Function at 0x40b640
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x35c
push ebx
push esi
push edi
push 5
lea eax, [esp + 0x30]
mov ebx, edx
push eax
mov dword [esp + 0x18], ebx
mov edi, ecx
call sym.ProcessHacker.exe_PhEnumProcessesEx
mov esi, eax
test esi, esi
jns 0x40b704
cmp esi, 0xc0000022
je 0x40b68e
cmp esi, 0xc0000005
je 0x40b68e
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x40b699
movzx eax, si
jmp 0x40b695
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x40b6a1
push esi
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x40b6a7
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
jne 0x40b6c9
push str.Unable_to_enumerate_processes
push 0x532664
push 0x10
push edi
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 4]
push 0x52304c
push str.Unable_to_enumerate_processes
push 0xfffe
push 0x20
push edi
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40bc8b
call fcn.004a2a20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x845c
push dword [ebx + 0x70]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push dword [ebx + 0x70]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebx + 0x6c]
call dword [sym.imp.COMCTL32.dll_ImageList_Remove]
mov ebx, dword [esp + 0x2c]
jmp 0x40b740
cmp dword [ebx + 0x44], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 0
je 0x40b79c
movzx eax, word [ebx + 0x38]
test ax, ax
jne 0x40b768
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
jmp 0x40b7cf
push dword [0x54b7b4]
mov edi, eax
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0x1c], eax
lea eax, [edi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], eax
mov dword [esi], edi
mov word [eax + edi], cx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40b7cf
push edi
push eax
jmp 0x40b7c4
push dword [0x54b7b4]
push 0x30
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
push 0x26
push str.System_Idle_Process
mov dword [esi], 0x26
mov dword [esi + 4], eax
mov word [eax + 0x26], cx
push dword [esi + 4]
call fcn.004dd620
add esp, 0xc
mov eax, dword [esi + 4]
mov ecx, dword [ebx + 0x44]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0x104d
mov dword [esp + 0x4c], 5
push dword [eax + 0x70]
mov dword [esp + 0x54], SysStringLen
mov dword [esp + 0x58], 0
mov dword [esp + 0x70], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x18], eax
lea ecx, [esi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x40b825
call fcn.004a2a20
cmp byte [0x5496b4], 0
mov eax, dword [ebx + 0x44]
mov esi, dword [sym.ProcessHacker.exe_ProcessQueryAccess]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
je 0x40b84e
mov eax, esi
and eax, 0x121410
cmp eax, esi
je 0x40b8ba
lea eax, [esp + 0x34]
mov dword [esp + 0x7c], 0x18
push eax
lea eax, [esp + 0x80]
mov dword [esp + 0x84], 0
push eax
push esi
lea eax, [esp + 0x30]
mov dword [esp + 0x94], 0
push eax
mov dword [esp + 0x94], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
call dword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x40b8ca
cmp byte [0x5496b4], 0
je 0x40b9b4
lea eax, [esp + 0x34]
mov edx, esi
push eax
lea ecx, [esp + 0x28]
call fcn.004b3c50
test eax, eax
js 0x40b9b4
cmp byte [0x5496b4], 0
lea eax, [esp + 0x20]
mov esi, dword [esp + 0x24]
push eax
jne 0x40b906
push 8
push esi
call dword [sym.imp.ntdll.dll_NtOpenProcessToken]
cmp eax, 0xc0000022
jne 0x40b912
cmp byte [0x5496b4], 0
je 0x40b9aa
lea eax, [esp + 0x20]
push eax
mov edx, 8
mov ecx, esi
call fcn.004b3d60
test eax, eax
js 0x40b9aa
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 1
push esi
mov dword [esp + 0x28], 0
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
push dword [esp + 0x14]
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push edi
push 1
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov esi, eax
test esi, esi
js 0x40b96b
mov dword [esp + 0x3c], edi
jmp 0x40b97e
push edi
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, dword [esp + 0x3c]
test esi, esi
js 0x40b9a0
push 0
push 1
push dword [edi]
call sym.ProcessHacker.exe_PhGetSidFullName
push edi
push 0
push dword [0x54b674]
mov dword [esp + 0x34], eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebx + 0x44]
mov eax, ecx
test ecx, ecx
jne 0x40b9d8
cmp dword [esp + 0x28], ecx
jne 0x40b9d8
mov edx, dword [0x5491dc]
test edx, edx
je 0x40b9d8
mov dword [esp + 0x28], edx
lock inc dword [edx - 4]
mov eax, dword [ebx + 0x44]
cmp eax, 4
jne 0x40ba23
lea eax, [esp + 0x30]
xor esi, esi
push eax
call sym.ProcessHacker.exe_PhEnumKernelModules
test eax, eax
js 0x40ba32
mov edi, dword [esp + 0x30]
cmp dword [edi], 1
jb 0x40ba12
lea edx, [edi + 0x20]
mov ecx, edx
lea esi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ba00
sub ecx, esi
push ecx
push edx
call sym.ProcessHacker.exe_PhConvertMultiByteToUtf16Ex
mov esi, eax
push edi
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x40ba32
lea ecx, [esp + 0x1c]
push ecx
push eax
call sym.ProcessHacker.exe_PhGetProcessImageFileNameByProcessId
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x40ba62
push esi
call sym.ProcessHacker.exe_PhGetFileName
mov edi, eax
mov eax, esi
mov esi, edi
test eax, eax
je 0x40ba59
lea ecx, [eax - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x40ba59
call fcn.004a2a20
test edi, edi
je 0x40ba62
mov edi, dword [edi + 4]
jmp 0x40ba64
xor edi, edi
push str..exe
push str..exe
call fcn.004de297
add esp, 8
mov dword [esp + 0xc], 0
test eax, eax
jne 0x40bac3
test edi, edi
je 0x40ba9c
lea eax, [esp + 0xc]
xor edx, edx
push eax
mov ecx, edi
call fcn.004a1db0
mov ecx, dword [esp + 0xc]
test ecx, ecx
jne 0x40babd
push 0
lea eax, [esp + 0x10]
push eax
call sym.ProcessHacker.exe_PhGetStockApplicationIcon
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x40babd
push ecx
call dword [sym.imp.USER32.dll_CopyIcon]
mov ecx, eax
mov dword [esp + 0xc], ecx
mov edi, ecx
mov eax, edi
jmp 0x40bb30
test edi, edi
je 0x40baf8
push 0x101
push 0x2b4
lea eax, [esp + 0xb8]
push eax
push 0
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [esp + 0xc]
test eax, eax
cmovne ecx, dword [esp + 0xb0]
mov dword [esp + 0xc], ecx
test ecx, ecx
jne 0x40bb2c
push 0x111
push 0x2b4
lea eax, [esp + 0xb8]
push eax
push 0x80
push str..exe
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [esp + 0xc]
test eax, eax
cmovne ecx, dword [esp + 0xb0]
mov dword [esp + 0xc], ecx
mov edi, ecx
mov eax, ecx
test eax, eax
je 0x40bb80
mov eax, dword [esp + 0x10]
push ecx
push 0xffffffffffffffff
push dword [eax + 0x6c]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0x104c
mov dword [esp + 0x4c], 2
push dword [eax + 0x70]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], 0
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0xa
lea eax, [esp + 0x98]
push eax
push dword [ebx + 0x44]
call fcn.004dec37
mov eax, dword [esp + 0x24]
add esp, 0xc
mov dword [esp + 0x44], eax
lea eax, [esp + 0x94]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 1
push eax
mov eax, dword [esp + 0x14]
push 0
push 0x104c
mov dword [esp + 0x54], 1
push dword [eax + 0x70]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [esp + 0x28]
test edi, edi
je 0x40bbde
mov eax, dword [edi + 4]
jmp 0x40bbe0
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0x104c
mov dword [esp + 0x4c], 1
push dword [eax + 0x70]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], 2
call dword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
je 0x40bc2c
lea ecx, [edi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40bc2c
call fcn.004a2a20
test esi, esi
je 0x40bc43
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40bc43
call fcn.004a2a20
mov eax, dword [ebx]
test eax, eax
je 0x40bc51
add ebx, eax
jne 0x40b740
push dword [esp + 0x2c]
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, dword [esp + 0x10]
push 0
push 0
push 0x844d
push dword [ebx + 0x70]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x845c
push dword [ebx + 0x70]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret