Function at 0x4b8510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe4
mov eax, dword [sym.ProcessHacker.exe_PhStdGetClientIdName]
push ebx
push esi
push edi
mov dword [esp + 0x10], eax
mov esi, edx
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x1e
push eax
push dword [ebp + 0xc]
mov ebx, ecx
mov dword [esp + 0x2c], str.EtwRegistration
xor edi, edi
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4b8641
mov eax, dword [0x5496ac]
test eax, eax
je 0x4b947a
push edi
push edi
push 0x18
lea ecx, [esp + 0xe8]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x58], ecx
lea ecx, [esp + 0x4c]
push ecx
push 0x9999225f
lea ecx, [esp + 0x3c]
mov dword [esp + 0x58], esi
push ecx
push edi
push edi
push edi
push eax
mov dword [esp + 0x70], 6
mov dword [esp + 0x78], 0x14
mov dword [esp + 0x7c], edi
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x4b947a
lea eax, [esp + 0xdc]
push eax
call sym.ProcessHacker.exe_PhFormatGuid
mov ebx, eax
push ebx
push 0x547e44
call sym.ProcessHacker.exe_PhConcatStringRef2
push edi
mov esi, eax
lea eax, [esp + 0x18]
push esi
push 0xfffffffffffffffd
push 0x20019
push eax
call sym.ProcessHacker.exe_PhOpenKey
test eax, eax
js 0x4b8608
push edi
push dword [esp + 0x18]
call sym.ProcessHacker.exe_PhQueryRegistryString
mov edi, eax
test edi, edi
je 0x4b85fe
cmp dword [edi], 0
jne 0x4b85fe
push edi
call sym.ProcessHacker.exe_PhDereferenceObject
xor edi, edi
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [esi - 8]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4b861d
call fcn.004a2a20
test edi, edi
je 0x4b863a
lea ecx, [ebx - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x4b9466
call fcn.004a2a20
jmp 0x4b9466
mov edi, ebx
jmp 0x4b9466
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 8
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x2c], 0x5248b8
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4b877b
mov eax, dword [ebp + 8]
push eax
call sym.ProcessHacker.exe_PhResolveDevicePrefix
mov edi, eax
test edi, edi
jne 0x4b8684
mov eax, dword [ebp + 8]
mov edi, eax
test eax, eax
je 0x4b868d
lock inc dword [eax - 4]
cmp dword [edi], 0
je 0x4b868d
xor al, al
jmp 0x4b868f
mov al, 1
cmp dword [0x5496ac], 0
je 0x4b9466
test al, al
je 0x4b9466
push 0
push 4
lea eax, [esp + 0x1c]
mov edx, esi
push eax
push 8
mov ecx, ebx
call fcn.004b4010
test eax, eax
js 0x4b9466
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4b9466
lea eax, [esp + 0xc]
mov edx, 1
push eax
call fcn.004aee10
test eax, eax
js 0x4b945c
mov ebx, dword [esp + 0xc]
movzx eax, word [ebx]
test ax, ax
jne 0x4b86f8
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
jmp 0x4b873b
push dword [0x54b7b4]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x10], eax
add eax, 0xa
push eax
mov dword [esp + 0x44], ecx
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, dword [esp + 0xc]
mov esi, eax
lea eax, [esi + 8]
xor edx, edx
mov dword [esi + 4], eax
mov dword [esi], ecx
mov word [eax + ecx], dx
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4b873b
push ecx
push eax
push dword [esi + 4]
call fcn.004dd620
add esp, 0xc
push ebx
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push esi
push 0x547ddc
call sym.ProcessHacker.exe_PhConcatStringRef2
mov ecx, edi
mov edi, eax
test ecx, ecx
je 0x4b8770
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4b8770
call fcn.004a2a20
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
jmp 0x4b945c
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 6
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x2c], 0x525a94
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4b89b8
mov eax, dword [ebp + 8]
test eax, eax
je 0x4b87b1
cmp dword [eax], edi
je 0x4b87b1
xor al, al
jmp 0x4b87b3
mov al, 1
test al, al
je 0x4b947a
push 0
push 0
push 4
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
push esi
push ebx
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4b947a
cmp dword [esp + 0x10], edi
je 0x4b89af
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x10]
call sym.ProcessHacker.exe_PhGetJobProcessIdList
test eax, eax
js 0x4b89af
push dword [0x54b7b4]
mov ebx, 0x28
push 0x32
mov dword [esp + 0x24], ebx
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [esp + 0x20], edi
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [edi + 4], eax
mov word [eax + 0x28], cx
mov dword [edi], ecx
mov eax, dword [edi + 4]
mov word [eax], cx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
cmp dword [eax + 4], ecx
jbe 0x4b891d
add eax, 8
mov dword [esp + 0x3c], eax
mov eax, dword [eax]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
call dword [esp + 0x14]
mov ebx, eax
test ebx, ebx
je 0x4b88fa
mov esi, dword [ebx]
mov eax, dword [ebx + 4]
mov dword [esp + 0x24], eax
test esi, esi
je 0x4b88a8
mov edx, dword [edi]
add edx, esi
cmp dword [esp + 0x1c], edx
jae 0x4b8887
lea ecx, [esp + 0x1c]
call fcn.004a80b0
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4b889b
push esi
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push eax
call fcn.004dd620
add esp, 0xc
add dword [edi], esi
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
push 0x52f5f0
call sym.ProcessHacker.exe_PhCountStringZ
mov esi, eax
add esi, esi
je 0x4b88f0
mov edx, dword [edi]
add edx, esi
cmp dword [esp + 0x1c], edx
jae 0x4b88cf
lea ecx, [esp + 0x1c]
call fcn.004a80b0
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
add eax, dword [edi + 4]
push esi
push 0x52f5f0
push eax
call fcn.004dd620
add dword [edi], esi
add esp, 0xc
mov ecx, dword [edi]
xor edx, edx
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
push ebx
call sym.ProcessHacker.exe_PhDereferenceObject
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
inc esi
mov eax, dword [esp + 0x3c]
add eax, 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x3c], eax
cmp esi, dword [ecx + 4]
jb 0x4b8846
mov ebx, dword [esp + 0x1c]
mov eax, ecx
push eax
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [edi]
test esi, esi
je 0x4b8969
mov ecx, dword [edi + 4]
mov edx, esi
and edx, 0xfffffffe
mov eax, esi
sub edx, 4
shr esi, 1
sub eax, edx
sub eax, 4
push eax
lea eax, [ecx + esi*2]
push eax
lea eax, [edx + ecx]
push eax
call fcn.004ddca0
add dword [edi], 0xfffffffc
xor edx, edx
mov ecx, dword [edi]
add esp, 0xc
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
cmp dword [edi], edx
jne 0x4b89af
push str._No_processes_
call sym.ProcessHacker.exe_PhCountStringZ
mov esi, eax
add esi, esi
je 0x4b89af
mov edx, dword [edi]
add edx, esi
cmp ebx, edx
jae 0x4b898e
lea ecx, [esp + 0x1c]
call fcn.004a80b0
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
add eax, dword [edi + 4]
push esi
push str._No_processes_
push eax
call fcn.004dd620
add dword [edi], esi
add esp, 0xc
mov ecx, dword [edi]
xor edx, edx
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
push dword [esp + 0xc]
jmp 0x4b9460
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 6
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x38], 0x525648
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4b89eb
mov eax, dword [ebp + 8]
push eax
call sym.ProcessHacker.exe_PhFormatNativeKeyName
mov edi, eax
jmp 0x4b9466
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0xe
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x38], 0x5247fc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4b8a87
mov dword [esp + 0x20], edi
push 0
cmp dword [0x5496ac], edi
je 0x4b8a32
push 0x18
lea eax, [esp + 0x48]
mov edx, esi
push eax
push 4
mov ecx, ebx
call fcn.004b4010
test eax, eax
jmp 0x4b8a74
push 0
push dword [sym.ProcessHacker.exe_ProcessQueryAccess]
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
push esi
push ebx
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4b947a
push 0
push 0x18
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x4b947a
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1c], eax
jmp 0x4b8cb1
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0xe
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x38], 0x52568c
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4b8c12
mov eax, dword [ebp + 8]
test eax, eax
je 0x4b8abd
cmp dword [eax], edi
je 0x4b8abd
xor al, al
jmp 0x4b8abf
mov al, 1
test al, al
je 0x4b947a
push 0
push 0
push 5
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
push esi
push ebx
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4b947a
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
call fcn.004b8240
test eax, eax
js 0x4b8b10
mov esi, dword [esp + 0x24]
push esi
call sym.ProcessHacker.exe_PhResolveDevicePrefix
push esi
mov edi, eax
call sym.ProcessHacker.exe_PhDereferenceObject
push dword [esp + 0x18]
jmp 0x4b9460
push 0
push 0x10
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtQuerySection]
test eax, eax
js 0x4b8c09
mov eax, dword [esp + 0x2c]
mov ecx, 0x5254a4
test eax, 0x8000000
je 0x4b8b44
mov edx, 0x529620
jmp 0x4b8b6d
test eax, 0x800000
je 0x4b8b52
mov edx, 0x5248b8
jmp 0x4b8b6d
test eax, 0x1000000
je 0x4b8b60
mov edx, 0x529654
jmp 0x4b8b6d
test eax, 0x4000000
mov edx, str.Reserve
cmove edx, ecx
mov ecx, edx
mov dword [esp + 0x78], 1
lea esi, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b8b80
sub ecx, esi
mov dword [esp + 0x8c], edx
sar ecx, 1
push 0x14
push 4
mov dword [esp + 0x98], 1
lea eax, [ecx + ecx]
mov dword [esp + 0xa8], 4
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc0], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc4], eax
mov eax, 0x29
mov word [esp + 0xd8], ax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0xb0], 0x525c40
mov dword [esp + 0xb4], 0xc
mov dword [esp + 0xcc], edi
call sym.ProcessHacker.exe_PhFormat
mov edi, eax
push dword [esp + 0x18]
jmp 0x4b9460
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0xc
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x38], 0x5256c4
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4b8ccb
push 0
cmp dword [0x5496ac], edi
je 0x4b8c59
push 0x1c
lea eax, [esp + 0x48]
mov edx, esi
push eax
push 5
mov ecx, ebx
call fcn.004b4010
test eax, eax
jmp 0x4b8c9b
push 0
push dword [sym.ProcessHacker.exe_ThreadQueryAccess]
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
push esi
push ebx
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4b947a
push 0
push 0x1c
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x4b947a
mov eax, dword [esp + 0x48]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b947a
lea ecx, [esp + 0x1c]
push ecx
call eax
mov edi, eax
jmp 0x4b9466
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 8
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x38], str.TmEn
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4b8d83
push 0
push 0
push 1
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
push esi
push ebx
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4b947a
mov esi, dword [esp + 0xc]
mov edx, 0x54b4e7
push str.NtQueryInformationEnlistment
push 0x522ce8
mov ecx, 0x54b4e8
call fcn.004d4ff0
test eax, eax
je 0x4b8d5b
push str.NtQueryInformationEnlistment
push 0x522ce8
mov edx, 0x54b4e7
mov ecx, 0x54b4e8
call fcn.004d4ff0
push 0
push 0x30
lea ecx, [esp + 0x48]
push ecx
push 0
push esi
call eax
mov esi, eax
jmp 0x4b8d60
mov esi, 0xc00000bb
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x4b947a
lea eax, [esp + 0x40]
push eax
call sym.ProcessHacker.exe_PhFormatGuid
mov edi, eax
jmp 0x4b9466
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 8
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x38], str.TmRm
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4b8e25
push 0
push 0
push 1
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
push esi
push ebx
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4b947a
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x2c]
call fcn.004aead0
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x4b947a
mov esi, dword [esp + 0x24]
test esi, esi
je 0x4b8df9
cmp dword [esi], edi
je 0x4b8df9
xor al, al
jmp 0x4b8dfb
mov al, 1
test al, al
jne 0x4b8e06
mov edi, esi
jmp 0x4b9466
lea eax, [esp + 0x28]
push eax
call sym.ProcessHacker.exe_PhFormatGuid
mov edi, eax
test esi, esi
je 0x4b9466
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
jmp 0x4b9466
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 8
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x38], str.TmTm
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4b906f
push 0
push 0
push 1
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
push esi
push ebx
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4b947a
mov eax, dword [esp + 0x18]
mov edx, 0x54b4e6
push str.NtQueryInformationTransactionManager
push 0x522ce8
mov ecx, 0x54b500
mov dword [esp + 0x14], eax
mov esi, 0x100
call fcn.004d4ff0
test eax, eax
jne 0x4b8e9f
mov ebx, 0xc00000bb
xor esi, esi
jmp 0x4b8fcf
push 0x100
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push str.NtQueryInformationTransactionManager
mov ebx, eax
mov edx, 0x54b4e6
push 0x522ce8
mov ecx, 0x54b500
mov dword [esp + 0x18], ebx
call fcn.004d4ff0
push 0
push 0x100
push ebx
push 2
push dword [esp + 0x1c]
call eax
mov ebx, eax
cmp ebx, 0x80000005
jne 0x4b8f50
jmp 0x4b8ef0
push dword [esp + 0x10]
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
add esi, esi
cmp esi, 0x100000
ja 0x4b8f6f
push esi
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push str.NtQueryInformationTransactionManager
mov ebx, eax
mov edx, 0x54b4e6
push 0x522ce8
mov ecx, 0x54b500
mov dword [esp + 0x18], ebx
call fcn.004d4ff0
push 0
push esi
push ebx
push 2
push dword [esp + 0x1c]
call eax
mov ebx, eax
cmp ebx, 0x80000005
je 0x4b8ef0
mov esi, dword [esp + 0x10]
test ebx, ebx
jns 0x4b8f78
push esi
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
jns 0x4b8f78
xor esi, esi
jmp 0x4b8fcf
mov ebx, 0xc000009a
xor esi, esi
jmp 0x4b8fcf
mov eax, dword [esi]
add esi, 4
push dword [0x54b7b4]
mov dword [esp + 0x28], eax
add eax, 0xa
push eax
mov dword [esp + 0x14], esi
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor edx, edx
mov eax, dword [esp + 0x24]
lea ecx, [esi + 8]
mov dword [esi + 4], ecx
mov dword [esi], eax
mov word [ecx + eax], dx
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4b8fbd
push eax
push ecx
push dword [esi + 4]
call fcn.004dd620
add esp, 0xc
push dword [esp + 0x10]
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
js 0x4b8ffc
test esi, esi
je 0x4b8fdf
cmp dword [esi], edi
je 0x4b8fdf
xor al, al
jmp 0x4b8fe1
mov al, 1
test al, al
jne 0x4b8ffc
push esi
call sym.ProcessHacker.exe_PhGetFileName
push esi
mov edi, eax
call sym.ProcessHacker.exe_PhDereferenceObject
push dword [esp + 0x18]
jmp 0x4b9460
test esi, esi
je 0x4b9006
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
mov esi, dword [esp + 0x18]
mov edx, 0x54b4e6
push str.NtQueryInformationTransactionManager
push 0x522ce8
mov ecx, 0x54b500
call fcn.004d4ff0
test eax, eax
je 0x4b8c09
push str.NtQueryInformationTransactionManager
push 0x522ce8
mov edx, 0x54b4e6
mov ecx, 0x54b500
call fcn.004d4ff0
push 0
push 0x18
lea ecx, [esp + 0x48]
push ecx
push 0
push esi
call eax
test eax, eax
js 0x4b8c09
lea eax, [esp + 0x40]
push eax
call sym.ProcessHacker.exe_PhFormatGuid
push dword [esp + 0x18]
mov edi, eax
jmp 0x4b9460
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 8
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x38], str.TmTx
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4b92ad
push 0
push 0
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x24], edi
push eax
push 0xffffffffffffffff
push esi
push ebx
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4b947a
mov eax, dword [esp + 0x14]
mov edx, 0x54b4f4
push str.NtQueryInformationTransaction
push 0x522ce8
mov ecx, 0x54b4ec
mov dword [esp + 0x14], eax
mov esi, 0x100
call fcn.004d4ff0
test eax, eax
jne 0x4b90eb
mov ebx, 0xc00000bb
jmp 0x4b9212
push 0x100
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push str.NtQueryInformationTransaction
mov ebx, eax
mov edx, 0x54b4f4
push 0x522ce8
mov ecx, 0x54b4ec
mov dword [esp + 0x18], ebx
call fcn.004d4ff0
push 0
push 0x100
push ebx
push 1
push dword [esp + 0x1c]
call eax
mov ebx, eax
cmp ebx, 0x80000005
jne 0x4b91a4
jmp 0x4b9140
push dword [esp + 0x10]
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
add esi, esi
cmp esi, 0x100000
ja 0x4b9226
push esi
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push str.NtQueryInformationTransaction
mov ebx, eax
mov edx, 0x54b4f4
push 0x522ce8
mov ecx, 0x54b4ec
mov dword [esp + 0x18], ebx
call fcn.004d4ff0
push 0
push esi
push ebx
push 1
push dword [esp + 0x1c]
call eax
mov ebx, eax
cmp ebx, 0x80000005
je 0x4b9140
mov esi, dword [esp + 0x10]
test ebx, ebx
jns 0x4b91bf
push esi
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
js 0x4b923a
mov eax, dword [esi + 0x14]
push dword [0x54b7b4]
mov dword [esp + 0x28], eax
add eax, 0xa
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edx, dword [esp + 0x24]
xor esi, esi
mov dword [esp + 0x18], eax
lea ecx, [eax + 8]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov word [ecx + edx], si
mov esi, dword [esp + 0x10]
lea ecx, [esi + 0x18]
test ecx, ecx
je 0x4b9203
push edx
push ecx
push dword [eax + 4]
call fcn.004dd620
add esp, 0xc
push esi
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
js 0x4b923a
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4b922d
cmp dword [eax], edi
je 0x4b922d
xor cl, cl
jmp 0x4b922f
mov ebx, 0xc000009a
jmp 0x4b9212
mov cl, 1
test cl, cl
jne 0x4b923e
mov edi, eax
jmp 0x4b945c
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4b9248
push eax
call sym.ProcessHacker.exe_PhDereferenceObject
mov esi, dword [esp + 0x14]
mov edx, 0x54b4f4
push str.NtQueryInformationTransaction
push 0x522ce8
mov ecx, 0x54b4ec
call fcn.004d4ff0
test eax, eax
je 0x4b945c
push str.NtQueryInformationTransaction
push 0x522ce8
mov edx, 0x54b4f4
mov ecx, 0x54b4ec
call fcn.004d4ff0
push 0
push 0x18
lea ecx, [esp + 0x48]
push ecx
push 0
push esi
call eax
test eax, eax
js 0x4b945c
lea eax, [esp + 0x40]
push eax
call sym.ProcessHacker.exe_PhFormatGuid
mov edi, eax
jmp 0x4b945c
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0xa
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x38], 0x525acc
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4b947a
push 0x38
lea eax, [esp + 0x44]
push 0
push eax
call fcn.004dce30
add esp, 0xc
lea eax, [esp + 0x14]
push 0
push 0
push 8
push eax
push 0xffffffffffffffff
push esi
push ebx
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4b947a
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 1
push esi
mov dword [esp + 0x24], edi
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
push dword [esp + 0x10]
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebx
push 1
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov esi, eax
test esi, esi
jns 0x4b935a
push ebx
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
lea eax, [esp + 0x24]
push eax
push 0x38
lea eax, [esp + 0x48]
push eax
push 0xa
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
test esi, esi
js 0x4b945c
push 0
push 1
push dword [ebx]
call sym.ProcessHacker.exe_PhGetSidFullName
mov esi, eax
test esi, esi
je 0x4b944d
mov eax, dword [esp + 0x48]
mov edx, str.__Primary_
mov ecx, dword [esi]
cmp dword [esp + 0x58], 1
mov dword [esp + 0xb8], eax
mov eax, str.__Impersonation_
mov dword [esp + 0x88], ecx
cmovne edx, eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x8c], ecx
mov ecx, edx
mov dword [esp + 0x78], 1
mov dword [esp + 0x90], 1
mov dword [esp + 0xa0], 8
mov dword [esp + 0xa4], str.:_0x
lea edi, [ecx + 2]
mov dword [esp + 0xa8], 0x108
mov byte [esp + 0xb2], 0x10
mov dword [esp + 0xc0], 1
jmp 0x4b9410
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b9410
sub ecx, edi
mov dword [esp + 0xd4], edx
sar ecx, 1
lea eax, [ecx + ecx]
mov dword [esp + 0xd0], eax
mov eax, dword [esi]
add eax, 0x28
push eax
push 4
lea eax, [esp + 0x80]
push eax
call sym.ProcessHacker.exe_PhFormat
push esi
mov edi, eax
call sym.ProcessHacker.exe_PhDereferenceObject
push ebx
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
je 0x4b947a
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4b9485
lock inc dword [ebx - 4]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ebx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc