Function at 0x42f380
Capabilities:
Check mutex on windows
Check processdebugflags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3ec
mov eax, dword [0x62e040]
xor eax, esp
mov dword [esp + 0x3e8], eax
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x42f3ae
mov ecx, dword [ecx + 4]
jmp 0x42f3b3
mov ecx, 0x5cbc90
mov eax, dword [ebx + 0x58]
mov dword [esp + 0x11c], eax
lea eax, [esp + 0x118]
push eax
push 0
push 0x104c
push dword [ebx]
mov dword [esp + 0x128], 1
mov dword [esp + 0x130], 1
mov dword [esp + 0x13c], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x42f402
mov ecx, dword ds:[ecx + 4]
jmp 0x42f407
mov ecx, 0x5cbc90
mov eax, dword ds:[ebx + 0x5c]
mov dword [esp + 0x11c], eax
lea eax, [esp + 0x118]
push eax
push 0
push 0x104c
push dword [ebx]
mov dword [esp + 0x128], 1
mov dword [esp + 0x130], 1
mov dword [esp + 0x13c], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x42f4b3
push 0x10
lea ecx, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push ecx
push eax
call fcn.0058414a
mov eax, dword [ebx + 0x60]
add esp, 0xc
mov dword [esp + 0x11c], eax
lea eax, [esp + 0x180]
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x118]
mov dword [esp + 0x118], 1
push eax
push 0
push 0x104c
push dword [ebx]
mov dword [esp + 0x130], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x42f4c2
mov eax, dword [eax + 4]
jmp 0x42f4c7
mov eax, 0x5cbc90
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x24]
push ecx
push eax
call sym.SystemInformer.exe_PhGetAccessEntries
mov ecx, dword ds:[ebx + 0xc]
test al, al
je 0x42f5c8
push dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push esi
push dword [ecx + 0x14]
call sym.SystemInformer.exe_PhGetAccessString
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
cmp dword [eax], 0
je 0x42f559
push dword [eax + 4]
mov eax, dword [ebx + 0xc]
push dword [eax + 0x14]
push str.0x_x___s_
call sym.SystemInformer.exe_PhFormatString
add esp, 0xc
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov dword [esp + 0x118], 1
mov dword [esp + 0x11c], 3
mov dword [esp + 0x120], 1
mov eax, dword [eax + 4]
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x118]
jmp 0x42f5a4
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x184]
push 0x10
push ecx
mov eax, dword [eax + 0x14]
push eax
mov dword [esp + 0x18c], 0x780030
call fcn.0058414a
lea eax, [esp + 0x18c]
mov dword [esp + 0x5c], 1
mov dword [esp + 0x70], eax
add esp, 0xc
mov dword [esp + 0x54], 3
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 0
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x42f62f
mov eax, dword [ecx + 0x14]
lea ecx, [esp + 0x184]
push 0x10
push ecx
push eax
mov dword [esp + 0x18c], 0x780030
call fcn.0058414a
add esp, 0xc
mov dword [esp + 0x118], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x11c], 3
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x118]
mov dword [esp + 0x120], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x636e88], 3
mov ecx, 0x1000
push dword [ebx + 8]
mov eax, 0x40
cmovge eax, ecx
push eax
lea eax, [esp + 0x24]
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x42f7e6
mov eax, dword ds:[ebx + 0xc]
lea ecx, [esp + 0x118]
push 0
push 0
push 0
push 0
push ecx
lea ecx, [esp + 0x3c]
push ecx
push 0
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x40]
call sym.SystemInformer.exe_PhGetHandleInformationEx
test eax, eax
js 0x42f7d9
mov eax, dword [esp + 0x28]
test eax, eax
js 0x42f7d9
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x12c]
call fcn.0058414a
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x54], 4
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x128]
call fcn.0058414a
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x54], 5
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x130]
call fcn.0058414a
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x54], 6
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x134]
call fcn.0058414a
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x54], 7
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword ds:[esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x43218e
cmp dword [eax], 0
je 0x43218e
push 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x12
push ecx
push eax
mov dword [esp + 0x20], str.ALPC_Port
call sym.SystemInformer.exe_PhEqualStringRef
lea ebx, [ebx]
test al, al
je 0x43092e
cmp dword [0x636e88], 3
jl 0x43218e
push dword [ebx + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43218e
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x1c]
push 0
push 0x14
mov edx, dword [edx + 8]
push eax
push 0
call fcn.00525180
test eax, eax
js 0x42fec7
mov edi, dword [esp + 0x54]
lea eax, [esp + 0x28]
push 0
push 0
mov esi, 0x100
mov dword [esp + 0x38], edi
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], esi
call sym.SystemInformer.exe_PhCreateString3
mov edx, eax
xor eax, eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], edx
mov dword [edx], 0
mov ecx, dword [edx + 4]
mov word [ecx], ax
test dword [esp + 0x54], 0x1000
je 0x42f92c
mov eax, dword [edx]
add eax, 0x14
cmp eax, esi
jbe 0x42f8e4
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x14
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], edx
mov ecx, dword [edx + 4]
xor edi, edi
add ecx, dword [edx]
mov eax, dword [str.LPC_mode_]
mov dword [ecx], eax
mov eax, dword [0x5fe4f8]
mov dword [ecx + 4], eax
mov eax, dword [0x5fe4fc]
mov dword [ecx + 8], eax
mov eax, dword [0x5fe500]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5fe504]
mov dword [ecx + 0x10], eax
add dword [edx], 0x14
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], di
mov edi, dword [esp + 0x30]
and edi, 0xffffefff
mov dword [esp + 0x30], edi
test dword [esp + 0x54], 0x10000
je 0x42f987
mov eax, dword [edx]
add eax, 0x2a
cmp esi, eax
jae 0x42f958
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x2a
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 0xa
add edi, dword [edx]
mov esi, str.Allow_impersonation_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x2a
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xfffeffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x20000
je 0x42f9e2
mov eax, dword [edx]
add eax, 0x28
cmp dword [esp + 0x10], eax
jae 0x42f9b5
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x28
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 0xa
add edi, dword [edx]
mov esi, str.Allow_LPC_requests_
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x28
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xfffdffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x40000
je 0x42fa54
mov eax, dword [edx]
add eax, 0x14
cmp dword [esp + 0x10], eax
jae 0x42fa10
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x14
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov ecx, dword [edx + 4]
xor esi, esi
add ecx, dword [edx]
mov eax, dword [str.Waitable_]
mov dword [ecx], eax
mov eax, dword [0x5fe568]
mov dword [ecx + 4], eax
mov eax, dword [0x5fe56c]
mov dword [ecx + 8], eax
mov eax, dword [0x5fe570]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5fe574]
mov dword [ecx + 0x10], eax
add dword [edx], 0x14
and edi, 0xfffbffff
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x80000
je 0x42faaf
mov eax, dword [edx]
add eax, 0x34
cmp dword [esp + 0x10], eax
jae 0x42fa82
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x34
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 0xd
add edi, dword [edx]
mov esi, str.Allow_object_duplication_
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x34
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xfff7ffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x100000
je 0x42fb0e
mov eax, dword ds:[edx]
add eax, 0x2a
cmp dword [esp + 0x10], eax
jae 0x42fadf
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x2a
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 0xa
add edi, dword [edx]
mov esi, str.System_process_only_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x2a
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xffefffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x200000
je 0x42fb6e
mov eax, dword ds:[edx]
add eax, 0x22
cmp dword [esp + 0x10], eax
jae 0x42fb3f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x22
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 8
add edi, dword [edx]
mov esi, str.Wake_policy__1__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xffdfffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x400000
je 0x42fbce
mov eax, dword ds:[edx]
add eax, 0x22
cmp dword [esp + 0x10], eax
jae 0x42fb9f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x22
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 8
add edi, dword [edx]
mov esi, str.Wake_policy__2__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xffbfffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x800000
je 0x42fc2e
mov eax, dword ds:[edx]
add eax, 0x22
cmp dword [esp + 0x10], eax
jae 0x42fbff
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x22
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 8
add edi, dword [edx]
mov esi, str.Wake_policy__3__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xff7fffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x1000000
je 0x42fc8c
mov eax, dword ds:[edx]
add eax, 0x38
cmp dword [esp + 0x10], eax
jae 0x42fc5f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x38
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 0xe
add edi, dword [edx]
mov esi, str.No_shared_section__direct__
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x38
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xfeffffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
test dword [esp + 0x54], 0x2000000
je 0x42fcea
mov eax, dword ds:[edx]
add eax, 0x3e
cmp dword [esp + 0x10], eax
jae 0x42fcbf
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x3e
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx + 4]
mov ecx, 0xf
add edi, dword [edx]
mov esi, str.Allow_multi_handle_attributes_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x3e
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xfdffffff
mov word [ecx + eax], si
mov ecx, dword ds:[edx]
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], 0x5d1100
cmp ecx, 4
jb 0x42fd74
mov eax, dword [edx + 4]
add ecx, 0xfffffffc
add eax, ecx
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], eax
lea eax, [esp + 0x28]
push 0
push eax
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x42fd70
mov ecx, dword [esp + 0x20]
mov esi, dword [ecx]
mov eax, esi
mov ecx, dword [ecx + 4]
shr eax, 1
lea edx, [eax*2 - 4]
sub esi, edx
lea eax, [ecx + eax*2]
sub esi, 4
push esi
push eax
lea eax, [ecx + edx]
push eax
call fcn.005823b0
mov edx, dword [esp + 0x2c]
add esp, 0xc
add dword [edx], 0xfffffffc
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], si
jmp 0x42fd74
mov edx, dword [esp + 0x20]
cmp dword [esp + 0x54], 0
jne 0x42fdc9
mov eax, dword [edx]
add eax, 0xa
cmp dword [esp + 0x10], eax
jae 0x42fd9b
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0xa
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 4]
add ecx, dword [edx]
mov eax, dword [0x5fe6c8]
mov dword [ecx], eax
mov eax, dword [0x5fe6cc]
mov dword [ecx + 4], eax
mov ax, word [0x5fe6d0]
mov word [ecx + 8], ax
add dword [edx], 0xa
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], si
jmp 0x42fe0c
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push dword [esp + 0x5c]
call fcn.0058414a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x14]
push str.___s_
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov edx, dword [esp + 0x20]
add esp, 0xc
test edi, edi
je 0x42fe4c
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push edi
call fcn.0058414a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x14]
push str.__UNKNOWN:__s_
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov edx, dword [esp + 0x20]
add esp, 0xc
push dword [edx + 4]
push 1
push dword [ebx + 0x78]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe_PhDeleteBytesBuilder
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x60]
call fcn.0058414a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 1
push dword [ebx + 0x7c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push dword [esp + 0x64]
call fcn.0058414a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 1
push dword [ebx + 0x80]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x1c]
push eax
mov edx, dword [edx + 8]
call fcn.00525260
mov edx, dword ds:[ebx + 0xc]
xor ecx, ecx
mov edi, dword [esp + 0x28]
test eax, eax
push ecx
push 0x3c
mov edx, dword [edx + 8]
lea eax, [esp + 0x120]
push eax
cmovs edi, ecx
mov ecx, dword [esp + 0x28]
push 1
call fcn.00525180
test eax, eax
js 0x4301d2
mov eax, dword [esp + 0x118]
test eax, eax
je 0x42ffeb
xor edx, edx
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.0052d240
mov esi, eax
mov dword [esp + 0x28], esi
test edi, edi
je 0x42ffd2
movzx ecx, word [edi]
mov edx, ecx
test cx, cx
je 0x42ffd2
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xb0], eax
mov eax, edx
mov dword [esp + 0xe0], eax
mov dword [esp + 0xa0], 1
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], 1
mov dword [esp + 0xc8], 6
mov dword [esp + 0xcc], 0x5fe6f4
mov dword [esp + 0xd0], 1
mov eax, dword [edi + 4]
push 0x104
mov dword [esp + 0xe8], eax
lea eax, [esp + 0xa4]
push 3
push eax
call sym.SystemInformer.exe_PhFormat
push dword [esp + 0x28]
mov esi, eax
call sym.SystemInformer.exe_PhDereferenceObject
push dword ds:[esi + 4]
push 1
push dword [ebx + 0xb8]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
mov eax, dword [esp + 0x12c]
test eax, eax
je 0x4300c5
xor edx, edx
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.0052d240
mov esi, eax
mov dword [esp + 0x28], esi
test edi, edi
je 0x4300aa
movzx ecx, word [edi + 8]
mov edx, ecx
test cx, cx
je 0x4300aa
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xb0], eax
mov eax, edx
mov dword [esp + 0xe0], eax
mov dword [esp + 0xa0], 1
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], 1
mov dword [esp + 0xc8], 6
mov dword [esp + 0xcc], 0x5fe6f4
mov dword [esp + 0xd0], 1
mov eax, dword [edi + 0xc]
push 0x104
mov dword [esp + 0xe8], eax
lea eax, [esp + 0xa4]
push 3
push eax
call sym.SystemInformer.exe_PhFormat
push dword [esp + 0x28]
mov esi, eax
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esi + 4]
push 1
push dword [ebx + 0xbc]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
mov eax, dword [esp + 0x140]
test eax, eax
je 0x43019d
xor edx, edx
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.0052d240
mov esi, eax
mov dword [esp + 0x28], esi
test edi, edi
je 0x430185
movzx ecx, word ds:[edi + 0x10]
mov edx, ecx
test cx, cx
je 0x430185
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xb0], eax
mov eax, edx
mov dword [esp + 0xe0], eax
mov dword [esp + 0xa0], 1
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], 1
mov dword [esp + 0xc8], 6
mov dword [esp + 0xcc], 0x5fe6f4
mov dword [esp + 0xd0], 1
mov eax, dword [edi + 0x14]
push 0x104
mov dword [esp + 0xe8], eax
lea eax, [esp + 0xa4]
push 3
push eax
call sym.SystemInformer.exe_PhFormat
push dword [esp + 0x28]
mov esi, eax
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esi + 4]
push 1
push dword [ebx + 0xc0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
lea ecx, [ecx]
test edi, edi
je 0x4301b3
push edi
push 0
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push dword [ebx + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 0
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43218e
push 0
push 0
push 0x20000
lea eax, [esp + 0x34]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [ecx]
test esi, esi
js 0x43218e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x43218e
push 0
push 0xc
lea ecx, [esp + 0x48]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x4308eb
mov edi, dword [esp + 0x40]
lea eax, [esp + 0x20]
push 0
push 0
mov esi, 0x100
mov dword [esp + 0x38], edi
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], esi
call sym.SystemInformer.exe_PhCreateString3
mov edx, eax
xor eax, eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], edx
mov dword [edx], 0
mov ecx, dword [edx + 4]
mov word [ecx], ax
mov eax, dword [esp + 0x40]
test eax, 0x1000
je 0x43031d
mov eax, dword [edx]
add eax, 0x14
cmp eax, esi
jbe 0x4302d1
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x14
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], edx
mov ecx, dword [edx]
xor edi, edi
add ecx, dword [edx + 4]
mov eax, dword [str.LPC_mode_]
mov dword [ecx], eax
mov eax, dword [0x5fe4f8]
mov dword [ecx + 4], eax
mov eax, dword [0x5fe4fc]
mov dword [ecx + 8], eax
mov eax, dword [0x5fe500]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5fe504]
mov dword [ecx + 0x10], eax
add dword [edx], 0x14
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov word [ecx + eax], di
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x40]
and edi, 0xffffefff
mov dword [esp + 0x30], edi
lea ecx, [ecx]
test eax, 0x10000
je 0x430380
mov eax, dword [edx]
add eax, 0x2a
cmp esi, eax
jae 0x43034d
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x2a
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 0xa
add edi, dword [edx + 4]
mov esi, str.Allow_impersonation_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x2a
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xfffeffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x20000
je 0x4303e0
mov eax, dword [edx]
add eax, 0x28
cmp dword [esp + 0x10], eax
jae 0x4303af
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x28
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 0xa
add edi, dword [edx + 4]
mov esi, str.Allow_LPC_requests_
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x28
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xfffdffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x40000
je 0x430457
mov eax, dword [edx]
add eax, 0x14
cmp dword [esp + 0x10], eax
jae 0x43040f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x14
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov ecx, dword [edx]
xor esi, esi
add ecx, dword [edx + 4]
mov eax, dword [str.Waitable_]
mov dword [ecx], eax
mov eax, dword [0x5fe568]
mov dword [ecx + 4], eax
mov eax, dword [0x5fe56c]
mov dword [ecx + 8], eax
mov eax, dword [0x5fe570]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5fe574]
mov dword [ecx + 0x10], eax
add dword [edx], 0x14
and edi, 0xfffbffff
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
jmp 0x430460
test eax, 0x80000
je 0x4304c0
mov eax, dword [edx]
add eax, 0x34
cmp dword [esp + 0x10], eax
jae 0x43048f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x34
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 0xd
add edi, dword [edx + 4]
mov esi, str.Allow_object_duplication_
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x34
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xfff7ffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x100000
je 0x430522
mov eax, dword [edx]
add eax, 0x2a
cmp dword [esp + 0x10], eax
jae 0x4304ef
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x2a
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 0xa
add edi, dword [edx + 4]
mov esi, str.System_process_only_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x2a
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xffefffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x200000
je 0x430584
mov eax, dword [edx]
add eax, 0x22
cmp dword [esp + 0x10], eax
jae 0x430551
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x22
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 8
add edi, dword [edx + 4]
mov esi, str.Wake_policy__1__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xffdfffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x400000
je 0x4305e6
mov eax, dword [edx]
add eax, 0x22
cmp dword [esp + 0x10], eax
jae 0x4305b3
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x22
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 8
add edi, dword [edx + 4]
mov esi, str.Wake_policy__2__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xffbfffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x800000
je 0x430648
mov eax, dword [edx]
add eax, 0x22
cmp dword [esp + 0x10], eax
jae 0x430615
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x22
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 8
add edi, dword [edx + 4]
mov esi, str.Wake_policy__3__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xff7fffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x1000000
je 0x4306a8
mov eax, dword [edx]
add eax, 0x38
cmp dword [esp + 0x10], eax
jae 0x430677
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x38
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 0xe
add edi, dword [edx + 4]
mov esi, str.No_shared_section__direct__
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x38
xor esi, esi
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov edi, dword [esp + 0x30]
and edi, 0xfeffffff
mov dword [esp + 0x30], edi
mov word [ecx + eax], si
mov eax, dword [esp + 0x40]
test eax, 0x2000000
je 0x430702
mov eax, dword [edx]
add eax, 0x3e
cmp dword [esp + 0x10], eax
jae 0x4306d7
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0x3e
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edi, dword [edx]
mov ecx, 0xf
add edi, dword [edx + 4]
mov esi, str.Allow_multi_handle_attributes_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x3e
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x30]
and edi, 0xfdffffff
mov word [ecx + eax], si
mov ecx, dword [edx]
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 0x5d1100
cmp ecx, 4
jb 0x43078f
mov eax, dword ds:[edx + 4]
add ecx, 0xfffffffc
add eax, ecx
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x30]
push 0
push eax
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x43078b
mov ecx, dword [esp + 0x20]
mov esi, dword [ecx]
mov eax, esi
mov ecx, dword [ecx + 4]
shr eax, 1
lea edx, [eax*2 - 4]
sub esi, edx
lea eax, [ecx + eax*2]
sub esi, 4
push esi
push eax
lea eax, [ecx + edx]
push eax
call fcn.005823b0
mov edx, dword [esp + 0x2c]
add esp, 0xc
add dword [edx], 0xfffffffc
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], si
jmp 0x43078f
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x4307ec
mov eax, dword [edx]
add eax, 0xa
cmp dword [esp + 0x10], eax
jae 0x4307bb
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x10]
add edx, 0xa
call fcn.004ff870
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
add ecx, dword [edx + 4]
mov eax, dword [0x5fe6c8]
mov dword [ecx], eax
mov eax, dword [0x5fe6cc]
mov dword [ecx + 4], eax
mov ax, word [0x5fe6d0]
mov word [ecx + 8], ax
add dword [edx], 0xa
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], si
jmp 0x43082c
push 0x10
lea ecx, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push ecx
push eax
call fcn.0058414a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x14]
push str.___s_
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov edx, dword [esp + 0x20]
add esp, 0xc
test edi, edi
je 0x430870
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push edi
call fcn.0058414a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x14]
push str.__UNKNOWN:__s_
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov edx, dword [esp + 0x20]
add esp, 0xc
push dword [edx + 4]
push 1
push dword [ebx + 0x78]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe_PhDeleteBytesBuilder
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x60]
call fcn.0058414a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 1
push dword [ebx + 0x7c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push dword [esp + 0x64]
call fcn.0058414a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 1
push dword [ebx + 0x80]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp dword [0x62ebb0], 0x6c
jb 0x43198b
push 0
push 8
lea eax, [esp + 0x18]
push eax
push 0xc
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x43198b
mov eax, dword [esp + 0x14]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x3c], 0
jmp 0x43196a
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x38]
push 1
push ecx
mov dword [esp + 0x40], 0x1e
push dword [eax + 0x20]
mov dword [esp + 0x48], str.EtwRegistration
call sym.SystemInformer.exe_PhEqualStringRef
mov ecx, dword [ebx + 0xc]
test al, al
je 0x43097f
mov eax, dword [ecx + 0x24]
test eax, eax
je 0x43096f
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xd4]
jmp 0x432187
xor eax, eax
push eax
push 1
push dword [ebx + 0xd4]
jmp 0x432187
push 1
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 8
push eax
push dword [ecx + 0x20]
mov dword [esp + 0x48], 0x5fc928
call sym.SystemInformer.exe_PhEqualStringRef
mov edi, edi
test al, al
je 0x4314a9
cmp dword [0x636e88], 3
jl 0x430f6f
push dword [ebx + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x430f6f
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x40]
push eax
push ecx
lea eax, [esp + 0x98]
mov byte [esp + 0x17], 0
mov edx, dword [edx + 8]
push eax
push ecx
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x1e], 0
call fcn.005253a0
test eax, eax
js 0x430a65
mov eax, dword [esp + 0x90]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x430a20.6
movzx eax, byte [eax + 0x4321b8]
lea esp, [esp]
jmp dword [eax*4 + 0x4321a4]
push str.Pipe
jmp 0x430a53
push str.Network
jmp 0x430a53
mov byte ds:[esp + 0xf], 1
push str.File_or_directory
jmp 0x430a53
mov byte [esp + 0xe], 1
push str.Console
jmp 0x430a53
push 0x5fe74c
push 1
push dword [ebx + 0x84]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 4
lea eax, [esp + 0x34]
push eax
mov eax, dword [ebx + 0xc]
push 0x10
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
lea ecx, [ecx]
test eax, eax
js 0x430b8e
mov eax, dword [esp + 0x30]
mov edx, eax
mov ecx, eax
and edx, 0xfeffffff
or ecx, 0x1000000
test al, 0x30
push 6
cmovne ecx, edx
push 0x5d3ac8
push ecx
call sym.SystemInformer.exe_PhGetAccessString
mov ecx, dword [esp + 0x30]
mov esi, eax
push 0
mov dword [esp + 0xa4], 1
mov dword [esp + 0xb4], 4
mov dword [esp + 0xb8], 0x5f6e50
mov dword [esp + 0xbc], pe_nt_image_headers32
mov dword [esp + 0xcc], ecx
mov byte [esp + 0xc6], 0x10
mov dword [esp + 0xd4], 1
mov dword [esp + 0xe4], 4
mov dword [esp + 0xe8], 0x5fd34c
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xfc], eax
lea eax, [esp + 0x1ec]
push 0x208
push eax
push 5
lea eax, [esp + 0xb0]
mov dword [esp + 0xf8], 1
push eax
mov dword [esp + 0x110], ecx
mov dword [esp + 0x114], 1
mov dword [esp + 0x124], 2
mov dword [esp + 0x128], 0x5fe758
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x430b88
lea eax, [esp + 0x1e8]
push eax
push 1
push dword [ebx + 0x88]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
cmp byte [esp + 0xe], 0
jne 0x430d87
push 0x18
lea eax, [esp + 0x54]
push eax
mov eax, dword [ebx + 0xc]
push 5
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
test eax, eax
js 0x430c39
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
push 0
mov dword [esp + 0x12c], eax
lea eax, [esp + 0xa4]
push 0x64
push eax
push 1
lea eax, [esp + 0x128]
mov dword [esp + 0x128], 0xd
push eax
mov dword [esp + 0x140], ecx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x430c10
lea eax, [esp + 0xa0]
push eax
push 1
push dword [ebx + 0x90]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [esp + 0xf], 0
je 0x430c39
cmp byte [esp + 0x65], 0
mov ecx, 0x5fc928
mov eax, 0x5fe75c
cmove eax, ecx
push eax
push 1
push dword [ebx + 0x84]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 8
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0xc]
push 0xe
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
test eax, eax
js 0x430d87
mov ecx, dword [esp + 0x10]
mov eax, ecx
mov edx, dword [esp + 0x14]
or eax, edx
je 0x430d87
mov eax, dword [esp + 0x58]
or eax, dword [esp + 0x5c]
push 0
push 0x64
je 0x430d3c
fild qword [esp + 0x18]
mov dword [esp + 0xa8], 0x10009
mov eax, 1
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbc], edx
mov dword [esp + 0xc0], 1
mov dword [esp + 0xd0], 4
mov dword [esp + 0xd4], 0x5fd34c
mov dword [esp + 0xd8], 0x4c
fstp qword [esp + 0x40]
fld qword [esp + 0x40]
fild qword [esp + 0x60]
fstp qword [esp + 0x40]
fdiv qword [esp + 0x40]
mov word [esp + 0xdc], ax
mov dword [esp + 0xf0], eax
lea eax, [esp + 0x120]
push eax
push 4
lea eax, [esp + 0xb0]
mov dword [esp + 0x108], 4
push eax
mov dword [esp + 0x110], 0x5fe770
fmul qword [0x61dae0]
fstp qword [esp + 0xf4]
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x430d87
lea eax, [esp + 0x118]
jmp 0x430d77
lea eax, [esp + 0xa8]
mov dword [esp + 0x120], 0x10009
push eax
push 1
lea eax, [esp + 0x128]
mov dword [esp + 0x138], ecx
push eax
mov dword [esp + 0x140], edx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x430d87
lea eax, [esp + 0xa0]
push eax
push 1
push dword [ebx + 0x8c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 8
lea eax, [esp + 0x9c]
push eax
mov eax, dword [ebx + 0xc]
push 0x2b
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
test eax, eax
js case.default.0x430dc0
mov eax, dword [esp + 0x98]
cmp eax, 4
ja case.default.0x430dc0
lea ecx, [ecx]
jmp dword [eax*4 + 0x432208]
push str.Very_Low
jmp 0x430de8
push 0x5fe78c
jmp 0x430de8
push 0x5d0420
jmp 0x430de8
push 0x5d0430
jmp 0x430de8
push 0x5fe794
push 1
push dword [ebx + 0x94]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push 0
push 4
mov edx, dword [edx + 8]
push eax
push 8
call fcn.00524bc0
test eax, eax
js 0x4301b3
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x28]
call fcn.00516200
test eax, eax
js 0x430e53
mov esi, dword [esp + 0x28]
test esi, esi
je 0x430e3b
mov eax, dword [esi + 4]
jmp 0x430e3d
xor eax, eax
push eax
push 1
push dword [ebx + 0x98]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
push 0
push 0
mov edx, 3
mov dword [esp + 0x34], 0
mov ecx, esi
call fcn.00524d60
push dword [esp + 0x28]
push 4
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov edx, 3
lea eax, [esp + 0x28]
mov ecx, esi
push eax
push dword [esp + 0x2c]
push edi
call fcn.00524d60
lfence
test eax, eax
js 0x430f34
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x430eba
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x430ed5
mov eax, dword [edi + 4]
mov dword [esp + 0x3c], eax
mov eax, ecx
push 0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push 0
push eax
call sym.SystemInformer.exe_PhCreateString3
push edi
push 0
push dword [0x635044]
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
je 0x430eef
mov eax, dword [esi + 4]
jmp 0x430ef1
xor eax, eax
push eax
push 1
push dword [ebx + 0x9c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push edi
push 0
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
push dword [ebx + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43218e
push 0
push 0
push 0x100001
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x43101e
push 0
push 0
push 0x100080
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x43101e
push 2
push 0
push 0
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push 0
push 0
push 0x100001
mov esi, eax
call fcn.0051b8c0
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x43218e
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43218e
push 4
push 8
lea ecx, [esp + 0xa0]
mov byte [esp + 0x16], 0
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1b], 0
push ecx
push eax
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov edi, edi
test eax, eax
js 0x4310cc
mov eax, dword [esp + 0x98]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x431082.9
movzx eax, byte [eax + 0x432230]
jmp dword [eax*4 + 0x43221c]
push str.Pipe
jmp 0x4310bd
push str.Network
jmp 0x4310bd
mov byte [esp + 0xe], 1
push str.File_or_directory
jmp 0x4310bd
mov byte [esp + 0xf], 1
push str.Console
jmp 0x4310bd
push 0x5fe74c
push 1
push dword [ebx + 0x84]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov ecx, dword ds:[esp + 0x20]
lea eax, [esp + 0x28]
push 4
push eax
mov edx, 0x10
call fcn.0052f7d0
test eax, eax
js 0x4311f7
mov eax, dword [esp + 0x28]
mov edx, eax
mov ecx, eax
and edx, 0xfeffffff
or ecx, 0x1000000
test al, 0x30
push 6
cmovne ecx, edx
push 0x5d3ac8
push ecx
call sym.SystemInformer.exe_PhGetAccessString
mov ecx, dword [esp + 0x28]
mov esi, eax
push 0
mov dword [esp + 0xa4], 1
mov dword [esp + 0xb4], 4
mov dword [esp + 0xb8], 0x5f6e50
mov dword [esp + 0xbc], pe_nt_image_headers32
mov dword [esp + 0xcc], ecx
mov byte [esp + 0xc6], 0x10
mov dword [esp + 0xd4], 1
mov dword [esp + 0xe4], 4
mov dword [esp + 0xe8], 0x5fd34c
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xfc], eax
lea eax, [esp + 0x1ec]
push 0x208
push eax
push 5
lea eax, [esp + 0xb0]
mov dword [esp + 0xf8], 1
push eax
mov dword [esp + 0x110], ecx
mov dword [esp + 0x114], 1
mov dword [esp + 0x124], 2
mov dword [esp + 0x128], 0x5fe758
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x4311f1
lea eax, [esp + 0x1e8]
push eax
push 1
push dword [ebx + 0x88]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
cmp byte ds:[esp + 0xf], 0
jne 0x431414
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x50]
push 0x18
push eax
mov edx, 5
call fcn.0052f7d0
jmp 0x431220
test eax, eax
js 0x4312b2
mov eax, dword ds:[esp + 0x58]
mov ecx, dword [esp + 0x5c]
push 0
mov dword [esp + 0x12c], eax
lea eax, [esp + 0xa4]
push 0x64
push eax
push 1
lea eax, [esp + 0x128]
mov dword [esp + 0x128], 0xd
push eax
mov dword [esp + 0x140], ecx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x431285
lea eax, ds:[esp + 0xa0]
push eax
push 1
push dword [ebx + 0x90]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [esp + 0xe], 0
je 0x4312b2
cmp byte [esp + 0x65], 0
mov ecx, 0x5fc928
mov eax, 0x5fe75c
cmove eax, ecx
push eax
push 1
push dword [ebx + 0x84]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push 8
push eax
mov edx, 0xe
call fcn.0052f7d0
test eax, eax
js 0x431414
mov ecx, dword ds:[esp + 0x10]
mov eax, ecx
mov edx, dword [esp + 0x14]
or eax, edx
je 0x431414
mov eax, dword [esp + 0x58]
or eax, dword [esp + 0x5c]
push 0
push 0x64
je 0x4313c5
fild qword [esp + 0x18]
mov dword [esp + 0xa8], 0x10009
mov eax, 1
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbc], edx
mov dword [esp + 0xc0], 1
mov dword [esp + 0xd0], 4
mov dword [esp + 0xd4], 0x5fd34c
mov dword [esp + 0xd8], 0x4c
fstp qword [esp + 0x98]
fld qword [esp + 0x98]
fild qword [esp + 0x60]
fstp qword [esp + 0x98]
fdiv qword [esp + 0x98]
mov word [esp + 0xdc], ax
mov dword [esp + 0xf0], eax
lea eax, [esp + 0x120]
push eax
push 4
lea eax, [esp + 0xb0]
mov dword [esp + 0x108], 4
push eax
mov dword [esp + 0x110], 0x5fe770
fmul qword [0x61dae0]
fstp qword [esp + 0xf4]
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x431414
lea eax, ds:[esp + 0x118]
jmp 0x431404
lea eax, [esp + 0xa8]
mov dword [esp + 0x120], 0x10009
push eax
push 1
lea eax, [esp + 0x128]
mov dword [esp + 0x138], ecx
push eax
mov dword [esp + 0x140], edx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x431414
lea eax, [esp + 0xa0]
push eax
push 1
push dword [ebx + 0x8c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x38]
push 8
push eax
mov edx, 0x2b
call fcn.0052f7d0
test eax, eax
js case.default.0x431440
mov eax, dword [esp + 0x38]
cmp eax, 4
ja case.default.0x431440
mov edi, edi
jmp dword [eax*4 + 0x432280]
push str.Very_Low
jmp 0x431474
push 0x5fe78c
jmp 0x431474
push 0x5d0420
jmp 0x431474
push 0x5d0430
jmp 0x431474
push 0x5fe794
push 1
push dword [ebx + 0x94]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x38]
push 1
push ecx
mov dword [esp + 0x40], 0xe
push dword [eax + 0x20]
mov dword [esp + 0x48], 0x5fdbdc
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x43182c
xor edi, edi
cmp dword [0x636e88], 3
mov dword [esp + 0x28], edi
jl 0x431618
push dword [ebx + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
jmp 0x431500
test eax, eax
js 0x431618
push 0x100
push 4
push dword [0x635044]
mov dword [esp + 0x34], edi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov esi, eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x40]
push edi
push 0x10
mov edx, dword [edx + 8]
push eax
push 0xe
call fcn.00524bc0
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
mov edx, dword [edx + 8]
push 0x100
push esi
push 0xf
call fcn.00524bc0
lea ebx, [ebx]
cmp eax, 0x80000005
jne 0x4315b9
cmp dword [esp + 0x28], edi
jbe 0x431600
push esi
push edi
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x28]
push esi
push 4
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push eax
mov edx, dword [edx + 8]
push esi
mov esi, dword [esp + 0x28]
push esi
push 0xf
call fcn.00524bc0
lea esp, [esp]
test eax, eax
js 0x431600
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4315e5
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x4315e0
jmp 0x4315fe
mov eax, dword [esi + 4]
push 0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x3c]
push 0
push eax
mov dword [esp + 0x44], ecx
call sym.SystemInformer.exe_PhCreateString3
mov edi, eax
push esi
push 0
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x1c]
jmp 0x4316cc
push dword [ebx + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x24], edi
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43218e
push 0
push 0
push 5
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x431679
push 0
push 0
push 1
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
push dword ds:[esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x43218e
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4316dd
push 0
push 0x10
lea ecx, [esp + 0x48]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQuerySection]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x28]
mov dword [esp + 0x30], eax
call fcn.0052d1a0
mov edi, dword [esp + 0x28]
xor ecx, ecx
push dword [esp + 0x20]
test eax, eax
cmovs edi, ecx
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [esp + 0x30], 0
jl 0x43218e
mov eax, dword [esp + 0x44]
mov ecx, 0x5d0404
test eax, 0x8000000
je 0x4316fb
mov esi, 0x5fe7a8
jmp 0x431742
jmp 0x431700
test eax, 0x800000
je 0x431715
mov esi, 0x5fc928
jmp 0x431742
jmp 0x431720
test eax, 0x1000000
je 0x431735
mov esi, str.Image
jmp 0x431742
test eax, 0x4000000
mov esi, str.Reserve
cmove esi, ecx
mov al, byte [0x632948]
mov ecx, dword [esp + 0x4c]
mov byte [esp + 0x5a], al
mov eax, dword [esp + 0x48]
push 0
mov dword [esp + 0x64], eax
lea eax, [esp + 0x54]
push 1
push eax
mov dword [esp + 0x5c], 0x10d
mov dword [esp + 0x70], ecx
call sym.SystemInformer.exe_PhFormat
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov dword ds:[esp + 0x28], eax
test edi, edi
je 0x4317d0
push edi
call sym.SystemInformer.exe_PhResolveDevicePrefix
test eax, eax
je 0x4317bf
mov ecx, edi
mov edi, eax
test ecx, ecx
je 0x4317bf
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4317bf
call fcn.004fc020
nop
test edi, edi
je 0x4317d0
mov eax, dword [edi + 4]
jmp 0x4317d5
mov eax, 0x5fe7d4
push eax
push 1
push dword [ebx + 0xa4]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
push 1
push dword [ebx + 0xa0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov eax, dword ds:[esp + 0x28]
test eax, eax
je 0x431819
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xa8]
jmp 0x432187
mov eax, 0x5d0404
push eax
push 1
push dword [ebx + 0xa8]
jmp 0x432187
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x38]
push 1
push ecx
mov dword [esp + 0x40], 0xc
push dword [eax + 0x20]
mov dword [esp + 0x48], 0x5fe400
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x4319aa
push dword [ebx + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 0
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43218e
push 0
push 0
push 1
lea eax, [esp + 0x34]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov edi, edi
test esi, esi
js 0x43218e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x43218e
push 0
push 8
lea ecx, [esp + 0x40]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x43193a
mov eax, dword [esp + 0x38]
cdq
push 0
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x11c]
push 1
push eax
mov dword [esp + 0x124], 0x10009
mov dword [esp + 0x138], edx
call sym.SystemInformer.exe_PhFormat
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xac]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [esp + 0x3d], 0
mov ecx, str.False
mov eax, str.True
cmove eax, ecx
push eax
push 1
push dword [ebx + 0xb0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 0
push 8
lea eax, [esp + 0x18]
push eax
push 1
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x43198b
cmp dword ds:[esp + 0x10], 0
je 0x43198b
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetClientIdName_4
mov esi, eax
push dword [esi + 4]
push 1
push dword [ebx + 0xb4]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x38]
push 1
push ecx
mov dword [esp + 0x40], 0xe
push dword [eax + 0x20]
mov dword [esp + 0x48], 0x5fc83c
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x431d81
xor esi, esi
mov edi, 0x103
cmp dword [0x636e88], 3
mov dword [esp + 0x28], esi
jl 0x431b58
push dword [ebx + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
mov edi, edi
test eax, eax
js 0x431b58
push 0x100
push 4
push dword [0x635044]
mov dword [esp + 0x34], esi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x1c]
push esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x11c]
mov edx, dword [edx + 8]
push 0x18
push eax
push 4
call fcn.00524bc0
mov edx, dword ds:[ebx + 0xc]
test eax, eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x50]
cmovns edi, dword [esp + 0x118]
push esi
mov edx, dword [edx + 8]
push 0x20
push eax
push 9
call fcn.00524bc0
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x1c]
shr eax, 0x1f
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
mov edx, dword [edx + 8]
push eax
push 0x100
push dword [esp + 0x28]
push 0xb
call fcn.00524bc0
cmp eax, 0xc0000023
jne 0x431aec
jmp 0x431aa0
cmp dword [esp + 0x28], esi
jbe 0x431b45
push dword [esp + 0x20]
push esi
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x28]
push esi
push 4
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x20]
push esi
mov edx, dword [edx + 8]
push eax
push 0xb
mov dword [esp + 0x30], eax
call fcn.00524bc0
xor esi, esi
test eax, eax
js 0x431b45
mov edx, dword ds:[esp + 0x20]
movzx eax, word [edx]
mov ecx, eax
test ax, ax
jne 0x431b13
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x431b2c
mov eax, dword [edx + 4]
push 0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x3c]
push 0
push eax
mov dword [esp + 0x44], ecx
call sym.SystemInformer.exe_PhCreateString3
push eax
mov dword [esp + 0x24], eax
call sym.SystemInformer.exe_PhGetFileName
push dword ds:[esp + 0x20]
mov esi, eax
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0x30]
jmp 0x431c2d
push dword [ebx + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x24], esi
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43218e
push 0
push 0
push 0x1000
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
nop
test esi, esi
js 0x43218e
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43218e
lea ecx, [esp + 0x28]
push ecx
push eax
call sym.SystemInformer.exe_PhGetProcessImageFileName
mov esi, dword [esp + 0x28]
test eax, eax
js 0x431bdf
push esi
call sym.SystemInformer.exe_PhGetFileName
push esi
mov dword [esp + 0x2c], eax
call sym.SystemInformer.exe_PhDereferenceObject
mov esi, dword [esp + 0x28]
push 0
push 0x18
lea eax, [esp + 0x120]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push 0
test eax, eax
lea eax, [esp + 0x54]
push 0x20
cmovns edi, dword [esp + 0x120]
push eax
push 4
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push dword ds:[esp + 0x20]
mov dword [esp + 0x34], eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0x30]
shr eax, 0x1f
xor al, 1
mov dword [esp + 0x30], eax
test esi, esi
je 0x431c57
push dword [esi + 4]
push 1
push dword [ebx + 0xc4]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
mov eax, dword [esp + 0x30]
test al, al
je 0x431cd4
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhFormatDateTime
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xc8]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp edi, 0x103
je 0x43218e
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhFormatDateTime
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xcc]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
jmp 0x431cec
jmp 0x431ce0
cmp edi, 0x103
je 0x43218e
push 0
push edi
call sym.SystemInformer.exe_PhGetStatusMessage
mov esi, eax
test esi, esi
je 0x431d06
mov eax, dword [esi + 4]
jmp 0x431d0b
mov eax, 0x5d0404
push eax
push edi
push str.0x_x___s_
call sym.SystemInformer.exe_PhFormatString
mov edi, eax
add esp, 0xc
test edi, edi
je 0x431d30
mov eax, dword [edi + 4]
jmp 0x431d35
mov eax, 0x5cbc90
push eax
push 1
push dword [ebx + 0xd0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push edi
call sym.SystemInformer.exe_PhDereferenceObject
test esi, esi
je 0x43218e
lea ecx, ds:[esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x43218e
call fcn.004fc020
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov eax, dword ds:[ebx + 0xc]
lea ecx, [esp + 0x38]
push 1
push ecx
mov dword [esp + 0x40], 0xc
push dword [eax + 0x20]
mov dword [esp + 0x48], str.Thread
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x43218e
xor eax, eax
mov byte [esp + 0xe], 0
cmp dword [0x636e88], 3
mov edi, 0x103
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
jl 0x431f65
push dword ds:[ebx + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x431f65
push 0x100
push 4
push dword [0x635044]
mov dword [esp + 0x34], 0
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov esi, eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
push 0x100
mov edx, dword [edx + 8]
push esi
push 0xc
call fcn.00524bc0
cmp eax, 0xc0000023
jne 0x431e7e
cmp dword [esp + 0x28], 0
jbe 0x431ec2
push esi
push 0
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x28]
push esi
push 4
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
mov edx, dword [edx + 8]
push esi
mov esi, dword [esp + 0x38]
push esi
push 0xc
call fcn.00524bc0
mov edi, edi
test eax, eax
js 0x431ec2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x431ea5
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x431ea0
jmp 0x431ebe
mov eax, dword [esi + 4]
push 0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x3c]
push 0
push eax
mov dword [esp + 0x44], ecx
call sym.SystemInformer.exe_PhCreateString3
mov dword [esp + 0x20], eax
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x1c]
push 0
push 4
mov edx, dword [edx + 8]
push eax
push 0xd
call fcn.00524bc0
lea esp, [esp]
test eax, eax
js 0x431f22
mov eax, dword [esp + 0x10]
test eax, eax
setne byte [esp + 0xe]
test eax, eax
je 0x431f22
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x118]
mov ecx, dword [esp + 0x1c]
push 0
push 0x1c
mov edx, dword [edx + 8]
push eax
push 5
call fcn.00524bc0
test eax, eax
cmovns edi, dword [esp + 0x118]
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x1c]
push 0
push 0x20
mov edx, dword [edx + 8]
push eax
push 0xa
call fcn.00524bc0
push esi
push 0
push dword [0x635044]
mov dword [esp + 0x3c], eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword ds:[esp + 0x20]
jmp 0x432066
push dword [ebx + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
lea esp, [esp]
test eax, eax
js 0x43218e
push 0
push 0
push 0x800
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x43218e
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x43211f
lea edx, [esp + 0x28]
call fcn.0051d820
mov esi, dword [esp + 0x28]
test eax, eax
js 0x431fe5
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push 0
push 4
lea eax, [esp + 0x18]
push eax
push 0x14
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
lea ebx, [ebx]
test eax, eax
js 0x43203d
mov eax, dword [esp + 0x10]
test eax, eax
setne byte [esp + 0xe]
test eax, eax
je 0x43203d
push 0
push 0x1c
lea eax, [esp + 0x120]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
cmovns edi, dword [esp + 0x118]
push 0
push 0x20
lea eax, [esp + 0x58]
push eax
push 1
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
push dword ds:[esp + 0x20]
mov dword [esp + 0x34], eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x43208b
push dword ds:[esi + 4]
push 1
push dword [ebx + 0xc4]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
cmp byte [esp + 0xe], 0
je 0x432114
push 0
push edi
call sym.SystemInformer.exe_PhGetStatusMessage
mov esi, eax
test esi, esi
je 0x4320b0
mov eax, dword [esi + 4]
jmp 0x4320b5
mov eax, 0x5d0404
push eax
push edi
push str.0x_x___s_
call sym.SystemInformer.exe_PhFormatString
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4320da
mov eax, dword [edi + 4]
jmp 0x4320df
mov eax, 0x5cbc90
push eax
push 1
push dword [ebx + 0xd0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push edi
call sym.SystemInformer.exe_PhDereferenceObject
test esi, esi
je 0x432114
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x432114
call fcn.004fc020
cmp dword [esp + 0x30], 0
jl 0x43218e
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhFormatDateTime
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xc8]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [esp + 0xe], 0
je 0x43218e
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhFormatDateTime
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xcc]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov ecx, dword [esp + 0x3f4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005802ef
mov esp, ebp
pop ebp
ret