Function at 0x42e63e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov dword [esp + 0x10], esi
lea eax, [esi - 0x9c41]
cmp eax, 0x130
ja case.0x42e637.40002
movzx eax, byte [eax + 0x4303e4]
jmp dword [eax*4 + 0x43026c]
push str.HideOnClose
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x42e678
call fcn.00451a40
test al, al
je case.0x42e637.40002
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push str.CloseOnEscape
lea ecx, [ecx]
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je case.0x42e637.40002
push dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [sym.ProcessHacker.exe_PhMainWndHandle]
push eax
push 0x8091
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push 0
push 0x4910e0
push ebx
push 0xfd
push dword [0x5cd528]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
xor edx, edx
call fcn.0048d420
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push 0x435c80
push 0
push 0x8091
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 3
push 1
push 5
push str._v__newinstance
xor edx, edx
mov ecx, ebx
call fcn.0040cf20
test al, al
jne case.0x42e637.40001
mov byte [0x5ccf75], al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe_PhCreateSaveFileDialog
mov ecx, dword [0x5cd974]
mov edi, eax
push 3
mov dword [esp + 0x34], 1
mov dword [esp + 0x44], 0x1e
mov dword [esp + 0x48], 0x5839b4
mov dword [esp + 0x4c], 1
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
push 0x5c96fc
push edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], 1
mov dword [esp + 0x7c], 8
mov dword [esp + 0x80], str..txt
call sym.ProcessHacker.exe_PhSetFileDialogFilter
push 0x3c
push 3
lea eax, [esp + 0x38]
push eax
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push edi
call sym.ProcessHacker.exe_PhSetFileDialogFileName
push edi
push ebx
call sym.ProcessHacker.exe_PhShowFileDialog
test al, al
je 0x42e89a
push edi
call sym.ProcessHacker.exe_PhGetFileDialogFileName
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push edi
mov esi, eax
call sym.ProcessHacker.exe_PhGetFileDialogFilterIndex
push 0
push 5
push 1
push 0x120116
push dword [esi + 4]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x3c]
push eax
call sym.ProcessHacker.exe_PhCreateFileStream
test eax, eax
js 0x42e889
push dword [0x5c7c4c]
mov edi, dword [esp + 0x2c]
mov eax, 2
push dword [0x5c7c50]
xor esi, esi
cmp dword [esp + 0x18], eax
push edi
cmove esi, eax
call sym.ProcessHacker.exe_PhWriteStringAsUtf8FileStreamEx
push edi
call sym.ProcessHacker.exe__PhWritePhTextHeader_4
push 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], edi
push eax
mov eax, dword [0x5cd974]
push 7
mov dword [esp + 0x38], esi
push eax
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x55890c]
nop
call esi
push edi
call sym.ProcessHacker.exe_PhDereferenceObject
mov edi, dword [esp + 0x18]
push edi
call sym.ProcessHacker.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push 0
push eax
push str.Unable_to_create_the_file
push ebx
lfence
call sym.ProcessHacker.exe_PhShowStatus
push edi
call sym.ProcessHacker.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
cmp dword [0x5cd748], 0
mov edi, edi
jne 0x42e918
push 0
push 0x419920
push 0x5cd748
call sym.ProcessHacker.exe_PhCreateThreadEx
test eax, eax
jns 0x42e903
push str.Unable_to_create_the_window.
push 0x5634d8
push 0x10
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
test byte [0x5c95b0], 1
jne 0x42e918
xor edx, edx
mov ecx, 0x5c95b0
call sym.ProcessHacker.exe_PhfWaitForEvent
push 0
push 0
push 0x8321
push dword [0x5cd74c]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
nop
call fcn.00454de0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
lfence
call fcn.00430c80
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
xor ecx, ecx
call fcn.0049bfa0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
lfence
call fcn.00433ac0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push str.HideOtherUserProcesses
call sym.ProcessHacker.exe_PhGetIntegerSetting
neg eax
sbb eax, eax
inc eax
push eax
push str.HideOtherUserProcesses
mov dword [0x5cfd3c], eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 1
call sym.ProcessHacker.exe__PhExpandAllProcessNodes_4
push 0x5ce2dc
call sym.ProcessHacker.exe__PhApplyTreeNewFilters_4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5cdb6c]
test eax, eax
jne 0x42ea47
cmp byte [0x5cfcd4], al
jne 0x42ea2f
push str.Enable_it_in_Options___General_and_restart_Process_Hacker.
push str.This_filter_cannot_function_because_digital_signature_checking_is_not_enabled._r_n_s
push 0
push 0xfffd
push 0x20
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push 0
push 0x448840
push 0x5ce2dc
call sym.ProcessHacker.exe__PhAddTreeNewFilter_12
jmp 0x42ea54
push eax
push 0x5ce2dc
call sym.ProcessHacker.exe__PhRemoveTreeNewFilter_8
xor eax, eax
push 0x5ce2dc
mov dword [0x5cdb6c], eax
mov edi, edi
call sym.ProcessHacker.exe__PhApplyTreeNewFilters_4
xor eax, eax
cmp dword [0x5cdb6c], eax
setne al
push eax
push str.HideSignedProcesses
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [0x5cfdd0], eax
sete al
push eax
push str.ScrollToNewProcesses
mov dword [0x5cfdd0], eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [0x5cfdc4], eax
sete al
push eax
push str.ShowCpuBelow001
mov dword [0x5cfdc4], eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
call sym.ProcessHacker.exe__PhInvalidateAllProcessNodes_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5cdc04]
test eax, eax
jne 0x42eb07
push eax
push 0x44b5a0
push 0x5ce7b0
call sym.ProcessHacker.exe__PhAddTreeNewFilter_12
jmp 0x42eb14
push eax
push 0x5ce7b0
call sym.ProcessHacker.exe__PhRemoveTreeNewFilter_8
xor eax, eax
push 0x5ce7b0
mov dword [0x5cdc04], eax
mov edi, edi
call sym.ProcessHacker.exe__PhApplyTreeNewFilters_4
xor eax, eax
cmp dword [0x5cdc04], eax
setne al
push eax
push str.HideDriverServices
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5cdba0]
test eax, eax
je 0x42eb69
push eax
push 0x5ce7b0
call sym.ProcessHacker.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x42eb87
cmp byte [0x5cfdc1], 0
je 0x42e9fc
push 0
push 0x44b5c0
push 0x5ce7b0
call sym.ProcessHacker.exe__PhAddTreeNewFilter_12
push 0x5ce7b0
mov dword [0x5cdba0], eax
call sym.ProcessHacker.exe__PhApplyTreeNewFilters_4
xor eax, eax
cmp dword [0x5cdba0], eax
setne al
push eax
push str.HideDefaultServices
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5cdad0]
test eax, eax
je 0x42ebd6
push eax
push 0x5cdc14
call sym.ProcessHacker.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x42ebe7
push 0
push 0x447760
push 0x5cdc14
call sym.ProcessHacker.exe__PhAddTreeNewFilter_12
push 0x5cdc14
mov dword [0x5cdad0], eax
call sym.ProcessHacker.exe__PhApplyTreeNewFilters_4
xor eax, eax
cmp dword [0x5cdad0], eax
setne al
push eax
push str.HideWaitingConnections
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
cmp byte [0x5cd72f], 0
push 0x13
push 0
sete al
push 0
mov byte [0x5cd72f], al
push 0
movzx eax, al
push 0
sub eax, 2
push eax
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
movzx eax, byte [0x5cd72f]
push eax
push str.MainWindowAlwaysOnTop
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov al, byte [0x5cd72f]
xor edi, edi
mov byte [esp + 0x17], al
mov eax, 0x5cf070
lock bts dword [eax], 0
jae 0x42ec76
mov ecx, eax
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
mov ebx, dword [0x5cf07c]
lea esp, [esp]
mov edx, dword [ebx + 0x24]
cmp edi, edx
jae 0x42eca4
mov esi, dword [ebx]
mov eax, edi
add esi, 8
imul eax, esi
add eax, dword [ebx + 0x18]
mov ecx, eax
inc edi
add eax, esi
cmp dword [ecx], 0xffffffff
jne 0x42ece9
mov edi, edi
cmp edi, edx
jb 0x42ec94
or edi, 0xffffffff
mov ecx, 0x5cf070
lock xadd dword [ecx], edi
mov eax, edi
and al, 6
cmp al, 2
jne case.0x42e637.40002
dec edi
mov eax, edi
lea edx, [edi + 4]
mov esi, edx
lock cmpxchg dword [ecx], esi
cmp eax, edi
jne case.0x42e637.40002
call fcn.004e1320
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov esi, dword [ecx + 8]
test byte [esi + 4], 1
je 0x42ec80
mov esi, dword [esi]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0x13
push 0
xor eax, eax
cmp byte [esp + 0x1f], al
push 0
push 0
setne al
push 0
add eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x42ec76
lea eax, [esi + esi*4]
mov esi, 0x62066
add eax, eax
sub esi, eax
push esi
push str.MainWindowOpacity
lfence
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, esi
mov ecx, ebx
call fcn.0040cae0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push 0
push 0x5d0380
call sym.ProcessHacker.exe_PhBoostProvider
push 0
push 0x5d0360
call sym.ProcessHacker.exe_PhBoostProvider
cmp byte [0x5d0358], 0
je case.0x42e637.40002
push 0
push 0x5d0340
call sym.ProcessHacker.exe_PhBoostProvider
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
add esi, 0xffff6325
cmp esi, 4
ja case.default.0x42eda7
jmp dword [esi*4 + 0x430518]
mov esi, 0x1f4
jmp 0x42edd5
mov esi, 0x3e8
jmp 0x42edd5
mov esi, 0x7d0
jmp 0x42edd5
mov esi, 0x1388
jmp 0x42edd5
mov esi, 0x2710
jmp 0x42edd5
mov esi, dword [esp + 0x18]
push esi
push str.UpdateInterval
mov dword [0x5cfdcc], esi
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov ecx, dword [0x5d03e4]
mov edi, 0x2710
mov dword [0x5d03ec], esi
test ecx, ecx
je 0x42ee26
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [esp + 0x28], eax
adc edx, 0
push 0
lea eax, [esp + 0x2c]
neg edx
push eax
push ecx
mov dword [esp + 0x38], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ecx, dword [0x5d0424]
mov dword [0x5d042c], esi
test ecx, ecx
je case.0x42e637.40002
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [esp + 0x28], eax
adc edx, 0
push 0
lea eax, [esp + 0x2c]
neg edx
push eax
push ecx
mov dword [esp + 0x38], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
cmp byte [0x5c79c8], 0
push ecx
sete al
mov ecx, 9
movzx edx, al
mov byte [0x5c79c8], al
call fcn.00434a20
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [0x5cfdd8], eax
push 0
push 0x495bc0
cmovne ebx, eax
push ebx
push 0xa8
push dword [0x5cd528]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5cd758]
test eax, eax
jne 0x42ef0b
push eax
push 0x41bc80
push eax
push 0x87
push dword [0x5cd528]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov dword [0x5cd758], eax
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x42ef38
push 5
push dword [0x5cd758]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5cd758]
mov edi, edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe_PhCreateOpenFileDialog
push 2
mov edi, eax
push 0x5c971c
push edi
call sym.ProcessHacker.exe_PhSetFileDialogFilter
cmp byte [edi], 0
mov ecx, dword [edi + 4]
je 0x42efc4
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push ecx
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x55890c]
call esi
test eax, eax
js 0x42efdf
mov edx, dword [esp + 0x10]
test edx, edx
je 0x42efa3
and edx, 0xcfefc7d9
or edx, 0x100
jmp 0x42efa8
mov edx, 0x100
mov eax, dword [edi + 4]
mov dword [esp + 0x10], edx
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x55890c]
mov edi, edi
call esi
jmp 0x42efdf
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x42efd7
and eax, 0xefefc7fd
or eax, 0x100
jmp 0x42efdc
mov eax, 0x100
mov dword [ecx + 0x34], eax
push edi
push ebx
call sym.ProcessHacker.exe_PhShowFileDialog
test al, al
je 0x42f00c
push str.Make_sure_the_PE_Viewer_executable_file_is_present.
push 0
push edi
call sym.ProcessHacker.exe_PhGetFileDialogFileName
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push str.ProgramInspectExecutables
push ebx
call sym.ProcessHacker.exe__PhShellExecuteUserString_20
push edi
call sym.ProcessHacker.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5cd02c]
test eax, eax
jne 0x42f08e
cmp dword [0x5cfdd8], eax
mov esi, dword [0x5cd528]
cmovne ebx, eax
lea eax, [esp + 0x18]
push eax
push 0
push 5
push 0x8a
push esi
call sym.ProcessHacker.exe_PhLoadResource
test al, al
jne 0x42f05d
xor eax, eax
jmp 0x42f070
push 0
push 0x45b180
push ebx
push dword [esp + 0x24]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x5cd02c], eax
call sym.ProcessHacker.exe__PhRegisterDialog_4
push 5
push dword [0x5cd02c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5cd02c]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x42f0b9
push 9
push dword [0x5cd02c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5cd02c]
nop
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push 0
push 0x4288a0
push 0
push 0xfe
push dword [0x5cd528]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe_PhGetSystemDirectory
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push str._taskmgr.exe
push dword ds:[eax + 4]
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
cmp dword [0x5c7aa8], 0x3e
mov esi, eax
jb 0x42f1a9
lea eax, ds:[esp + 0x18]
push eax
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x42f1a9
push 0
push 0
push ebx
call sym.ProcessHacker.exe__PhUiConnectToPhSvcEx_12
test al, al
je case.0x42e637.40002
lea ecx, [ecx]
test esi, esi
je 0x42f189
mov ecx, dword [esi + 4]
xor edx, edx
call fcn.0045d260
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
xor ecx, ecx
xor edx, edx
call fcn.0045d260
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x42f1c9
mov ecx, dword [esi + 4]
xor edx, edx
call fcn.0040d380
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
xor ecx, ecx
xor edx, edx
call fcn.0040d380
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe_PhGetSystemDirectory
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push str.perfmon.exe
push dword ds:[eax + 4]
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov edi, eax
push str.__res
push dword [edi + 4]
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov esi, eax
lea eax, [esp + 0x18]
push eax
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x42f29c
push 0
push 0
push ebx
call sym.ProcessHacker.exe__PhUiConnectToPhSvcEx_12
test al, al
je case.0x42e637.40002
test esi, esi
je 0x42f277
mov edx, dword [esi + 4]
mov ecx, dword [edi + 4]
call fcn.0045d260
lea esp, [esp]
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov ecx, dword ds:[edi + 4]
xor edx, edx
call fcn.0045d260
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
lea esp, [esp]
test esi, esi
je 0x42f2c1
mov edx, dword [esi + 4]
mov ecx, dword [edi + 4]
call fcn.0040d380
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 4]
xor edx, edx
call fcn.0040d380
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x42e5a0
push str.SCManager
mov edx, str.Service_Control_Manager
xor ecx, ecx
call fcn.00509260
push eax
push 0x5091c0
call sym.ProcessHacker.exe_PhCreateThread2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x42e5e0
push str.PowerDefault
mov edx, str.Current_Power_Scheme
jmp 0x42f2f2
push 0
push 0
push 0
push 0x42e5e0
push str.RdpDefault
mov edx, str.Terminal_Server_Listener
jmp 0x42f2f2
push 0
push 0
push 0
push 0x42e5e0
push str.WmiDefault
mov edx, str.WMI_Root_Namespace
jmp 0x42f2f2
push dword [0x5c9714]
push ebx
call sym.ProcessHacker.exe__PhUiConnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5c9714]
push ebx
call sym.ProcessHacker.exe__PhUiDisconnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5c9714]
push ebx
call sym.ProcessHacker.exe__PhUiLogoffSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov edi, dword [0x5c9714]
lea eax, [esp + 0x18]
push 0
push 4
push eax
push 0x18
push 0xffffffffffffffff
or esi, 0xffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
cmovns esi, dword [esp + 0x18]
cmp edi, esi
jne 0x42f40f
push str.You_cannot_remote_control_the_current_session.
push 0x5634d8
push str.Unable_to_shadow_session.
push 0xfffe
push 0x20
push ebx
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push edi
push 0x493d40
push ebx
push 0xc1
push dword [0x5cd528]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5c9714]
push 0x49bc80
push ebx
push 0x98
push dword [0x5cd528]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5c9714]
xor eax, eax
cmp dword [0x5cfdd8], eax
push 0x493760
cmovne ebx, eax
push ebx
push 0x99
push dword [0x5cd528]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5cce2c]
test eax, eax
jne 0x42f504
mov esi, dword [0x5cd528]
lea eax, [esp + 0x18]
push eax
push 0
push 5
push 0xb2
push esi
call sym.ProcessHacker.exe_PhLoadResource
test al, al
jne 0x42f4ce
xor eax, eax
jmp 0x42f4e6
push 0
push 0x429780
push 0
push dword [esp + 0x24]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x5cce2c], eax
call sym.ProcessHacker.exe__PhRegisterDialog_4
push 5
push dword [0x5cce2c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5cce2c]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x42f52f
push 9
push dword [0x5cce2c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5cce2c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push 0
push str.https:__sourceforge.net_project_project_donations.php_group_id242527
push ebx
call sym.ProcessHacker.exe_PhShellExecute
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call fcn.00414140
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5cd6fc]
test eax, eax
jne 0x42f5eb
cmp dword [0x5cfdd8], eax
mov esi, dword [0x5cd528]
cmovne ebx, eax
lea eax, [esp + 0x18]
push eax
push 0
push 5
push 0x79
push esi
call sym.ProcessHacker.exe_PhLoadResource
test al, al
jne 0x42f5b4
xor eax, eax
jmp 0x42f5c7
push 0
push section..text
push ebx
push dword [esp + 0x24]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push eax
mov dword [0x5cd6fc], eax
call sym.ProcessHacker.exe__PhRegisterDialog_4
push 5
push dword [0x5cd6fc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5cd6fc]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x42f618
push 9
push dword [0x5cd6fc]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5cd6fc]
mov edi, edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x28]
push edi
push esi
call sym.ProcessHacker.exe_PhReferenceObjects
push edi
push esi
push ebx
call sym.ProcessHacker.exe__PhUiTerminateProcesses_12
mov edi, edi
test al, al
je 0x42f679
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x5ce2e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push esi
call sym.ProcessHacker.exe_PhDereferenceObjects
push esi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword ds:[esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiTerminateTreeProcess_8
test al, al
je 0x42f6de
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x5ce2e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
nop
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
push esi
push edi
push ebx
call sym.ProcessHacker.exe__PhUiSuspendProcesses_12
push esi
push edi
call sym.ProcessHacker.exe_PhDereferenceObjects
push edi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword ds:[esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiSuspendTreeProcess_8
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
push esi
push edi
push ebx
call sym.ProcessHacker.exe__PhUiResumeProcesses_12
jmp 0x42f71d
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword ds:[esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiResumeTreeProcess_8
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
lea ecx, [ecx]
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword [esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiFreezeTreeProcess_8
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword [esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiThawTreeProcess_8
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword [esi - 4]
mov edx, dword fs:[0x18]
mov ecx, dword [esi + 0x10]
cmp ecx, dword [edx + 0x20]
jne 0x42f8c7
push 0x435c80
push 0
push 0x8091
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [sym.ProcessHacker.exe_PhMainWndHandle]
xor edx, edx
push 0
push 0
push 3
push 4
push 5
push 0
call fcn.0040cf20
nop
test al, al
je 0x42f8bb
push dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [sym.ProcessHacker.exe_PhMainWndHandle]
push eax
push 0x8091
push eax
jmp 0x42f6d8
mov byte [0x5ccf75], 0
jmp 0x42f6de
push esi
push ebx
call sym.ProcessHacker.exe__PhUiRestartProcess_8
jmp 0x42f6c5
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov edi, eax
test edi, edi
je case.0x42e637.40002
lock inc dword [edi - 4]
call sym.ProcessHacker.exe_PhCreateSaveFileDialog
push 2
mov esi, eax
push 0x5c972c
push esi
mov dword [esp + 0x24], esi
call sym.ProcessHacker.exe_PhSetFileDialogFilter
mov ecx, dword [edi + 0x18]
push str..dmp
push dword [ecx + 4]
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push dword ds:[eax + 4]
push esi
call sym.ProcessHacker.exe_PhSetFileDialogFileName
push esi
push ebx
call sym.ProcessHacker.exe_PhShowFileDialog
push esi
test al, al
jne 0x42f93c
call sym.ProcessHacker.exe_PhFreeFileDialog
push edi
jmp 0x42f6df
lea esp, [esp]
call sym.ProcessHacker.exe_PhGetFileDialogFileName
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push dword [esp + 0x18]
mov esi, eax
call sym.ProcessHacker.exe_PhFreeFileDialog
push dword ds:[esi + 4]
mov edx, dword [edi + 0x10]
mov ecx, ebx
call fcn.004362e0
push edi
jmp 0x42f6df
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword [esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiDebugProcess_8
jmp 0x42f6de
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword [esi - 4]
cmp byte [0x5d0300], 0
sete cl
movzx ecx, cl
push ecx
push esi
push ebx
call sym.ProcessHacker.exe__PhUiSetVirtualizationProcess_12
jmp 0x42f6de
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword [esi - 4]
push 0
mov edx, esi
mov ecx, ebx
call fcn.004090a0
jmp 0x42f6de
lea esp, [esp]
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword [esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiSetCriticalProcess_8
jmp 0x42f6de
nop
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword [esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiDetachFromDebuggerProcess_8
jmp 0x42f6de
nop
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov edi, eax
test edi, edi
je case.0x42e637.40002
lea esi, ds:[edi - 4]
lock inc dword [esi]
push 0x5c
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x5c
push 0
push eax
mov dword [esp + 0x1c], eax
call fcn.00536b00
add esp, 0xc
lock inc dword [esi]
mov eax, dword [esp + 0x10]
push dword [0x5cd4fc]
push 0xc
mov dword [eax], edi
call sym.ProcessHacker.exe_PhCreateObject
push 0x50
mov esi, eax
push 4
push dword [0x5cd55c]
mov dword [esi], 0
mov dword [esi + 4], 0x14
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [eax + 4], esi
xor eax, eax
cmp dword [0x5cfdd8], eax
mov esi, dword [0x5cd528]
cmovne ebx, eax
lea eax, [esp + 0x18]
push eax
push 0
push 5
push 0xaf
push esi
call sym.ProcessHacker.exe_PhLoadResource
test al, al
jne 0x42fac3
xor esi, esi
jmp 0x42fada
push dword [esp + 0x10]
push 0x41a160
push ebx
push dword [esp + 0x24]
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
jmp 0x42f6df
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword [esi - 4]
mov edx, esi
call fcn.0041a560
jmp 0x42f6de
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov edi, eax
test edi, edi
je case.0x42e637.40002
add esi, 0xffff62d1
cmp esi, 4
ja case.default.0x42fb33
jmp dword [esi*4 + 0x43052c]
mov eax, 1
jmp 0x42fb62
mov eax, 2
jmp 0x42fb62
mov eax, 3
jmp 0x42fb62
mov eax, 4
jmp 0x42fb62
mov eax, 5
jmp 0x42fb62
mov eax, dword [esp + 0x18]
lock inc dword [edi - 4]
push eax
push edi
push ebx
call sym.ProcessHacker.exe__PhUiSetPagePriorityProcess_12
push edi
jmp 0x42f6df
lea eax, ds:[esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
push esi
push edi
push ebx
call sym.ProcessHacker.exe__PhUiReduceWorkingSetProcesses_12
lea esp, [esp]
jmp 0x42f71d
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x42e637.40002
mov eax, dword [eax + 0x2c]
test eax, eax
je case.0x42e637.40002
push eax
push str.RunAsProgram
call sym.ProcessHacker.exe_PhSetStringSetting2
xor edx, edx
mov ecx, ebx
call fcn.0048d420
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x42e637.40002
mov edx, dword [eax + 0x10]
mov ecx, ebx
call fcn.0048d420
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
lfence
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
mov ecx, dword [esp + 0x10]
mov edx, edi
push esi
call fcn.00448860
jmp 0x42f71d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
lfence
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
mov ecx, dword [esp + 0x10]
mov edx, edi
push esi
call fcn.00448900
jmp 0x42f71d
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword [esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiSetEcoModeProcess_8
jmp 0x42f6de
push dword [0x5d02fc]
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x42fca0
test eax, eax
je case.0x42e637.40002
xor eax, eax
mov dword [esp + 0x30], 0x2c
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0x30]
push eax
push dword [0x5d02fc]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword [esp + 0x38], 6
je 0x42fd28
push dword [0x5d02fc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5d02fc]
call dword [sym.imp.USER32.dll_IsWindow]
lea esp, [esp]
test eax, eax
je case.0x42e637.40002
push 9
push dword [0x5d02fc]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5d02fc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x42e637.40002
push 6
push dword [0x5d02fc]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5d02fc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x42e637.40002
push 3
push dword [0x5d02fc]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push dword [0x5d02fc]
call dword [sym.imp.USER32.dll_IsWindow]
lea ecx, [ecx]
test eax, eax
je case.0x42e637.40002
push 0
push 0
push 0x10
push dword [0x5d02fc]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
mov eax, dword ds:[esi + 0x2c]
test eax, eax
je case.0x42e637.40002
cmp dword [eax], 0
je case.0x42e637.40002
push dword [eax + 4]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
lea esp, [esp]
test al, al
je case.0x42e637.40002
lock inc dword ds:[esi - 4]
mov eax, dword [esi + 0x2c]
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [eax + 4]
push str.FileBrowseExecutable
push ebx
call sym.ProcessHacker.exe__PhShellExecuteUserString_20
jmp 0x42f6de
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x42e637.40002
mov eax, dword ds:[eax + 0x18]
push dword [eax + 4]
push ebx
call sym.ProcessHacker.exe__PhSearchOnlineString_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
lea esp, [esp]
test eax, eax
je case.0x42e637.40002
push eax
call fcn.004487a0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push 0
push dword [0x5ce2e8]
call sym.ProcessHacker.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x5ce2e8]
call sym.ProcessHacker.exe_PhSetClipboardString
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne case.0x42e637.40002
call fcn.004c1f60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x42e637.40002
push dword [eax + 0x28]
call sym.ProcessHacker.exe__PhFindProcessNode_4
mov esi, eax
test esi, esi
je case.0x42e637.40002
mov ecx, dword [0x5d02f8]
mov ecx, dword [ecx + 0x14]
call fcn.00434960
push dword [0x5d02f4]
lea esp, [esp]
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, 1
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x18]
call fcn.00479140
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword ds:[esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiStartService_8
jmp 0x42f6de
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword ds:[esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiContinueService_8
jmp 0x42f6de
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword ds:[esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiPauseService_8
jmp 0x42f6de
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword ds:[esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiStopService_8
jmp 0x42f6de
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lock inc dword ds:[esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiDeleteService_8
test al, al
je 0x42f6de
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x5ce7c0]
jmp 0x42f6d8
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x42e637.40002
push dword [eax + 8]
push 0x5c96f4
call sym.ProcessHacker.exe_PhConcatStringRef2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push 0
mov esi, eax
lea eax, [esp + 0x1c]
push esi
push 0xfffffffffffffffd
push 0x20019
push eax
call sym.ProcessHacker.exe_PhOpenKey
jmp 0x430040
test eax, eax
js case.0x42e637.40002
push esi
push 0x5c96ec
lfence
call sym.ProcessHacker.exe_PhConcatStringRef2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov edx, eax
mov ecx, ebx
call fcn.0040e980
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
mov ecx, dword [esi + 8]
push 1
push dword [ecx + 4]
call sym.ProcessHacker.exe_PhOpenService
mov edi, eax
test edi, edi
je case.0x42e637.40002
mov ecx, dword [esi + 8]
mov edx, edi
call fcn.0040c120
mov esi, eax
test esi, esi
je 0x4300d3
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [esi + 4]
push str.FileBrowseExecutable
push ebx
call sym.ProcessHacker.exe__PhShellExecuteUserString_20
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42e637.40002
lea ecx, [esi - 4]
lock inc dword [ecx]
lock inc dword [ecx]
push esi
push 0x499080
call sym.ProcessHacker.exe_PhCreateThread2
jmp 0x42f6de
push 0
push dword [0x5ce7c0]
call sym.ProcessHacker.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x5ce7c0]
jmp 0x42feb7
call fcn.0044e700
jmp 0x430140
test eax, eax
je case.0x42e637.40002
push dword [eax + 0x38]
jmp 0x42fef9
call fcn.0044e700
test eax, eax
je case.0x42e637.40002
mov eax, dword [eax + 0x48]
test eax, eax
je case.0x42e637.40002
push dword [eax + 4]
call sym.ProcessHacker.exe__PhReferenceServiceItem_4
mov esi, eax
test esi, esi
je case.0x42e637.40002
mov ecx, dword [0x5d02d8]
mov ecx, dword [ecx + 0x14]
call fcn.00434960
push dword [0x5d02d4]
call dword [sym.imp.USER32.dll_SetFocus]
push 0x435e60
push esi
push 0x8091
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
jmp 0x42f6d8
lea edx, [esp + 0x18]
lea ecx, [esp + 0x28]
call fcn.0044e740
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x28]
push edi
push esi
call sym.ProcessHacker.exe_PhReferenceObjects
push edi
push esi
push ebx
call sym.ProcessHacker.exe__PhUiCloseConnections_12
test al, al
je 0x42f679
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x5cdc3c]
jmp 0x42f673
push 0
push dword [0x5cdc3c]
call sym.ProcessHacker.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x5cdc3c]
jmp 0x42feb7
push 0
push 0
push 0x130b
push dword [0x5cd97c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x5cd9a4]
mov ecx, dword [ecx]
dec ecx
cmp eax, ecx
je 0x43022a
inc eax
jmp 0x430252
xor eax, eax
jmp 0x430252
push 0
push 0
push 0x130b
push dword [0x5cd97c]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x430251
mov eax, dword [0x5cd9a4]
mov eax, dword [eax]
dec eax
mov ecx, eax
call fcn.00434960
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret