Function at 0x441ac7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
lea eax, [esi - 0x9c41]
cmp eax, 0x137
ja case.0x441ac0.40101
movzx eax, byte [eax + 0x444378]
lea esp, [esp]
jmp dword [eax*4 + 0x4441e4]
lea eax, ds:[esp + 0x30]
mov dword [esp + 0x30], 0x16
push eax
mov dword [esp + 0x38], str.HideOnClose
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x441b14
call fcn.0046e300
test al, al
je case.0x441ac0.40101
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x1a
push eax
mov dword [esp + 0x38], str.CloseOnEscape
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je case.0x441ac0.40101
push 0
push 0
push 0
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov esi, dword [0x6336a4]
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0xfd
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x441ac0.40101
push 0
push 0x4baf00
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
xor edx, edx
call fcn.004b7c60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov esi, dword [0x6336a4]
xor eax, eax
cmp dword [0x636100], eax
cmovne edi, eax
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0x107
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x441ac0.40101
push edi
push 0x4bc680
push 0
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push 0
push 0
push 3
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
push 0
push 0
push 3
push 1
push 5
push str._v__newinstance
xor edx, edx
mov ecx, edi
call fcn.004118e0
push 0
sar eax, 0x1f
push 0
and eax, 4
push eax
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe_PhCreateSaveFileDialog
mov ecx, dword [0x633b84]
mov ebx, eax
push 3
mov dword [esp + 0x44], 1
mov dword [esp + 0x54], 0x20
mov dword [esp + 0x58], 0x5d04fc
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
push 0x62e454
push ebx
mov dword [esp + 0x64], 1
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], 1
mov dword [esp + 0x8c], 8
mov dword [esp + 0x90], str..txt
call sym.SystemInformer.exe_PhSetFileDialogFilter
push 0x3c
push 3
lea eax, [esp + 0x48]
push eax
call sym.SystemInformer.exe_PhFormat
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push ebx
call sym.SystemInformer.exe_PhSetFileDialogFileName
push ebx
push edi
call sym.SystemInformer.exe_PhShowFileDialog
test al, al
je 0x441db2
push ebx
call sym.SystemInformer.exe_PhGetFileDialogFileName
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push ebx
mov esi, eax
call sym.SystemInformer.exe_PhGetFileDialogFilterIndex
push 0
push 5
push 1
push 0x120116
push dword [esi + 4]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhCreateFileStream
test eax, eax
js 0x441da1
mov edi, dword ds:[esp + 0x2c]
push 2
push 0x618910
push edi
call sym.SystemInformer.exe_PhWriteStringAsUtf8FileStreamEx
push edi
call sym.SystemInformer.exe__PhWritePhTextHeader_4
xor ecx, ecx
mov dword [esp + 0x30], edi
mov eax, 2
cmp dword [esp + 0xc], eax
push ecx
cmovne eax, ecx
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
push eax
mov eax, dword [0x633b84]
push 7
push eax
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5a38e4]
call esi
push edi
call sym.SystemInformer.exe_PhDereferenceObject
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push 0
push eax
push str.Unable_to_create_the_file
push edi
lfence
call sym.SystemInformer.exe_PhShowStatus
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
cmp dword [0x633948], 0
jne 0x441e32
push 0
push 0x424880
push 0x633948
call sym.SystemInformer.exe_PhCreateThreadEx
test eax, eax
jns 0x441e1d
push str.Unable_to_create_the_window.
push 0x5cd020
push 0x10
push dword [sym.SystemInformer.exe_PhMainWndHandle]
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
test byte [0x62e34c], 1
jne 0x441e32
xor edx, edx
mov ecx, 0x62e34c
call sym.SystemInformer.exe_PhfWaitForEvent
push 0
push 0
push 0x8321
push dword [0x633958]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lea esp, [esp]
call fcn.00474d80
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lfence
call fcn.00444ba0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push 0
call sym.SystemInformer.exe__PhShowSystemInformationDialog_4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lfence
call fcn.00447ee0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lfence
call fcn.004483a0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov eax, dword [0x633d50]
nop
test eax, eax
jne 0x441f1b
push eax
push 0x463640
push 0x63450c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x633d50], eax
jmp 0x441f4c
push eax
push 0x63450c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x633d50], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x63451c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x63450c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [esp + 0x30], 0x2c
cmp dword [0x633d50], eax
mov dword [esp + 0x34], str.HideOtherUserProcesses
setne al
push eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov eax, dword [0x633d94]
test eax, eax
jne 0x441ff5
lea ebx, [ebx]
cmp byte [0x6360ca], al
jne 0x441fdd
push str.Enable_it_in_Options___General_and_restart_System_Informer.
push str.This_filter_cannot_function_because_digital_signature_checking_is_not_enabled._r_n_s
push eax
push 0xfffd
push 0x20
push dword [sym.SystemInformer.exe_PhMainWndHandle]
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push 0
push 0x463720
push 0x63450c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x633d94], eax
jmp 0x44202b
push eax
push 0x63450c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x633d94], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x63451c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x63450c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [esp + 0x30], 0x26
cmp dword [0x633d94], eax
mov dword [esp + 0x34], str.HideSignedProcesses
setne al
push eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov eax, dword [0x633d74]
test eax, eax
jne 0x442090
push eax
push 0x463740
push 0x63450c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x633d74], eax
jmp 0x4420c6
push eax
push 0x63450c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x633d74], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x63451c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x63450c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [esp + 0x30], 0x2c
cmp dword [0x633d74], eax
mov dword [esp + 0x34], str.HideMicrosoftProcesses
setne al
push eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esp + 0x30], 0x28
cmp dword [0x6360d8], eax
mov dword [esp + 0x34], str.ScrollToNewProcesses
sete al
push eax
mov dword [0x6360d8], eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esp + 0x30], 0x1e
cmp dword [0x6360cc], eax
mov dword [esp + 0x34], str.ShowCpuBelow001
sete al
push eax
mov dword [0x6360cc], eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
call sym.SystemInformer.exe__PhInvalidateAllProcessNodes_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov eax, dword [0x633e2c]
test eax, eax
jne 0x4421ab
push eax
push 0x466a20
push 0x6349d4
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
jmp 0x4421b8
push eax
push 0x6349d4
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
push 0x6349d4
mov dword [0x633e2c], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [esp + 0x30], 0x24
cmp dword [0x633e2c], eax
mov dword [esp + 0x34], str.HideDriverServices
setne al
push eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov eax, dword [0x633dc8]
test eax, eax
je 0x44221a
push eax
push 0x6349d4
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x44222b
push 0
push 0x466a40
push 0x6349d4
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
push 0x6349d4
mov dword [0x633dc8], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [esp + 0x30], 0x26
cmp dword [0x633dc8], eax
mov dword [esp + 0x34], str.HideDefaultServices
setne al
push eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov eax, dword [0x633cec]
nop
test eax, eax
je 0x442293
push eax
push 0x633e68
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x4422a5
push 0
push 0x4625e0
push 0x633e68
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
push 0x633e68
mov dword [0x633cec], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [esp + 0x30], 0x2c
cmp dword [0x633cec], eax
mov dword [esp + 0x34], str.HideWaitingConnections
setne al
push eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
cmp byte [0x63392e], 0
push 0x13
push 0
sete al
push 0
mov byte [0x63392e], al
push 0
movzx eax, al
push 0
sub eax, 2
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
movzx eax, byte [0x63392e]
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x2a
push eax
mov dword [esp + 0x3c], str.MainWindowAlwaysOnTop
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov al, byte [0x63392e]
xor edi, edi
mov byte [esp + 0x13], al
mov eax, 0x635318
lock bts dword [eax], 0
jae 0x442356
mov ecx, eax
call sym.SystemInformer.exe_PhfAcquireQueuedLockExclusive
mov ebx, dword [0x63535c]
lea esp, [esp]
mov ecx, dword [ebx + 0x24]
cmp edi, ecx
jae 0x442384
mov edx, dword [ebx]
mov eax, edi
add edx, 8
imul eax, edx
add eax, dword [ebx + 0x18]
mov esi, eax
inc edi
add eax, edx
cmp dword [esi], 0xffffffff
jne 0x4423ca
mov edi, edi
cmp edi, ecx
jb 0x442374
or edi, 0xffffffff
mov ecx, 0x635318
lock xadd dword [ecx], edi
mov eax, edi
and al, 6
cmp al, 2
jne case.0x441ac0.40101
dec edi
mov eax, edi
lea edx, [edi + 4]
mov esi, edx
lock cmpxchg dword [ecx], esi
cmp eax, edi
jne case.0x441ac0.40101
call fcn.005212a0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
test byte [esi + 0xc], 1
je 0x442360
mov esi, dword [esi + 8]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0x13
push 0
xor eax, eax
cmp byte [esp + 0x1b], al
push 0
push 0
setne al
push 0
add eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x442356
lea eax, [esi + esi*4]
mov esi, 0x62066
add eax, eax
sub esi, eax
lea eax, [esp + 0x30]
push esi
lfence
push eax
mov dword [esp + 0x38], 0x22
mov dword [esp + 0x3c], str.MainWindowOpacity
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov edx, esi
mov ecx, edi
call fcn.00411560
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push 0
push 0x636740
call sym.SystemInformer.exe_PhBoostProvider
push 0
push 0x636720
call sym.SystemInformer.exe_PhBoostProvider
cmp byte [0x636718], 0
je case.0x441ac0.40101
push 0
push 0x636700
call sym.SystemInformer.exe_PhBoostProvider
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
add esi, 0xffff6325
cmp esi, 4
ja case.default.0x4424a0
mov edi, edi
jmp dword [esi*4 + 0x4444b0]
mov esi, 0x1f4
jmp 0x4424ce
mov esi, 0x3e8
jmp 0x4424ce
mov esi, 0x7d0
jmp 0x4424ce
mov esi, 0x1388
jmp 0x4424ce
mov esi, 0x2710
jmp 0x4424ce
mov esi, dword [esp + 0x2c]
push esi
lea eax, [esp + 0x34]
mov dword [0x6360d4], esi
push eax
mov dword [esp + 0x38], 0x1c
mov dword [esp + 0x3c], str.UpdateInterval
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov ecx, dword [0x636764]
mov edi, 0x2710
mov dword [0x636768], esi
test ecx, ecx
je 0x44252c
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [esp + 0x40], eax
adc edx, 0
push 0
lea eax, [esp + 0x44]
neg edx
push eax
push ecx
mov dword [esp + 0x50], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ecx, dword [0x636784]
mov dword [0x636788], esi
test ecx, ecx
je 0x442566
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [esp + 0x40], eax
adc edx, 0
push 0
lea eax, [esp + 0x44]
neg edx
push eax
push ecx
mov dword [esp + 0x50], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ecx, dword [0x6367a4]
mov dword [0x6367a8], esi
test ecx, ecx
je case.0x441ac0.40101
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [esp + 0x40], eax
adc edx, 0
push 0
lea eax, [esp + 0x44]
neg edx
push eax
push ecx
mov dword [esp + 0x50], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
cmp byte [0x62d94c], 0
push ecx
sete al
mov ecx, 9
movzx edx, al
mov byte [0x62d94c], al
call fcn.004493c0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call fcn.004e5f60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov esi, dword [0x6336a4]
xor eax, eax
cmp dword [0x636100], eax
cmovne edi, eax
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0xa8
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x441ac0.40101
push 0
push 0x4c31c0
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov eax, dword [0x63395c]
test eax, eax
jne 0x4426ab
mov esi, dword [0x6336a4]
lea eax, ds:[esp + 0x2c]
push eax
push 0
push 5
push 0x87
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x44268d
xor eax, eax
jmp 0x4426a6
push 0
push 0x4274e0
push 0
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [0x63395c], eax
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4426db
push 5
push dword [0x63395c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push dword [0x63395c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lea esp, [esp]
call sym.SystemInformer.exe_PhCreateOpenFileDialog
push 2
mov ebx, eax
push 0x62e470
push ebx
call sym.SystemInformer.exe_PhSetFileDialogFilter
cmp byte ds:[ebx], 0
mov edx, dword [ebx + 4]
je 0x4427ca
mov ecx, dword [edx]
lea eax, [esp + 0xc]
push eax
push edx
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0x5a38e4]
call esi
jmp 0x442740
test eax, eax
js 0x4427e5
mov edx, dword [esp + 0xc]
xor eax, eax
test edx, edx
je 0x442790
jmp 0x442760
test dword [eax + 0x5d3d88], 0x600
mov ecx, dword [eax + 0x5d3d8c]
je 0x442776
or edx, ecx
jmp 0x44277a
not ecx
and edx, ecx
add eax, 8
cmp eax, 0x58
jb 0x442760
jmp 0x4427aa
test dword [eax + 0x5d3d88], 0x600
je 0x4427a2
or edx, dword [eax + 0x5d3d8c]
add eax, 8
cmp eax, 0x58
jb 0x442790
mov eax, dword ds:[ebx + 4]
mov dword [esp + 0xc], edx
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x5a38e4]
call esi
jmp 0x4427e5
mov eax, dword [edx + 0x34]
test eax, eax
je 0x4427dd
and eax, 0xefefc7fd
or eax, 0x2000100
jmp 0x4427e2
mov eax, 0x2000100
mov dword [edx + 0x34], eax
push ebx
push edi
call sym.SystemInformer.exe_PhShowFileDialog
test al, al
je 0x442814
push str.Make_sure_the_PE_Viewer_executable_file_is_present.
push 0
push ebx
call sym.SystemInformer.exe_PhGetFileDialogFileName
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push str.ProgramInspectExecutables
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov eax, dword [0x632d10]
test eax, eax
jne 0x442898
cmp dword [0x636100], eax
mov esi, dword [0x6336a4]
cmovne edi, eax
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0x8a
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x442863
xor eax, eax
jmp 0x442876
push 0
push 0x47c280
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x632d10], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x632d10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x632d10]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
nop
test eax, eax
je 0x4428c9
push 9
push dword [0x632d10]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push dword [0x632d10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call fcn.00437400
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lea eax, ds:[esp + 0x30]
mov dword [esp + 0x14], 0x18
push eax
mov dword [esp + 0x1c], str._taskmgr.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [esp + 0x14]
push eax
push 0x630ba8
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov esi, eax
mov dword [esp + 0x30], 0x24
lea eax, [esp + 0x30]
mov dword [esp + 0x34], str.TaskmgrWindowState
push eax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
neg eax
sbb ebx, ebx
and ebx, 0x6019e0
call fcn.004760e0
test al, al
jne 0x442a69
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x44
push eax
mov dword [esp + 0x38], str.EnableShellExecuteSkipIfeoDebugger
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x442a69
test esi, esi
je 0x44299d
mov eax, dword [esi + 4]
jmp 0x44299f
xor eax, eax
mov dword [esp + 0x54], ebx
lea ecx, [esp + 0x40]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x40], 0x3c
mov dword [esp + 0x44], 0x800540
mov dword [esp + 0x48], edi
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 5
call fcn.004f7960
test al, al
je 0x442a49
mov eax, dword ds:[esp + 0x78]
test eax, eax
je case.0x441ac0.40101
push eax
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
cmp dword [0x62dbb0], 0x3e
jb 0x442ae2
lea eax, [esp + 0x30]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x442ae2
push 0
push 0
push edi
call sym.SystemInformer.exe__PhUiConnectToPhSvcEx_12
test al, al
je case.0x441ac0.40101
test esi, esi
je 0x442abf
mov ecx, dword ds:[esi + 4]
mov edx, ebx
call fcn.0047e500
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, ebx
call fcn.0047e500
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x442b09
mov ecx, dword [esi + 4]
mov edx, ebx
call fcn.00411e60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, ebx
call fcn.00411e60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lea eax, ds:[esp + 0x30]
mov dword [esp + 0x1c], 0x18
push eax
mov dword [esp + 0x24], str.perfmon.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [esp + 0x1c]
push eax
push 0x630ba8
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov esi, eax
mov dword [esp + 0x30], 0x44
lea eax, [esp + 0x30]
mov dword [esp + 0x34], str.EnableShellExecuteSkipIfeoDebugger
push eax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x442ba5
nop
test esi, esi
je 0x442b94
mov eax, dword [esi + 4]
mov dword [esp + 0x54], str.__res
jmp 0x4429a3
xor eax, eax
mov dword [esp + 0x54], str.__res
jmp 0x4429a3
lea eax, [esp + 0x30]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x442c1a
push 0
push 0
push edi
call sym.SystemInformer.exe__PhUiConnectToPhSvcEx_12
nop
test al, al
je case.0x441ac0.40101
test esi, esi
je 0x442bf3
mov ecx, dword [esi + 4]
mov edx, str.__res
call fcn.0047e500
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, str.__res
call fcn.0047e500
nop
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x442c41
mov ecx, dword [esi + 4]
mov edx, str.__res
call fcn.00411e60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, str.__res
call fcn.00411e60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x30]
mov dword [esp + 0x24], 0x10
push eax
mov dword [esp + 0x2c], str.wsl.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [esp + 0x24]
push eax
push 0x630ba8
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
test eax, eax
je 0x442c9f
mov eax, dword [eax + 4]
jmp 0x442ca1
xor eax, eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x40], 0x3c
mov dword [esp + 0x44], 0x800540
mov dword [esp + 0x48], edi
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], str.___shutdown
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 5
call fcn.004f7960
lea ebx, [ebx]
test al, al
jne 0x442a18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
test eax, eax
jns case.0x441ac0.40101
push 0
push eax
push str.Unable_to_shutdown_WSL_instances.
push edi
lfence
call sym.SystemInformer.exe_PhShowStatus
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push ecx
push 0
push 0x441980
push str.SCManager
mov edx, str.Service_Control_Manager
xor ecx, ecx
call fcn.00534ea0
push eax
push 0x534dc0
call sym.SystemInformer.exe_PhCreateThread2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push ecx
push 0
push 0x4419b0
push str.PowerDefault
mov edx, str.Current_Power_Scheme
jmp 0x442d7a
push 0
push 0
push 0
push ecx
push 0
push 0x4419b0
push str.RdpDefault
mov edx, str.Terminal_Server_Listener
jmp 0x442d7a
push 0
push 0
push 0
push ecx
push 0
push 0x4419b0
push str.WmiDefault
mov edx, str.WMI_Root_Namespace
jmp 0x442d7a
push 0
push 0
push 0
push ecx
push 0x441a00
push 0x4419c0
push str.Desktop
mov edx, str.Current_Window_Desktop
jmp 0x442d7a
push 0
push 0
push 0
push ecx
push 0x441a60
push 0x441a20
push str.WindowStation
mov edx, str.Current_Window_Station
jmp 0x442d7a
push dword [0x62e450]
push edi
call sym.SystemInformer.exe__PhUiConnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push dword [0x62e450]
push edi
call sym.SystemInformer.exe__PhUiDisconnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push dword [0x62e450]
push edi
call sym.SystemInformer.exe__PhUiLogoffSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x62e450]
lea eax, [esp + 0x2c]
push 0
push 4
push eax
push 0x18
push 0xffffffffffffffff
or esi, 0xffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
cmovns esi, dword [esp + 0x2c]
cmp ebx, esi
jne 0x442efd
push str.You_cannot_remote_control_the_current_session.
push 0x5cd020
push str.Unable_to_shadow_session.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov esi, dword [0x6336a4]
lea eax, [esp + 0xc]
push eax
push 0
push 5
push 0xc1
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x441ac0.40101
push ebx
push 0x4c07c0
push edi
push dword [esp + 0x18]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov esi, dword [0x6336a4]
lea eax, [esp + 0x2c]
mov ebx, dword [0x62e450]
push eax
push 0
push 5
push 0x98
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x441ac0.40101
push ebx
push 0x4c9880
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov esi, dword [0x6336a4]
xor eax, eax
cmp dword [0x636100], eax
mov ebx, dword [0x62e450]
cmovne edi, eax
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0x99
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x441ac0.40101
push ebx
push 0x4c0140
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov eax, dword [0x632c4c]
test eax, eax
jne 0x44305a
mov esi, dword [0x6336a4]
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0xb2
push esi
call sym.SystemInformer.exe_PhLoadResource
mov edi, edi
test al, al
jne 0x443028
xor eax, eax
jmp 0x44303c
push 0
push 0x43c4c0
push 0
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x632c4c], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x632c4c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x632c4c]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x44308d
push 9
push dword [0x632c4c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push dword [0x632c4c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call fcn.00419060
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov eax, dword [0x63388c]
test eax, eax
jne 0x44312b
cmp dword [0x636100], eax
mov esi, dword [0x6336a4]
cmovne edi, eax
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0x79
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x4430fa
xor eax, eax
jmp 0x44310d
push 0
push section..text
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x63388c], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x63388c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x63388c]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x44315b
push 9
push dword [0x63388c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push dword [0x63388c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x4431ac
lea esp, [esp]
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4431a0
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiTerminateProcesses_12
test al, al
je 0x4431cd
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x63451c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test ebx, ebx
je 0x4431f4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4431ef
call fcn.004fbfa0
inc edi
cmp edi, ebx
jb 0x4431d6
push dword [esp + 0xc]
push 0
push dword [0x6337d4]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
jmp 0x443220
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiTerminateTreeProcess_8
test al, al
je 0x443253
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x63451c]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x44329c
jmp 0x443290
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x443290
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiSuspendProcesses_12
xor edi, edi
test ebx, ebx
je 0x4431f4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4432cb
call fcn.004fbfa0
inc edi
cmp edi, ebx
jb 0x4432b2
jmp 0x4431f4
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSuspendTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x44333c
jmp 0x443330
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x443330
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiResumeProcesses_12
xor edi, edi
test ebx, ebx
je 0x4431f4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44336b
call fcn.004fbfa0
inc edi
cmp edi, ebx
jb 0x443352
jmp 0x4431f4
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiResumeTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiFreezeTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiThawTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
mov edx, dword fs:[0x18]
mov ecx, dword [esi + 0x10]
cmp ecx, dword [edx + 0x20]
jne 0x443471
push 0
push 0
push 3
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
push 0
push 0
push 3
push 0
push 5
push 0
xor edx, edx
mov ecx, edi
call fcn.004118e0
push 0
sar eax, 0x1f
push 0
and eax, 4
push eax
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
jmp 0x443253
push esi
push edi
call sym.SystemInformer.exe__PhUiRestartProcess_8
jmp 0x44323a
lea ecx, [ecx]
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x441ac0.40101
lock inc dword [ebx - 4]
cmp dword [ebx + 0x10], 4
jne 0x44352b
lea ecx, [ecx]
cmp esi, 0x9c53
jne 0x4434ec
mov esi, dword [0x6336a4]
lea eax, ds:[esp + 0x2c]
push eax
push 0
push 5
push 0xfe
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je 0x4435ba
push 0
push 0x437160
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push ebx
jmp 0x443254
mov byte [esp + 0x13], 0x11
sub esi, 0x9c42
je 0x443514
sub esi, 3
jne 0x443519
lea edx, [esp + 0x13]
mov byte [esp + 0x13], 0x35
mov ecx, edi
call fcn.004370c0
push ebx
jmp 0x443254
mov byte [esp + 0x13], 0x19
lea edx, ds:[esp + 0x13]
mov ecx, edi
call fcn.004370c0
push ebx
jmp 0x443254
cmp esi, 0x9c53
jne 0x44356c
mov esi, dword [0x6336a4]
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0x100
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je 0x4435ba
push ebx
push 0x44c340
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push ebx
jmp 0x443254
add esi, 0xffff63be
cmp esi, 3
ja case.0x443577.40003
jmp dword [esi*4 + 0x4444c4]
mov eax, 0x21021
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044b3c0
push ebx
jmp 0x443254
mov eax, 0x6fab67
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044b3c0
push ebx
jmp 0x443254
mov eax, 0x421826
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044b3c0
push ebx
jmp 0x443254
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDebugProcess_8
nop
jmp 0x443253
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
cmp byte [0x6366c0], 0
sete cl
movzx ecx, cl
push ecx
push esi
push edi
call sym.SystemInformer.exe__PhUiSetVirtualizationProcess_12
jmp 0x443253
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
push 0
mov edx, esi
mov ecx, edi
call fcn.0040c8e0
jmp 0x443253
lea esp, [esp]
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetCriticalProcess_8
jmp 0x443253
nop
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDetachFromDebuggerProcess_8
jmp 0x443253
nop
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x441ac0.40101
lea esi, ds:[ebx - 4]
lock inc dword [esi]
push 0x58
push 4
push dword [0x6337d4]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x58
push 0
push eax
mov dword [esp + 0x18], eax
call fcn.00581cf0
add esp, 0xc
lock inc dword [esi]
mov eax, dword [esp + 0xc]
push dword [0x6336a0]
push 0xc
mov dword [eax + 8], ebx
call sym.SystemInformer.exe_PhCreateObject
push 0x50
mov esi, eax
push 4
push dword [0x6337d4]
mov dword [esi], 0
mov dword [esi + 4], 0x14
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
mov eax, dword [esp + 0xc]
mov dword [eax + 0xc], esi
mov esi, dword [0x6336a4]
mov dword [eax + 4], edi
xor eax, eax
cmp dword [0x636100], eax
cmovne edi, eax
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0xaf
push esi
call sym.SystemInformer.exe_PhLoadResource
nop
test al, al
jne 0x443728
xor esi, esi
jmp 0x443740
mov eax, dword [esp + 0xc]
push eax
push 0x425100
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
jmp 0x443254
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
mov edx, esi
call fcn.00425aa0
jmp 0x443253
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x441ac0.40101
add esi, 0xffff62d1
cmp esi, 4
ja case.default.0x443793
jmp dword [esi*4 + 0x4444d4]
mov eax, 1
jmp 0x4437c2
mov eax, 2
jmp 0x4437c2
mov eax, 3
jmp 0x4437c2
mov eax, 4
jmp 0x4437c2
mov eax, 5
jmp 0x4437c2
mov eax, dword [esp + 0x2c]
lock inc dword [ebx - 4]
push eax
push ebx
push edi
call sym.SystemInformer.exe__PhUiSetPagePriorityProcess_12
push ebx
jmp 0x443254
lea eax, ds:[esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x4437ff
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4437f3
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiReduceWorkingSetProcesses_12
xor edi, edi
test ebx, ebx
je 0x4431f4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44382d
call fcn.004fbfa0
inc edi
cmp edi, ebx
jb 0x443814
jmp 0x4431f4
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
lea esp, [esp]
test eax, eax
je case.0x441ac0.40101
mov eax, dword [eax + 0x34]
test eax, eax
je case.0x441ac0.40101
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x18
push eax
mov dword [esp + 0x3c], str.RunAsProgram
call sym.SystemInformer.exe_PhSetStringRefSetting
xor edx, edx
mov ecx, edi
call fcn.004b7c60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x441ac0.40101
mov edx, dword ds:[eax + 0x10]
mov ecx, edi
call fcn.004b7c60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
mov edx, esi
mov ecx, edi
call fcn.00438780
jmp 0x443253
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
lfence
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x44390c
jmp 0x443900
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x443900
push ebx
mov ecx, esi
call fcn.004637e0
xor edi, edi
test ebx, ebx
je 0x4431f4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44393a
call fcn.004fbfa0
inc edi
cmp edi, ebx
jb 0x443921
nop
jmp 0x4431f4
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
lfence
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x443971
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x443965
push ebx
mov ecx, esi
call fcn.00463880
xor edi, edi
test ebx, ebx
je 0x4431f4
or esi, 0xffffffff
jmp 0x443990
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4439a9
call fcn.004fbfa0
inc edi
cmp edi, ebx
jb 0x443990
jmp 0x4431f4
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetEcoModeProcess_8
jmp 0x443253
push dword [0x6366bc]
mov edi, edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x441ac0.40101
xor eax, eax
mov dword [esp + 0x40], 0x2c
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
lea eax, [esp + 0x40]
push eax
push dword [0x6366bc]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword [esp + 0x48], 6
je 0x443a6f
push dword [0x6366bc]
mov edi, edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push dword [0x6366bc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x441ac0.40101
push 9
push dword [0x6366bc]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push dword [0x6366bc]
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, edi
test eax, eax
je case.0x441ac0.40101
push 6
push dword [0x6366bc]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push dword [0x6366bc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x441ac0.40101
push 3
push dword [0x6366bc]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push dword [0x6366bc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x441ac0.40101
push 0
push 0
push 0x10
push dword [0x6366bc]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lea ecx, [ecx]
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
mov eax, dword [esi + 0x38]
test eax, eax
je case.0x441ac0.40101
cmp dword ds:[eax], 0
je case.0x441ac0.40101
push eax
call sym.SystemInformer.exe_PhDoesFileExist
test al, al
je case.0x441ac0.40101
lock inc dword [esi - 4]
mov eax, dword [esi + 0x34]
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [eax + 4]
push str.FileBrowseExecutable
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
jmp 0x443253
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
lea ebx, [ebx]
test eax, eax
je case.0x441ac0.40101
mov eax, dword [eax + 0x18]
push dword [eax + 4]
push edi
call sym.SystemInformer.exe__PhSearchOnlineString_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x441ac0.40101
push eax
call fcn.004635e0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push 0
push dword [0x63451c]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x63451c]
call sym.SystemInformer.exe_PhSetClipboardString
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne case.0x441ac0.40101
mov edi, edi
call fcn.004fbfa0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
nop
test eax, eax
je case.0x441ac0.40101
push dword [eax + 0x2c]
call sym.SystemInformer.exe__PhFindProcessNode_4
mov esi, eax
test esi, esi
je case.0x441ac0.40101
mov ecx, dword [0x6366b8]
mov ecx, dword [ecx + 0x14]
call fcn.00449370
push dword [0x6366b4]
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, 1
mov dword [esp + 0x2c], esi
lea ecx, [esp + 0x2c]
call fcn.0049f320
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x443cc4
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x443cb8
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiStartServices_12
xor edi, edi
test ebx, ebx
je 0x4431f4
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x443cf9
call fcn.004fbfa0
inc edi
cmp edi, ebx
jb 0x443ce0
mov edi, edi
jmp 0x4431f4
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword ds:[esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x443d30
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x443d24
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiContinueServices_12
xor edi, edi
test ebx, ebx
je 0x4431f4
or esi, 0xffffffff
jmp 0x443d50
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x443d69
call fcn.004fbfa0
inc edi
cmp edi, ebx
jb 0x443d50
jmp 0x4431f4
lea eax, ds:[esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x443d9f
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x443d93
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiPauseServices_12
xor edi, edi
test ebx, ebx
je 0x4431f4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x443dcd
call fcn.004fbfa0
inc edi
cmp edi, ebx
jb 0x443db4
jmp 0x4431f4
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x443e04
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x443df4
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiStopServices_12
xor edi, edi
test ebx, ebx
je 0x4431f4
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x443e39
call fcn.004fbfa0
inc edi
cmp edi, ebx
jb 0x443e20
mov edi, edi
jmp 0x4431f4
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDeleteService_8
nop
test al, al
je 0x443253
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x6349e4]
jmp 0x44324d
lea esp, [esp]
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x441ac0.40101
push dword [eax + 8]
lea eax, [esp + 0x30]
push 0x20019
push eax
call sym.SystemInformer.exe_PhOpenServiceKey
nop
test eax, eax
js 0x443f71
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x443f3d
cmp edx, 0xffffffff
je 0x443f3d
lea ecx, [ecx]
cmp edx, 0xfffffffe
je 0x443f3d
lea eax, [esp + 0xc]
or esi, 0xffffffff
push eax
push 0
mov ecx, esi
call fcn.0052b900
lea ebx, [ebx]
test eax, eax
js 0x443f3d
mov ebx, dword [esp + 0xc]
push ebx
call sym.SystemInformer.exe_PhFormatNativeKeyName
mov dword [esp + 0xc], eax
test ebx, ebx
je 0x443f0e
lea ecx, [ebx - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x443f0e
call fcn.004fbfa0
mov eax, dword [esp + 0xc]
push eax
push edi
call sym.SystemInformer.exe__PhShellOpenKey2_8
push dword [esp + 0xc]
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push str.The_service_does_not_exist.
push 0x5cd020
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
push str.The_service_does_not_exist.
push 0x5cd020
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
lea ecx, [ecx]
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
mov eax, dword [esi + 8]
test eax, eax
je 0x443fbb
mov eax, dword [eax + 4]
jmp 0x443fbd
xor eax, eax
push eax
push 1
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhOpenService
test eax, eax
js case.0x441ac0.40101
mov ebx, dword ds:[esp + 0x2c]
mov ecx, ebx
mov edx, dword [esi + 8]
call fcn.00522d80
mov esi, eax
test esi, esi
je 0x44400b
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [esi + 4]
push str.FileBrowseExecutable
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x441ac0.40101
lea ecx, [esi - 4]
lock inc dword [ecx]
lock inc dword [ecx]
push esi
push 0x4c6980
call sym.SystemInformer.exe_PhCreateThread2
jmp 0x443253
push 0
push dword [0x6349e4]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x6349e4]
jmp 0x443c07
call fcn.0046a360
test eax, eax
je case.0x441ac0.40101
push dword ds:[eax + 0x38]
jmp 0x443c4b
call fcn.0046a360
test eax, eax
je case.0x441ac0.40101
mov eax, dword [eax + 0x48]
test eax, eax
je case.0x441ac0.40101
push dword [eax + 4]
call sym.SystemInformer.exe__PhReferenceServiceItem_4
mov esi, eax
test esi, esi
je case.0x441ac0.40101
mov ecx, dword [0x636698]
mov ecx, dword [ecx + 0x14]
call fcn.00449370
push dword [0x636694]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
push 0
push 0xc
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
jmp 0x443253
lea edx, [esp + 0x2c]
lea ecx, [esp + 0xc]
call fcn.0046a3a0
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x4440ff
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4440f3
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiCloseConnections_12
test al, al
je 0x444126
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x633e3c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test ebx, ebx
je 0x4431f4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44414c
call fcn.004fbfa0
inc edi
cmp edi, ebx
jb 0x444133
jmp 0x4431f4
push 0
push dword [0x633e3c]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x633e3c]
jmp 0x443c07
push 0
push 0
push 0x130b
push dword [0x633ba4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x633ba8]
xor esi, esi
mov edx, dword [ecx]
lea ecx, [eax + 1]
dec edx
cmp eax, edx
cmove ecx, esi
jmp 0x4441c8
push 0
push 0
push 0x130b
push dword [0x633ba4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x4441c5
mov eax, dword [0x633ba8]
mov eax, dword [eax]
dec eax
mov ecx, eax
call fcn.00449370
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret