Function at 0x4754c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe4
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0xe0], eax
cmp dword [0x635a90], 3
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x14], ebx
jge 0x475521
push str.Viewing_active_mappings_requires_a_connection_to_the_kernel_driver.
push str._s_r_n_r_nSystem_Informer_is_not_connected_to_the_kernel_driver_or_lacks_the_required_state_necessary_for_this_feature._Make_sure_that_the__Enable_kernel_mode_driver__option_is_enabled_and_that_System_Informer_is_running_with_administrator_privileges.
push str.Kernel_driver_not_connected
push 0xfffd
push dword [ebx + 0xc]
call fcn.0043ada0
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret
mov eax, dword ds:[ebx]
lea ecx, [esp + 0x74]
mov dword [esp + 0x78], eax
mov edx, 0x1000
lea eax, [esp + 0x78]
mov dword [esp + 0x7c], 0
push eax
call fcn.00524800
test eax, eax
js 0x47586f
mov edi, dword [ebx + 4]
mov eax, dword [esp + 0x74]
push 0x104
push 4
push dword [0x633a74]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x104
mov dword [ebx + 0x14], 0
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [esp + 0x10]
mov esi, eax
lea eax, [esp + 0xc]
mov edx, edi
push eax
push 0x104
push esi
push 0x14
call fcn.00524dc0
cmp eax, 0xc0000023
jne 0x4755eb
mov ebx, dword [esp + 0x10]
nop
push esi
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword ds:[esp + 0xc]
push 4
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov edx, edi
lea eax, [esp + 0xc]
mov ecx, ebx
push eax
push dword [esp + 0x10]
push esi
push 0x14
call fcn.00524dc0
nop dword [eax]
cmp eax, 0xc0000023
je 0x4755a0
mov ebx, dword [esp + 0x14]
test eax, eax
jns 0x475629
push esi
push 0
lfence
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x74]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret
push dword [esp + 0x74]
mov dword [ebx + 0x14], esi
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x10], 0
cmp dword [eax], 0
jbe 0x47586f
xor ecx, ecx
mov dword [esp + 0x14], ecx
lea esi, [eax + 4]
mov al, byte [esi + ecx]
add esi, ecx
cmp al, 1
jne 0x4756ca
mov eax, dword [esi + 4]
lea ecx, [esp + 0x78]
xor edx, edx
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], 0
call fcn.0052d260
mov edi, eax
mov dword [esp + 0x18], 5
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], 0x7fffffff
push eax
push 0
mov ecx, dword [edi + 4]
push 0x104d
push dword [ebx + 0x10]
mov dword [esp + 0x30], 0
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x48], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword ds:[esp + 0xc], eax
lea ecx, [edi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x475731
call fcn.004fe0c0
jmp 0x475731
cmp al, 2
jne 0x4756e7
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], str.Session
push eax
push 0
push 0x104d
push dword [ebx + 0x10]
jmp 0x47570b
mov ecx, dword [ebx + 0x10]
cmp al, 3
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], 0x60dda0
push eax
push 0
push 0x104d
push ecx
je 0x47570b
mov dword [esp + 0x3c], 0x5fb6ac
mov dword [esp + 0x28], 5
mov dword [esp + 0x2c], 0x7fffffff
mov dword [esp + 0x30], 0
mov dword [esp + 0x48], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 8]
lea ecx, [esp + 0x84]
push 0x10
push ecx
push eax
mov dword [esp + 0x8c], 0x780030
call fcn.005880a8
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x8c]
add esp, 0xc
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], 1
push eax
push 0
push 0x104c
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x84]
push 0x10
push ecx
push eax
mov dword [esp + 0x8c], 0x780030
call fcn.005880a8
add esp, 0xc
mov dword [esp + 0x18], 1
lea eax, [esp + 0x80]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x20], 2
push eax
push 0
push 0x104c
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, byte [0x6314c0]
mov byte [esp + 0x62], al
mov eax, dword [esi + 8]
cdq
mov ecx, eax
mov dword [esp + 0x58], 0x10d
mov eax, dword [esi + 0xc]
mov edi, edx
cdq
sub eax, ecx
push 0
mov dword [esp + 0x6c], eax
sbb edx, edi
push 1
lea eax, [esp + 0x60]
mov dword [esp + 0x74], edx
push eax
call sym.SystemInformer.exe_Ordinal_1375
mov ecx, dword [esp + 0xc]
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 3
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x104c
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x14]
inc edx
mov ecx, dword [esp + 0x14]
add ecx, 0x10
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
cmp edx, dword [eax]
jb 0x475650
mov ecx, dword ds:[esp + 0xec]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret