Function at 0x42efe0
Capabilities:
Check mutex on windows
Check processdebugflags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3e4
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x3e0], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x42f00e
mov ecx, dword [ecx + 4]
jmp 0x42f013
mov ecx, 0x5d1e90
mov eax, dword [edi + 0x58]
mov dword [esp + 0x114], eax
lea eax, [esp + 0x110]
push eax
push 0
push 0x104c
push dword [edi]
mov dword [esp + 0x120], 1
mov dword [esp + 0x128], 1
mov dword [esp + 0x134], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x42f062
mov ecx, dword ds:[ecx + 4]
jmp 0x42f067
mov ecx, 0x5d1e90
mov eax, dword ds:[edi + 0x5c]
mov dword [esp + 0x114], eax
lea eax, [esp + 0x110]
push eax
push 0
push 0x104c
push dword [edi]
mov dword [esp + 0x120], 1
mov dword [esp + 0x128], 1
mov dword [esp + 0x134], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xc]
mov ebx, 0x78
mov eax, dword [eax + 0xc]
test eax, eax
je 0x42f118
push 0x10
lea ecx, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push ecx
push eax
call fcn.005880a8
mov eax, dword [edi + 0x60]
add esp, 0xc
mov dword [esp + 0x114], eax
lea eax, [esp + 0x178]
mov dword [esp + 0x124], eax
lea eax, [esp + 0x110]
mov dword [esp + 0x110], 1
push eax
push 0
push 0x104c
push dword [edi]
mov dword [esp + 0x128], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword ds:[edi + 0xc]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x42f129
mov eax, dword [eax + 4]
jmp 0x42f12e
mov eax, 0x5d1e90
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1913
mov ecx, dword [edi + 0xc]
test al, al
je 0x42f228
push dword [esp + 0x14]
mov esi, dword [esp + 0x34]
push esi
push dword [ecx + 0x14]
call sym.SystemInformer.exe_Ordinal_1914
push eax
call sym.SystemInformer.exe_Ordinal_1238
cmp dword [eax], 0
je 0x42f1ba
push dword [eax + 4]
mov eax, dword [edi + 0xc]
push dword [eax + 0x14]
push str.0x_x___s_
call sym.SystemInformer.exe_Ordinal_1378
add esp, 0xc
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov dword [esp + 0x110], 1
mov dword [esp + 0x114], 3
mov dword [esp + 0x118], 1
mov eax, dword [eax + 4]
mov dword [esp + 0x124], eax
lea eax, [esp + 0x110]
jmp 0x42f205
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x17c]
push 0x10
push ecx
mov eax, dword [eax + 0x14]
push eax
mov dword [esp + 0x184], 0x780030
call fcn.005880a8
lea eax, [esp + 0x184]
mov dword [esp + 0x5c], 1
mov dword [esp + 0x70], eax
add esp, 0xc
mov dword [esp + 0x54], 3
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x42f28f
mov eax, dword [ecx + 0x14]
lea ecx, [esp + 0x17c]
push 0x10
push ecx
push eax
mov dword [esp + 0x184], 0x780030
call fcn.005880a8
add esp, 0xc
mov dword [esp + 0x110], 1
lea eax, [esp + 0x178]
mov dword [esp + 0x114], 3
mov dword [esp + 0x124], eax
lea eax, [esp + 0x110]
mov dword [esp + 0x118], 1
push eax
push 0
push 0x104c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x635a90], 3
mov ecx, 0x1000
push dword [edi + 8]
mov eax, 0x40
cmovge eax, ecx
push eax
lea eax, [esp + 0x24]
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x42f446
mov eax, dword ds:[edi + 0xc]
lea ecx, [esp + 0x110]
push 0
push 0
push 0
push 0
push ecx
lea ecx, [esp + 0x28]
push ecx
push 0
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x40]
call sym.SystemInformer.exe_Ordinal_1854
test eax, eax
js 0x42f439
mov eax, dword [esp + 0x14]
test eax, eax
js 0x42f439
push 0xa
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x124]
call fcn.005880a8
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x178]
mov dword [esp + 0x54], 4
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x120]
call fcn.005880a8
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x178]
mov dword [esp + 0x54], 5
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x128]
call fcn.005880a8
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x178]
mov dword [esp + 0x54], 6
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x12c]
call fcn.005880a8
add esp, 0xc
mov dword [esp + 0x50], 1
lea eax, [esp + 0x178]
mov dword [esp + 0x54], 7
mov dword [esp + 0x64], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x58], 1
push eax
push 0
push 0x104c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword ds:[esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x431d6e
cmp dword [eax], 0
je 0x431d6e
push 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x12
push ecx
push eax
mov dword [esp + 0x24], str.ALPC_Port
call sym.SystemInformer.exe_Ordinal_1351
nop word [eax + eax]
test al, al
je 0x430625
cmp dword [0x635a90], 3
jl 0x431d6e
push dword [edi + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431d6e
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x1c]
push 0
push 0x14
mov edx, dword [edx + 8]
push eax
push 0
call fcn.00525340
test eax, eax
js 0x42fb74
mov eax, dword [esp + 0x54]
mov esi, 0x100
push 0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], esi
call sym.SystemInformer.exe_Ordinal_1331
mov ebx, eax
xor eax, eax
mov dword [esp + 0x18], ebx
mov dword [ebx], 0
mov ecx, dword [ebx + 4]
mov word [ecx], ax
test dword [esp + 0x54], 0x1000
je 0x42f56a
mov eax, dword ds:[ebx]
add eax, 0x14
cmp eax, esi
jbe 0x42f53d
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x14
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.LPC_mode_]
movups xmmword [ecx], xmm0
mov eax, dword [0x604bbc]
mov dword [ecx + 0x10], eax
add dword [ebx], 0x14
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xffffefff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x10000
je 0x42f5dd
mov eax, dword [ebx]
add eax, 0x2a
cmp esi, eax
jae 0x42f596
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x2a
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Allow_impersonation_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604bd4]
movups xmmword [ecx + 0x10], xmm0
movq xmm0, qword [0x604be4]
movq qword [ecx + 0x20], xmm0
mov ax, word [0x604bec]
mov word [ecx + 0x28], ax
add dword [ebx], 0x2a
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfffeffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x20000
je 0x42f64a
mov eax, dword [ebx]
add eax, 0x28
cmp esi, eax
jae 0x42f60d
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x28
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, dword [ebx + 4]
xor edx, edx
add eax, dword [ebx]
movups xmm0, xmmword [str.Allow_LPC_requests_]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x604c00]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [0x604c10]
movq qword [eax + 0x20], xmm0
add dword [ebx], 0x28
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfffdffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x40000
je 0x42f6a3
mov eax, dword [ebx]
add eax, 0x14
cmp esi, eax
jae 0x42f676
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x14
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Waitable_]
movups xmmword [ecx], xmm0
mov eax, dword [0x604c2c]
mov dword [ecx + 0x10], eax
add dword [ebx], 0x14
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfffbffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x80000
je 0x42f712
mov eax, dword [ebx]
add eax, 0x34
cmp esi, eax
jae 0x42f6cf
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x34
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Allow_object_duplication_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604c44]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x604c54]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x604c64]
mov dword [ecx + 0x30], eax
add dword [ebx], 0x34
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfff7ffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x100000
je 0x42f785
mov eax, dword [ebx]
add eax, 0x2a
cmp esi, eax
jae 0x42f73e
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x2a
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.System_process_only_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604c7c]
movups xmmword [ecx + 0x10], xmm0
movq xmm0, qword [0x604c8c]
movq qword [ecx + 0x20], xmm0
mov ax, word [0x604c94]
mov word [ecx + 0x28], ax
add dword [ebx], 0x2a
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xffefffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x200000
je 0x42f7eb
mov eax, dword [ebx]
add eax, 0x22
cmp esi, eax
jae 0x42f7b1
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x22
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Wake_policy__1__]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604ca8]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [0x604cb8]
mov word [ecx + 0x20], ax
add dword [ebx], 0x22
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xffdfffff
mov word [ecx + eax], dx
test dword [esp + 0x54], sym.SystemInformer.exe_Ordinal_1329
je 0x42f851
mov eax, dword [ebx]
add eax, 0x22
cmp esi, eax
jae 0x42f817
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x22
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Wake_policy__2__]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604ccc]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [0x604cdc]
mov word [ecx + 0x20], ax
add dword [ebx], 0x22
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xffbfffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x800000
je 0x42f8b7
mov eax, dword [ebx]
add eax, 0x22
cmp esi, eax
jae 0x42f87d
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x22
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Wake_policy__3__]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604cf0]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [0x604d00]
mov word [ecx + 0x20], ax
add dword [ebx], 0x22
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xff7fffff
mov word [ecx + eax], dx
test dword ds:[esp + 0x54], 0x1000000
je 0x42f92c
mov eax, dword [ebx]
add eax, 0x38
cmp esi, eax
jae 0x42f8e4
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x38
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, dword [ebx + 4]
xor edx, edx
add eax, dword [ebx]
movups xmm0, xmmword [str.No_shared_section__direct__]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x604d14]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [0x604d24]
movups xmmword [eax + 0x20], xmm0
movq xmm0, qword [0x604d34]
movq qword [eax + 0x30], xmm0
add dword [ebx], 0x38
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfeffffff
mov word [ecx + eax], dx
test dword [esp + 0x54], 0x2000000
je 0x42f9ae
mov eax, dword [ebx]
add eax, 0x3e
cmp esi, eax
jae 0x42f954
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x3e
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx + 4]
xor edx, edx
add ecx, dword [ebx]
movups xmm0, xmmword [str.Allow_multi_handle_attributes_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604d50]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x604d60]
movups xmmword [ecx + 0x20], xmm0
movq xmm0, qword [0x604d70]
movq qword [ecx + 0x30], xmm0
mov eax, dword [0x604d78]
mov dword [ecx + 0x38], eax
mov ax, word [0x604d7c]
mov word [ecx + 0x3c], ax
add dword [ebx], 0x3e
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfdffffff
mov word [ecx + eax], dx
mov ecx, dword [ebx]
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 0x5fc3c0
cmp ecx, 4
jb 0x42fa22
mov eax, dword [ebx + 4]
add ecx, 0xfffffffc
add eax, ecx
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x30]
push 0
push eax
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x42fa22
mov esi, dword [ebx]
mov eax, esi
mov ecx, dword [ebx + 4]
shr eax, 1
lea edx, [eax*2 - 4]
sub esi, edx
lea eax, [ecx + eax*2]
sub esi, 4
push esi
push eax
lea eax, [ecx + edx]
push eax
call fcn.00586310
add dword [ebx], 0xfffffffc
add esp, 0xc
mov ecx, dword [ebx]
xor edx, edx
mov eax, dword [ebx + 4]
mov word [ecx + eax], dx
cmp dword [esp + 0x54], 0
jne 0x42fa74
mov eax, dword [ebx]
add eax, 0xa
cmp dword [esp + 0x14], eax
jae 0x42fa49
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0xa
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx + 4]
add ecx, dword [ebx]
movq xmm0, qword [0x604d80]
movq qword [ecx], xmm0
mov ax, word [0x604d88]
mov word [ecx + 8], ax
add dword [ebx], 0xa
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
mov word [ecx + eax], dx
jmp 0x42fab3
push 0x10
lea eax, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push eax
push dword [esp + 0x5c]
call fcn.005880a8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x18]
push str.___s_
push eax
call sym.SystemInformer.exe_Ordinal_1288
mov ebx, dword [esp + 0x24]
add esp, 0xc
mov eax, dword [esp + 0x28]
test eax, eax
je 0x42faf7
push 0x10
lea ecx, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push ecx
push eax
call fcn.005880a8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x18]
push str.__UNKNOWN:__s_
push eax
call sym.SystemInformer.exe_Ordinal_1288
mov ebx, dword [esp + 0x24]
add esp, 0xc
push dword [ebx + 4]
push 1
push dword [edi + 0x78]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
lea eax, [esp + 0x14]
push eax
call sym.SystemInformer.exe_Ordinal_1338
push 0xa
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x60]
call fcn.005880a8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
push 1
push dword [edi + 0x7c]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push 0x10
lea eax, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push eax
push dword [esp + 0x64]
call fcn.005880a8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
push 1
push dword [edi + 0x80]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x1c]
push eax
mov edx, dword [edx + 8]
call fcn.00525400
mov edx, dword [edi + 0xc]
xor ecx, ecx
mov ebx, dword [esp + 0x14]
test eax, eax
push ecx
push 0x3c
mov edx, dword [edx + 8]
lea eax, [esp + 0x118]
push eax
cmovs ebx, ecx
mov ecx, dword [esp + 0x28]
push 1
call fcn.00525340
test eax, eax
js 0x42fe7b
mov eax, dword ds:[esp + 0x110]
test eax, eax
je 0x42fc8f
xor edx, edx
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], 0
call fcn.0052d260
mov esi, eax
mov dword [esp + 0x14], esi
test ebx, ebx
je 0x42fc77
movzx ecx, word [ebx]
mov edx, ecx
test cx, cx
je 0x42fc77
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xa8], eax
mov eax, edx
mov dword [esp + 0xd8], eax
mov dword [esp + 0x98], 1
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], 1
mov dword [esp + 0xc0], 6
mov dword [esp + 0xc4], 0x604dac
mov dword [esp + 0xc8], 1
mov eax, dword [ebx + 4]
push 0x104
mov dword [esp + 0xe0], eax
lea eax, [esp + 0x9c]
push 3
push eax
call sym.SystemInformer.exe_Ordinal_1375
push dword [esp + 0x14]
mov esi, eax
call sym.SystemInformer.exe_Ordinal_1244
push dword [esi + 4]
push 1
push dword [edi + 0xb8]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
mov eax, dword [esp + 0x124]
test eax, eax
je 0x42fd6b
xor edx, edx
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], 0
call fcn.0052d260
mov esi, eax
mov dword [esp + 0x14], esi
test ebx, ebx
je 0x42fd53
movzx ecx, word [ebx + 8]
mov edx, ecx
test cx, cx
je 0x42fd53
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xa8], eax
mov eax, edx
mov dword [esp + 0xd8], eax
mov dword [esp + 0x98], 1
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], 1
mov dword [esp + 0xc0], 6
mov dword [esp + 0xc4], 0x604dac
mov dword [esp + 0xc8], 1
mov eax, dword [ebx + 0xc]
push 0x104
mov dword [esp + 0xe0], eax
lea eax, [esp + 0x9c]
push 3
push eax
call sym.SystemInformer.exe_Ordinal_1375
push dword [esp + 0x14]
mov esi, eax
call sym.SystemInformer.exe_Ordinal_1244
push dword [esi + 4]
push 1
push dword [edi + 0xbc]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
mov eax, dword [esp + 0x138]
test eax, eax
je 0x42fe45
xor edx, edx
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], 0
call fcn.0052d260
mov esi, eax
mov dword [esp + 0x14], esi
test ebx, ebx
je 0x42fe2a
movzx ecx, word [ebx + 0x10]
mov edx, ecx
test cx, cx
je 0x42fe2a
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xa8], eax
mov eax, edx
mov dword [esp + 0xd8], eax
mov dword [esp + 0x98], 1
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], 1
mov dword [esp + 0xc0], 6
mov dword [esp + 0xc4], 0x604dac
mov dword [esp + 0xc8], 1
mov eax, dword [ebx + 0x14]
push 0x104
mov dword [esp + 0xe0], eax
lea eax, [esp + 0x9c]
push 3
push eax
call sym.SystemInformer.exe_Ordinal_1375
push dword [esp + 0x14]
mov esi, eax
call sym.SystemInformer.exe_Ordinal_1244
push dword [esi + 4]
push 1
push dword [edi + 0xc0]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
test ebx, ebx
je 0x42fe58
push ebx
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword ds:[esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret
push dword [edi + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x3c], 0
push 0x40
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431d6e
push 0
push 0
push 0x20000
lea eax, [esp + 0x44]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x431d6e
mov eax, dword [esp + 0x38]
test eax, eax
je 0x431d6e
push 0
push 0xc
lea ecx, [esp + 0x48]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x4305d4
mov eax, dword [esp + 0x40]
mov esi, 0x100
push 0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], esi
call sym.SystemInformer.exe_Ordinal_1331
mov ebx, eax
xor eax, eax
mov dword [esp + 0x18], ebx
mov dword [ebx], 0
mov ecx, dword [ebx + 4]
mov word [ecx], ax
mov eax, dword [esp + 0x40]
test eax, 0x1000
je 0x42ff91
mov eax, dword [ebx]
add eax, 0x14
cmp eax, esi
jbe 0x42ff60
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x14
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.LPC_mode_]
movups xmmword [ecx], xmm0
mov eax, dword [0x604bbc]
mov dword [ecx + 0x10], eax
add dword [ebx], 0x14
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xffffefff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, 0x10000
je 0x430008
mov eax, dword ds:[ebx]
add eax, 0x2a
cmp esi, eax
jae 0x42ffbd
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x2a
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Allow_impersonation_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604bd4]
movups xmmword [ecx + 0x10], xmm0
movq xmm0, qword [0x604be4]
movq qword [ecx + 0x20], xmm0
mov ax, word [0x604bec]
mov word [ecx + 0x28], ax
add dword [ebx], 0x2a
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xfffeffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, 0x20000
je 0x430076
mov eax, dword [ebx]
add eax, 0x28
cmp esi, eax
jae 0x430035
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x28
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, dword [ebx]
xor edx, edx
add eax, dword [ebx + 4]
movups xmm0, xmmword [str.Allow_LPC_requests_]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x604c00]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [0x604c10]
movq qword [eax + 0x20], xmm0
add dword [ebx], 0x28
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xfffdffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, 0x40000
je 0x4300d0
mov eax, dword [ebx]
add eax, 0x14
cmp esi, eax
jae 0x43009f
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x14
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Waitable_]
movups xmmword [ecx], xmm0
mov eax, dword [0x604c2c]
mov dword [ecx + 0x10], eax
add dword [ebx], 0x14
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xfffbffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, 0x80000
je 0x430144
mov eax, dword [ebx]
add eax, 0x34
cmp esi, eax
jae 0x4300fd
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x34
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Allow_object_duplication_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604c44]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x604c54]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x604c64]
mov dword [ecx + 0x30], eax
add dword [ebx], 0x34
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xfff7ffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, 0x100000
je 0x4301bc
mov eax, dword [ebx]
add eax, 0x2a
cmp esi, eax
jae 0x430171
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x2a
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.System_process_only_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604c7c]
movups xmmword [ecx + 0x10], xmm0
movq xmm0, qword [0x604c8c]
movq qword [ecx + 0x20], xmm0
mov ax, word [0x604c94]
mov word [ecx + 0x28], ax
add dword [ebx], 0x2a
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xffefffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
nop dword [eax]
test eax, 0x200000
je 0x43022b
mov eax, dword [ebx]
add eax, 0x22
cmp esi, eax
jae 0x4301ed
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x22
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Wake_policy__1__]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604ca8]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [0x604cb8]
mov word [ecx + 0x20], ax
add dword [ebx], 0x22
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xffdfffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, sym.SystemInformer.exe_Ordinal_1329
je 0x430292
mov eax, dword [ebx]
add eax, 0x22
cmp esi, eax
jae 0x430254
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x22
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Wake_policy__2__]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604ccc]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [0x604cdc]
mov word [ecx + 0x20], ax
add dword [ebx], 0x22
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xffbfffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
test eax, 0x800000
je 0x4302fd
mov eax, dword [ebx]
add eax, 0x22
cmp esi, eax
jae 0x4302bf
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x22
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Wake_policy__3__]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604cf0]
movups xmmword [ecx + 0x10], xmm0
mov ax, word [0x604d00]
mov word [ecx + 0x20], ax
add dword [ebx], 0x22
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xff7fffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
nop dword [eax]
test eax, 0x1000000
je 0x430379
mov eax, dword [ebx]
add eax, 0x38
cmp esi, eax
jae 0x43032d
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x38
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, dword [ebx]
xor edx, edx
add eax, dword [ebx + 4]
movups xmm0, xmmword [str.No_shared_section__direct__]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x604d14]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [0x604d24]
movups xmmword [eax + 0x20], xmm0
movq xmm0, qword [0x604d34]
movq qword [eax + 0x30], xmm0
add dword [ebx], 0x38
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
and dword [esp + 0x28], 0xfeffffff
mov word [ecx + eax], dx
mov eax, dword [esp + 0x40]
nop dword [eax]
test eax, 0x2000000
je 0x430403
mov eax, dword [ebx]
add eax, 0x3e
cmp esi, eax
jae 0x4303a9
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0x3e
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx]
xor edx, edx
add ecx, dword [ebx + 4]
movups xmm0, xmmword [str.Allow_multi_handle_attributes_]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x604d50]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x604d60]
movups xmmword [ecx + 0x20], xmm0
movq xmm0, qword [0x604d70]
movq qword [ecx + 0x30], xmm0
mov eax, dword [0x604d78]
mov dword [ecx + 0x38], eax
mov ax, word [0x604d7c]
mov word [ecx + 0x3c], ax
add dword [ebx], 0x3e
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
and dword [esp + 0x28], 0xfdffffff
mov word [ecx + eax], dx
mov ecx, dword [ebx]
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 0x5fc3c0
cmp ecx, 4
jb 0x43047d
mov eax, dword ds:[ebx + 4]
add ecx, 0xfffffffc
add eax, ecx
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], eax
lea eax, [esp + 0x30]
push 0
push eax
lea eax, [esp + 0x28]
push eax
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x43047d
mov esi, dword [ebx]
mov eax, esi
mov ecx, dword [ebx + 4]
shr eax, 1
lea edx, [eax*2 - 4]
sub esi, edx
lea eax, [ecx + eax*2]
sub esi, 4
push esi
push eax
lea eax, [ecx + edx]
push eax
call fcn.00586310
add dword [ebx], 0xfffffffc
add esp, 0xc
mov ecx, dword [ebx]
xor edx, edx
mov eax, dword [ebx + 4]
mov word [ecx + eax], dx
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x4304d4
mov eax, dword [ebx]
add eax, 0xa
cmp dword [esp + 0x14], eax
jae 0x4304a9
lfence
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
add edx, 0xa
call fcn.005018a0
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx]
add ecx, dword [ebx + 4]
movq xmm0, qword [0x604d80]
movq qword [ecx], xmm0
mov ax, word [0x604d88]
mov word [ecx + 8], ax
add dword [ebx], 0xa
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
mov word [ecx + eax], dx
jmp 0x430510
push 0x10
lea ecx, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push ecx
push eax
call fcn.005880a8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x18]
push str.___s_
push eax
call sym.SystemInformer.exe_Ordinal_1288
mov ebx, dword [esp + 0x24]
add esp, 0xc
mov eax, dword [esp + 0x28]
test eax, eax
je 0x430554
push 0x10
lea ecx, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push ecx
push eax
call fcn.005880a8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x18]
push str.__UNKNOWN:__s_
push eax
call sym.SystemInformer.exe_Ordinal_1288
mov ebx, dword [esp + 0x24]
add esp, 0xc
push dword ds:[ebx + 4]
push 1
push dword [edi + 0x78]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
lea eax, [esp + 0x14]
push eax
call sym.SystemInformer.exe_Ordinal_1338
push 0xa
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x60]
call fcn.005880a8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
push 1
push dword [edi + 0x7c]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push 0x10
lea eax, [esp + 0x180]
mov dword [esp + 0x17c], 0x780030
push eax
push dword [esp + 0x64]
call fcn.005880a8
add esp, 0xc
lea eax, [esp + 0x178]
push eax
push 1
push dword [edi + 0x80]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
cmp dword [0x62db64], 0x6c
nop dword [eax + eax]
jb 0x43155f
push 0
push 8
lea eax, [esp + 0x1c]
push eax
push 0xc
push dword [esp + 0x48]
call dword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
nop dword [eax + eax]
test eax, eax
js 0x43155f
mov eax, dword ds:[esp + 0x18]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
jmp 0x43153e
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0x1e
push dword [eax + 0x20]
mov dword [esp + 0x30], str.EtwRegistration
call sym.SystemInformer.exe_Ordinal_1351
mov ecx, dword [edi + 0xc]
test al, al
je 0x430676
mov eax, dword [ecx + 0x24]
test eax, eax
je 0x430666
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xd4]
jmp 0x431d67
xor eax, eax
push eax
push 1
push dword [edi + 0xd4]
jmp 0x431d67
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
push dword [ecx + 0x20]
mov dword [esp + 0x30], 0x602fe0
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x4310db
cmp dword [0x635a90], 3
jl 0x430be9
push dword [edi + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_Ordinal_1560
nop dword [eax]
test eax, eax
js 0x430be9
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x40]
push eax
push ecx
lea eax, [esp + 0x30]
xor bh, bh
mov edx, dword [edx + 8]
xor bl, bl
push eax
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.00525540
test eax, eax
js 0x43073f
mov eax, dword [esp + 0x28]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x430702.9
movzx eax, byte [eax + 0x431d98]
jmp dword [eax*4 + 0x431d84]
push str.Pipe
jmp 0x430730
push str.Network
jmp 0x430730
mov bh, 1
push str.File_or_directory
jmp 0x430730
mov bl, 1
push str.Console
jmp 0x430730
push 0x604e04
push 1
push dword [edi + 0x84]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push 4
lea eax, [esp + 0x3c]
push eax
mov eax, dword [edi + 0xc]
push 0x10
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_Ordinal_1858
test eax, eax
js 0x43086b
mov eax, dword [esp + 0x38]
mov edx, eax
mov ecx, eax
and edx, 0xfeffffff
or ecx, 0x1000000
test al, 0x30
push 6
cmovne ecx, edx
push 0x5d6bd0
push ecx
call sym.SystemInformer.exe_Ordinal_1914
mov ecx, dword ds:[esp + 0x38]
mov esi, eax
push 0
mov dword [esp + 0x9c], 1
mov dword [esp + 0xac], 4
mov dword [esp + 0xb0], 0x5fd468
mov dword [esp + 0xb4], 0x108
mov dword [esp + 0xc4], ecx
mov byte [esp + 0xbe], 0x10
mov dword [esp + 0xcc], 1
mov dword [esp + 0xdc], 4
mov dword [esp + 0xe0], 0x603a3c
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xf4], eax
lea eax, [esp + 0x1e4]
push 0x208
push eax
push 5
lea eax, [esp + 0xa8]
mov dword [esp + 0xf0], 1
push eax
mov dword [esp + 0x108], ecx
mov dword [esp + 0x10c], 1
mov dword [esp + 0x11c], 2
mov dword [esp + 0x120], 0x604e10
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x430865
lea eax, ds:[esp + 0x1e0]
push eax
push 1
push dword [edi + 0x88]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
test bl, bl
jne 0x430a74
push 0x18
lea eax, [esp + 0x54]
push eax
mov eax, dword [edi + 0xc]
push 5
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_Ordinal_1858
test eax, eax
js 0x430910
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
push 0
mov dword [esp + 0x124], eax
lea eax, [esp + 0x9c]
push 0x64
push eax
push 1
lea eax, [esp + 0x120]
mov dword [esp + 0x120], 0xd
push eax
mov dword [esp + 0x138], ecx
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x4308ea
lea eax, [esp + 0x98]
push eax
push 1
push dword [edi + 0x90]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
test bh, bh
je 0x430910
cmp byte [esp + 0x65], 0
mov ecx, 0x602fe0
mov eax, 0x604e14
cmove eax, ecx
push eax
push 1
push dword [edi + 0x84]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push 8
lea eax, [esp + 0x24]
push eax
mov eax, dword [edi + 0xc]
push 0xe
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_Ordinal_1858
test eax, eax
js 0x430a74
mov ecx, dword ds:[esp + 0x20]
mov eax, ecx
mov edx, dword [esp + 0x24]
or eax, edx
je 0x430a74
mov esi, dword [esp + 0x58]
mov eax, esi
mov ebx, dword [esp + 0x5c]
or eax, ebx
je 0x430a25
mov dword ds:[esp + 0x98], 0x10009
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
mov dword [esp + 0xb0], 1
mov dword [esp + 0xc0], 4
mov dword [esp + 0xc4], 0x603a3c
mov dword [esp + 0xc8], 0x4b
call fcn.005a7260
mov edx, ebx
movss dword [esp + 0x14], xmm0
mov ecx, esi
call fcn.005a7260
movss xmm1, dword [esp + 0x14]
mov eax, 1
divss xmm1, xmm0
push 0
mov word [esp + 0xd0], ax
mov dword [esp + 0xe4], eax
lea eax, [esp + 0x114]
push 0x64
push eax
push 4
lea eax, [esp + 0xa8]
mov dword [esp + 0x100], 4
push eax
mov dword [esp + 0x108], 0x604e28
mulss xmm1, dword [0x62453c]
movss dword [esp + 0xec], xmm1
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x430a74
lea eax, [esp + 0x110]
jmp 0x430a64
push 0
push 0x64
lea eax, [esp + 0xa0]
mov dword [esp + 0x118], 0x10009
push eax
push 1
lea eax, [esp + 0x120]
mov dword [esp + 0x130], ecx
push eax
mov dword [esp + 0x138], edx
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x430a74
lea eax, [esp + 0x98]
push eax
push 1
push dword [edi + 0x8c]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push 8
lea eax, [esp + 0x94]
push eax
mov eax, dword [edi + 0xc]
push 0x2b
push dword [eax + 8]
push dword [esp + 0x2c]
call sym.SystemInformer.exe_Ordinal_1858
test eax, eax
js case.default.0x430aa5
mov eax, dword ds:[esp + 0x90]
cmp eax, 4
ja case.default.0x430aa5
jmp dword [eax*4 + 0x431de8]
push str.Very_Low
jmp 0x430ace
push 0x604e44
jmp 0x430ace
push 0x5fb6c8
nop
jmp 0x430ace
push 0x5fb6d8
jmp 0x430ace
push 0x604e4c
push 1
push dword [edi + 0x94]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x1c]
push 0
push 4
mov edx, dword [edx + 8]
push eax
push 8
call fcn.00524dc0
test eax, eax
js 0x42fe58
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x14]
call fcn.00517fe0
test eax, eax
js 0x430b35
mov esi, dword [esp + 0x14]
test esi, esi
je 0x430b1d
mov eax, dword [esi + 4]
jmp 0x430b1f
xor eax, eax
push eax
push 1
push dword [edi + 0x98]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x14]
push eax
mov edx, 3
call fcn.00517f20
test eax, eax
js 0x430bb7
mov ebx, dword [esp + 0x14]
movzx eax, word [ebx]
mov ecx, eax
test ax, ax
jne 0x430b67
nop
call sym.SystemInformer.exe_Ordinal_1430
jmp 0x430b85
mov eax, dword ds:[ebx + 4]
mov dword [esp + 0x18], eax
mov eax, ecx
push 0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push 0
push eax
call sym.SystemInformer.exe_Ordinal_1331
push ebx
push 0
push dword [0x633a74]
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
je 0x430b9f
mov eax, dword [esi + 4]
jmp 0x430ba1
xor eax, eax
push eax
push 1
push dword [edi + 0x9c]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
push dword ds:[esp + 0x30]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret
push dword ds:[edi + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 0
push 0x40
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431d6e
push 0
push 0
push 0x100001
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x430c92
push 0
push 0
push 0x100080
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x430c92
push 2
push 0
push 0
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push 0
push 0
push 0x100001
mov esi, eax
call fcn.0051bfa0
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
nop dword [eax]
test esi, esi
js 0x431d6e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x431d6e
push 4
push 8
lea ecx, [esp + 0x98]
xor bh, bh
push ecx
lea ecx, [esp + 0x4c]
xor bl, bl
push ecx
push eax
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x430d29
mov eax, dword [esp + 0x90]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x430cee.9
movzx eax, byte [eax + 0x431e10]
jmp dword [eax*4 + 0x431dfc]
push str.Pipe
jmp 0x430d1a
push str.Network
jmp 0x430d1a
mov bh, 1
push str.File_or_directory
jmp 0x430d1a
mov bl, 1
push str.Console
jmp 0x430d1a
push 0x604e04
push 1
push dword [edi + 0x84]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x30]
push 4
push eax
mov edx, 0x10
call fcn.0052f820
nop
test eax, eax
js 0x430e4e
mov eax, dword [esp + 0x30]
mov edx, eax
mov ecx, eax
and edx, 0xfeffffff
or ecx, 0x1000000
test al, 0x30
push 6
cmovne ecx, edx
push 0x5d6bd0
push ecx
call sym.SystemInformer.exe_Ordinal_1914
mov ecx, dword [esp + 0x30]
mov esi, eax
push 0
mov dword [esp + 0x9c], 1
mov dword [esp + 0xac], 4
mov dword [esp + 0xb0], 0x5fd468
mov dword [esp + 0xb4], 0x108
mov dword [esp + 0xc4], ecx
mov byte [esp + 0xbe], 0x10
mov dword [esp + 0xcc], 1
mov dword [esp + 0xdc], 4
mov dword [esp + 0xe0], 0x603a3c
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xf4], eax
lea eax, [esp + 0x1e4]
push 0x208
push eax
push 5
lea eax, [esp + 0xa8]
mov dword [esp + 0xf0], 1
push eax
mov dword [esp + 0x108], ecx
mov dword [esp + 0x10c], 1
mov dword [esp + 0x11c], 2
mov dword [esp + 0x120], 0x604e10
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x430e48
lea eax, [esp + 0x1e0]
push eax
push 1
push dword [edi + 0x88]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
test bl, bl
jne 0x43104d
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x50]
push 0x18
push eax
mov edx, 5
call fcn.0052f820
test eax, eax
js 0x430ef0
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
push 0
mov dword [esp + 0x124], eax
lea eax, [esp + 0x9c]
push 0x64
push eax
push 1
lea eax, [esp + 0x120]
mov dword [esp + 0x120], 0xd
push eax
mov dword [esp + 0x138], ecx
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x430eca
lea eax, [esp + 0x98]
push eax
push 1
push dword [edi + 0x90]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
test bh, bh
je 0x430ef0
cmp byte [esp + 0x65], 0
mov ecx, 0x602fe0
mov eax, 0x604e14
cmove eax, ecx
push eax
push 1
push dword [edi + 0x84]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x20]
push 8
push eax
mov edx, 0xe
call fcn.0052f820
test eax, eax
js 0x43104d
mov ecx, dword [esp + 0x20]
mov eax, ecx
mov edx, dword [esp + 0x24]
or eax, edx
je 0x43104d
mov esi, dword [esp + 0x58]
mov eax, esi
mov ebx, dword [esp + 0x5c]
or eax, ebx
je 0x430ffe
mov dword [esp + 0x98], 0x10009
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
mov dword [esp + 0xb0], 1
mov dword [esp + 0xc0], 4
mov dword [esp + 0xc4], 0x603a3c
mov dword [esp + 0xc8], 0x4b
call fcn.005a7260
mov edx, ebx
movss dword [esp + 0x14], xmm0
mov ecx, esi
call fcn.005a7260
movss xmm1, dword [esp + 0x14]
mov eax, 1
divss xmm1, xmm0
push 0
mov word [esp + 0xd0], ax
mov dword [esp + 0xe4], eax
lea eax, [esp + 0x114]
push 0x64
push eax
push 4
lea eax, [esp + 0xa8]
mov dword [esp + 0x100], 4
push eax
mov dword [esp + 0x108], 0x604e28
mulss xmm1, dword [0x62453c]
movss dword [esp + 0xec], xmm1
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x43104d
lea eax, [esp + 0x110]
jmp 0x43103d
push 0
push 0x64
lea eax, [esp + 0xa0]
mov dword [esp + 0x118], 0x10009
push eax
push 1
lea eax, [esp + 0x120]
mov dword [esp + 0x130], ecx
push eax
mov dword [esp + 0x138], edx
call sym.SystemInformer.exe_Ordinal_1380
test al, al
je 0x43104d
lea eax, [esp + 0x98]
push eax
push 1
push dword [edi + 0x8c]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov ecx, dword ds:[esp + 0x28]
lea eax, [esp + 0x38]
push 8
push eax
mov edx, 0x2b
call fcn.0052f820
test eax, eax
js case.default.0x431080
mov eax, dword [esp + 0x38]
cmp eax, 4
ja case.default.0x431080
nop word [eax + eax]
jmp dword [eax*4 + 0x431e60]
push str.Very_Low
jmp 0x4310a8
push 0x604e44
jmp 0x4310a8
push 0x5fb6c8
jmp 0x4310a8
push 0x5fb6d8
jmp 0x4310a8
push 0x604e4c
push 1
push dword [edi + 0x94]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push dword ds:[esp + 0x28]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xe
push dword [eax + 0x20]
mov dword [esp + 0x30], 0x6042cc
call sym.SystemInformer.exe_Ordinal_1351
nop dword [eax]
test al, al
je 0x431405
xor ebx, ebx
cmp dword [0x635a90], 3
mov dword [esp + 0x30], ebx
jl 0x431228
push dword [edi + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431228
push 0x100
push 4
push dword [0x633a74]
mov dword [esp + 0x44], ebx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [edi + 0xc]
mov esi, eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x40]
push ebx
push 0x10
mov edx, dword [edx + 8]
push eax
push 0xe
call fcn.00524dc0
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
push eax
mov edx, dword [edx + 8]
push 0x100
push esi
push 0xf
call fcn.00524dc0
cmp eax, 0x80000005
jne 0x4311dd
cmp dword [esp + 0x38], ebx
jbe 0x431210
push esi
push ebx
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x38]
push esi
push 4
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x38]
push eax
mov edx, dword [edx + 8]
push esi
mov esi, dword [esp + 0x38]
push esi
push 0xf
call fcn.00524dc0
nop dword [eax]
test eax, eax
js 0x431210
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4311f5
call sym.SystemInformer.exe_Ordinal_1430
jmp 0x43120e
mov eax, dword [esi + 4]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x2c], ecx
call sym.SystemInformer.exe_Ordinal_1331
mov ebx, eax
push esi
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x1c]
jmp 0x4312db
push dword [edi + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], ebx
push 0x40
push eax
call sym.SystemInformer.exe_Ordinal_1560
nop dword [eax + eax]
test eax, eax
js 0x431d6e
push 0
push 0
push 5
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x43128b
push 0
push 0
push 1
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x431d6e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4312f1
push 0
push 0x10
lea ecx, [esp + 0x48]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQuerySection]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x30]
mov dword [esp + 0x14], eax
call fcn.0052d1e0
mov ebx, dword [esp + 0x30]
xor ecx, ecx
push dword [esp + 0x28]
test eax, eax
cmovs ebx, ecx
nop dword [eax + eax]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [esp + 0x14], 0
jl 0x431d6e
mov eax, dword ds:[esp + 0x44]
mov ecx, 0x5fb6ac
test eax, 0x8000000
je 0x431311
mov esi, 0x604e60
jmp 0x43133b
test eax, 0x800000
je 0x43131f
mov esi, 0x602fe0
jmp 0x43133b
nop
test eax, 0x1000000
je 0x43132e
mov esi, 0x604e70
jmp 0x43133b
test eax, 0x4000000
mov esi, str.Reserve
cmove esi, ecx
mov al, byte [0x6314c0]
mov ecx, dword [esp + 0x4c]
mov byte [esp + 0x5a], al
mov eax, dword [esp + 0x48]
push 0
mov dword [esp + 0x64], eax
lea eax, [esp + 0x54]
push 1
push eax
mov dword [esp + 0x5c], 0x10d
mov dword [esp + 0x70], ecx
call sym.SystemInformer.exe_Ordinal_1375
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x4313ae
push ebx
call sym.SystemInformer.exe_Ordinal_1570
test eax, eax
je 0x4313a5
mov ecx, ebx
mov ebx, eax
test ecx, ecx
je 0x4313a5
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4313a5
nop
call fcn.004fe0c0
test ebx, ebx
je 0x4313ae
mov eax, dword [ebx + 4]
jmp 0x4313b3
mov eax, 0x604e8c
push eax
push 1
push dword [edi + 0xa4]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
push 1
push dword [edi + 0xa0]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4313ee
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xa8]
jmp 0x431d67
mov eax, 0x5fb6ac
push eax
push 1
push dword [edi + 0xa8]
jmp 0x431d67
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xc
push dword [eax + 0x20]
mov dword [esp + 0x30], 0x604ab8
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x43157e
push dword [edi + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x3c], 0
push 0x40
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431d6e
push 0
push 0
push 1
lea eax, [esp + 0x44]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x431d6e
mov eax, dword [esp + 0x38]
test eax, eax
je 0x431d6e
push 0
push 8
lea ecx, [esp + 0x28]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQueryMutant]
nop dword [eax]
test eax, eax
js 0x431512
mov eax, dword [esp + 0x20]
cdq
push 0
mov dword [esp + 0x124], eax
lea eax, [esp + 0x114]
push 1
push eax
mov dword [esp + 0x11c], 0x10009
mov dword [esp + 0x130], edx
call sym.SystemInformer.exe_Ordinal_1375
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xac]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
cmp byte [esp + 0x25], 0
mov ecx, str.False
mov eax, str.True
cmove eax, ecx
push eax
push 1
push dword [edi + 0xb0]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push 0
push 8
lea eax, [esp + 0x1c]
push eax
push 1
push dword [esp + 0x48]
call dword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x43155f
cmp dword [esp + 0x14], 0
je 0x43155f
lea eax, [esp + 0x14]
push eax
call sym.SystemInformer.exe_Ordinal_1037
mov esi, eax
push dword [esi + 4]
push 1
push dword [edi + 0xb4]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret
mov eax, dword ds:[edi + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xe
push dword [eax + 0x20]
mov dword [esp + 0x30], 0x602ef4
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x431969
xor ebx, ebx
mov esi, 0x103
cmp dword [0x635a90], 3
mov dword [esp + 0x30], ebx
jl 0x431730
push dword [edi + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_Ordinal_1560
nop dword [eax + eax]
test eax, eax
js 0x431730
push 0x100
push 4
push dword [0x633a74]
mov dword [esp + 0x34], ebx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
push ebx
mov dword [esp + 0x34], eax
lea eax, [esp + 0x114]
mov edx, dword [edx + 8]
push 0x18
push eax
push 4
call fcn.00524dc0
mov edx, dword [edi + 0xc]
test eax, eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x50]
cmovns esi, dword [esp + 0x110]
push ebx
mov edx, dword [edx + 8]
push 0x20
push eax
push 9
mov dword [esp + 0x24], esi
call fcn.00524dc0
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
shr eax, 0x1f
mov dword [esp + 0x38], eax
lea eax, [esp + 0x28]
mov edx, dword [edx + 8]
push eax
push 0x100
push dword [esp + 0x38]
push 0xb
call fcn.00524dc0
cmp eax, 0xc0000023
jne 0x4316ce
nop word [eax + eax]
cmp dword [esp + 0x28], ebx
jbe 0x43171d
push dword [esp + 0x30]
push ebx
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x28]
push esi
push 4
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [edi + 0xc]
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x20]
push esi
mov edx, dword [edx + 8]
push eax
push 0xb
mov dword [esp + 0x40], eax
call fcn.00524dc0
mov esi, dword [esp + 0x14]
test eax, eax
js 0x43171d
mov edx, dword ds:[esp + 0x30]
movzx eax, word [edx]
mov ecx, eax
test ax, ax
jne 0x4316ef
call sym.SystemInformer.exe_Ordinal_1430
jmp 0x431708
mov eax, dword [edx + 4]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x2c], ecx
call sym.SystemInformer.exe_Ordinal_1331
push eax
mov dword [esp + 0x18], eax
call sym.SystemInformer.exe_Ordinal_1509
push dword [esp + 0x14]
mov ebx, eax
call sym.SystemInformer.exe_Ordinal_1244
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0x38]
jmp 0x431811
push dword ds:[edi + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], ebx
push 0x40
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431d6e
push 0
push 0
push 0x1000
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
nop dword [eax]
test esi, esi
js 0x431d6e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x431d6e
lea ecx, [esp + 0x30]
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1530
nop
test eax, eax
js 0x4317bc
mov esi, dword [esp + 0x30]
push esi
call sym.SystemInformer.exe_Ordinal_1509
push esi
mov ebx, eax
call sym.SystemInformer.exe_Ordinal_1244
jmp 0x4317c0
mov ebx, dword [esp + 0x30]
push 0
push 0x18
lea eax, [esp + 0x118]
push eax
push 0
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push 0
test eax, eax
mov esi, 0x103
push 0x20
cmovns esi, dword [esp + 0x118]
lea eax, [esp + 0x58]
push eax
push 4
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push dword [esp + 0x28]
mov dword [esp + 0x3c], eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0x38]
shr eax, 0x1f
xor al, 1
mov dword [esp + 0x38], eax
test ebx, ebx
je 0x43183b
push dword [ebx + 4]
push 1
push dword [edi + 0xc4]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push ebx
call sym.SystemInformer.exe_Ordinal_1244
mov eax, dword [esp + 0x38]
nop dword [eax + eax]
test al, al
je 0x4318c5
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_Ordinal_1675
lea eax, ds:[esp + 0x40]
push eax
call sym.SystemInformer.exe_Ordinal_1619
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xc8]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
nop
cmp esi, 0x103
je 0x431d6e
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_Ordinal_1675
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_Ordinal_1619
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xcc]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
nop
jmp 0x4318d1
cmp esi, 0x103
je 0x431d6e
push 0
push esi
call sym.SystemInformer.exe_Ordinal_1662
mov ebx, eax
test ebx, ebx
je 0x4318f0
mov eax, dword [ebx + 4]
jmp 0x4318f5
mov eax, 0x5fb6ac
push eax
push esi
push str.0x_x___s_
call sym.SystemInformer.exe_Ordinal_1378
mov esi, eax
add esp, 0xc
test esi, esi
je 0x43191a
mov eax, dword [esi + 4]
jmp 0x43191f
mov eax, 0x5d1e90
push eax
push 1
push dword [edi + 0xd0]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
test ebx, ebx
je 0x431d6e
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x431d6e
call fcn.004fe0c0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xc
push dword [eax + 0x20]
mov dword [esp + 0x30], str.Thread
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x431d6e
xor eax, eax
mov byte [esp + 0x13], 0
cmp dword [0x635a90], 3
mov ebx, 0x103
mov dword [esp + 0x38], eax
mov dword [esp + 0x14], eax
jl 0x431b45
push dword [edi + 8]
lea eax, [esp + 0x20]
push 0x1000
push eax
call sym.SystemInformer.exe_Ordinal_1560
test eax, eax
js 0x431b45
push 0x100
push 4
push dword [0x633a74]
mov dword [esp + 0x3c], 0
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [edi + 0xc]
mov esi, eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
push 0x100
mov edx, dword [edx + 8]
push esi
push 0xc
call fcn.00524dc0
cmp eax, 0xc0000023
jne 0x431a5f
cmp dword [esp + 0x30], 0
jbe 0x431aa2
push esi
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x30]
push esi
push 4
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x30]
push eax
mov edx, dword [edx + 8]
push esi
mov esi, dword [esp + 0x1c]
push esi
push 0xc
call fcn.00524dc0
nop
test eax, eax
js 0x431aa2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x431a85
call sym.SystemInformer.exe_Ordinal_1430
nop dword [eax + eax]
jmp 0x431a9e
mov eax, dword [esi + 4]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x2c], ecx
call sym.SystemInformer.exe_Ordinal_1331
mov dword [esp + 0x38], eax
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x1c]
push 0
push 4
mov edx, dword [edx + 8]
push eax
push 0xd
call fcn.00524dc0
nop dword [eax]
test eax, eax
js 0x431b02
mov eax, dword [esp + 0x28]
test eax, eax
setne byte [esp + 0x13]
test eax, eax
je 0x431b02
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x110]
mov ecx, dword [esp + 0x1c]
push 0
push 0x1c
mov edx, dword [edx + 8]
push eax
push 5
call fcn.00524dc0
test eax, eax
cmovns ebx, dword [esp + 0x110]
mov edx, dword [edi + 0xc]
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x1c]
push 0
push 0x20
mov edx, dword [edx + 8]
push eax
push 0xa
call fcn.00524dc0
push esi
push 0
push dword [0x633a74]
mov dword [esp + 0x20], eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword ds:[esp + 0x38]
jmp 0x431c46
push dword [edi + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 0
push 0x40
push eax
call sym.SystemInformer.exe_Ordinal_1560
nop dword [eax]
test eax, eax
js 0x431d6e
push 0
push 0
push 0x800
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x431d6e
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x431cff
lea edx, [esp + 0x14]
call fcn.005241a0
mov esi, dword [esp + 0x14]
test eax, eax
js 0x431bc5
push esi
call sym.SystemInformer.exe_Ordinal_1244
push 0
push 4
lea eax, [esp + 0x1c]
push eax
push 0x14
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
nop word [eax + eax]
test eax, eax
js 0x431c1d
mov eax, dword [esp + 0x14]
test eax, eax
setne byte [esp + 0x13]
test eax, eax
je 0x431c1d
push 0
push 0x1c
lea eax, [esp + 0x118]
push eax
push 0
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
cmovns ebx, dword [esp + 0x110]
push 0
push 0x20
lea eax, [esp + 0x58]
push eax
push 1
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
push dword ds:[esp + 0x28]
mov dword [esp + 0x18], eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x431c6b
push dword ds:[esi + 4]
push 1
push dword [edi + 0xc4]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push esi
call sym.SystemInformer.exe_Ordinal_1244
cmp byte [esp + 0x13], 0
je 0x431cf4
push 0
push ebx
call sym.SystemInformer.exe_Ordinal_1662
mov esi, eax
test esi, esi
je 0x431c90
mov eax, dword [esi + 4]
jmp 0x431c95
mov eax, 0x5fb6ac
push eax
push ebx
push str.0x_x___s_
call sym.SystemInformer.exe_Ordinal_1378
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x431cba
mov eax, dword [ebx + 4]
jmp 0x431cbf
mov eax, 0x5d1e90
push eax
push 1
push dword [edi + 0xd0]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
push ebx
call sym.SystemInformer.exe_Ordinal_1244
test esi, esi
je 0x431cf4
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x431cf4
call fcn.004fe0c0
cmp dword [esp + 0x14], 0
jl 0x431d6e
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_Ordinal_1675
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_Ordinal_1619
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xc8]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
cmp byte [esp + 0x13], 0
je 0x431d6e
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_Ordinal_1675
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_Ordinal_1619
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov eax, dword [eax + 4]
push eax
push 1
push dword [edi + 0xcc]
push dword [edi]
call sym.SystemInformer.exe_Ordinal_1819
mov ecx, dword [esp + 0x3ec]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret