or esi, 0xffffffff
jmp 0x444990
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4449a8
call fcn.004fc020
inc edi
cmp edi, ebx
jb 0x444990
push dword [ebp - 0x6c]
push 0
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiTerminateTreeProcess_8
test al, al
je 0x444a06
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x635dac]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x444a4c
lea ebx, [ebx]
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x444a40
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiSuspendProcesses_12
xor edi, edi
test ebx, ebx
je 0x4449ad
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x444a79
call fcn.004fc020
inc edi
cmp edi, ebx
jb 0x444a61
mov edi, edi
jmp 0x4449ad
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSuspendTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lea eax, ds:[ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x444ae4
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x444ad5
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiResumeProcesses_12
xor edi, edi
test ebx, ebx
je 0x4449ad
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x444b18
call fcn.004fc020
inc edi
cmp edi, ebx
jb 0x444b00
lea ecx, [ecx]
jmp 0x4449ad
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiResumeTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiFreezeTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword ds:[esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiThawTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lea esp, [esp]
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword ds:[esi - 4]
mov edx, dword fs:[0x18]
mov ecx, dword [esi + 0x10]
cmp ecx, dword [edx + 0x20]
jne 0x444c1e
push 0
push 0
push 3
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
push 0
push 0
push 3
push 0
push 5
push 0
xor edx, edx
mov ecx, edi
call fcn.00413680
push 0
sar eax, 0x1f
push 0
and eax, 4
push eax
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
jmp 0x444a06
push esi
push edi
call sym.SystemInformer.exe__PhUiRestartProcess_8
jmp 0x4449e9
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x443492.40011
lock inc dword [ebx - 4]
cmp dword [ebx + 0x10], 4
jne 0x444cd1
cmp esi, 0x9c53
jne 0x444c8c
mov esi, dword [0x634f14]
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0xfe
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je 0x444d69
push 0
push 0x4389c0
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push ebx
jmp 0x444a07
mov byte [ebp - 0x6d], 0x11
sub esi, 0x9c42
je 0x444cbd
lea esp, [esp]
sub esi, 3
jne 0x444cc1
lea edx, [ebp - 0x6d]
mov byte [ebp - 0x6d], 0x35
mov ecx, edi
call fcn.00438920
push ebx
jmp 0x444a07
mov byte [ebp - 0x6d], 0x19
lea edx, [ebp - 0x6d]
mov ecx, edi
call fcn.00438920
push ebx
jmp 0x444a07
cmp esi, 0x9c53
jne 0x444d15
mov esi, dword [0x634f14]
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x100
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je 0x444d69
push ebx
push 0x44dba0
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push ebx
jmp 0x444a07
add esi, 0xffff63be
cmp esi, 3
ja case.0x444d29.40003
jmp dword [esi*4 + 0x445d38]
mov eax, 0x21021
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044cc80
push ebx
jmp 0x444a07
mov eax, 0x6fab67
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044cc80
push ebx
jmp 0x444a07
mov eax, 0x421826
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044cc80
push ebx
jmp 0x444a07
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDebugProcess_8
jmp 0x444a06
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword [esi - 4]
cmp byte [0x637f60], 0
sete cl
movzx ecx, cl
push ecx
push esi
push edi
call sym.SystemInformer.exe__PhUiSetVirtualizationProcess_12
jmp 0x444a06
jmp 0x444dc0
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword [esi - 4]
push 0
mov edx, esi
mov ecx, edi
call fcn.0040df20
mov edi, edi
jmp 0x444a06
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetCriticalProcess_8
nop
jmp 0x444a06
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDetachFromDebuggerProcess_8
nop
jmp 0x444a06
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x443492.40011
lea esi, [ebx - 4]
lock inc dword [esi]
push 0x58
push 4
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x58
push 0
push eax
mov dword [ebp - 0x6c], eax
call fcn.00582250
add esp, 0xc
lock inc dword [esi]
mov eax, dword [ebp - 0x6c]
push dword [0x634f10]
push 0xc
mov dword [eax + 8], ebx
call sym.SystemInformer.exe_PhCreateObject
push 0x50
mov esi, eax
push 4
push dword [0x635044]
mov dword [esi], 0
mov dword [esi + 4], 0x14
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [eax + 0xc], esi
mov esi, dword [0x634f14]
mov dword [eax + 4], edi
xor eax, eax
cmp dword [0x6379a0], eax
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0xaf
push esi
call sym.SystemInformer.exe_PhLoadResource
nop
test al, al
jne 0x444ecf
xor esi, esi
jmp 0x444ee8
mov eax, dword ds:[ebp - 0x6c]
push eax
push 0x426de0
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
jmp 0x444a07
mov edi, edi
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword [esi - 4]
mov edx, esi
call fcn.00427720
jmp 0x444a06
nop
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x443492.40011
add esi, 0xffff62d1
cmp esi, 4
ja case.default.0x444f40
mov edi, edi
jmp dword [esi*4 + 0x445d48]
mov eax, 1
jmp 0x444f7c
mov eax, 2
jmp 0x444f7c
mov eax, 3
jmp 0x444f7c
mov eax, 4
jmp 0x444f7c
mov eax, 5
jmp 0x444f7c
mov eax, dword [ebp - 0x54]
lock inc dword [ebx - 4]
push eax
push ebx
push edi
call sym.SystemInformer.exe__PhUiSetPagePriorityProcess_12
push ebx
jmp 0x444a07
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x444fbe
jmp 0x444fb0
mov eax, dword [edx + ecx*4]
sub eax, 4
lock inc dword [eax]
inc ecx
cmp ecx, ebx
jb 0x444fb0
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiReduceWorkingSetProcesses_12
xor edi, edi
test ebx, ebx
je 0x4449ad
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x444fef
call fcn.004fc020
inc edi
cmp edi, ebx
jb 0x444fd3
jmp 0x4449ad
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov edi, edi
test eax, eax
je case.0x443492.40011
mov eax, dword [eax + 0x34]
test eax, eax
je case.0x443492.40011
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x18
push eax
mov dword [ebp - 0x5c], str.RunAsProgram
call sym.SystemInformer.exe_PhSetStringRefSetting
xor edx, edx
mov ecx, edi
call fcn.004b81a0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x443492.40011
mov edx, dword ds:[eax + 0x10]
mov ecx, edi
call fcn.004b81a0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword [esi - 4]
mov edx, esi
mov ecx, edi
call fcn.0043a0c0
jmp 0x444a06
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x4450c4
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4450b7
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiFlushHeapProcesses_12
xor edi, edi
test ebx, ebx
je 0x4449ad
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4450fc
call fcn.004fc020
inc edi
cmp edi, ebx
jb 0x4450e0
jmp 0x4449ad
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
lfence
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x44513c
lea esp, [esp]
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445130
push ebx
mov ecx, esi
call fcn.00464e40
xor edi, edi
test ebx, ebx
je 0x4449ad
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44516e
call fcn.004fc020
inc edi
cmp edi, ebx
jb 0x445152
jmp 0x4449ad
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
lfence
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x4451a4
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445198
push ebx
mov ecx, esi
call fcn.00464ee0
xor edi, edi
test ebx, ebx
je 0x4449ad
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4451dc
call fcn.004fc020
inc edi
cmp edi, ebx
jb 0x4451c0
jmp 0x4449ad
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword ds:[esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetEcoModeProcess_8
jmp 0x444a06
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40055
lock inc dword ds:[esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetExecutionRequiredProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push dword [0x637f5c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x443492.40011
xor eax, eax
mov dword [ebp - 0x34], 0x2c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x34]
push eax
push dword [0x637f5c]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword ds:[ebp - 0x2c], 6
je 0x4452b7
push dword [0x637f5c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push dword [0x637f5c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x443492.40011
push 9
push dword [0x637f5c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push dword [0x637f5c]
lea ecx, [ecx]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x443492.40011
push 6
push dword [0x637f5c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push dword [0x637f5c]
call dword [sym.imp.USER32.dll_IsWindow]
lea esp, [esp]
test eax, eax
je case.0x443492.40011
push 3
push dword [0x637f5c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push dword [0x637f5c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x443492.40011
push 0
push 0
push 0x10
push dword [0x637f5c]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
mov eax, dword [esi + 0x38]
test eax, eax
je case.0x443492.40011
cmp dword ds:[eax], 0
je case.0x443492.40011
push eax
call sym.SystemInformer.exe_PhDoesFileExist
test al, al
je case.0x443492.40011
lock inc dword [esi - 4]
mov eax, dword [esi + 0x34]
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [eax + 4]
push str.FileBrowseExecutable
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
jmp 0x444a06
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
lea ebx, [ebx]
test eax, eax
je case.0x443492.40011
mov eax, dword [eax + 0x18]
push dword [eax + 4]
push edi
call sym.SystemInformer.exe__PhSearchOnlineString_8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x443492.40011
push eax
call fcn.00464c40
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push 0
push dword [0x635dac]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x635dac]
call sym.SystemInformer.exe_PhSetClipboardString
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne case.0x443492.40011
call fcn.004fc020
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x443492.40011
push dword [eax + 0x2c]
call sym.SystemInformer.exe__PhFindProcessNode_4
mov esi, eax
test esi, esi
je 0x4454ca
mov ecx, dword [0x637f58]
mov ecx, dword [ecx + 0x14]
call fcn.0044ac30
push dword [0x637f54]
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, 1
mov dword [ebp - 0x54], esi
lea ecx, [ebp - 0x54]
call fcn.0049f4e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push 0
push 0xc000000b
push str.The_process_does_not_exist.
push edi
call sym.SystemInformer.exe_PhShowStatus
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x44551c
lea ebx, [ebx]
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445510
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiStartServices_12
xor edi, edi
test ebx, ebx
je 0x4449ad
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44554e
call fcn.004fc020
inc edi
cmp edi, ebx
jb 0x445532
jmp 0x4449ad
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445584
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445575
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiContinueServices_12
xor edi, edi
test ebx, ebx
je 0x4449ad
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4455bc
call fcn.004fc020
inc edi
cmp edi, ebx
jb 0x4455a0
jmp 0x4449ad
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword ds:[ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x4455f4
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4455e8
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiPauseServices_12
xor edi, edi
test ebx, ebx
je 0x4449ad
or esi, 0xffffffff
jmp 0x445610
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44562c
call fcn.004fc020
inc edi
cmp edi, ebx
jb 0x445610
jmp 0x4449ad
lea eax, ds:[ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445664
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445655
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiStopServices_12
xor edi, edi
test ebx, ebx
je 0x4449ad
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44569c
call fcn.004fc020
inc edi
cmp edi, ebx
jb 0x445680
jmp 0x4449ad
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lock inc dword ds:[esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDeleteService_8
test al, al
je 0x444a06
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x636274]
jmp 0x444a00
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x443492.40011
push dword ds:[eax + 8]
lea eax, [ebp - 0x54]
push 0x20019
push eax
call sym.SystemInformer.exe_PhOpenServiceKey
test eax, eax
js 0x4457d7
mov edx, dword [ebp - 0x54]
test edx, edx
je 0x4457a9
jmp 0x445720
cmp edx, 0xffffffff
je 0x4457a9
cmp edx, 0xfffffffe
je 0x4457a9
lea eax, ds:[ebp - 0x6c]
or esi, 0xffffffff
push eax
push 0
mov ecx, esi
call fcn.0052c2c0
test eax, eax
js 0x4457a9
mov ebx, dword [ebp - 0x6c]
push ebx
call sym.SystemInformer.exe_PhFormatNativeKeyName
mov dword ds:[ebp - 0x6c], eax
test ebx, ebx
je 0x44577f
lea ecx, [ebx - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x44577f
call fcn.004fc020
mov eax, dword [ebp - 0x6c]
push eax
push edi
call sym.SystemInformer.exe__PhShellOpenKey2_8
push dword [ebp - 0x6c]
call sym.SystemInformer.exe_PhDereferenceObject
push dword [ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push 0
push 0xc0000034
push str.The_service_does_not_exist.
push edi
call sym.SystemInformer.exe_PhShowStatus
push dword ds:[ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push 0
push 0xc0000034
push str.The_service_does_not_exist.
push edi
call sym.SystemInformer.exe_PhShowStatus
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
mov eax, dword [esi + 8]
test eax, eax
je 0x44581c
mov eax, dword [eax + 4]
jmp 0x44581e
xor eax, eax
push eax
push 1
lea eax, [ebp - 0x54]
push eax
call sym.SystemInformer.exe_PhOpenService
test eax, eax
js case.0x443492.40011
mov ebx, dword [ebp - 0x54]
mov ecx, ebx
mov edx, dword [esi + 8]
call fcn.005238e0
mov esi, eax
test esi, esi
je 0x445865
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [esi + 4]
push str.FileBrowseExecutable
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
lea ecx, [ecx]
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x443492.40011
lea ecx, ds:[esi - 4]
lock inc dword [ecx]
lock inc dword [ecx]
push esi
push 0x4c6ee0
call sym.SystemInformer.exe_PhCreateThread2
jmp 0x444a06
push 0
push dword [0x636274]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x636274]
jmp 0x445443
call fcn.0046bb20
test eax, eax
je case.0x443492.40011
push dword [eax + 0x38]
jmp 0x445480
call fcn.0046bb20
nop
test eax, eax
je case.0x443492.40011
mov eax, dword [eax + 0x48]
test eax, eax
je case.0x443492.40011
push dword [eax + 4]
call sym.SystemInformer.exe__PhReferenceServiceItem_4
mov esi, eax
test esi, esi
je case.0x443492.40011
mov ecx, dword [0x637f38]
mov ecx, dword [ecx + 0x14]
call fcn.0044ac30
push dword [0x637f34]
lea esp, [esp]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
push 0
push 0xb
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
jmp 0x444a06
lea edx, ds:[ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.0046bb60
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445964
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445955
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiCloseConnections_12
test al, al
je 0x445989
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x6356cc]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test ebx, ebx
je 0x4449ad
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4459b2
call fcn.004fc020
inc edi
cmp edi, ebx
jb 0x445996
jmp 0x4449ad
push 0
push dword [0x6356cc]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x6356cc]
jmp 0x445443
push 0
push 0
push 0x130b
push dword [0x635434]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x635438]
xor esi, esi
mov edx, dword [ecx]
lea ecx, [eax + 1]
dec edx
cmp eax, edx
cmove ecx, esi
jmp 0x445a32
push 0
push 0
push 0x130b
push dword [0x635434]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ebx, [ebx]
test eax, eax
jne 0x445a2f
mov eax, dword [0x635438]
mov eax, dword [eax]
dec eax
mov ecx, eax
call fcn.0044ac30
mov ecx, dword ds:[ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005802ef
mov esp, ebp
pop ebp
ret