Function at 0x40c1f0
Capabilities:
Continue service
Delete service
Pause service
Resume thread
Start service
Stop service
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
lea eax, [esp + 8]
push ebx
push esi
push edi
push eax
push 0xffffffffffffffff
call sym.ProcessHacker.exe_PhGetProcessCommandLine
mov edi, eax
test edi, edi
js 0x40c5e2
mov esi, dword [esp + 0x14]
push 0
push 0x40c1e0
push 1
push 1
push 0x54612c
push esi
call sym.ProcessHacker.exe_PhParseCommandLine
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40c23f
call fcn.004a2a20
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xe
push eax
push dword [0x54c394]
mov dword [esp + 0x28], str.process
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c771
mov ebx, dword [0x54c398]
test ebx, ebx
je 0x40cae8
mov esi, dword [ebx]
mov ecx, 0
shr esi, 1
je 0x40c29a
mov edx, dword [ebx + 4]
mov ax, word [edx]
sub ax, 0x30
cmp ax, 0xa
jae 0x40c29a
inc ecx
add edx, 2
cmp ecx, esi
jb 0x40c285
cmp ecx, esi
jne 0x40c2bc
lea eax, [esp + 0x18]
push eax
push 0xa
push ebx
call sym.ProcessHacker.exe_PhStringToInteger64
test al, al
je 0x40cae8
mov esi, dword [esp + 0x18]
jmp 0x40c343
push 5
lea eax, [esp + 0x10]
push eax
call sym.ProcessHacker.exe_PhEnumProcessesEx
mov edi, eax
test edi, edi
js 0x40c5e0
mov ecx, dword [0x54c398]
mov ebx, dword [esp + 0xc]
mov esi, ebx
mov dword [esp + 0x18], ecx
movzx eax, word [esi + 0x38]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x3c]
push 1
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push ecx
push eax
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x40c312
mov eax, dword [esi]
test eax, eax
je 0x40c316
add esi, eax
je 0x40c316
mov ecx, dword [esp + 0x18]
jmp 0x40c2e2
test esi, esi
jne 0x40c331
push ebx
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000225
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi + 0x44]
push ebx
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x12
push eax
push dword [0x54c39c]
mov dword [esp + 0x28], str.terminate
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c3a1
push esi
push 1
lea eax, [esp + 0x1c]
push eax
call sym.ProcessHacker.exe_PhOpenProcess
mov edi, eax
test edi, edi
js 0x40c5e0
push 0
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push dword [esp + 0x14]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xe
push eax
push dword [0x54c39c]
mov dword [esp + 0x28], str.suspend
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c400
push esi
push 0x800
lea eax, [esp + 0x1c]
push eax
call sym.ProcessHacker.exe_PhOpenProcess
mov edi, eax
test edi, edi
js 0x40c5e0
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtSuspendProcess]
push dword [esp + 0x14]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xc
push eax
push dword [0x54c39c]
mov dword [esp + 0x28], str.resume
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c45f
push esi
push 0x800
lea eax, [esp + 0x1c]
push eax
call sym.ProcessHacker.exe_PhOpenProcess
mov edi, eax
test edi, edi
js 0x40c5e0
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtResumeProcess]
push dword [esp + 0x14]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x10
push eax
push dword [0x54c39c]
mov dword [esp + 0x28], str.priority
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c5e9
mov eax, dword [0x54c3a0]
test eax, eax
je 0x40cae8
push 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 8
push ecx
push eax
mov dword [esp + 0x28], str.idle
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c4be
mov bl, 1
jmp 0x40c598
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xc
push eax
push dword [0x54c3a0]
mov dword [esp + 0x28], str.normal
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c4eb
mov bl, 2
jmp 0x40c598
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 8
push eax
push dword [0x54c3a0]
mov dword [esp + 0x28], str.high
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c518
mov bl, 3
jmp 0x40c598
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x10
push eax
push dword [0x54c3a0]
mov dword [esp + 0x28], str.realtime
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c542
mov bl, 4
jmp 0x40c598
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x16
push eax
push dword [0x54c3a0]
mov dword [esp + 0x28], str.abovenormal
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c56c
mov bl, 6
jmp 0x40c598
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x16
push eax
push dword [0x54c3a0]
mov dword [esp + 0x28], str.belownormal
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40cae8
mov bl, 5
push esi
push 0x200
lea eax, [esp + 0x1c]
push eax
call sym.ProcessHacker.exe_PhOpenProcess
mov edi, eax
test edi, edi
js 0x40c5e0
mov byte [esp + 0xc], 0
mov byte [esp + 0xd], bl
mov ax, word [esp + 0xc]
mov word [esp + 0xc], ax
lea eax, [esp + 0xc]
push 2
push eax
push 0x12
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
push dword [esp + 0x14]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x14
push eax
push dword [0x54c39c]
mov dword [esp + 0x28], str.iopriority
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c6fd
mov eax, dword [0x54c3a0]
test eax, eax
je 0x40cae8
push 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0xe
push ecx
push eax
mov dword [esp + 0x28], str.verylow
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c648
xor ebx, ebx
jmp 0x40c6d1
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 6
push eax
push dword [0x54c3a0]
mov dword [esp + 0x28], 0x52363c
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c675
mov ebx, 1
jmp 0x40c6d1
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xc
push eax
push dword [0x54c3a0]
mov dword [esp + 0x28], str.normal
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c6a2
mov ebx, 2
jmp 0x40c6d1
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 8
push eax
push dword [0x54c3a0]
mov dword [esp + 0x28], str.high
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40cae8
mov ebx, 3
push esi
push 0x200
lea eax, [esp + 0x1c]
push eax
call sym.ProcessHacker.exe_PhOpenProcess
mov edi, eax
test edi, edi
js 0x40c5e0
push 4
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push eax
push 0x21
jmp 0x40c5ca
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x18
push eax
push dword [0x54c39c]
mov dword [esp + 0x28], str.pagepriority
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c5e0
mov eax, dword [0x54c3a0]
test eax, eax
je 0x40cae8
lea ecx, [esp + 0x18]
push ecx
push 0xa
push eax
call sym.ProcessHacker.exe_PhStringToInteger64
push esi
push 0x200
lea eax, [esp + 0x1c]
push eax
call sym.ProcessHacker.exe_PhOpenProcess
mov edi, eax
test edi, edi
js 0x40c5e0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push 4
push eax
push 0x27
jmp 0x40c5ca
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xe
push eax
push dword [0x54c394]
mov dword [esp + 0x28], str.service
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c975
cmp dword [0x54c398], 0
je 0x40cae8
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xa
push eax
push dword [0x54c39c]
mov dword [esp + 0x28], str.start
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c810
mov eax, dword [0x54c398]
push 0x10
push dword [eax + 4]
call sym.ProcessHacker.exe_PhOpenService
mov esi, eax
test esi, esi
jne 0x40c800
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40c5e2
movzx eax, ax
or eax, 0xc0070000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x40c94c
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x10
push eax
push dword [0x54c39c]
mov dword [esp + 0x28], 0x508878
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c85e
mov eax, dword [0x54c398]
push 0x40
push dword [eax + 4]
call sym.ProcessHacker.exe_PhOpenService
mov esi, eax
test esi, esi
je 0x40c7e3
lea eax, [esp + 0x24]
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x40c94c
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xa
push eax
push dword [0x54c39c]
mov dword [esp + 0x28], str.pause
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c8b0
mov eax, dword [0x54c398]
push 0x40
push dword [eax + 4]
call sym.ProcessHacker.exe_PhOpenService
mov esi, eax
test esi, esi
je 0x40c7e3
lea eax, [esp + 0x24]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x40c94c
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 8
push eax
push dword [0x54c39c]
mov dword [esp + 0x28], str.stop
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c8ff
mov eax, dword [0x54c398]
push 0x20
push dword [eax + 4]
call sym.ProcessHacker.exe_PhOpenService
mov esi, eax
test esi, esi
je 0x40c7e3
lea eax, [esp + 0x24]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x40c94c
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xc
push eax
push dword [0x54c39c]
mov dword [esp + 0x28], 0x50898c
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c5e0
mov eax, dword [0x54c398]
push 0x10000
push dword [eax + 4]
call sym.ProcessHacker.exe_PhOpenService
mov esi, eax
test esi, esi
je 0x40c7e3
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x40c965
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x40c965
movzx edi, di
or edi, 0xc0070000
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xc
push eax
push dword [0x54c394]
mov dword [esp + 0x28], str.thread
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c5e0
mov eax, dword [0x54c398]
test eax, eax
je 0x40cae8
lea ecx, [esp + 0x18]
push ecx
push 0xa
push eax
call sym.ProcessHacker.exe_PhStringToInteger64
test al, al
je 0x40cae8
push 1
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x12
push eax
push dword [0x54c39c]
mov dword [esp + 0x1c], str.terminate
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40ca22
push dword [esp + 0x18]
lea eax, [esp + 0x18]
push 1
push eax
call sym.ProcessHacker.exe_PhOpenThread
mov edi, eax
test edi, edi
js 0x40c5e0
push 0
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtTerminateThread]
push dword [esp + 0x14]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0xe
push eax
push dword [0x54c39c]
mov dword [esp + 0x1c], str.suspend
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40ca83
push dword [esp + 0x18]
lea eax, [esp + 0x18]
push 2
push eax
call sym.ProcessHacker.exe_PhOpenThread
mov edi, eax
test edi, edi
js 0x40c5e0
push 0
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtSuspendThread]
push dword [esp + 0x14]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0xc
push eax
push dword [0x54c39c]
mov dword [esp + 0x1c], str.resume
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x40c5e0
push dword [esp + 0x18]
lea eax, [esp + 0x18]
push 2
push eax
call sym.ProcessHacker.exe_PhOpenThread
mov edi, eax
test edi, edi
js 0x40c5e0
push 0
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtResumeThread]
push dword [esp + 0x14]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xc000000d
pop ebx
mov esp, ebp
pop ebp
ret