Function at 0x443559
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x62d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
lea eax, [esi - 0x9c41]
cmp eax, 0x138
ja case.0x443552.40011
movzx eax, byte [eax + 0x445d68]
jmp dword [eax*4 + 0x445bcc]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x16
push eax
mov dword [ebp - 0x5c], str.HideOnClose
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x4435a2
call fcn.0046fdc0
lea esp, [esp]
test al, al
je case.0x443552.40011
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x1a
push eax
mov dword [ebp - 0x5c], str.CloseOnEscape
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
lea esp, [esp]
test eax, eax
je case.0x443552.40011
push 0
push 0
push 0
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x633f80]
lea eax, ds:[ebp - 0x54]
push eax
push 0
push 5
push 0xfd
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443552.40011
push 0
push 0x4bb600
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
xor edx, edx
call fcn.004b84e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x633f80]
xor eax, eax
cmp dword [0x636a80], eax
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x107
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443552.40011
push edi
push 0x4bcd00
push 0
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push 0
push 0
push 3
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
push 0
push 0
push 3
push 1
push 5
push str._v__newinstance
xor edx, edx
mov ecx, edi
call fcn.00413760
push 0
sar eax, 0x1f
push 0
and eax, 4
push eax
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov edi, edi
call sym.SystemInformer.exe_PhCreateSaveFileDialog
mov ecx, dword [0x634484]
mov ebx, eax
push 3
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x40], 0x20
mov dword [ebp - 0x3c], 0x5c9820
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
push 0x62e468
push ebx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x10], 8
mov dword [ebp - 0xc], str..txt
call sym.SystemInformer.exe_PhSetFileDialogFilter
push 0x3c
push 3
lea eax, [ebp - 0x50]
push eax
call sym.SystemInformer.exe_PhFormat
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push ebx
call sym.SystemInformer.exe_PhSetFileDialogFileName
push ebx
push edi
call sym.SystemInformer.exe_PhShowFileDialog
lea esp, [esp]
test al, al
je 0x44380d
push ebx
call sym.SystemInformer.exe_PhGetFileDialogFileName
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push ebx
mov esi, eax
call sym.SystemInformer.exe_PhGetFileDialogFilterIndex
push 0
push 5
push 1
push 0x120116
push dword [esi + 4]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x54]
push eax
call sym.SystemInformer.exe_PhCreateFileStream
test eax, eax
js 0x4437fc
mov edi, dword [ebp - 0x54]
push 2
push 0x617da0
push edi
call sym.SystemInformer.exe_PhWriteStringAsUtf8FileStreamEx
push edi
call sym.SystemInformer.exe__PhWritePhTextHeader_4
xor ecx, ecx
mov dword [ebp - 0x60], edi
mov eax, 2
cmp dword [ebp - 0x6c], eax
push ecx
cmovne eax, ecx
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [0x634484]
push 7
push eax
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5a28f0]
call esi
push edi
call sym.SystemInformer.exe_PhDereferenceObject
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push 0
push eax
push str.Unable_to_create_the_file
push edi
lfence
call sym.SystemInformer.exe_PhShowStatus
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
cmp dword [0x634244], 0
jne 0x443865
push 0
push 0x4265c0
push 0x634244
call sym.SystemInformer.exe_PhCreateThreadEx
test eax, eax
js 0x4440bc
test byte [0x62e360], 1
jne 0x443865
xor edx, edx
mov ecx, 0x62e360
call sym.SystemInformer.exe_PhfWaitForEvent
push 0
push 0
push 0x8321
push dword [0x634250]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call fcn.004755a0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lfence
call fcn.00446580
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push 0
call sym.SystemInformer.exe__PhShowSystemInformationDialog_4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lfence
call fcn.004498c0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lfence
call fcn.00449d80
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x634650]
test eax, eax
jne 0x44392c
push eax
push 0x464f20
push 0x634e2c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x634650], eax
jmp 0x44395d
push eax
push 0x634e2c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x634650], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x634e3c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x634e2c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x2c
cmp dword [0x634650], eax
mov dword [ebp - 0x5c], str.HideOtherUserProcesses
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x634694]
test eax, eax
jne 0x4439f5
cmp byte [0x636a4a], al
jne 0x4439dd
push str.Enable_it_in_Options___General_and_restart_System_Informer.
push str.This_filter_cannot_function_because_digital_signature_checking_is_not_enabled._r_n_s
push eax
push 0xfffd
push 0x20
push dword [sym.SystemInformer.exe_PhMainWndHandle]
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push 0
push 0x465000
push 0x634e2c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x634694], eax
jmp 0x443a2b
push eax
push 0x634e2c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x634694], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x634e3c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x634e2c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x26
cmp dword [0x634694], eax
mov dword [ebp - 0x5c], str.HideSignedProcesses
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x634674]
test eax, eax
jne 0x443a8c
push eax
push 0x465020
push 0x634e2c
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
mov dword [0x634674], eax
jmp 0x443abd
push eax
push 0x634e2c
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
push 1
mov dword [0x634674], 0
call sym.SystemInformer.exe__PhExpandAllProcessNodes_4
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x634e3c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x634e2c
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x2c
cmp dword [0x634674], eax
mov dword [ebp - 0x5c], str.HideMicrosoftProcesses
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x60], 0x28
cmp dword [0x636a58], eax
mov dword [ebp - 0x5c], str.ScrollToNewProcesses
sete al
push eax
mov dword [0x636a58], eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x60], 0x1e
cmp dword [0x636a4c], eax
mov dword [ebp - 0x5c], str.ShowCpuBelow001
sete al
push eax
mov dword [0x636a4c], eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov edi, edi
call sym.SystemInformer.exe__PhInvalidateAllProcessNodes_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x63472c]
test eax, eax
jne 0x443b91
push eax
push 0x468420
push 0x635304
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
jmp 0x443b9e
push eax
push 0x635304
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
push 0x635304
mov dword [0x63472c], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x24
cmp dword [0x63472c], eax
mov dword [ebp - 0x5c], str.HideDriverServices
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6346c8]
test eax, eax
je 0x443bf9
push eax
push 0x635304
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x443c0a
push 0
push 0x468440
push 0x635304
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
push 0x635304
mov dword [0x6346c8], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x26
cmp dword [0x6346c8], eax
mov dword [ebp - 0x5c], str.HideDefaultServices
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6345ec]
test eax, eax
je 0x443c69
push eax
push 0x634768
call sym.SystemInformer.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x443c7a
push 0
push 0x463ea0
push 0x634768
call sym.SystemInformer.exe__PhAddTreeNewFilter_12
push 0x634768
mov dword [0x6345ec], eax
call sym.SystemInformer.exe__PhApplyTreeNewFilters_4
xor eax, eax
mov dword [ebp - 0x60], 0x2c
cmp dword [0x6345ec], eax
mov dword [ebp - 0x5c], str.HideWaitingConnections
setne al
push eax
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
cmp byte [0x6341ee], 0
push 0x13
push 0
sete al
push 0
mov byte [0x6341ee], al
push 0
movzx eax, al
push 0
sub eax, 2
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
movzx eax, byte [0x6341ee]
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x2a
push eax
mov dword [ebp - 0x5c], str.MainWindowAlwaysOnTop
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov al, byte [0x6341ee]
xor edi, edi
mov byte [ebp - 0x6d], al
mov ecx, 0x635c6c
lock bts dword [ecx], 0
setb al
test al, al
je 0x443d29
call sym.SystemInformer.exe_PhfAcquireQueuedLockExclusive
mov ebx, dword [0x635cb0]
nop
mov ecx, dword [ebx + 0x24]
cmp edi, ecx
jae 0x443d52
mov edx, dword [ebx]
add edx, 8
mov eax, edx
imul eax, edi
add eax, dword [ebx + 0x18]
mov esi, eax
inc edi
add eax, edx
cmp dword [esi], 0xffffffff
jne 0x443d96
cmp edi, ecx
jb 0x443d44
or edi, 0xffffffff
mov ecx, 0x635c6c
lock xadd dword [ecx], edi
mov eax, edi
and al, 6
cmp al, 2
jne case.0x443552.40011
dec edi
mov eax, edi
lea edx, [edi + 4]
mov esi, edx
lock cmpxchg dword [ecx], esi
cmp eax, edi
jne case.0x443552.40011
mov edi, edi
call fcn.00520ae0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
test byte [esi + 0xc], 1
je 0x443d30
mov esi, dword [esi + 8]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0x13
push 0
xor eax, eax
cmp byte [ebp - 0x6d], al
push 0
push 0
setne al
push 0
add eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x443d29
lea eax, [esi + esi*4]
mov esi, 0x62066
add eax, eax
sub esi, eax
lea eax, [ebp - 0x60]
push esi
lfence
push eax
mov dword [ebp - 0x60], 0x22
mov dword [ebp - 0x5c], str.MainWindowOpacity
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov edx, esi
mov ecx, edi
call fcn.00413260
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push 0
push 0x6370c0
call sym.SystemInformer.exe_PhBoostProvider
push 0
push 0x6370a0
call sym.SystemInformer.exe_PhBoostProvider
cmp byte [0x637098], 0
je case.0x443552.40011
push 0
push 0x637080
call sym.SystemInformer.exe_PhBoostProvider
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
add esi, 0xffff6325
cmp esi, 4
ja case.default.0x443e60
lea ebx, [ebx]
jmp dword [esi*4 + 0x445ea4]
mov esi, 0x1f4
jmp 0x443e8d
mov esi, 0x3e8
jmp 0x443e8d
mov esi, 0x7d0
jmp 0x443e8d
mov esi, 0x1388
jmp 0x443e8d
mov esi, 0x2710
jmp 0x443e8d
mov esi, dword [ebp - 0x54]
push esi
lea eax, [ebp - 0x60]
mov dword [0x636a54], esi
push eax
mov dword [ebp - 0x60], 0x1c
mov dword [ebp - 0x5c], str.UpdateInterval
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov ecx, dword [0x6370e4]
mov edi, 0x2710
mov dword [0x6370e8], esi
test ecx, ecx
je 0x443ee9
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [ebp - 0x60], eax
adc edx, 0
push 0
lea eax, [ebp - 0x60]
neg edx
push eax
push ecx
mov dword [ebp - 0x5c], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ecx, dword [0x637104]
mov dword [0x637108], esi
test ecx, ecx
je 0x443f1e
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [ebp - 0x60], eax
adc edx, 0
push 0
lea eax, [ebp - 0x60]
neg edx
push eax
push ecx
mov dword [ebp - 0x5c], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ecx, dword [0x637124]
mov dword [0x637128], esi
test ecx, ecx
je case.0x443552.40011
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [ebp - 0x60], eax
adc edx, 0
push 0
lea eax, [ebp - 0x60]
neg edx
push eax
push ecx
mov dword [ebp - 0x5c], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
cmp byte [0x62d94c], 0
push ecx
sete al
mov ecx, 9
movzx edx, al
mov byte [0x62d94c], al
call fcn.0044ade0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
test byte [0x630a7c], 1
mov edi, edi
jne 0x4440a8
mov esi, 0x630a7c
lock bts dword [esi], 0x1f
setb al
test al, al
jne 0x444096
push dword [0x633f68]
push 0x28
call sym.SystemInformer.exe_PhCreateObject
mov edx, eax
mov ebx, 1
xor eax, eax
mov ecx, ebx
mov word [edx], ax
lock xadd dword [0x633f64], ecx
inc ecx
push dword [0x633f68]
dec cl
mov dword [edx + 4], eax
movzx eax, cl
push 0x28
mov byte [edx + 2], cl
mov dword [edx + 8], 0x4e2d40
mov dword [edx + 0xc], str.ThreadStacks
mov dword [eax*4 + 0x6365a0], edx
mov dword [0x635b90], edx
call sym.SystemInformer.exe_PhCreateObject
mov edx, eax
mov ecx, ebx
xor eax, eax
mov word [edx], ax
lock xadd dword [0x633f64], ecx
inc ecx
push dword [0x633f68]
dec cl
mov dword [edx + 4], eax
movzx eax, cl
push 0x28
mov byte [edx + 2], cl
mov dword [edx + 8], 0x4e2ca0
mov dword [edx + 0xc], str.ThreadStacksWorker
mov dword [eax*4 + 0x6365a0], edx
mov dword [0x635b8c], edx
call sym.SystemInformer.exe_PhCreateObject
mov edx, eax
xor eax, eax
mov word [edx], ax
lock xadd dword [0x633f64], ebx
inc ebx
dec bl
mov dword [edx + 4], eax
movzx eax, bl
mov ecx, esi
mov byte [edx + 2], bl
mov dword [edx + 8], 0x4e2a60
mov dword [edx + 0xc], str.ThreadStacksNode
mov dword [eax*4 + 0x6365a0], edx
mov dword [0x635b94], edx
call sym.SystemInformer.exe_PhfEndInitOnce
jmp 0x4440a8
test byte [0x630a7c], 1
jne 0x4440a8
xor edx, edx
mov ecx, esi
call sym.SystemInformer.exe_PhfWaitForEvent
push 0
push 0x4e61a0
call sym.SystemInformer.exe_PhCreateThread2
test eax, eax
jns case.0x443552.40011
push str.Unable_to_create_the_window.
push 0x5cc434
push 0x10
push dword [sym.SystemInformer.exe_PhMainWndHandle]
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x633f80]
xor eax, eax
cmp dword [0x636a80], eax
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0xa8
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443552.40011
push 0
push 0x4c37a0
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x634254]
lea ecx, [ecx]
test eax, eax
jne 0x444180
mov esi, dword [0x633f80]
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x87
push esi
call sym.SystemInformer.exe_PhLoadResource
lea ecx, [ecx]
test al, al
jne 0x444168
xor eax, eax
jmp 0x44417b
push 0
push 0x429140
push 0
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [0x634254], eax
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4441aa
push 5
push dword [0x634254]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push dword [0x634254]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe_PhCreateOpenFileDialog
push 2
mov ebx, eax
push 0x62e484
push ebx
call sym.SystemInformer.exe_PhSetFileDialogFilter
cmp byte [ebx], 0
mov edx, dword [ebx + 4]
je 0x444284
mov ecx, dword [edx]
lea eax, [ebp - 0x6c]
push eax
push edx
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0x5a28f0]
call esi
lea ecx, [ecx]
test eax, eax
js 0x44429f
mov edx, dword [ebp - 0x6c]
xor eax, eax
test edx, edx
je 0x444250
jmp 0x444220
test dword [eax + 0x5d3000], 0x600
mov ecx, dword [eax + 0x5d3004]
je 0x444236
or edx, ecx
jmp 0x44423a
not ecx
and edx, ecx
add eax, 8
cmp eax, 0x58
jb 0x444220
jmp 0x44426a
test dword [eax + 0x5d3000], 0x600
je 0x444262
or edx, dword [eax + 0x5d3004]
add eax, 8
cmp eax, 0x58
jb 0x444250
mov eax, dword [ebx + 4]
mov dword [ebp - 0x6c], edx
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x5a28f0]
nop
call esi
jmp 0x44429f
mov eax, dword [edx + 0x34]
test eax, eax
je 0x444297
and eax, 0xefefc7fd
or eax, 0x2000100
jmp 0x44429c
mov eax, 0x2000100
mov dword [edx + 0x34], eax
push ebx
push edi
call sym.SystemInformer.exe_PhShowFileDialog
test al, al
je 0x4442cc
push str.Make_sure_the_PE_Viewer_executable_file_is_present.
push 0
push ebx
call sym.SystemInformer.exe_PhGetFileDialogFileName
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push str.ProgramInspectExecutables
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
push ebx
call sym.SystemInformer.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6335ec]
test eax, eax
jne 0x44434b
cmp dword [0x636a80], eax
mov esi, dword [0x633f80]
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x8a
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x44431a
xor eax, eax
jmp 0x44432c
push 0
push 0x47ca00
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x6335ec], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x6335ec]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x6335ec]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x444377
push 9
push dword [0x6335ec]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push dword [0x6335ec]
lea ecx, [ecx]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call fcn.00438ce0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lea eax, ds:[ebp - 0x60]
mov dword [ebp - 0x78], 0x18
push eax
mov dword [ebp - 0x74], str._taskmgr.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [ebp - 0x78]
push eax
push 0x630c00
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov ebx, eax
mov dword [ebp - 0x60], 0x24
lea eax, [ebp - 0x60]
mov dword [ebp - 0x5c], str.TaskmgrWindowState
push eax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
neg eax
sbb esi, esi
and esi, 0x600e50
call fcn.004768c0
test al, al
jne 0x444457
lea eax, ds:[ebp - 0x60]
mov dword [ebp - 0x60], 0x44
push eax
mov dword [ebp - 0x5c], str.EnableShellExecuteSkipIfeoDebugger
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x444457
test ebx, ebx
je 0x444432
mov eax, dword [ebx + 4]
jmp 0x444434
xor eax, eax
push 0
push 0
push 0
push 5
push 0
push esi
push eax
push edi
call sym.SystemInformer.exe_PhShellExecuteEx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
cmp dword [0x62dbb0], 0x3e
mov edi, edi
jb 0x4444d6
lea eax, [ebp - 0x68]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x4444d6
push 0
push 0
push edi
call sym.SystemInformer.exe__PhUiConnectToPhSvcEx_12
test al, al
je case.0x443552.40011
test ebx, ebx
je 0x4444b6
mov ecx, dword [ebx + 4]
mov edx, esi
call fcn.0047ec40
jmp 0x4444a0
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, esi
call fcn.0047ec40
nop
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x4444f6
mov ecx, dword ds:[ebx + 4]
mov edx, esi
call fcn.00413ce0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, esi
call fcn.00413ce0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
mov dword [ebp - 0x80], 0x18
push eax
mov dword [ebp - 0x7c], str.perfmon.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [ebp - 0x80]
push eax
push 0x630c00
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov esi, eax
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 0x60]
mov dword [ebp - 0x5c], str.EnableShellExecuteSkipIfeoDebugger
push eax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
jmp 0x444560
test eax, eax
je 0x44459a
test esi, esi
je 0x444571
mov eax, dword [esi + 4]
jmp 0x444573
xor eax, eax
push 0
push 0
push 0
push 5
push 0
push str.__res
push eax
push edi
call sym.SystemInformer.exe_PhShellExecuteEx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lea eax, ds:[ebp - 0x68]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x444616
push 0
push 0
push edi
call sym.SystemInformer.exe__PhUiConnectToPhSvcEx_12
lea esp, [esp]
test al, al
je case.0x443552.40011
test esi, esi
je 0x4445ef
mov ecx, dword [esi + 4]
mov edx, str.__res
call fcn.0047ec40
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, str.__res
call fcn.0047ec40
jmp 0x444600
call sym.SystemInformer.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x444638
mov ecx, dword [esi + 4]
mov edx, str.__res
call fcn.00413ce0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, str.__res
call fcn.00413ce0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
mov dword [ebp - 0x88], 0x10
push eax
mov dword [ebp - 0x84], str.wsl.exe
call sym.SystemInformer.exe_PhGetSystemRoot
lea eax, [ebp - 0x88]
push eax
push 0x630c00
lea eax, [ebp - 0x60]
push eax
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
test eax, eax
je 0x444697
mov eax, dword [eax + 4]
jmp 0x444699
xor eax, eax
push 0
push 0
push 0
push 5
push 0
push str.___shutdown
push eax
push edi
call sym.SystemInformer.exe_PhShellExecuteEx
test eax, eax
jns case.0x443552.40011
push 0
push eax
push str.Unable_to_shutdown_WSL_instances.
push edi
lfence
call sym.SystemInformer.exe_PhShowStatus
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push ecx
push 0
push 0x4433e0
push str.SCManager
mov edx, str.Service_Control_Manager
xor ecx, ecx
call fcn.00534620
push eax
push 0x534540
call sym.SystemInformer.exe_PhCreateThread2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push ecx
push 0
push 0x443430
push str.PowerDefault
mov edx, str.Current_Power_Scheme
jmp 0x4446f1
push 0
push 0
push 0
push ecx
push 0
push 0x443430
push str.RdpDefault
mov edx, str.Terminal_Server_Listener
jmp 0x4446f1
push 0
push 0
push 0
push ecx
push 0
push 0x443430
push str.WmiDefault
mov edx, str.WMI_Root_Namespace
jmp 0x4446f1
push 0
push 0
push 0
push ecx
push 0x443480
push 0x443440
push str.Desktop
mov edx, str.Current_Window_Desktop
jmp 0x4446f1
push 0
push 0
push 0
push ecx
push 0x4434e0
push 0x4434a0
push str.WindowStation
mov edx, str.Current_Window_Station
jmp 0x4446f1
push dword [0x62e464]
push edi
call sym.SystemInformer.exe__PhUiConnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push dword [0x62e464]
push edi
call sym.SystemInformer.exe__PhUiDisconnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push dword [0x62e464]
push edi
call sym.SystemInformer.exe__PhUiLogoffSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x62e464]
lea eax, [ebp - 0x54]
push 0
push 4
push eax
push 0x18
push 0xffffffffffffffff
or esi, 0xffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
cmovns esi, dword [ebp - 0x54]
cmp ebx, esi
jne 0x444859
push str.You_cannot_remote_control_the_current_session.
push 0x5cc434
push str.Unable_to_shadow_session.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x633f80]
lea eax, [ebp - 0x6c]
push eax
push 0
push 5
push 0xc1
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443552.40011
push ebx
push 0x4c0d60
push edi
push dword [ebp - 0x6c]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x633f80]
lea eax, [ebp - 0x54]
mov ebx, dword [0x62e464]
push eax
push 0
push 5
push 0x98
push esi
call sym.SystemInformer.exe_PhLoadResource
jmp 0x4448c0
test al, al
je case.0x443552.40011
push ebx
push 0x4c9ec0
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov esi, dword [0x633f80]
xor eax, eax
cmp dword [0x636a80], eax
mov ebx, dword [0x62e464]
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x99
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je case.0x443552.40011
push ebx
push 0x4c0740
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x63352c]
test eax, eax
jne 0x4449a4
mov esi, dword [0x633f80]
lea eax, ds:[ebp - 0x54]
push eax
push 0
push 5
push 0xb2
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x44496d
xor eax, eax
jmp 0x444986
push 0
push 0x43dfc0
push 0
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x63352c], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x63352c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x63352c]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4449ce
push 9
push dword [0x63352c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push dword [0x63352c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call fcn.0041ae20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x634168]
test eax, eax
jne 0x444a6b
cmp dword [0x636a80], eax
mov esi, dword [0x633f80]
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x79
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
jne 0x444a35
xor eax, eax
jmp 0x444a47
push 0
push section..text
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x634168], eax
call sym.SystemInformer.exe__PhRegisterDialog_4
push 5
push dword [0x634168]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x634168]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x444a97
push 9
push dword [0x634168]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push dword [0x634168]
lea ecx, [ecx]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lea eax, ds:[ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x444add
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x444ad1
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiTerminateProcesses_12
test al, al
je 0x444afe
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x634e3c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test ebx, ebx
je 0x444b2d
or esi, 0xffffffff
jmp 0x444b10
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x444b28
call fcn.004fbd80
inc edi
cmp edi, ebx
jb 0x444b10
push dword [ebp - 0x6c]
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiTerminateTreeProcess_8
test al, al
je 0x444b86
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x634e3c]
lea esp, [esp]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x444bc4
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x444bb6
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiSuspendProcesses_12
xor edi, edi
test ebx, ebx
je 0x444b2d
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x444bf8
call fcn.004fbd80
inc edi
cmp edi, ebx
jb 0x444be0
lea ecx, [ecx]
jmp 0x444b2d
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSuspendTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lea eax, ds:[ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x444c5d
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x444c51
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiResumeProcesses_12
xor edi, edi
test ebx, ebx
je 0x444b2d
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x444c8a
call fcn.004fbd80
inc edi
cmp edi, ebx
jb 0x444c72
jmp 0x444b2d
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiResumeTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword ds:[esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiFreezeTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lea esp, [esp]
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiThawTreeProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
mov edx, dword fs:[0x18]
mov ecx, dword [esi + 0x10]
cmp ecx, dword [edx + 0x20]
jne 0x444d94
push 0
push 0
push 3
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
push 0
push 0
push 3
push 0
push 5
push 0
xor edx, edx
mov ecx, edi
call fcn.00413760
push 0
sar eax, 0x1f
push 0
and eax, 4
push eax
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
jmp 0x444b86
push esi
push edi
call sym.SystemInformer.exe__PhUiRestartProcess_8
jmp 0x444da0
jmp 0x444b69
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x443552.40011
lock inc dword ds:[ebx - 4]
cmp dword [ebx + 0x10], 4
jne 0x444e51
cmp esi, 0x9c53
jne 0x444e0c
mov esi, dword [0x633f80]
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0xfe
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je 0x444ee9
push 0
push 0x438a40
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push ebx
jmp 0x444b87
mov byte [ebp - 0x6d], 0x11
sub esi, 0x9c42
je 0x444e3d
lea esp, [esp]
sub esi, 3
jne 0x444e41
lea edx, [ebp - 0x6d]
mov byte [ebp - 0x6d], 0x35
mov ecx, edi
call fcn.004389a0
push ebx
jmp 0x444b87
mov byte [ebp - 0x6d], 0x19
lea edx, [ebp - 0x6d]
mov ecx, edi
call fcn.004389a0
push ebx
jmp 0x444b87
cmp esi, 0x9c53
jne 0x444e95
mov esi, dword [0x633f80]
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0x100
push esi
call sym.SystemInformer.exe_PhLoadResource
test al, al
je 0x444ee9
push ebx
push 0x44ddc0
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push ebx
jmp 0x444b87
add esi, 0xffff63be
cmp esi, 3
ja case.0x444ea9.40003
jmp dword [esi*4 + 0x445eb8]
mov eax, 0x21021
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044ce60
push ebx
jmp 0x444b87
mov eax, 0x6fab67
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044ce60
push ebx
jmp 0x444b87
mov eax, 0x421826
mov edx, ebx
push eax
mov ecx, edi
call fcn.0044ce60
push ebx
jmp 0x444b87
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDebugProcess_8
jmp 0x444b86
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
cmp byte [0x637040], 0
sete cl
movzx ecx, cl
push ecx
push esi
push edi
call sym.SystemInformer.exe__PhUiSetVirtualizationProcess_12
jmp 0x444b86
jmp 0x444f40
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
push 0
mov edx, esi
mov ecx, edi
call fcn.0040e020
mov edi, edi
jmp 0x444b86
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetCriticalProcess_8
nop
jmp 0x444b86
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDetachFromDebuggerProcess_8
nop
jmp 0x444b86
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x443552.40011
lea esi, [ebx - 4]
lock inc dword [esi]
push 0x58
push 4
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x58
push 0
push eax
mov dword [ebp - 0x6c], eax
call fcn.00580b30
add esp, 0xc
lock inc dword [esi]
mov eax, dword [ebp - 0x6c]
push dword [0x633f7c]
push 0xc
mov dword [eax + 8], ebx
call sym.SystemInformer.exe_PhCreateObject
push 0x50
mov esi, eax
push 4
push dword [0x633f94]
mov dword [esi], 0
mov dword [esi + 4], 0x14
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [eax + 0xc], esi
mov esi, dword [0x633f80]
mov dword [eax + 4], edi
xor eax, eax
cmp dword [0x636a80], eax
cmovne edi, eax
lea eax, [ebp - 0x54]
push eax
push 0
push 5
push 0xaf
push esi
call sym.SystemInformer.exe_PhLoadResource
nop
test al, al
jne 0x44504f
xor esi, esi
jmp 0x445068
mov eax, dword ds:[ebp - 0x6c]
push eax
push 0x426e40
push edi
push dword [ebp - 0x54]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
jmp 0x444b87
mov edi, edi
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
mov edx, esi
call fcn.00427780
jmp 0x444b86
nop
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x443552.40011
add esi, 0xffff62d1
cmp esi, 4
ja case.default.0x4450c0
mov edi, edi
jmp dword [esi*4 + 0x445ec8]
mov eax, 1
jmp 0x4450fc
mov eax, 2
jmp 0x4450fc
mov eax, 3
jmp 0x4450fc
mov eax, 4
jmp 0x4450fc
mov eax, 5
jmp 0x4450fc
mov eax, dword [ebp - 0x54]
lock inc dword [ebx - 4]
push eax
push ebx
push edi
call sym.SystemInformer.exe__PhUiSetPagePriorityProcess_12
push ebx
jmp 0x444b87
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x44513c
jmp 0x445130
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445130
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiReduceWorkingSetProcesses_12
xor edi, edi
test ebx, ebx
je 0x444b2d
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44516e
call fcn.004fbd80
inc edi
cmp edi, ebx
jb 0x445152
jmp 0x444b2d
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
lea ecx, [ecx]
test eax, eax
je case.0x443552.40011
mov eax, dword [eax + 0x34]
test eax, eax
je case.0x443552.40011
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x18
push eax
mov dword [ebp - 0x5c], str.RunAsProgram
call sym.SystemInformer.exe_PhSetStringRefSetting
xor edx, edx
mov ecx, edi
call fcn.004b84e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x443552.40011
mov edx, dword ds:[eax + 0x10]
mov ecx, edi
call fcn.004b84e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
mov edx, esi
mov ecx, edi
call fcn.0043a120
jmp 0x444b86
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445244
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445237
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiFlushHeapProcesses_12
xor edi, edi
test ebx, ebx
je 0x444b2d
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44527c
call fcn.004fbd80
inc edi
cmp edi, ebx
jb 0x445260
jmp 0x444b2d
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
lfence
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x4452bc
lea esp, [esp]
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4452b0
push ebx
mov ecx, esi
call fcn.004650c0
xor edi, edi
test ebx, ebx
je 0x444b2d
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4452ea
call fcn.004fbd80
inc edi
cmp edi, ebx
jb 0x4452d2
jmp 0x444b2d
lea eax, ds:[ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
lfence
call sym.SystemInformer.exe__PhGetSelectedProcessItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445324
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445315
push ebx
mov ecx, esi
call fcn.00465160
xor edi, edi
test ebx, ebx
je 0x444b2d
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x445358
call fcn.004fbd80
inc edi
cmp edi, ebx
jb 0x445340
lea ecx, [ecx]
jmp 0x444b2d
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetEcoModeProcess_8
nop
jmp 0x444b86
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40055
lock inc dword [esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiSetExecutionRequiredProcess_8
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push dword [0x63703c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x443552.40011
xor eax, eax
mov dword [ebp - 0x34], 0x2c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x34]
push eax
push dword [0x63703c]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword [ebp - 0x2c], 6
je 0x44542e
push dword [0x63703c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push dword [0x63703c]
lea ecx, [ecx]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x443552.40011
push 9
push dword [0x63703c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push dword [0x63703c]
call dword [sym.imp.USER32.dll_IsWindow]
lea esp, [esp]
test eax, eax
je case.0x443552.40011
push 6
push dword [0x63703c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push dword [0x63703c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x443552.40011
push 3
push dword [0x63703c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push dword [0x63703c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x443552.40011
push 0
push 0
push 0x10
push dword [0x63703c]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
mov eax, dword [esi + 0x38]
test eax, eax
je case.0x443552.40011
cmp dword [eax], 0
je case.0x443552.40011
push eax
call sym.SystemInformer.exe_PhDoesFileExist
test al, al
je case.0x443552.40011
lock inc dword [esi - 4]
mov eax, dword [esi + 0x34]
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [eax + 4]
push str.FileBrowseExecutable
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
jmp 0x444b86
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x443552.40011
mov eax, dword [eax + 0x18]
push dword [eax + 4]
push edi
call sym.SystemInformer.exe__PhSearchOnlineString_8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedProcessItem_0
lea ecx, [ecx]
test eax, eax
je case.0x443552.40011
push eax
call fcn.00464ec0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push 0
push dword [0x634e3c]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x634e3c]
call sym.SystemInformer.exe_PhSetClipboardString
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne case.0x443552.40011
call fcn.004fbd80
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x443552.40011
push dword [eax + 0x2c]
call sym.SystemInformer.exe__PhFindProcessNode_4
mov esi, eax
test esi, esi
je 0x445649
mov ecx, dword [0x637038]
mov ecx, dword [ecx + 0x14]
call fcn.0044ad90
push dword [0x637034]
lea esp, [esp]
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, 1
mov dword [ebp - 0x54], esi
lea ecx, [ebp - 0x54]
call fcn.0049f740
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push 0
push 0xc000000b
push str.The_process_does_not_exist.
push edi
call sym.SystemInformer.exe_PhShowStatus
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x44569c
lea esp, [esp]
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445690
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiStartServices_12
xor edi, edi
test ebx, ebx
je 0x444b2d
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4456ce
call fcn.004fbd80
inc edi
cmp edi, ebx
jb 0x4456b2
jmp 0x444b2d
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445704
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4456f5
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiContinueServices_12
xor edi, edi
test ebx, ebx
je 0x444b2d
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44573c
call fcn.004fbd80
inc edi
cmp edi, ebx
jb 0x445720
jmp 0x444b2d
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword ds:[ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445774
mov eax, dword [edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445768
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiPauseServices_12
xor edi, edi
test ebx, ebx
je 0x444b2d
or esi, 0xffffffff
jmp 0x445790
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4457ac
call fcn.004fbd80
inc edi
cmp edi, ebx
jb 0x445790
jmp 0x444b2d
lea eax, ds:[ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.SystemInformer.exe__PhGetSelectedServiceItems_8
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x4457e4
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x4457d5
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiStopServices_12
xor edi, edi
test ebx, ebx
je 0x444b2d
or esi, 0xffffffff
lea esp, [esp]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x44581c
call fcn.004fbd80
inc edi
cmp edi, ebx
jb 0x445800
jmp 0x444b2d
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lock inc dword ds:[esi - 4]
push esi
push edi
call sym.SystemInformer.exe__PhUiDeleteService_8
test al, al
je 0x444b86
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x635314]
jmp 0x444b7c
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x443552.40011
push dword ds:[eax + 8]
lea eax, [ebp - 0x54]
push 0x20019
push eax
call sym.SystemInformer.exe_PhOpenServiceKey
test eax, eax
js 0x445957
mov edx, dword [ebp - 0x54]
test edx, edx
je 0x445929
jmp 0x4458a0
cmp edx, 0xffffffff
je 0x445929
cmp edx, 0xfffffffe
je 0x445929
lea eax, ds:[ebp - 0x6c]
or esi, 0xffffffff
push eax
push 0
mov ecx, esi
call fcn.0052b120
test eax, eax
js 0x445929
mov ebx, dword [ebp - 0x6c]
push ebx
call sym.SystemInformer.exe_PhFormatNativeKeyName
mov dword ds:[ebp - 0x6c], eax
test ebx, ebx
je 0x4458ff
lea ecx, [ebx - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x4458ff
call fcn.004fbd80
mov eax, dword [ebp - 0x6c]
push eax
push edi
call sym.SystemInformer.exe__PhShellOpenKey2_8
push dword [ebp - 0x6c]
call sym.SystemInformer.exe_PhDereferenceObject
push dword [ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push 0
push 0xc0000034
push str.The_service_does_not_exist.
push edi
call sym.SystemInformer.exe_PhShowStatus
push dword ds:[ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push 0
push 0xc0000034
push str.The_service_does_not_exist.
push edi
call sym.SystemInformer.exe_PhShowStatus
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
mov eax, dword [esi + 8]
test eax, eax
je 0x44599c
mov eax, dword [eax + 4]
jmp 0x44599e
xor eax, eax
push eax
push 1
lea eax, [ebp - 0x54]
push eax
call sym.SystemInformer.exe_PhOpenService
test eax, eax
js case.0x443552.40011
mov ebx, dword [ebp - 0x54]
mov ecx, ebx
mov edx, dword [esi + 8]
call fcn.00522820
mov esi, eax
test esi, esi
je 0x4459e5
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [esi + 4]
push str.FileBrowseExecutable
push edi
call sym.SystemInformer.exe__PhShellExecuteUserString_20
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
lea ecx, [ecx]
call sym.SystemInformer.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x443552.40011
lea ecx, ds:[esi - 4]
lock inc dword [ecx]
lock inc dword [ecx]
push esi
push 0x4c7140
call sym.SystemInformer.exe_PhCreateThread2
jmp 0x444b86
push 0
push dword [0x635314]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x635314]
jmp 0x4455b5
call fcn.0046bda0
test eax, eax
je case.0x443552.40011
push dword [eax + 0x38]
jmp 0x4455f2
call fcn.0046bda0
nop
test eax, eax
je case.0x443552.40011
mov eax, dword [eax + 0x48]
test eax, eax
je case.0x443552.40011
push dword [eax + 4]
call sym.SystemInformer.exe__PhReferenceServiceItem_4
mov esi, eax
test esi, esi
je case.0x443552.40011
mov ecx, dword [0x637018]
mov ecx, dword [ecx + 0x14]
call fcn.0044ad90
push dword [0x637014]
lea esp, [esp]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
push 0
push 0xc
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
jmp 0x444b86
lea edx, ds:[ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.0046bde0
mov ebx, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
test ebx, ebx
je 0x445ae4
mov eax, dword ds:[edx + ecx*4]
lock inc dword [eax - 4]
inc ecx
cmp ecx, ebx
jb 0x445ad5
push ebx
push edx
push edi
call sym.SystemInformer.exe__PhUiCloseConnections_12
test al, al
je 0x445b09
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x634774]
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test ebx, ebx
je 0x444b2d
or esi, 0xffffffff
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + edi*4]
mov eax, esi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x445b32
call fcn.004fbd80
inc edi
cmp edi, ebx
jb 0x445b16
jmp 0x444b2d
push 0
push dword [0x634774]
call sym.SystemInformer.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x634774]
jmp 0x4455b5
push 0
push 0
push 0x130b
push dword [0x6344a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x6344a8]
xor esi, esi
mov edx, dword [ecx]
lea ecx, [eax + 1]
dec edx
cmp eax, edx
cmove ecx, esi
jmp 0x445bb2
push 0
push 0
push 0x130b
push dword [0x6344a4]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ebx, [ebx]
test eax, eax
jne 0x445baf
mov eax, dword [0x6344a8]
mov eax, dword [eax]
dec eax
mov ecx, eax
call fcn.0044ad90
mov ecx, dword ds:[ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057e94f
mov esp, ebp
pop ebp
ret