Function at 0x445780
Capabilities:
Check processdebugport
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0x28], eax
test byte [0x5c979c], 1
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0xc], ebx
jne 0x4458ad
mov edi, 0x5c979c
lock bts dword [edi], 0x1f
jae 0x4457d4
test byte [0x5c979c], 1
lea ecx, [ecx]
jne 0x4458ad
xor edx, edx
mov ecx, edi
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x4458ad
push dword [0x5cd4e0]
push 0x28
call sym.ProcessHacker.exe_PhCreateObject
mov edx, eax
mov ebx, 1
xor eax, eax
mov ecx, ebx
mov word [edx], ax
lock xadd dword [0x5cd4e8], ecx
inc ecx
push dword [0x5cd4e0]
dec cl
mov dword [edx + 4], eax
movzx eax, cl
push 0x28
mov byte [edx + 2], cl
mov dword [edx + 8], 0x445c40
mov dword [edx + 0xc], str.ModuleProvider
mov dword [eax*4 + 0x5cf880], edx
mov dword [0x5ccf9c], edx
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, eax
xor eax, eax
mov word [ecx], ax
lock xadd dword [0x5cd4e8], ebx
inc ebx
dec bl
mov dword [ecx + 4], eax
movzx eax, bl
mov byte [ecx + 2], bl
mov dword [ecx + 8], 0x445dc0
mov dword [ecx + 0xc], str.ModuleItem
mov dword [eax*4 + 0x5cf880], ecx
mov dword [0x5ccf98], ecx
lock bts dword [edi], 0
jb 0x4458a9
mov esi, dword [0x5c97a0]
test esi, esi
je 0x44587f
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
lock xadd dword [edi], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x4458a9
test esi, esi
je 0x4458a9
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x5c97a0], 0
mov ebx, dword [esp + 0xc]
mov eax, dword [0x5ccf34]
push dword [0x5ccf9c]
add eax, 0x70
mov dword [0x5ccf30], 0x70
push eax
call sym.ProcessHacker.exe_PhCreateObject
push 0x70
mov edi, eax
push 0
push edi
call fcn.00536b00
add esp, 0xc
push dword [0x5cd4ec]
push 0x28
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
push 0x80
push 4
push dword [0x5cd55c]
mov dword [esi], 4
mov dword [esi + 4], 0x445e50
mov dword [esi + 8], 0x445e70
mov dword [esi + 0xc], 0x20
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [esi + 0xc]
shl ecx, 2
push ecx
push 0xff
push eax
mov dword [esi + 0x10], eax
call fcn.00536b00
mov eax, dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x14], eax
lea eax, [eax + eax*2]
shl eax, 2
push eax
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp byte [0x5cd02b], 0
mov dword [esi + 0x18], eax
lea eax, [edi + 0x10]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
lea eax, [edi + 0x20]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
lea eax, [edi + 0x30]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
lea eax, [edi + 0x40]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
lea eax, [esp + 0xc]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi], esi
lea esi, [edi + 0x54]
mov dword [edi + 0x50], ebx
mov dword [esi], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x68], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0
push eax
jne 0x445a62
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x18
push eax
push 0x410
push esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call dword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x445a6e
cmp byte [0x5cd02b], 0
je 0x445a72
lea eax, [esp + 0xc]
push eax
mov edx, 0x410
mov ecx, esi
call fcn.004dd080
test eax, eax
jns 0x445a9c
push ebx
mov edx, 0x1010
mov ecx, esi
lfence
call fcn.004d3720
test eax, eax
jns 0x445a99
push ebx
mov edx, 0x1000
mov ecx, esi
lfence
call fcn.004d3720
mov dword [edi + 0x68], eax
lea eax, [esp + 0xc]
push eax
push ebx
call sym.ProcessHacker.exe_PhGetProcessImageFileNameByProcessId
test eax, eax
js 0x445acc
mov ecx, dword [edi + 0x58]
mov eax, dword [esp + 0xc]
mov dword [edi + 0x58], eax
test ecx, ecx
je 0x445acc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x445acc
call fcn.004c1f60
cmp dword [0x5c7aa8], 0x3e
jb 0x445b1e
mov ecx, dword [esi]
test ecx, ecx
je 0x445b1e
jmp 0x445ae0
call fcn.004e4ac0
cmp dword [0x5c7aa8], 0x3f
mov dword [edi + 0x5c], eax
jb 0x445b1e
push 0
push 8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 7
push eax
push 0x34
push dword [esi]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x445b1e
mov al, byte [esp + 0x10]
add al, al
xor al, byte [edi + 0x6c]
and al, 2
xor byte [edi + 0x6c], al
cmp dword [0x5c7aa8], 0x64
jb 0x445bde
mov eax, dword [esi]
test eax, eax
je 0x445bde
push 0
push 0x20
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x20
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x445b65
mov eax, dword [esp + 0x30]
shr eax, 8
shl al, 2
xor al, byte [edi + 0x6c]
and al, 4
xor byte [edi + 0x6c], al
cmp dword [0x5c7aa8], 0x6d
jb 0x445bde
cmp dword [edi + 0x50], 4
push 0
jne 0x445ba2
push 4
lea eax, [esp + 0x14]
push eax
push 0xdd
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x445bde
mov ecx, dword ds:[esp + 0xc]
mov al, byte [edi + 0x6c]
shr ecx, 8
and cl, 1
or cl, 2
and al, 0xf7
jmp 0x445bd6
push 8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0xf
push eax
push 0x34
push dword [esi]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x445bde
mov eax, dword [esp + 0x10]
mov ecx, eax
shr ecx, 4
and al, 1
and cl, 1
add cl, cl
or cl, al
mov al, byte [edi + 0x6c]
and al, 0xe7
shl cl, 3
or cl, al
mov byte [edi + 0x6c], cl
mov eax, dword [0x5cfd54]
sub eax, 1
je 0x445bf9
sub eax, 1
je 0x445bf3
mov byte [edi + 0x6d], 2
jmp 0x445bfd
mov byte [edi + 0x6d], 1
jmp 0x445bfd
mov byte [edi + 0x6d], 0
lea eax, [edi + 0x60]
push eax
call dword [sym.imp.ntdll.dll_RtlInitializeSListHead]
push 0
mov edx, edi
mov ecx, 0x10
call fcn.00416440
mov ecx, dword [esp + 0x34]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret