Function at 0x404ab0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xec
push ebx
push esi
push edi
push str.EnableWarnings
call sym.ProcessHacker.exe_PhGetIntegerSetting
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x404b2f
mov eax, dword [edi + 0x10]
dec eax
cmp eax, 4
ja case.default.0x404b3c
jmp dword [eax*4 + 0x404eb0]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
mov ecx, str.unload
mov eax, str.Unloading_a_module_may_cause_the_process_to_crash.
jb 0x404b17
mov eax, str.Unloading_a_module_may_cause_the_process_to_crash._NOTE:_This_feature_may_not_work_correctly_on_your_version_of_Windows_and_some_programs_may_restrict_access_or_ban_your_account.
jmp 0x404b17
mov ecx, str.unload
mov eax, str.Unloading_a_driver_may_cause_system_instability.
jmp 0x404b17
mov ecx, str.unmap
mov eax, str.Unmapping_a_section_view_may_cause_the_process_to_crash.
push 1
push eax
mov eax, dword [edi + 0x18]
push dword [eax + 4]
push ecx
push ebx
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
je case.default.0x404b3c
mov eax, dword [edi + 0x10]
dec eax
cmp eax, 4
ja case.default.0x404b3c
jmp dword [eax*4 + 0x404ec4]
mov edx, dword [sym.ProcessHacker.exe_ProcessQueryAccess]
lea ecx, [esp + 0x18]
push dword [ebp + 0xc]
or edx, 0x3a
call fcn.004ad010
mov esi, eax
test esi, esi
js 0x404c4a
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
mov esi, dword [edi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], 0xfd050f80
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
jae 0x404bc4
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0xc0000135
push ecx
mov edx, 0x4af6c0
mov dword [esp + 0x30], esi
mov ecx, eax
mov dword [esp + 0x34], 1
call fcn.004af340
mov esi, dword [esp + 0x24]
test eax, eax
cmovs esi, eax
test esi, esi
js 0x404c40
mov esi, dword [esp + 0x20]
mov ecx, 0x522ce8
call fcn.004a2030
test eax, eax
je 0x404be0
push 0
mov edx, 0x5333b8
mov ecx, eax
call fcn.004a20e0
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push eax
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x40]
call dword [sym.imp.ntdll.dll_RtlCreateUserThread]
mov esi, eax
test esi, esi
js 0x404c40
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov esi, eax
test esi, esi
jne 0x404c36
push eax
push 0x1c
lea eax, [esp + 0x44]
push eax
push esi
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov esi, eax
test esi, esi
cmovns esi, dword [esp + 0x3c]
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtClose]
cmp esi, 0xc0000135
jne 0x404c6d
push str.Unable_to_find_the_module_to_unload.
push 0x10
push ebx
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test esi, esi
jns 0x404e7d
mov eax, dword [edi + 0x18]
push dword [eax + 4]
push str.Unable_to_unload
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push 0
push esi
push dword [eax + 4]
push ebx
call sym.ProcessHacker.exe_PhShowStatus
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x18]
push dword [eax + 4]
push dword [edi]
call sym.ProcessHacker.exe_PhUnloadDriver
mov esi, eax
test esi, esi
jns 0x404e7d
mov ecx, dword [edi + 0x18]
mov byte [esp + 0x12], 0
push dword [ecx + 4]
push str.Unable_to_unload
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea ecx, [esp + 0x13]
push ecx
push esi
mov edx, dword [eax + 4]
mov ecx, ebx
call fcn.00401580
test al, al
je 0x404e2b
cmp byte [esp + 0x13], 0
je 0x404d4a
mov eax, dword [edi + 0x18]
xor ebx, ebx
push 0xa0
push ebx
mov esi, dword [eax + 4]
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x28], esi
call fcn.004dce30
mov ecx, dword [0x54c160]
add esp, 0xc
test ecx, ecx
jne 0x404d57
mov esi, 0xc0000037
mov eax, dword [edi + 0x18]
push dword [eax + 4]
push str.Unable_to_unload
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push 0
push esi
push dword [eax + 4]
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShowStatus
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi]
mov dword [esp + 0x70], 3
mov dword [esp + 0x78], eax
test esi, esi
je 0x404dc5
push esi
call sym.ProcessHacker.exe_PhCountStringZ
mov ecx, dword [0x54c164]
add eax, eax
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x404e21
push eax
push 0
push ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
je 0x404e21
push dword [esp + 0x14]
mov esi, ebx
push dword [esp + 0x20]
sub esi, dword [0x54c164]
push ebx
call fcn.004dd620
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [0x54c160]
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], esi
lea eax, [esp + 0x58]
mov dword [esp + 0x58], 0xa00088
push eax
push eax
push ecx
mov dword [esp + 0x68], 0
call dword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov esi, dword [esp + 0x74]
test eax, eax
cmovs esi, eax
test ebx, ebx
je 0x404e02
mov eax, dword [0x54c164]
test eax, eax
je 0x404e02
push ebx
push 0
push eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
js 0x404d21
mov byte [esp + 0x12], 1
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, 0xc0000017
jmp 0x404d21
mov eax, dword [edi + 0x18]
push 0
push esi
push str.._Make_sure_Process_Hacker_is_running_with_administrative_privileges.
push dword [eax + 4]
push str.Unable_to_unload
push 3
call fcn.004013e0
add esp, 0x10
jmp 0x404e9a
push dword [ebp + 0xc]
mov edx, 8
lea ecx, [esp + 0x1c]
call fcn.004ad010
mov esi, eax
test esi, esi
js 0x404e88
push dword [edi]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x404e88
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0
push esi
push dword [edi]
push str.Unable_to_unmap_the_section_view_at_0x_Ix
call fcn.00401400
add esp, 8
mov eax, dword [eax + 4]
push eax
push ebx
call sym.ProcessHacker.exe_PhShowStatus
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc