Function at 0x42b567
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x5ac004]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov dword [esp + 0x10], esi
lea eax, [esi - 0x9c41]
cmp eax, 0x12e
ja case.0x42b560.40084
movzx eax, byte [eax + 0x42d124]
lea ecx, [ecx]
jmp dword [eax*4 + 0x42cfd4]
push str.HideOnClose
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je 0x42b5a9
call fcn.0044cd00
lea ebx, [ebx]
test al, al
je case.0x42b560.40084
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push str.CloseOnEscape
call sym.ProcessHacker.exe_PhGetIntegerSetting
test eax, eax
je case.0x42b560.40084
push dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [sym.ProcessHacker.exe_PhMainWndHandle]
push eax
push 0x8091
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push 0
push 0x487480
push ebx
push 0xfd
push dword [0x5b1d78]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
xor edx, edx
call fcn.00483ae0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push 0x432600
push 0
push 0x8091
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 3
push 1
push 5
push 0x570cb4
xor edx, edx
mov ecx, ebx
call fcn.0040ad40
test al, al
jne case.0x42b560.40001
mov byte [0x5b1805], al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe_PhCreateSaveFileDialog
mov ecx, dword [0x5b21c8]
mov esi, eax
push 3
mov dword [esp + 0xd4], 1
mov dword [esp + 0xe4], 0x1e
mov dword [esp + 0xe8], 0x56b074
mov dword [esp + 0xec], 1
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
push 0x5ae31c
push esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x104], edx
mov dword [esp + 0x108], ecx
mov dword [esp + 0x10c], 1
mov dword [esp + 0x11c], 8
mov dword [esp + 0x120], str..txt
call sym.ProcessHacker.exe_PhSetFileDialogFilter
push 0x3c
push 3
lea eax, [esp + 0xd8]
push eax
call sym.ProcessHacker.exe_PhFormat
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push esi
call sym.ProcessHacker.exe_PhSetFileDialogFileName
push esi
push ebx
call sym.ProcessHacker.exe_PhShowFileDialog
test al, al
je 0x42b81d
push esi
call sym.ProcessHacker.exe_PhGetFileDialogFileName
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
cmp byte [esi], 0
mov edi, eax
mov edx, dword [esi + 4]
je 0x42b775
mov ecx, dword [edx]
lea eax, [esp + 0x10]
push eax
push edx
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x5404bc]
call esi
xor esi, esi
test eax, eax
cmovns esi, dword [esp + 0x10]
jmp 0x42b778
mov esi, dword [edx + 0x18]
push 0
push 5
push 1
push 0x120116
push dword [edi + 4]
lea eax, [esp + 0x24]
push eax
call sym.ProcessHacker.exe_PhCreateFileStream
test eax, eax
js 0x42b80c
push dword [0x5acb28]
mov edi, dword [esp + 0x14]
push dword [0x5acb2c]
push edi
call sym.ProcessHacker.exe_PhWriteStringAsUtf8FileStreamEx
push edi
call sym.ProcessHacker.exe__PhWritePhTextHeader_4
xor ecx, ecx
mov dword [esp + 0x18], edi
mov eax, 2
cmp esi, eax
push ecx
cmovne eax, ecx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [0x5b21c8]
push 7
push eax
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5404bc]
call esi
push edi
call sym.ProcessHacker.exe_PhDereferenceObject
push dword [esp + 0x2c]
call sym.ProcessHacker.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push 0
push eax
push str.Unable_to_create_the_file
push ebx
lfence
call sym.ProcessHacker.exe_PhShowStatus
push dword [esp + 0x2c]
call sym.ProcessHacker.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
cmp dword [0x5b1f9c], 0
jne 0x42b89e
push 0
push 0x4172c0
push 0x5b1f9c
call sym.ProcessHacker.exe_PhCreateThreadEx
test eax, eax
jns 0x42b889
push str.Unable_to_create_the_window.
push 0x54ace8
push 0x10
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
test byte [0x5ae1e8], 1
jne 0x42b89e
xor edx, edx
mov ecx, 0x5ae1e8
call sym.ProcessHacker.exe_PhfWaitForEvent
push 0
push 0
push 0x8321
push dword [0x5b1fa8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call fcn.0044fcc0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
lfence
call fcn.0042d860
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
xor ecx, ecx
call fcn.00491f60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
lfence
call fcn.00430100
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push str.HideOtherUserProcesses
nop
call sym.ProcessHacker.exe_PhGetIntegerSetting
neg eax
sbb eax, eax
inc eax
push eax
push str.HideOtherUserProcesses
mov dword [0x5b44fc], eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
push 1
call sym.ProcessHacker.exe__PhExpandAllProcessNodes_4
push 0x5b2b1c
call sym.ProcessHacker.exe__PhApplyTreeNewFilters_4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5b23c0]
test eax, eax
jne 0x42b9e7
cmp byte [0x5b456a], al
jne 0x42b9cf
push str.Enable_it_in_Options___General_and_restart_Process_Hacker.
push str.This_filter_cannot_function_because_digital_signature_checking_is_not_enabled._r_n_s
push eax
push 0xfffd
push 0x20
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push 0
push 0x444680
push 0x5b2b1c
call sym.ProcessHacker.exe__PhAddTreeNewFilter_12
jmp 0x42b9f4
push eax
push 0x5b2b1c
call sym.ProcessHacker.exe__PhRemoveTreeNewFilter_8
xor eax, eax
push 0x5b2b1c
mov dword [0x5b23c0], eax
mov edi, edi
call sym.ProcessHacker.exe__PhApplyTreeNewFilters_4
xor eax, eax
cmp dword [0x5b23c0], eax
setne al
push eax
push str.HideSignedProcesses
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [0x5b4578], eax
sete al
push eax
push str.ScrollToNewProcesses
mov dword [0x5b4578], eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [0x5b456c], eax
sete al
push eax
push str.ShowCpuBelow001
mov dword [0x5b456c], eax
call sym.ProcessHacker.exe_PhSetIntegerSetting
lea esp, [esp]
call sym.ProcessHacker.exe__PhInvalidateAllProcessNodes_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5b2454]
nop
test eax, eax
jne 0x42bab6
push eax
push 0x446f60
push 0x5b2fec
call sym.ProcessHacker.exe__PhAddTreeNewFilter_12
jmp 0x42bac7
push eax
push 0x5b2fec
call sym.ProcessHacker.exe__PhRemoveTreeNewFilter_8
xor eax, eax
push 0x5b2fec
mov dword [0x5b2454], eax
call sym.ProcessHacker.exe__PhApplyTreeNewFilters_4
xor eax, eax
cmp dword [0x5b2454], eax
setne al
push eax
push str.HideDriverServices
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5b2324]
test eax, eax
je 0x42bb19
push eax
push 0x5b2464
call sym.ProcessHacker.exe__PhRemoveTreeNewFilter_8
xor eax, eax
jmp 0x42bb2a
push 0
push 0x4435c0
push 0x5b2464
call sym.ProcessHacker.exe__PhAddTreeNewFilter_12
push 0x5b2464
mov dword [0x5b2324], eax
call sym.ProcessHacker.exe__PhApplyTreeNewFilters_4
xor eax, eax
cmp dword [0x5b2324], eax
setne al
push eax
push str.HideWaitingConnections
call sym.ProcessHacker.exe_PhSetIntegerSetting
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
cmp byte [0x5b1f83], 0
push 0x13
push 0
sete al
push 0
mov byte [0x5b1f83], al
push 0
movzx eax, al
push 0
sub eax, 2
push eax
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
movzx eax, byte [0x5b1f83]
push eax
push str.MainWindowAlwaysOnTop
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov al, byte [0x5b1f83]
xor edi, edi
mov byte [esp + 0x17], al
mov eax, 0x5b3890
lock bts dword [eax], 0
jae 0x42bbc5
mov ecx, eax
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
mov ebx, dword [0x5b38a4]
jmp 0x42bbd0
mov edx, dword [ebx + 0x24]
cmp edi, edx
jae 0x42bbf2
mov esi, dword [ebx]
mov eax, edi
add esi, 8
imul eax, esi
add eax, dword [ebx + 0x18]
mov ecx, eax
inc edi
add eax, esi
cmp dword [ecx], 0xffffffff
jne 0x42bc3a
cmp edi, edx
jb 0x42bbe4
or edi, 0xffffffff
mov ecx, 0x5b3890
lock xadd dword [ecx], edi
mov eax, edi
and al, 6
cmp al, 2
jne case.0x42b560.40084
dec edi
mov eax, edi
lea edx, [edi + 4]
mov esi, edx
lock cmpxchg dword [ecx], esi
cmp eax, edi
jne case.0x42b560.40084
mov edi, edi
call fcn.004cc580
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov esi, dword [ecx + 8]
test byte [esi + 4], 1
je 0x42bbd0
mov esi, dword [esi]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0x13
push 0
xor eax, eax
cmp byte [esp + 0x1f], al
push 0
push 0
setne al
push 0
add eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x42bbc5
lea eax, [esi + esi*4]
mov esi, 0x62066
add eax, eax
sub esi, eax
push esi
push str.MainWindowOpacity
lfence
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov edx, esi
mov ecx, ebx
call fcn.0040a900
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push 0
push 0x5b4b20
call sym.ProcessHacker.exe_PhBoostProvider
push 0
push 0x5b4b00
call sym.ProcessHacker.exe_PhBoostProvider
cmp byte [0x5b4af8], 0
je case.0x42b560.40084
push 0
push 0x5b4ae0
call sym.ProcessHacker.exe_PhBoostProvider
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
add esi, 0xffff6325
cmp esi, 4
ja case.default.0x42bd00
mov edi, edi
jmp dword [esi*4 + 0x42d254]
mov esi, 0x1f4
jmp 0x42bd2e
mov esi, 0x3e8
jmp 0x42bd2e
mov esi, 0x7d0
jmp 0x42bd2e
mov esi, 0x1388
jmp 0x42bd2e
mov esi, 0x2710
jmp 0x42bd2e
mov esi, dword [esp + 0x18]
push esi
push str.UpdateInterval
mov dword [0x5b4574], esi
call sym.ProcessHacker.exe_PhSetIntegerSetting
mov ecx, dword [0x5b4b84]
mov edi, 0x2710
mov dword [0x5b4b88], esi
test ecx, ecx
je 0x42bd7c
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [esp + 0x28], eax
adc edx, 0
push 0
lea eax, [esp + 0x2c]
neg edx
push eax
push ecx
mov dword [esp + 0x38], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
mov ecx, dword [0x5b4ba4]
mov dword [0x5b4ba8], esi
test ecx, ecx
je case.0x42b560.40084
push 0
mov eax, esi
mul edi
push esi
push 0
neg eax
push 0
mov dword [esp + 0x28], eax
adc edx, 0
push 0
lea eax, [esp + 0x2c]
neg edx
push eax
push ecx
mov dword [esp + 0x38], edx
call dword [sym.imp.ntdll.dll_NtSetTimer]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
cmp byte [0x5ac988], 0
push ecx
sete al
mov ecx, 9
movzx edx, al
mov byte [0x5ac988], al
call fcn.00431400
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [0x5b449c], eax
push 0
push 0x48bc80
cmovne ebx, eax
push ebx
push 0xa8
push dword [0x5b1d78]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5b1fac]
test eax, eax
jne 0x42be61
push eax
push 0x4195a0
push eax
push 0x87
push dword [0x5b1d78]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov dword [0x5b1fac], eax
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x42be8f
push 5
push dword [0x5b1fac]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5b1fac]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe_PhCreateOpenFileDialog
push 2
mov edi, eax
push 0x5ae304
push edi
call sym.ProcessHacker.exe_PhSetFileDialogFilter
cmp byte [edi], 0
mov ecx, dword [edi + 4]
je 0x42bf22
mov eax, dword ds:[ecx]
lea edx, [esp + 0x10]
push edx
push ecx
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x5404bc]
call esi
test eax, eax
js 0x42bf3d
mov edx, dword [esp + 0x10]
test edx, edx
je 0x42bf02
and edx, 0xcfefc7d9
or edx, 0x100
jmp 0x42bf07
mov edx, 0x100
mov eax, dword [edi + 4]
mov dword [esp + 0x10], edx
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x5404bc]
call esi
nop
jmp 0x42bf3d
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x42bf35
and eax, 0xefefc7fd
or eax, 0x100
jmp 0x42bf3a
mov eax, 0x100
mov dword [ecx + 0x34], eax
push edi
push ebx
call sym.ProcessHacker.exe_PhShowFileDialog
test al, al
je 0x42bf6b
push str.Make_sure_the_PE_Viewer_executable_file_is_present.
push 0
push edi
call sym.ProcessHacker.exe_PhGetFileDialogFileName
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push str.ProgramInspectExecutables
push ebx
call sym.ProcessHacker.exe__PhShellExecuteUserString_20
push edi
call sym.ProcessHacker.exe_PhFreeFileDialog
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5b18bc]
test eax, eax
jne 0x42bfd1
cmp dword [0x5b449c], eax
push eax
push 0x455ac0
cmovne ebx, eax
push ebx
push 0x8a
push dword [0x5b1d78]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push eax
mov dword [0x5b18bc], eax
call sym.ProcessHacker.exe__PhRegisterDialog_4
push 5
push dword [0x5b18bc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5b18bc]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x42bfff
push 9
push dword [0x5b18bc]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5b18bc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push 0
push 0x426000
push 0
push 0xfe
push dword [0x5b1d78]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe_PhGetSystemDirectory
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push str._taskmgr.exe
push dword [eax + 4]
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
mov esi, eax
jb 0x42c183
lea eax, [esp + 0x18]
push eax
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
test byte [eax + 4], 1
jne 0x42c183
push 0
push 0
push ebx
call sym.ProcessHacker.exe__PhUiConnectToPhSvcEx_12
jmp 0x42c0a0
test al, al
je case.0x42b560.40084
mov ebx, dword [esi + 4]
lea eax, [esp + 0x30]
push 0xa0
push 0
push eax
call fcn.0051fd40
add esp, 0xc
cmp dword [0x5b4940], 0
je 0x42c169
push ebx
mov dword [esp + 0x4c], 0x10
call sym.ProcessHacker.exe_PhCountStringZ
mov esi, eax
mov eax, dword [0x5b4944]
add esi, esi
test eax, eax
je 0x42c169
push esi
push 0
push eax
lfence
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x42c169
sub eax, dword [0x5b4944]
mov dword [esp + 0x2c], eax
test ebx, ebx
je 0x42c12c
push esi
push ebx
push edi
lfence
call fcn.00521a30
mov eax, dword [esp + 0x38]
add esp, 0xc
mov dword [esp + 0x54], eax
lea eax, [esp + 0x30]
push eax
push eax
push dword [0x5b4940]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x3c], 0xa00088
mov dword [esp + 0x40], 0
call dword [sym.imp.ntdll.dll_NtRequestWaitReplyPort]
mov eax, dword [0x5b4944]
test eax, eax
je 0x42c169
push edi
push 0
push eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 4]
call fcn.0040b1a0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x42b4e0
push str.SCManager
mov edx, str.Service_Control_Manager
xor ecx, ecx
call fcn.004f5840
push eax
push 0x4f57a0
call sym.ProcessHacker.exe_PhCreateThread2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5ae334]
push ebx
call sym.ProcessHacker.exe__PhUiConnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5ae334]
push ebx
call sym.ProcessHacker.exe__PhUiDisconnectSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5ae334]
push ebx
call sym.ProcessHacker.exe__PhUiLogoffSession_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov edi, dword [0x5ae334]
lea eax, [esp + 0x2c]
push 0
push 4
push eax
push 0x18
push 0xffffffffffffffff
or esi, 0xffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
cmovns esi, dword [esp + 0x2c]
cmp edi, esi
jne 0x42c29d
push str.You_cannot_remote_control_the_current_session.
push 0x54ace8
push str.Unable_to_shadow_session.
push 0xfffe
push 0x20
push ebx
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push edi
push 0x48a020
push ebx
push 0xc1
push dword [0x5b1d78]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5ae334]
push 0x491c40
push ebx
push 0x98
push dword [0x5b1d78]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5ae334]
xor eax, eax
cmp dword [0x5b449c], eax
push 0x489a20
cmovne ebx, eax
push ebx
push 0x99
push dword [0x5b1d78]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5b16bc]
test eax, eax
jne 0x42c37a
push eax
push 0x426a00
push eax
push 0xb2
push dword [0x5b1d78]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push eax
mov dword [0x5b16bc], eax
call sym.ProcessHacker.exe__PhRegisterDialog_4
push 5
push dword [0x5b16bc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5b16bc]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x42c3ad
push 9
push dword [0x5b16bc]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5b16bc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push 0
push str.https:__sourceforge.net_project_project_donations.php_group_id242527
push ebx
call sym.ProcessHacker.exe_PhShellExecute
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call fcn.00411ce0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5b1f50]
test eax, eax
jne 0x42c44b
push eax
push section..text
push eax
push 0x79
push dword [0x5b1d78]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push eax
mov dword [0x5b1f50], eax
call sym.ProcessHacker.exe__PhRegisterDialog_4
push 5
push dword [0x5b1f50]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5b1f50]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x42c47b
push 9
push dword [0x5b1f50]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5b1f50]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x10]
push edi
push esi
call sym.ProcessHacker.exe_PhReferenceObjects
push edi
push esi
push ebx
call sym.ProcessHacker.exe__PhUiTerminateProcesses_12
test al, al
je 0x42c4de
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x5b2b2c]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push esi
call sym.ProcessHacker.exe_PhDereferenceObjects
push esi
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword ds:[esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiTerminateTreeProcess_8
test al, al
je 0x42c53e
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x5b2b2c]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
nop
call sym.ProcessHacker.exe_PhDereferenceObject
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x10]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
push esi
push edi
push ebx
call sym.ProcessHacker.exe__PhUiSuspendProcesses_12
push esi
push edi
call sym.ProcessHacker.exe_PhDereferenceObjects
push edi
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x10]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
push esi
push edi
push ebx
call sym.ProcessHacker.exe__PhUiResumeProcesses_12
jmp 0x42c585
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword [esi - 4]
mov edx, dword fs:[0x18]
mov ecx, dword [esi + 0x10]
cmp ecx, dword [edx + 0x20]
jne 0x42c657
push 0x432600
push 0
push 0x8091
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [sym.ProcessHacker.exe_PhMainWndHandle]
xor edx, edx
push 0
push 0
push 3
push 4
push 5
push 0
call fcn.0040ad40
test al, al
je 0x42c64b
push dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [sym.ProcessHacker.exe_PhMainWndHandle]
push eax
push 0x8091
push eax
jmp 0x42c538
mov byte [0x5b1805], 0
jmp 0x42c53e
push esi
push ebx
call sym.ProcessHacker.exe__PhUiRestartProcess_8
mov edi, edi
jmp 0x42c525
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov edi, eax
test edi, edi
je case.0x42b560.40084
lock inc dword [edi - 4]
call sym.ProcessHacker.exe_PhCreateSaveFileDialog
push 2
mov esi, eax
push 0x5ae344
push esi
mov dword [esp + 0x38], esi
call sym.ProcessHacker.exe_PhSetFileDialogFilter
mov ecx, dword ds:[edi + 0x18]
push str..dmp
push dword [ecx + 4]
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push dword [eax + 4]
push esi
call sym.ProcessHacker.exe_PhSetFileDialogFileName
push esi
push ebx
call sym.ProcessHacker.exe_PhShowFileDialog
push esi
test al, al
jne 0x42c6cf
call sym.ProcessHacker.exe_PhFreeFileDialog
push edi
jmp 0x42c53f
call sym.ProcessHacker.exe_PhGetFileDialogFileName
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push dword [esp + 0x2c]
mov esi, eax
call sym.ProcessHacker.exe_PhFreeFileDialog
mov edx, dword [edi + 0x10]
push ecx
push dword [esi + 4]
mov ecx, ebx
call fcn.00432b60
push edi
jmp 0x42c53f
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword [esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiDebugProcess_8
jmp 0x42c53e
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword ds:[esi - 4]
cmp byte [0x5b4aa0], 0
sete cl
movzx ecx, cl
push ecx
push esi
push ebx
call sym.ProcessHacker.exe__PhUiSetVirtualizationProcess_12
jmp 0x42c53e
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword [esi - 4]
push 0
mov edx, esi
mov ecx, ebx
call fcn.00406ee0
jmp 0x42c53e
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword [esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiSetCriticalProcess_8
jmp 0x42c53e
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword [esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiDetachFromDebuggerProcess_8
jmp 0x42c53e
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov edi, eax
test edi, edi
je case.0x42b560.40084
lock inc dword [edi - 4]
push dword [0x5b1d74]
mov dword [esp + 0x1c], edi
push 0xc
call sym.ProcessHacker.exe_PhCreateObject
push 0x50
mov esi, eax
push 4
push dword [0x5b1dac]
mov dword [esi], 0
mov dword [esi + 4], 0x14
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
lea eax, [esp + 0x18]
push eax
push 0x417aa0
push ebx
push 0xaf
push dword [0x5b1d78]
mov dword [esp + 0x30], esi
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push edi
jmp 0x42c53f
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword [esi - 4]
mov edx, esi
call fcn.00417d80
jmp 0x42c53e
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov edi, eax
test edi, edi
je case.0x42b560.40084
add esi, 0xffff62d1
cmp esi, 4
ja case.default.0x42c857
jmp dword [esi*4 + 0x42d268]
mov eax, 1
jmp 0x42c886
mov eax, 2
jmp 0x42c886
mov eax, 3
jmp 0x42c886
mov eax, 4
jmp 0x42c886
mov eax, 5
jmp 0x42c886
mov eax, dword [esp + 0x18]
lock inc dword [edi - 4]
push eax
push edi
push ebx
call sym.ProcessHacker.exe__PhUiSetPagePriorityProcess_12
push edi
jmp 0x42c53f
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
push eax
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x10]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
push esi
push edi
push ebx
call sym.ProcessHacker.exe__PhUiReduceWorkingSetProcesses_12
mov edi, edi
jmp 0x42c585
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x42b560.40084
mov eax, dword [eax + 0x2c]
test eax, eax
je case.0x42b560.40084
push eax
push str.RunAsProgram
call sym.ProcessHacker.exe_PhSetStringSetting2
xor edx, edx
mov ecx, ebx
call fcn.00483ae0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x42b560.40084
mov edx, dword ds:[eax + 0x10]
mov ecx, ebx
call fcn.00483ae0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
lfence
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x18]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
mov ecx, dword [esp + 0x10]
mov edx, edi
push esi
call fcn.004446a0
jmp 0x42c585
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x30]
push eax
lfence
call sym.ProcessHacker.exe__PhGetSelectedProcessItems_8
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x2c]
push esi
push edi
call sym.ProcessHacker.exe_PhReferenceObjects
mov ecx, dword [esp + 0x10]
mov edx, edi
push esi
call fcn.00444740
jmp 0x42c585
push dword [0x5b4a9c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x42b560.40084
xor eax, eax
mov dword [esp + 0xd0], 0x2c
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
lea eax, [esp + 0xd0]
push eax
push dword [0x5b4a9c]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword [esp + 0xd8], 6
je 0x42ca5d
push dword [0x5b4a9c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5b4a9c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x42b560.40084
push 9
push dword [0x5b4a9c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5b4a9c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x42b560.40084
push 6
push dword [0x5b4a9c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5b4a9c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je case.0x42b560.40084
push 3
push dword [0x5b4a9c]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push dword [0x5b4a9c]
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, edi
test eax, eax
je case.0x42b560.40084
push 0
push 0
push 0x10
push dword [0x5b4a9c]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
mov eax, dword [esi + 0x2c]
test eax, eax
je case.0x42b560.40084
cmp dword [eax], 0
je case.0x42b560.40084
push dword [eax + 4]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
lea ebx, [ebx]
test al, al
je case.0x42b560.40084
lock inc dword ds:[esi - 4]
mov eax, dword [esi + 0x2c]
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [eax + 4]
push str.FileBrowseExecutable
push ebx
call sym.ProcessHacker.exe__PhShellExecuteUserString_20
jmp 0x42c53e
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
test eax, eax
je case.0x42b560.40084
mov eax, dword ds:[eax + 0x18]
push dword [eax + 4]
push ebx
call sym.ProcessHacker.exe__PhSearchOnlineString_8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedProcessItem_0
nop
test eax, eax
je case.0x42b560.40084
push eax
call fcn.004445e0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
push 0
push dword [0x5b2b2c]
call sym.ProcessHacker.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x5b2b2c]
call sym.ProcessHacker.exe_PhSetClipboardString
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne case.0x42b560.40084
call fcn.004b3960
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x42b560.40084
push dword [eax + 0x2c]
call sym.ProcessHacker.exe__PhFindProcessNode_4
mov esi, eax
test esi, esi
je case.0x42b560.40084
mov ecx, dword [0x5b4a98]
mov ecx, dword [ecx + 0x14]
call fcn.00431340
push dword [0x5b4a94]
lea ecx, [ecx]
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, 1
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x18]
call fcn.00471d20
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword [esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiStartService_8
jmp 0x42c53e
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword [esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiContinueService_8
jmp 0x42c53e
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword [esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiPauseService_8
jmp 0x42c53e
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword ds:[esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiStopService_8
jmp 0x42c53e
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lock inc dword ds:[esi - 4]
push esi
push ebx
call sym.ProcessHacker.exe__PhUiDeleteService_8
test al, al
je 0x42c53e
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x5b3000]
jmp 0x42c538
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
test eax, eax
je case.0x42b560.40084
push dword [eax + 8]
push 0x5ae338
call sym.ProcessHacker.exe_PhConcatStringRef2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
push 0
mov esi, eax
lea eax, [esp + 0x1c]
push esi
push 0xfffffffffffffffd
push 0x20019
push eax
call sym.ProcessHacker.exe_PhOpenKey
jmp 0x42cd80
test eax, eax
js case.0x42b560.40084
push esi
push 0x5ae314
lfence
call sym.ProcessHacker.exe_PhConcatStringRef2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov edx, eax
mov ecx, ebx
call fcn.0040c7a0
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
mov ecx, dword [esi + 8]
push 1
push dword [ecx + 4]
call sym.ProcessHacker.exe_PhOpenService
mov edi, eax
test edi, edi
je case.0x42b560.40084
mov ecx, dword [esi + 8]
mov edx, edi
call fcn.00409f20
mov esi, eax
test esi, esi
je 0x42ce25
push str.Make_sure_the_Explorer_executable_file_is_present.
push 0
push dword [esi + 4]
push str.FileBrowseExecutable
push ebx
call sym.ProcessHacker.exe__PhShellExecuteUserString_20
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
call sym.ProcessHacker.exe__PhGetSelectedServiceItem_0
mov esi, eax
test esi, esi
je case.0x42b560.40084
lea ecx, ds:[esi - 4]
lock inc dword [ecx]
lock inc dword [ecx]
push esi
push 0x48f060
call sym.ProcessHacker.exe_PhCreateThread2
jmp 0x42c53e
push 0
push dword [0x5b3000]
call sym.ProcessHacker.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x5b3000]
jmp 0x42cbf9
call fcn.00449fa0
test eax, eax
je case.0x42b560.40084
push dword [eax + 0x38]
jmp 0x42cc3a
call fcn.00449fa0
nop
test eax, eax
je case.0x42b560.40084
mov eax, dword [eax + 0x48]
test eax, eax
je case.0x42b560.40084
push dword [eax + 4]
call sym.ProcessHacker.exe__PhReferenceServiceItem_4
mov esi, eax
test esi, esi
je case.0x42b560.40084
mov ecx, dword [0x5b4a78]
mov ecx, dword [ecx + 0x14]
call fcn.00431340
push dword [0x5b4a74]
lea esp, [esp]
call dword [sym.imp.USER32.dll_SetFocus]
push 0x432700
push esi
push 0x8091
push dword [sym.ProcessHacker.exe_PhMainWndHandle]
jmp 0x42c538
lea edx, [esp + 0x18]
lea ecx, [esp + 0x2c]
call fcn.00449fe0
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x2c]
push edi
push esi
call sym.ProcessHacker.exe_PhReferenceObjects
push edi
push esi
push ebx
call sym.ProcessHacker.exe__PhUiCloseConnections_12
test al, al
je 0x42c4de
push 0xffffffffffffffff
push 0
push 0x41d
push dword [0x5b248c]
jmp 0x42c4d8
push 0
push dword [0x5b248c]
call sym.ProcessHacker.exe_PhGetTreeNewText
mov esi, eax
push esi
push dword [0x5b248c]
jmp 0x42cbf9
push 0
push 0
push 0x130b
push dword [0x5b21f4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x5b21f8]
mov ecx, dword [ecx]
dec ecx
cmp eax, ecx
je 0x42cf8d
inc eax
jmp 0x42cfb5
xor eax, eax
jmp 0x42cfb5
push 0
push 0
push 0x130b
push dword [0x5b21f4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x42cfb4
mov eax, dword [0x5b21f8]
mov eax, dword [eax]
dec eax
mov ecx, eax
call fcn.00431340
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret