Function at 0x420cbd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
push ebx
mov ebx, ecx
push esi
push edi
lea eax, [ebx - 0x9c41]
cmp eax, 0x11d
ja case.0x420cb6.40002
movzx eax, byte [eax + 0x422450]
jmp dword [eax*4 + 0x42230c]
push str.HideOnClose
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x420ced
call fcn.0043b390
test al, al
je case.0x420cb6.40002
push 0
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.CloseOnEscape
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je case.0x420cb6.40002
push 0
push 0
push 0x8079
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x54b7c8]
test esi, esi
je case.0x420cb6.40002
push 0x40
push 0
push 0
push 0
push 0
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
mov ecx, esi
mov dword [0x549920], 0
call dword [0x4fe8dc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x54b7c8]
test esi, esi
je case.0x420cb6.40002
push 0
push str.Type_the_name_of_a_program_that_will_be_opened_under_alternate_credentials.
push 0
push 0
push 0
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
mov ecx, esi
mov dword [0x549920], 1
call dword [0x4fe8dc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x54b7c8]
test esi, esi
je case.0x420cb6.40002
push 0
push str.Type_the_name_of_a_program_that_will_be_opened_under_standard_user_privileges.
push 0
push 0
push 0
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
mov ecx, esi
mov dword [0x549920], 2
call dword [0x4fe8dc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x807b
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [sym.ProcessHacker.exe_PhMainWndHandle]
xor edx, edx
push 0
push 0
push 3
push 1
push 5
push 0x528210
call fcn.00408bf0
push 0
push 0
test al, al
jne 0x420d03
push 0x807c
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe_PhCreateSaveFileDialog
mov edx, dword [0x549938]
mov ebx, eax
push 3
push 0x5463a0
push ebx
mov ecx, dword [edx]
mov dword [ebp - 0xc0], ecx
mov ecx, dword [edx + 4]
mov dword [ebp - 0xe8], 1
mov dword [ebp - 0xd8], 0x1e
mov dword [ebp - 0xd4], 0x523168
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0xa8], 8
mov dword [ebp - 0xa4], str..txt
call sym.ProcessHacker.exe_PhSetFileDialogFilter
push 0x3c
push 3
lea eax, [ebp - 0xe8]
push eax
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push ebx
call sym.ProcessHacker.exe_PhSetFileDialogFileName
push ebx
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhShowFileDialog
test al, al
je 0x420f7d
push ebx
call sym.ProcessHacker.exe_PhGetFileDialogFileName
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
cmp byte [ebx], 0
mov edi, eax
mov edx, dword [ebx + 4]
je 0x420ef2
mov ecx, dword [edx]
lea eax, [ebp - 0x18]
push eax
push edx
mov ecx, dword [ecx + 0x18]
call ecx
xor esi, esi
test eax, eax
cmovns esi, dword [ebp - 0x18]
jmp 0x420ef5
mov esi, dword [edx + 0x18]
push 0
push 5
push 1
push 0x120116
push dword [edi + 4]
lea eax, [ebp - 8]
push eax
call sym.ProcessHacker.exe_PhCreateFileStream
test eax, eax
js 0x420f6a
push dword [0x544b34]
mov edi, dword [ebp - 8]
push dword [0x544b38]
push edi
call sym.ProcessHacker.exe_PhWriteStringAsUtf8FileStreamEx
push edi
call sym.ProcessHacker.exe__PhWritePhTextHeader_4
xor ecx, ecx
mov dword [ebp - 0x5c], edi
mov eax, 2
cmp esi, eax
push ecx
cmovne eax, ecx
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [0x549938]
push 7
push eax
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4fe8dc]
call esi
push edi
call sym.ProcessHacker.exe_PhDereferenceObject
push ebx
call sym.ProcessHacker.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push eax
push str.Unable_to_create_the_file
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhShowStatus
push ebx
call sym.ProcessHacker.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x5496fc], 0
jne 0x421003
push 0
push 0x413230
push 0
call sym.ProcessHacker.exe_PhCreateThread
mov dword [0x5496fc], eax
test eax, eax
jne 0x420fee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.ProcessHacker.exe_PhMainWndHandle]
test eax, eax
jne 0x420fc2
push eax
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x420fc8
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
jne 0x421086
push str.Unable_to_create_the_window.
push 0x532664
push 0x10
push edi
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [0x546144], 1
jne 0x421003
xor edx, edx
mov ecx, 0x546144
call sym.ProcessHacker.exe_PhfWaitForEvent
push 0
push 0
push 0x8321
push dword [0x549700]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [sym.ProcessHacker.exe_PhMainWndHandle]
call fcn.0043e340
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x5491e4], 0
je 0x4210d9
cmp dword [0x54a040], 0
jne 0x4210bd
push 0
push 0x45dee0
push 0
call sym.ProcessHacker.exe_PhCreateThread
mov dword [0x54a040], eax
test eax, eax
jne 0x4210a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.ProcessHacker.exe_PhMainWndHandle]
test eax, eax
jne 0x421076
push eax
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x42107c
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x420fd2
push dword [esi + 4]
push 0x52304c
push str.Unable_to_create_the_window.
push 0xfffe
push 0x20
push edi
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
jmp 0x421f0b
test byte [0x546ba0], 1
jne 0x4210bd
xor edx, edx
mov ecx, 0x546ba0
call sym.ProcessHacker.exe_PhfWaitForEvent
push 0
push 0
push 0x8191
push dword [0x54a03c]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.To_use_plugins_enable_them_in_Options_and_restart_Process_Hacker.
push str.Plugins_are_not_enabled.
push 0xfffd
push 0x20
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004235c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
call fcn.004899a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x549aec]
test eax, eax
jne 0x421134
push eax
push 0x4351c0
push 0x54a190
call sym.ProcessHacker.exe__PhAddTreeNewFilter_12
jmp 0x421141
push eax
push 0x54a190
call sym.ProcessHacker.exe__PhRemoveTreeNewFilter_8
xor eax, eax
push 0x54a190
mov dword [0x549aec], eax
call sym.ProcessHacker.exe__PhApplyTreeNewFilters_4
xor eax, eax
cmp dword [0x549aec], eax
setne al
push eax
push str.HideOtherUserProcesses
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x549b28]
test eax, eax
jne 0x4211a6
cmp byte [0x54bc89], al
jne 0x421193
push str.This_filter_cannot_function_because_digital_signature_checking_is_not_enabled._Enable_it_in_Options___General_and_restart_Process_Hacker.
push 0x40
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0xc
push 0
push 0x435200
push 0x54a190
call sym.ProcessHacker.exe__PhAddTreeNewFilter_12
jmp 0x4211b3
push eax
push 0x54a190
call sym.ProcessHacker.exe__PhRemoveTreeNewFilter_8
xor eax, eax
push 0x54a190
mov dword [0x549b28], eax
call sym.ProcessHacker.exe__PhApplyTreeNewFilters_4
xor eax, eax
cmp dword [0x549b28], eax
setne al
push eax
push str.HideSignedProcesses
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [0x54bc94], eax
sete al
push eax
push str.ScrollToNewProcesses
mov dword [0x54bc94], eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [0x54bc8c], eax
sete al
push eax
push str.ShowCpuBelow001
mov dword [0x54bc8c], eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
call sym.ProcessHacker.exe__PhInvalidateAllProcessNodes_0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x549bbc]
test eax, eax
jne 0x421243
push eax
push 0x4368e0
push 0x54a658
call sym.ProcessHacker.exe__PhAddTreeNewFilter_12
jmp 0x421250
push eax
push 0x54a658
call sym.ProcessHacker.exe__PhRemoveTreeNewFilter_8
xor eax, eax
push 0x54a658
mov dword [0x549bbc], eax
call sym.ProcessHacker.exe__PhApplyTreeNewFilters_4
xor eax, eax
cmp dword [0x549bbc], eax
setne al
push eax
push str.HideDriverServices
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x5496e7], 0
push 0x13
push 0
sete al
push 0
mov byte [0x5496e7], al
push 0
movzx eax, al
push 0
sub eax, 2
push eax
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SetWindowPos]
movzx eax, byte [0x5496e7]
push eax
push str.MainWindowAlwaysOnTop
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + ebx*4]
mov esi, 0x62066
add eax, eax
sub esi, eax
push esi
push str.MainWindowOpacity
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov ecx, dword [sym.ProcessHacker.exe_PhMainWndHandle]
mov edx, esi
call fcn.00408760
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x54c300
call fcn.004cd680
mov ecx, 0x54c2e0
call fcn.004cd680
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add ebx, 0xffff6325
cmp ebx, 4
ja case.default.0x421312
jmp dword [ebx*4 + 0x422570]
mov esi, 0x1f4
jmp 0x42133f
mov esi, 0x3e8
jmp 0x42133f
mov esi, 0x7d0
jmp 0x42133f
mov esi, 0x1388
jmp 0x42133f
mov esi, 0x2710
jmp 0x42133f
mov esi, dword [ebp - 4]
push esi
push str.UpdateInterval
mov dword [0x54bc90], esi
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov ebx, dword [0x54c344]
xor edi, edi
mov dword [0x54c348], esi
test ebx, ebx
je 0x421386
push 0xffffffffffffffff
push 0xffffd8f0
push edi
push esi
call fcn.004f88d0
push edi
push esi
push edi
push edi
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
push edi
push eax
push ebx
mov dword [ebp - 0x64], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ebx, dword [0x54c364]
mov eax, esi
mov dword [0x54c368], esi
test ebx, ebx
je case.0x420cb6.40002
push 0xffffffffffffffff
push 0xffffd8f0
push edi
push eax
call fcn.004f88d0
push 0
push esi
push 0
push 0
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x70]
push 0
push eax
push ebx
mov dword [ebp - 0x6c], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x544948], 0
push ecx
sete al
mov ecx, 9
movzx edx, al
mov byte [0x544948], al
call fcn.00424400
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x4830e0
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
push 0xa8
push dword [sym.ProcessHacker.exe_PhInstanceHandle]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x5496ac], 0
jne 0x421432
push str.Hidden_process_detection_cannot_function_properly_without_KProcessHacker._Make_sure_Process_Hacker_is_running_with_administrative_privileges.
push 0x30
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0xc
mov eax, dword [0x549704]
test eax, eax
jne 0x421458
push eax
push 0x413c80
push eax
push 0x87
push dword [sym.ProcessHacker.exe_PhInstanceHandle]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov dword [0x549704], eax
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x421478
push 5
push dword [0x549704]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x549704]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe_PhCreateOpenFileDialog
push 2
mov esi, eax
push 0x546390
push esi
call sym.ProcessHacker.exe_PhSetFileDialogFilter
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhShowFileDialog
test al, al
je 0x4214d6
push str.Make_sure_the_PE_Viewer_executable_file_is_present.
push 0
push esi
call sym.ProcessHacker.exe_PhGetFileDialogFileName
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push str.ProgramInspectExecutables
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhShellExecuteUserString_20
push esi
call sym.ProcessHacker.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x441fe0
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
push 0x8a
push dword [sym.ProcessHacker.exe_PhInstanceHandle]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe_PhGetSystemDirectory
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push str._taskmgr.exe
push dword [eax + 4]
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
mov esi, eax
jb 0x421623
lea eax, [ebp - 0xf8]
push eax
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x421623
push 0
push 0
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiConnectToPhSvcEx_12
test al, al
je case.0x420cb6.40002
mov ebx, dword [esi + 4]
lea eax, [ebp - 0x198]
push 0xa0
push 0
push eax
call fcn.004dce30
add esp, 0xc
cmp dword [0x54c160], 0
je 0x421617
push ebx
mov dword [ebp - 0x180], 0x10
call sym.ProcessHacker.exe_PhCountStringZ
mov esi, eax
mov eax, dword [0x54c164]
add esi, esi
test eax, eax
je 0x421617
push esi
push 0
push eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x421617
sub eax, dword [0x54c164]
mov dword [ebp - 8], eax
test ebx, ebx
je 0x4215d0
push esi
push ebx
push edi
call fcn.004dd620
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 0x174], eax
lea eax, [ebp - 0x198]
push eax
push eax
push dword [0x54c160]
mov dword [ebp - 0x178], esi
mov dword [ebp - 0x198], 0xa00088
mov dword [ebp - 0x194], 0
call dword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov eax, dword [0x54c164]
test eax, eax
je 0x421617
push edi
push 0
push eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 4]
call fcn.00409180
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x549950]
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiConnectSession_8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x549950]
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiDisconnectSession_8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x549950]
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiLogoffSession_8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x18]
mov edx, dword [0x549950]
mov ecx, dword [sym.ProcessHacker.exe_PhMainWndHandle]
mov eax, dword [eax + 0x30]
cmp edx, dword [eax + 0x1d4]
jne 0x4216ae
push str.You_cannot_remote_control_the_current_session.
push 0x10
push ecx
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
push 0x481da0
push ecx
push 0xc1
push dword [sym.ProcessHacker.exe_PhInstanceHandle]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x549950]
push 0x4894f0
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
push 0x98
push dword [sym.ProcessHacker.exe_PhInstanceHandle]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x549950]
push 0x481920
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
push 0x99
push dword [sym.ProcessHacker.exe_PhInstanceHandle]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x54908c]
test eax, eax
jne 0x4217cc
push eax
push 0x41cd80
push eax
push 0xb2
push dword [sym.ProcessHacker.exe_PhInstanceHandle]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov esi, dword [0x549804]
mov edi, eax
mov dword [0x54908c], edi
test esi, esi
jne 0x42178b
push dword [0x54b7b0]
push 0xc
call sym.ProcessHacker.exe_PhCreateObject
push 8
mov esi, eax
push 4
push dword [0x54b674]
mov dword [esi], 0
mov dword [esi + 4], 2
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
mov dword [0x549804], esi
mov eax, dword [esi + 4]
cmp dword [esi], eax
jne 0x4217af
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push dword [esi + 8]
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov dword [esi + 8], eax
mov ecx, dword [esi]
mov eax, dword [esi + 8]
push 5
mov dword [eax + ecx*4], edi
push dword [0x54908c]
inc dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x54908c]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4217ec
push 9
push dword [0x54908c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x54908c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push str.https:__sourceforge.net_project_project_donations.php_group_id242527
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhShellExecute
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0040e780
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push section..text
push 0
push 0x79
push dword [sym.ProcessHacker.exe_PhInstanceHandle]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
push edi
push esi
call sym.ProcessHacker.exe_PhReferenceObjects
push edi
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiTerminateProcesses_12
test al, al
je 0x421882
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x54a1a0]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push esi
call sym.ProcessHacker.exe_PhDereferenceObjects
push esi
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
lock inc dword [esi - 4]
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiTerminateTreeProcess_8
test al, al
je 0x4218d7
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x54a1a0]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
push esi
push edi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiSuspendProcesses_12
push esi
push edi
call sym.ProcessHacker.exe_PhDereferenceObjects
push edi
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0xc]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
push esi
push edi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiResumeProcesses_12
jmp 0x42190b
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
lock inc dword [esi - 4]
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiRestartProcess_8
jmp 0x4218be
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x420cb6.40002
lock inc dword [ebx - 4]
mov esi, dword [sym.ProcessHacker.exe_PhMainWndHandle]
mov dword [ebp - 0xc], esi
call sym.ProcessHacker.exe_PhCreateSaveFileDialog
push 2
mov edi, eax
push 0x5463c4
push edi
call sym.ProcessHacker.exe_PhSetFileDialogFilter
mov ecx, dword [ebx + 0x18]
push str..dmp
push dword [ecx + 4]
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push dword [eax + 4]
push edi
call sym.ProcessHacker.exe_PhSetFileDialogFileName
cmp byte [edi], 0
mov ecx, dword [edi + 4]
je 0x4219ec
mov eax, dword [ecx]
push 0x5077f0
push ecx
mov eax, dword [eax + 0x58]
call eax
mov eax, dword [edi + 4]
push esi
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
setns al
jmp 0x421a04
mov dword [ecx + 4], esi
cmp byte [edi + 1], 0
push ecx
jne 0x4219fe
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x421a04
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
push edi
test al, al
jne 0x421a1b
call sym.ProcessHacker.exe_PhFreeFileDialog
push ebx
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe_PhGetFileDialogFileName
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push edi
mov esi, eax
call sym.ProcessHacker.exe_PhFreeFileDialog
mov edx, dword [ebx + 0x10]
push ecx
push dword [esi + 4]
mov ecx, dword [ebp - 0xc]
call fcn.004254e0
push ebx
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
lock inc dword [esi - 4]
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiDebugProcess_8
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
lock inc dword [esi - 4]
cmp byte [0x54c260], 0
sete cl
movzx ecx, cl
push ecx
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiSetVirtualizationProcess_12
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
lock inc dword [esi - 4]
mov ecx, dword [sym.ProcessHacker.exe_PhMainWndHandle]
mov edx, esi
push 0
call fcn.00405320
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
lock inc dword [esi - 4]
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiDetachFromDebuggerProcess_8
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov ebx, eax
test ebx, ebx
je case.0x420cb6.40002
lock inc dword [ebx - 4]
push dword [0x54b7b0]
mov edi, dword [sym.ProcessHacker.exe_PhMainWndHandle]
push 0xc
mov dword [ebp - 0x14], ebx
call sym.ProcessHacker.exe_PhCreateObject
push 0x50
mov esi, eax
push 4
push dword [0x54b674]
mov dword [esi], 0
mov dword [esi + 4], 0x14
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
lea eax, [ebp - 0x14]
push eax
push 0x413910
push edi
push 0xaf
push dword [sym.ProcessHacker.exe_PhInstanceHandle]
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov ecx, dword [ebp - 0x10]
xor esi, esi
or edi, 0xffffffff
cmp dword [ecx], esi
jbe 0x421bbe
mov eax, dword [ecx + 8]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x421ba2
lea ecx, [eax - 8]
mov eax, edi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x421b9f
call fcn.004a2a20
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
push dword [eax + esi*4]
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp - 0x10]
inc esi
cmp esi, dword [ecx]
jb 0x421b80
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], edi
dec edi
jne 0x421a3d
call fcn.004a2a20
push ebx
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
add ebx, 0xffff62d1
cmp ebx, 4
ja case.default.0x421bf9
jmp dword [ebx*4 + 0x422584]
mov eax, 1
jmp 0x421c26
mov eax, 2
jmp 0x421c26
mov eax, 3
jmp 0x421c26
mov eax, 4
jmp 0x421c26
mov eax, 5
jmp 0x421c26
mov eax, dword [ebp - 4]
lock inc dword [esi - 4]
push eax
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiSetPagePriorityProcess_12
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
push esi
push edi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiReduceWorkingSetProcesses_12
jmp 0x42190b
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x420cb6.40002
mov eax, dword [eax + 0x2c]
test eax, eax
je case.0x420cb6.40002
push eax
push str.RunAsProgram
call sym.ProcessHacker.exe_PhSetStringSetting2
xor edx, edx
call fcn.0047e530
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x420cb6.40002
mov edx, dword [eax + 0x10]
call fcn.0047e530
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x3c]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
push esi
mov edx, edi
mov ecx, ebx
call fcn.00435220
jmp 0x42190b
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x44]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
push esi
mov edx, edi
mov ecx, ebx
call fcn.004352c0
jmp 0x42190b
push dword [0x54c25c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x420cb6.40002
xor eax, eax
mov dword [ebp - 0x9c], 0x2c
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x9c]
push eax
push dword [0x54c25c]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword [ebp - 0x94], 6
je 0x421da2
push dword [0x54c25c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x54c25c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x420cb6.40002
push 9
push dword [0x54c25c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x54c25c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x420cb6.40002
push 6
push dword [0x54c25c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x54c25c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x420cb6.40002
push 3
push dword [0x54c25c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x54c25c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x420cb6.40002
push 0
push 0
push 0x10
push dword [0x54c25c]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x421e55
cmp dword [eax], 0
je 0x421e55
xor cl, cl
jmp 0x421e57
mov cl, 1
test cl, cl
jne case.0x420cb6.40002
test eax, eax
je 0x421e68
mov eax, dword [eax + 4]
jmp 0x421e6a
xor eax, eax
push eax
call dword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
je case.0x420cb6.40002
lock inc dword [esi - 4]
mov eax, dword [esi + 0x2c]
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [eax + 4]
push str.FileBrowseExecutable
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhShellExecuteUserString_20
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x420cb6.40002
mov eax, dword [eax + 0x18]
push 0
push 1
push dword [eax + 4]
push str.SearchEngine
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhShellExecuteUserString_20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x420cb6.40002
mov ecx, eax
call fcn.00435180
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [0x54a1a0]
call sym.ProcessHacker.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x54a1a0]
call sym.ProcessHacker.exe_PhSetClipboardString
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne case.0x420cb6.40002
call fcn.004a2a20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x420cb6.40002
push dword [eax + 0x2c]
call sym.ProcessHacker.exe__PhFindProcessNode_4
mov esi, eax
test esi, esi
je case.0x420cb6.40002
mov ecx, dword [0x54c258]
mov ecx, dword [ecx + 0x14]
call fcn.004243c0
push dword [0x54c254]
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, 1
mov dword [ebp - 0x48], esi
lea ecx, [ebp - 0x48]
call fcn.00470b30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
lock inc dword [esi - 4]
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiStartService_8
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
lock inc dword [esi - 4]
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiContinueService_8
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
lock inc dword [esi - 4]
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiPauseService_8
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
lock inc dword [esi - 4]
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiStopService_8
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
lock inc dword [esi - 4]
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiDeleteService_8
test al, al
je 0x4218d7
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x54a66c]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x420cb6.40002
push dword [eax + 8]
push 0x546388
call sym.ProcessHacker.exe_PhConcatStringRef2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push 0
mov esi, eax
lea eax, [ebp - 0x4c]
push esi
push 0xfffffffffffffffd
push 0x20019
push eax
call sym.ProcessHacker.exe_PhOpenKey
test eax, eax
js case.0x420cb6.40002
push esi
push 0x5463bc
call sym.ProcessHacker.exe_PhConcatStringRef2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov ecx, dword [sym.ProcessHacker.exe_PhMainWndHandle]
mov edx, eax
call fcn.00409fd0
push dword [ebp - 0x4c]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
mov ecx, dword [esi + 8]
push 1
push dword [ecx + 4]
call sym.ProcessHacker.exe_PhOpenService
mov edi, eax
test edi, edi
je case.0x420cb6.40002
mov ecx, dword [esi + 8]
mov edx, edi
call fcn.00407ea0
mov esi, eax
test esi, esi
je 0x422133
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [esi + 4]
push str.FileBrowseExecutable
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhShellExecuteUserString_20
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x420cb6.40002
lock inc dword [esi - 4]
mov ecx, dword [sym.ProcessHacker.exe_PhMainWndHandle]
mov edx, esi
call fcn.00486750
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [0x54a66c]
call sym.ProcessHacker.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x54a66c]
jmp 0x421f06
call fcn.00438fe0
test eax, eax
je case.0x420cb6.40002
push dword [eax + 0x38]
call sym.ProcessHacker.exe__PhFindProcessNode_4
mov esi, eax
test esi, esi
je case.0x420cb6.40002
mov ecx, dword [0x54c258]
mov ecx, dword [ecx + 0x14]
call fcn.004243c0
push dword [0x54c254]
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, 1
mov dword [ebp - 0x50], esi
lea ecx, [ebp - 0x50]
call fcn.00470b30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00438fe0
test eax, eax
je case.0x420cb6.40002
mov eax, dword [eax + 0x48]
test eax, eax
je case.0x420cb6.40002
push dword [eax + 4]
call sym.ProcessHacker.exe__PhReferenceServiceItem_4
mov esi, eax
test esi, esi
je case.0x420cb6.40002
mov ecx, dword [0x54c208]
mov ecx, dword [ecx + 0x14]
call fcn.004243c0
push dword [0x54c204]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
push 0
push 0x8086
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x54]
lea ecx, [ebp - 4]
call fcn.00439010
mov edi, dword [ebp - 0x54]
mov esi, dword [ebp - 4]
push edi
push esi
call sym.ProcessHacker.exe_PhReferenceObjects
push edi
push esi
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe__PhUiCloseConnections_12
test al, al
je 0x421882
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x549bf4]
jmp 0x42187c
push 0
push dword [0x549bf4]
call sym.ProcessHacker.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x549bf4]
jmp 0x421f06
push 0
push 0
push 0x130b
push dword [0x549954]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x54995c]
mov ecx, dword [ecx]
dec ecx
cmp eax, ecx
je 0x4222cb
inc eax
mov ecx, eax
call fcn.004243c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, eax
call fcn.004243c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x130b
push dword [0x549954]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x4222fb
mov eax, dword [0x54995c]
mov eax, dword [eax]
dec eax
mov ecx, eax
call fcn.004243c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret