Function at 0x440ca7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
mov eax, dword [0x62a040]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
lea eax, [esi - 0x9c41]
cmp eax, 0x137
ja case.0x440ca0.40101
movzx eax, byte [eax + 0x443650]
lea esp, [esp]
jmp dword [eax*4 + 0x4434bc]
lea eax, ds:[esp + 0x30]
mov dword [esp + 0x30], 0x16
push eax
mov dword [esp + 0x38], str.HideOnClose
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x440cf4
call fcn.0046d3e0
test al, al
je case.0x440ca0.40101
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x1a
push eax
mov dword [esp + 0x38], str.CloseOnEscape
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je case.0x440ca0.40101
push 0
push 0
push 0
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x630f04]
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0xfd
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x440ca0.40101
push 0
push 0x4b9780
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
xor edx, edx
call fcn.004b65c0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x630f04]
xor eax, eax
cmp dword [0x633980], eax
cmovne edi, eax
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0x107
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x440ca0.40101
push edi
push 0x4bae80
push 0
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push 0
push 0
push 3
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
push 0
push 0
push 3
push 1
push 5
push str._v__newinstance
xor edx, edx
mov ecx, edi
call fcn.00411860
push 0
sar eax, 0x1f
push 0
and eax, 4
push eax
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe_PhCreateSaveFileDialog
mov ecx, dword [0x6313e4]
mov ebx, eax
push 3
mov dword [esp + 0x44], 1
mov dword [esp + 0x54], 0x20
mov dword [esp + 0x58], 0x5cd534
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
push 0x62b454
push ebx
mov dword [esp + 0x64], 1
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], 1
mov dword [esp + 0x8c], 8
mov dword [esp + 0x90], str..txt
call sym.SystemInformer.exe_PhSetFileDialogFilter
push 0x3c
push 3
lea eax, [esp + 0x48]
push eax
call sym.SystemInformer.exe_PhFormat
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push ebx
call sym.SystemInformer.exe_PhSetFileDialogFileName
push ebx
push edi
call sym.SystemInformer.exe_PhShowFileDialog
test al, al
je 0x440f92
push ebx
call sym.SystemInformer.exe_PhGetFileDialogFileName
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push ebx
mov esi, eax
call sym.SystemInformer.exe_PhGetFileDialogFilterIndex
push 0
push 5
push 1
push 0x120116
push dword [esi + 4]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhCreateFileStream
test eax, eax
js 0x440f81
mov edi, dword ds:[esp + 0x2c]
push 2
push 0x615980
push edi
call sym.SystemInformer.exe_PhWriteStringAsUtf8FileStreamEx
push edi
call sym.SystemInformer.exe__PhWritePhTextHeader_4
xor ecx, ecx
mov dword [esp + 0x30], edi
mov eax, 2
cmp dword [esp + 0xc], eax
push ecx
cmovne eax, ecx
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
push eax
mov eax, dword [0x6313e4]
push 7
push eax
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5a08ec]
call esi
push edi
call sym.SystemInformer.exe_PhDereferenceObject
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push 0
push eax
push str.Unable_to_create_the_file
push edi
lfence
call sym.SystemInformer.exe_PhShowStatus
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
cmp dword [0x6311a8], 0
jne 0x440fe5
push 0
push 0x424560
push 0x6311a8
call sym.SystemInformer.exe_PhCreateThreadEx
test eax, eax
js 0x4418bf
test byte [0x62b34c], 1
jne 0x440fe5
xor edx, edx
mov ecx, 0x62b34c
call sym.SystemInformer.exe_PhfWaitForEvent
push 0
push 0
push 0x8321
push dword [0x6311b8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call fcn.00473d80
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lfence
call fcn.00443e60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push 0
call sym.SystemInformer.exe__PhShowSystemInformationDialog_4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lfence
call fcn.004471a0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lfence
call fcn.00447660
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6315b0]
test eax, eax
jne 0x4410cc
push eax
push 0x462660
push 0x631d6c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x6315b0], eax
jmp 0x4410fd
push eax
push 0x631d6c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x6315b0], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x631d7c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x631d6c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [esp + 0x30], 0x2c
cmp dword [0x6315b0], eax
mov dword [esp + 0x34], str.HideOtherUserProcesses
setne al
push eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6315f4]
test eax, eax
jne 0x4411a2
cmp byte [0x63394a], al
jne 0x441189
push str.Enable_it_in_Options___General_and_restart_System_Informer.
push str.This_filter_cannot_function_because_digital_signature_checking_is_not_enabled._r_n_s
push eax
push 0xfffd
push 0x20
push dword [sym.SystemInformer.exe_PhMainWndHandle]
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push 0
push 0x462740
push 0x631d6c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x6315f4], eax
nop
jmp 0x4411d3
push eax
push 0x631d6c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x6315f4], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x631d7c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x631d6c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [esp + 0x30], 0x26
cmp dword [0x6315f4], eax
mov dword [esp + 0x34], str.HideSignedProcesses
setne al
push eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6315d4]
nop
test eax, eax
jne 0x44123b
push eax
push 0x462760
push 0x631d6c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x6315d4], eax
jmp 0x44126c
push eax
push 0x631d6c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x6315d4], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x631d7c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x631d6c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [esp + 0x30], 0x2c
cmp dword [0x6315d4], eax
mov dword [esp + 0x34], str.HideMicrosoftProcesses
setne al
push eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esp + 0x30], 0x28
cmp dword [0x633958], eax
mov dword [esp + 0x34], str.ScrollToNewProcesses
sete al
push eax
mov dword [0x633958], eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esp + 0x30], 0x1e
cmp dword [0x63394c], eax
mov dword [esp + 0x34], str.ShowCpuBelow001
sete al
push eax
mov dword [0x63394c], eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea esp, [esp]
call sym.SystemInformer.exe__PhInvalidateAllProcessNodes_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x63168c]
nop
test eax, eax
jne 0x441356
push eax
push 0x465a40
push 0x632234
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
jmp 0x441367
push eax
push 0x632234
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
push 0x632234
mov dword [0x63168c], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [esp + 0x30], 0x24
cmp dword [0x63168c], eax
mov dword [esp + 0x34], str.HideDriverServices
setne al
push eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x631628]
test eax, eax
je 0x4413c9
push eax
push 0x632234
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x4413da
push 0
push 0x465a60
push 0x632234
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
push 0x632234
mov dword [0x631628], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [esp + 0x30], 0x26
cmp dword [0x631628], eax
mov dword [esp + 0x34], str.HideDefaultServices
setne al
push eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x63154c]
test eax, eax
je 0x441442
push eax
push 0x6316c8
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x441453
push 0
push 0x4615e0
push 0x6316c8
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
push 0x6316c8
mov dword [0x63154c], eax
lea ecx, [ecx]
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [esp + 0x30], 0x2c
cmp dword [0x63154c], eax
mov dword [esp + 0x34], str.HideWaitingConnections
setne al
push eax
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
cmp byte [0x63118e], 0
push 0x13
push 0
sete al
push 0
mov byte [0x63118e], al
push 0
movzx eax, al
push 0
sub eax, 2
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
movzx eax, byte [0x63118e]
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x2a
push eax
mov dword [esp + 0x3c], str.MainWindowAlwaysOnTop
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov al, byte [0x63118e]
xor edi, edi
mov byte [esp + 0x13], al
mov ecx, 0x632b78
lock bts dword [ecx], 0
setb al
test al, al
je 0x44150b
call sym.SystemInformer.exe_PhfAcquireQueuedLockExclusive
mov ebx, dword [0x632bbc]
mov ecx, dword [ebx + 0x24]
cmp edi, ecx
jae 0x441533
mov edx, dword [ebx]
mov eax, edi
add edx, 8
imul eax, edx
add eax, dword [ebx + 0x18]
mov esi, eax
inc edi
add eax, edx
cmp dword [esi], 0xffffffff
jne 0x44157a
cmp edi, ecx
jb 0x441525
or edi, 0xffffffff
mov ecx, 0x632b78
lock xadd dword [ecx], edi
mov eax, edi
and al, 6
cmp al, 2
jne case.0x440ca0.40101
dec edi
mov eax, edi
lea edx, [edi + 4]
mov esi, edx
lock cmpxchg dword [ecx], esi
cmp eax, edi
jne case.0x440ca0.40101
nop
call fcn.0051e5c0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
test byte ds:[esi + 0xc], 1
je 0x441511
mov esi, dword [esi + 8]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0x13
push 0
xor eax, eax
cmp byte [esp + 0x1b], al
push 0
push 0
setne al
push 0
add eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x44150b
lea eax, [esi + esi*4]
mov esi, 0x62066
add eax, eax
sub esi, eax
lea eax, [esp + 0x30]
push esi
lfence
push eax
mov dword [esp + 0x38], 0x22
mov dword [esp + 0x3c], str.MainWindowOpacity
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov edx, esi
mov ecx, edi
call fcn.004114e0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push 0
push 0x633fc0
call sym.SystemInformer.exe_PhBoostProvider
push 0
push 0x633fa0
call sym.SystemInformer.exe_PhBoostProvider
cmp byte [0x633f98], 0
je case.0x440ca0.40101
push 0
push 0x633f80
call sym.SystemInformer.exe_PhBoostProvider
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
add esi, 0xffff6325
cmp esi, 4
ja case.default.0x44164c
jmp dword [esi*4 + 0x443788]
mov esi, 0x1f4
jmp 0x44167b
mov esi, 0x3e8
jmp 0x44167b
mov esi, 0x7d0
jmp 0x44167b
mov esi, 0x1388
jmp 0x44167b
mov esi, 0x2710
jmp 0x44167b
mov esi, dword [esp + 0x2c]
push esi
lea eax, [esp + 0x34]
mov dword [0x633954], esi
push eax
mov dword [esp + 0x38], 0x1c
mov dword [esp + 0x3c], str.UpdateInterval
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov ecx, dword [0x633fe4]
mov edi, 0x2710
mov dword [0x633fe8], esi
test ecx, ecx
je 0x4416d9
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [esp + 0x40], eax
adc edx, 0
push 0
lea eax, [esp + 0x44]
neg edx
push eax
push ecx
mov dword [esp + 0x50], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ecx, dword [0x634004]
mov dword [0x634008], esi
test ecx, ecx
je 0x441711
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [esp + 0x40], eax
adc edx, 0
push 0
lea eax, [esp + 0x44]
neg edx
push eax
push ecx
mov dword [esp + 0x50], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ecx, dword [0x634024]
mov dword [0x634028], esi
lea ecx, [ecx]
test ecx, ecx
je case.0x440ca0.40101
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [esp + 0x40], eax
adc edx, 0
push 0
lea eax, [esp + 0x44]
neg edx
push eax
push ecx
mov dword [esp + 0x50], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
cmp byte [0x62a94c], 0
push ecx
sete al
mov ecx, 9
movzx edx, al
mov byte [0x62a94c], al
call fcn.004486c0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
test byte [0x62da1c], 1
jne 0x4418ab
mov esi, 0x62da1c
lock bts dword [esi], 0x1f
setb al
test al, al
jne 0x441898
push dword [0x630eec]
push 0x28
call sym.SystemInformer.exe_PhCreateObject
mov edx, eax
mov ebx, 1
xor eax, eax
mov ecx, ebx
mov word [edx], ax
lock xadd dword [0x630ee8], ecx
inc ecx
push dword [0x630eec]
dec cl
mov dword [edx + 4], eax
movzx eax, cl
push 0x28
mov byte [edx + 2], cl
mov dword [edx + 8], 0x4e1180
mov dword [edx + 0xc], str.ThreadStacks
mov dword [eax*4 + 0x6334a0], edx
mov dword [0x632aa4], edx
call sym.SystemInformer.exe_PhCreateObject
mov edx, eax
mov ecx, ebx
xor eax, eax
mov word [edx], ax
lock xadd dword [0x630ee8], ecx
inc ecx
push dword [0x630eec]
dec cl
mov dword [edx + 4], eax
movzx eax, cl
push 0x28
mov byte [edx + 2], cl
mov dword [edx + 8], 0x4e10e0
mov dword [edx + 0xc], str.ThreadStacksWorker
mov dword [eax*4 + 0x6334a0], edx
mov dword [0x632aa0], edx
call sym.SystemInformer.exe_PhCreateObject
mov edx, eax
xor eax, eax
mov word [edx], ax
lock xadd dword [0x630ee8], ebx
inc ebx
dec bl
mov dword [edx + 4], eax
movzx eax, bl
mov ecx, esi
mov byte [edx + 2], bl
mov dword [edx + 8], 0x4e0ea0
mov dword [edx + 0xc], str.ThreadStacksNode
mov dword [eax*4 + 0x6334a0], edx
mov dword [0x632aa8], edx
call sym.SystemInformer.exe_PhfEndInitOnce
jmp 0x4418ab
test byte [0x62da1c], 1
nop
jne 0x4418ab
xor edx, edx
mov ecx, esi
call sym.SystemInformer.exe_PhfWaitForEvent
push 0
push 0x4e45e0
call sym.SystemInformer.exe_PhCreateThread2
test eax, eax
jns case.0x440ca0.40101
push str.Unable_to_create_the_window.
push 0x5ca058
push 0x10
push dword [sym.SystemInformer.exe_PhMainWndHandle]
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x630f04]
xor eax, eax
cmp dword [0x633980], eax
cmovne edi, eax
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0xa8
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x440ca0.40101
push 0
push 0x4c18e0
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6311bc]
test eax, eax
jne 0x44198b
mov esi, dword [0x630f04]
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0x87
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x44196e
xor eax, eax
jmp 0x441986
push 0
push 0x4270e0
push 0
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [0x6311bc], eax
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4419bb
push 5
push dword [0x6311bc]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push dword [0x6311bc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lea esp, [esp]
call sym.SystemInformer.exe_PhCreateOpenFileDialog
push 2
mov ebx, eax
push 0x62b470
push ebx
call sym.SystemInformer.exe_PhSetFileDialogFilter
cmp byte ds:[ebx], 0
mov edx, dword [ebx + 4]
je 0x441aaa
mov ecx, dword [edx]
lea eax, [esp + 0xc]
push eax
push edx
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0x5a08ec]
call esi
jmp 0x441a20
test eax, eax
js 0x441ac5
mov edx, dword [esp + 0xc]
xor eax, eax
test edx, edx
je 0x441a70
jmp 0x441a40
test dword [eax + 0x5d0dd0], 0x600
mov ecx, dword [eax + 0x5d0dd4]
je 0x441a56
or edx, ecx
jmp 0x441a5a
not ecx
and edx, ecx
add eax, 8
cmp eax, 0x58
jb 0x441a40
jmp 0x441a8a
test dword [eax + 0x5d0dd0], 0x600
je 0x441a82
or edx, dword [eax + 0x5d0dd4]
add eax, 8
cmp eax, 0x58
jb 0x441a70
mov eax, dword ds:[ebx + 4]
mov dword [esp + 0xc], edx
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x5a08ec]
call esi
jmp 0x441ac5
mov eax, dword [edx + 0x34]
test eax, eax
je 0x441abd
and eax, 0xefefc7fd
or eax, 0x2000100
jmp 0x441ac2
mov eax, 0x2000100
mov dword [edx + 0x34], eax
push ebx
push edi
call sym.SystemInformer.exe_PhShowFileDialog
test al, al
je 0x441af4
push str.Make_sure_the_PE_Viewer_executable_file_is_present.
push 0
push ebx
call sym.SystemInformer.exe_PhGetFileDialogFileName
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push str.ProgramInspectExecutables
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x630570]
test eax, eax
jne 0x441b78
cmp dword [0x633980], eax
mov esi, dword [0x630f04]
cmovne edi, eax
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0x8a
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x441b43
xor eax, eax
jmp 0x441b56
push 0
push 0x47b1e0
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x630570], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x630570]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x630570]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
nop
test eax, eax
je 0x441ba9
push 9
push dword [0x630570]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push dword [0x630570]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call fcn.004365e0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lea eax, ds:[esp + 0x30]
mov dword [esp + 0x14], 0x18
push eax
mov dword [esp + 0x1c], str._taskmgr.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [esp + 0x14]
push eax
push 0x62dba8
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov ebx, eax
mov dword [esp + 0x30], 0x24
lea eax, [esp + 0x30]
mov dword [esp + 0x34], str.TaskmgrWindowState
push eax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
neg eax
sbb esi, esi
and esi, 0x5fea50
call fcn.004750a0
test al, al
jne 0x441d49
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x44
push eax
mov dword [esp + 0x38], str.EnableShellExecuteSkipIfeoDebugger
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x441d49
test ebx, ebx
je 0x441c7d
mov eax, dword [ebx + 4]
jmp 0x441c7f
xor eax, eax
mov dword [esp + 0x54], esi
lea ecx, [esp + 0x40]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x40], 0x3c
mov dword [esp + 0x44], 0x800540
mov dword [esp + 0x48], edi
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 5
call fcn.004f5a40
test al, al
je 0x441d29
mov eax, dword ds:[esp + 0x78]
test eax, eax
je case.0x440ca0.40101
push eax
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
cmp dword [0x62abb0], 0x3e
jb 0x441dc2
lea eax, [esp + 0x30]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x441dc2
push 0
push 0
push edi
call sym.SystemInformer.exe__PhUiConnectToPhSvcEx_12
test al, al
je case.0x440ca0.40101
test ebx, ebx
je 0x441d9f
mov ecx, dword ds:[ebx + 4]
mov edx, esi
call fcn.0047d420
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, esi
call fcn.0047d420
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x441de9
mov ecx, dword [ebx + 4]
mov edx, esi
call fcn.00411de0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, esi
call fcn.00411de0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lea eax, ds:[esp + 0x30]
mov dword [esp + 0x1c], 0x18
push eax
mov dword [esp + 0x24], str.perfmon.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [esp + 0x1c]
push eax
push 0x62dba8
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov esi, eax
mov dword [esp + 0x30], 0x44
lea eax, [esp + 0x30]
mov dword [esp + 0x34], str.EnableShellExecuteSkipIfeoDebugger
push eax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x441e85
nop
test esi, esi
je 0x441e74
mov eax, dword [esi + 4]
mov dword [esp + 0x54], str.__res
jmp 0x441c83
xor eax, eax
mov dword [esp + 0x54], str.__res
jmp 0x441c83
lea eax, [esp + 0x30]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x441efa
push 0
push 0
push edi
call sym.SystemInformer.exe__PhUiConnectToPhSvcEx_12
nop
test al, al
je case.0x440ca0.40101
test esi, esi
je 0x441ed3
mov ecx, dword [esi + 4]
mov edx, str.__res
call fcn.0047d420
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, str.__res
call fcn.0047d420
nop
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x441f21
mov ecx, dword [esi + 4]
mov edx, str.__res
call fcn.00411de0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, str.__res
call fcn.00411de0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x30]
mov dword [esp + 0x24], 0x10
push eax
mov dword [esp + 0x2c], str.wsl.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [esp + 0x24]
push eax
push 0x62dba8
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
test eax, eax
je 0x441f7f
mov eax, dword [eax + 4]
jmp 0x441f81
xor eax, eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x40], 0x3c
mov dword [esp + 0x44], 0x800540
mov dword [esp + 0x48], edi
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], str.___shutdown
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 5
call fcn.004f5a40
lea ebx, [ebx]
test al, al
jne 0x441cf8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
test eax, eax
jns case.0x440ca0.40101
push 0
push eax
push str.Unable_to_shutdown_WSL_instances.
push edi
lfence
call sym.SystemInformer.exe_PhShowStatus
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push ecx
push 0
push 0x440b60
push str.SCManager
mov edx, str.Service_Control_Manager
xor ecx, ecx
call fcn.00531f40
push eax
push 0x531e60
call sym.SystemInformer.exe_PhCreateThread2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push ecx
push 0
push 0x440b90
push str.PowerDefault
mov edx, str.Current_Power_Scheme
jmp 0x44205a
push 0
push 0
push 0
push ecx
push 0
push 0x440b90
push str.RdpDefault
mov edx, str.Terminal_Server_Listener
jmp 0x44205a
push 0
push 0
push 0
push ecx
push 0
push 0x440b90
push str.WmiDefault
mov edx, str.WMI_Root_Namespace
jmp 0x44205a
push 0
push 0
push 0
push ecx
push 0x440be0
push 0x440ba0
push str.Desktop
mov edx, str.Current_Window_Desktop
jmp 0x44205a
push 0
push 0
push 0
push ecx
push 0x440c40
push 0x440c00
push str.WindowStation
mov edx, str.Current_Window_Station
jmp 0x44205a
push dword [0x62b450]
push edi
call sym.SystemInformer.exe__PhUiConnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push dword [0x62b450]
push edi
call sym.SystemInformer.exe__PhUiDisconnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push dword [0x62b450]
push edi
call sym.SystemInformer.exe__PhUiLogoffSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x62b450]
lea eax, [esp + 0x2c]
push 0
push 4
push eax
push 0x18
push 0xffffffffffffffff
or esi, 0xffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
cmovns esi, dword [esp + 0x2c]
cmp ebx, esi
jne 0x4421dd
push str.You_cannot_remote_control_the_current_session.
push 0x5ca058
push str.Unable_to_shadow_session.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x630f04]
lea eax, [esp + 0xc]
push eax
push 0
push 5
push 0xc1
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x440ca0.40101
push ebx
push 0x4beec0
push edi
push dword [esp + 0x18]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x630f04]
lea eax, [esp + 0x2c]
mov ebx, dword [0x62b450]
push eax
push 0
push 5
push 0x98
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x440ca0.40101
push ebx
push 0x4c8140
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x630f04]
xor eax, eax
cmp dword [0x633980], eax
mov ebx, dword [0x62b450]
cmovne edi, eax
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0x99
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x440ca0.40101
push ebx
push 0x4be8a0
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6304ac]
test eax, eax
jne 0x44233a
mov esi, dword [0x630f04]
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0xb2
push esi
call sym.SystemInformer.exe_PhLoadResource
mov edi, edi
test al, al
jne 0x442308
xor eax, eax
jmp 0x44231c
push 0
push 0x43b7a0
push 0
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x6304ac], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x6304ac]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x6304ac]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x44236d
push 9
push dword [0x6304ac]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push dword [0x6304ac]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call fcn.00418ee0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6310ec]
test eax, eax
jne 0x44240b
cmp dword [0x633980], eax
mov esi, dword [0x630f04]
cmovne edi, eax
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0x79
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x4423da
xor eax, eax
jmp 0x4423ed
push 0
push section..text
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x6310ec], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x6310ec]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x6310ec]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x44243b
push 9
push dword [0x6310ec]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push dword [0x6310ec]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x44248c
lea esp, [esp]
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x442480
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiTerminateProcesses_12
test al, al
je 0x4424ad
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x631d7c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test ebx, ebx
je 0x4424d4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4424cf
call fcn.004f9e40
inc edi
cmp edi, ebx
jb 0x4424b6
push dword [esp + 0xc]
push 0
push dword [0x631034]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
jmp 0x442500
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiTerminateTreeProcess_8
test al, al
je 0x442533
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x631d7c]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x44257c
jmp 0x442570
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x442570
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiSuspendProcesses_12
xor edi, edi
test ebx, ebx
je 0x4424d4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4425ab
call fcn.004f9e40
inc edi
cmp edi, ebx
jb 0x442592
jmp 0x4424d4
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSuspendTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x44261c
jmp 0x442610
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x442610
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiResumeProcesses_12
xor edi, edi
test ebx, ebx
je 0x4424d4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44264b
call fcn.004f9e40
inc edi
cmp edi, ebx
jb 0x442632
jmp 0x4424d4
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiResumeTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiFreezeTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiThawTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
mov edx, dword fs:[0x18]
mov ecx, dword [esi + 0x10]
cmp ecx, dword [edx + 0x20]
jne 0x442751
push 0
push 0
push 3
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
push 0
push 0
push 3
push 0
push 5
push 0
xor edx, edx
mov ecx, edi
call fcn.00411860
push 0
sar eax, 0x1f
push 0
and eax, 4
push eax
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
jmp 0x442533
push esi
push edi
call sym.SystemInformer.exe__PhUiRestartProcess_8
jmp 0x44251a
lea ecx, [ecx]
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x440ca0.40101
lock inc dword [ebx - 4]
cmp dword [ebx + 0x10], 4
jne 0x44280b
lea ecx, [ecx]
cmp esi, 0x9c53
jne 0x4427cc
mov esi, dword [0x630f04]
lea eax, ds:[esp + 0x2c]
push eax
push 0
push 5
push 0xfe
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je 0x44289a
push 0
push 0x436340
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push ebx
jmp 0x442534
mov byte [esp + 0x13], 0x11
sub esi, 0x9c42
je 0x4427f4
sub esi, 3
jne 0x4427f9
lea edx, [esp + 0x13]
mov byte [esp + 0x13], 0x35
mov ecx, edi
call fcn.004362a0
push ebx
jmp 0x442534
mov byte [esp + 0x13], 0x19
lea edx, ds:[esp + 0x13]
mov ecx, edi
call fcn.004362a0
push ebx
jmp 0x442534
cmp esi, 0x9c53
jne 0x44284c
mov esi, dword [0x630f04]
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0x100
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je 0x44289a
push ebx
push 0x44b640
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push ebx
jmp 0x442534
add esi, 0xffff63be
cmp esi, 3
ja case.0x442857.40003
jmp dword [esi*4 + 0x44379c]
mov eax, 0x21021
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044a6e0
push ebx
jmp 0x442534
mov eax, 0x6fab67
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044a6e0
push ebx
jmp 0x442534
mov eax, 0x421826
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044a6e0
push ebx
jmp 0x442534
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDebugProcess_8
nop
jmp 0x442533
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
cmp byte [0x633f40], 0
sete cl
movzx ecx, cl
push ecx
push esi
push edi
call sym.SystemInformer.exe__PhUiSetVirtualizationProcess_12
jmp 0x442533
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
push 0
mov edx, esi
mov ecx, edi
call fcn.0040c8e0
jmp 0x442533
lea esp, [esp]
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetCriticalProcess_8
jmp 0x442533
nop
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDetachFromDebuggerProcess_8
jmp 0x442533
nop
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x440ca0.40101
lea esi, ds:[ebx - 4]
lock inc dword [esi]
push 0x58
push 4
push dword [0x631034]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x58
push 0
push eax
mov dword [esp + 0x18], eax
call fcn.0057e450
add esp, 0xc
lock inc dword [esi]
mov eax, dword [esp + 0xc]
push dword [0x630f00]
push 0xc
mov dword [eax + 8], ebx
call sym.SystemInformer.exe_PhCreateObject
push 0x50
mov esi, eax
push 4
push dword [0x631034]
mov dword [esi], 0
mov dword [esi + 4], 0x14
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
mov eax, dword [esp + 0xc]
mov dword [eax + 0xc], esi
mov esi, dword [0x630f04]
mov dword [eax + 4], edi
xor eax, eax
cmp dword [0x633980], eax
cmovne edi, eax
lea eax, [esp + 0x2c]
push eax
push 0
push 5
push 0xaf
push esi
call sym.SystemInformer.exe_PhLoadResource
nop
test al, al
jne 0x442a08
xor esi, esi
jmp 0x442a20
mov eax, dword [esp + 0xc]
push eax
push 0x424de0
push edi
push dword [esp + 0x38]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
jmp 0x442534
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
mov edx, esi
call fcn.00425720
jmp 0x442533
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x440ca0.40101
add esi, 0xffff62d1
cmp esi, 4
ja case.default.0x442a73
jmp dword [esi*4 + 0x4437ac]
mov eax, 1
jmp 0x442aa2
mov eax, 2
jmp 0x442aa2
mov eax, 3
jmp 0x442aa2
mov eax, 4
jmp 0x442aa2
mov eax, 5
jmp 0x442aa2
mov eax, dword [esp + 0x2c]
lock inc dword [ebx - 4]
push eax
push ebx
push edi
call sym.SystemInformer.exe__PhUiSetPagePriorityProcess_12
push ebx
jmp 0x442534
lea eax, ds:[esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x442adf
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x442ad3
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiReduceWorkingSetProcesses_12
xor edi, edi
test ebx, ebx
je 0x4424d4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x442b0d
call fcn.004f9e40
inc edi
cmp edi, ebx
jb 0x442af4
jmp 0x4424d4
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
lea esp, [esp]
test eax, eax
je case.0x440ca0.40101
mov eax, dword [eax + 0x34]
test eax, eax
je case.0x440ca0.40101
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x18
push eax
mov dword [esp + 0x3c], str.RunAsProgram
call sym.SystemInformer.exe_PhSetStringRefSetting
xor edx, edx
mov ecx, edi
call fcn.004b65c0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x440ca0.40101
mov edx, dword ds:[eax + 0x10]
mov ecx, edi
call fcn.004b65c0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
mov edx, esi
mov ecx, edi
call fcn.00437a20
jmp 0x442533
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
lfence
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x442bec
jmp 0x442be0
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x442be0
push ebx
mov ecx, esi
call fcn.00462800
xor edi, edi
test ebx, ebx
je 0x4424d4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x442c1a
call fcn.004f9e40
inc edi
cmp edi, ebx
jb 0x442c01
nop
jmp 0x4424d4
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
lfence
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x442c51
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x442c45
push ebx
mov ecx, esi
call fcn.004628a0
xor edi, edi
test ebx, ebx
je 0x4424d4
or esi, 0xffffffff
jmp 0x442c70
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x442c89
call fcn.004f9e40
inc edi
cmp edi, ebx
jb 0x442c70
jmp 0x4424d4
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetEcoModeProcess_8
jmp 0x442533
push dword [0x633f3c]
mov edi, edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x440ca0.40101
xor eax, eax
mov dword [esp + 0x40], 0x2c
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
lea eax, [esp + 0x40]
push eax
push dword [0x633f3c]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword [esp + 0x48], 6
je 0x442d4f
push dword [0x633f3c]
mov edi, edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push dword [0x633f3c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x440ca0.40101
push 9
push dword [0x633f3c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push dword [0x633f3c]
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, edi
test eax, eax
je case.0x440ca0.40101
push 6
push dword [0x633f3c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push dword [0x633f3c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x440ca0.40101
push 3
push dword [0x633f3c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push dword [0x633f3c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x440ca0.40101
push 0
push 0
push 0x10
push dword [0x633f3c]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lea ecx, [ecx]
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
mov eax, dword [esi + 0x38]
test eax, eax
je case.0x440ca0.40101
cmp dword ds:[eax], 0
je case.0x440ca0.40101
push eax
call sym.SystemInformer.exe_PhDoesFileExist
test al, al
je case.0x440ca0.40101
lock inc dword [esi - 4]
mov eax, dword [esi + 0x34]
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [eax + 4]
push str.FileBrowseExecutable
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
jmp 0x442533
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
lea ebx, [ebx]
test eax, eax
je case.0x440ca0.40101
mov eax, dword [eax + 0x18]
push dword [eax + 4]
push edi
call sym.SystemInformer.exe__PhSearchOnlineString_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x440ca0.40101
push eax
call fcn.00462600
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push 0
push dword [0x631d7c]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x631d7c]
call sym.SystemInformer.exe_PhSetClipboardString
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne case.0x440ca0.40101
mov edi, edi
call fcn.004f9e40
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
nop
test eax, eax
je case.0x440ca0.40101
push dword [eax + 0x2c]
call sym.SystemInformer.exe__PhFindProcessNode_4
mov esi, eax
test esi, esi
je case.0x440ca0.40101
mov ecx, dword [0x633f38]
mov ecx, dword [ecx + 0x14]
call fcn.00448670
push dword [0x633f34]
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, 1
mov dword [esp + 0x2c], esi
lea ecx, [esp + 0x2c]
call fcn.0049df60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x442fa4
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x442f98
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiStartServices_12
xor edi, edi
test ebx, ebx
je 0x4424d4
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x442fd9
call fcn.004f9e40
inc edi
cmp edi, ebx
jb 0x442fc0
mov edi, edi
jmp 0x4424d4
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword ds:[esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x443010
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x443004
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiContinueServices_12
xor edi, edi
test ebx, ebx
je 0x4424d4
or esi, 0xffffffff
jmp 0x443030
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x443049
call fcn.004f9e40
inc edi
cmp edi, ebx
jb 0x443030
jmp 0x4424d4
lea eax, ds:[esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x44307f
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x443073
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiPauseServices_12
xor edi, edi
test ebx, ebx
je 0x4424d4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4430ad
call fcn.004f9e40
inc edi
cmp edi, ebx
jb 0x443094
jmp 0x4424d4
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x4430e4
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4430d4
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiStopServices_12
xor edi, edi
test ebx, ebx
je 0x4424d4
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x443119
call fcn.004f9e40
inc edi
cmp edi, ebx
jb 0x443100
mov edi, edi
jmp 0x4424d4
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDeleteService_8
nop
test al, al
je 0x442533
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x632244]
jmp 0x44252d
lea esp, [esp]
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x440ca0.40101
push dword [eax + 8]
lea eax, [esp + 0x30]
push 0x20019
push eax
call sym.SystemInformer.exe_PhOpenServiceKey
nop
test eax, eax
js 0x443251
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x44321d
cmp edx, 0xffffffff
je 0x44321d
lea ecx, [ecx]
cmp edx, 0xfffffffe
je 0x44321d
lea eax, [esp + 0xc]
or esi, 0xffffffff
push eax
push 0
mov ecx, esi
call fcn.00528ae0
lea ebx, [ebx]
test eax, eax
js 0x44321d
mov ebx, dword [esp + 0xc]
push ebx
call sym.SystemInformer.exe_PhFormatNativeKeyName
mov dword [esp + 0xc], eax
test ebx, ebx
je 0x4431ee
lea ecx, [ebx - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x4431ee
call fcn.004f9e40
mov eax, dword [esp + 0xc]
push eax
push edi
call sym.SystemInformer.exe__PhShellOpenKey2_8
push dword [esp + 0xc]
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push str.The_service_does_not_exist.
push 0x5ca058
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
push str.The_service_does_not_exist.
push 0x5ca058
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
lea ecx, [ecx]
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
mov eax, dword [esi + 8]
test eax, eax
je 0x44329b
mov eax, dword [eax + 4]
jmp 0x44329d
xor eax, eax
push eax
push 1
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_PhOpenService
test eax, eax
js case.0x440ca0.40101
mov ebx, dword ds:[esp + 0x2c]
mov ecx, ebx
mov edx, dword [esi + 8]
call fcn.00520040
mov esi, eax
test esi, esi
je 0x4432eb
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [esi + 4]
push str.FileBrowseExecutable
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x440ca0.40101
lea ecx, [esi - 4]
lock inc dword [ecx]
lock inc dword [ecx]
push esi
push 0x4c5240
call sym.SystemInformer.exe_PhCreateThread2
jmp 0x442533
push 0
push dword [0x632244]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x632244]
jmp 0x442ee7
call fcn.004693e0
test eax, eax
je case.0x440ca0.40101
push dword ds:[eax + 0x38]
jmp 0x442f2b
call fcn.004693e0
test eax, eax
je case.0x440ca0.40101
mov eax, dword [eax + 0x48]
test eax, eax
je case.0x440ca0.40101
push dword [eax + 4]
call sym.SystemInformer.exe__PhReferenceServiceItem_4
mov esi, eax
test esi, esi
je case.0x440ca0.40101
mov ecx, dword [0x633f18]
mov ecx, dword [ecx + 0x14]
call fcn.00448670
push dword [0x633f14]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
push 0
push 0xc
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
jmp 0x442533
lea edx, [esp + 0x2c]
lea ecx, [esp + 0xc]
call fcn.00469420
mov ebx, dword [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0xc]
test ebx, ebx
je 0x4433df
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4433d3
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiCloseConnections_12
test al, al
je 0x443406
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x63169c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test ebx, ebx
je 0x4424d4
or esi, 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44342c
call fcn.004f9e40
inc edi
cmp edi, ebx
jb 0x443413
jmp 0x4424d4
push 0
push dword [0x63169c]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x63169c]
jmp 0x442ee7
push 0
push 0
push 0x130b
push dword [0x631404]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x631408]
xor esi, esi
mov edx, dword [ecx]
lea ecx, [eax + 1]
dec edx
cmp eax, edx
cmove ecx, esi
jmp 0x4434a0
push 0
push 0
push 0x130b
push dword [0x631404]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x44349d
mov eax, dword [0x631408]
mov eax, dword [eax]
dec eax
mov ecx, eax
call fcn.00448670
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret