Function at 0x4aac40
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [0x5cd4f8]
mov esi, 0xa
mov ebx, ecx
push 0x14
mov dword [ebp - 0x48], esi
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor eax, eax
mov dword [ebp - 0x44], edi
lea ecx, [edi + 8]
mov dword [edi + 4], ecx
mov word [ecx + 0xa], ax
mov dword [edi], eax
mov ecx, dword [edi + 4]
mov word [ecx], ax
test bl, 1
je 0x4aace0
push str.Local_TID_
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4aace0
mov ecx, dword ds:[edi]
add ecx, eax
cmp ecx, esi
jbe 0x4aacbc
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.Local_TID_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test bl, 2
je 0x4aad3a
push str.UUID_initialized_
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4aad3a
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4aad16
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.UUID_initialized_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test bl, 4
je 0x4aad98
push str.Inside_thread_detach_
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4aad98
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4aad70
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.Inside_thread_detach_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test bl, 8
je 0x4aadf2
push str.Channel_thread_initialzed_
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4aadf2
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4aadce
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.Channel_thread_initialzed_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test bl, 0x10
je 0x4aae52
push str.WOW_Thread_
lea esp, [esp]
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4aae52
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4aae2e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.WOW_Thread_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test bl, 0x20
je 0x4aaeb2
push str.Thread_Uninitializing_
lea esp, [esp]
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4aaeb2
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4aae8e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.Thread_Uninitializing_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test bl, 0x40
je 0x4aaf12
push str.OLE1DDE_disabled_
lea esp, [esp]
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4aaf12
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4aaeee
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.OLE1DDE_disabled_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test bl, bl
jns 0x4aaf72
push str.Single_threaded__STA__
jmp 0x4aaf20
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4aaf72
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4aaf4e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.Single_threaded__STA__
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x100
je 0x4aafd2
push str.Multi_threaded__MTA__
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4aafd2
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4aafae
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.Multi_threaded__MTA__
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x200
je 0x4ab032
push str.Impersonating_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab032
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab00e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.Impersonating_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x400
je 0x4ab092
push str.Eventlogger_disabled_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab092
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab06e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.Eventlogger_disabled_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x800
je 0x4ab0f2
push str.Neutral_threaded__NTA__
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab0f2
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab0ce
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.Neutral_threaded__NTA__
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x1000
je 0x4ab152
push str.Dispatch_thread_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab152
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab12e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.Dispatch_thread_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x2000
je 0x4ab1b2
push str.HOSTTHREAD_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab1b2
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab18e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.HOSTTHREAD_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x4000
je 0x4ab212
push str.ALLOWCOINIT_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab212
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab1ee
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.ALLOWCOINIT_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x8000
je 0x4ab272
push str.PENDINGUNINIT_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab272
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab24e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.PENDINGUNINIT_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x10000
je 0x4ab2d2
push str.FIRSTMTAINIT_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab2d2
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab2ae
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.FIRSTMTAINIT_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x20000
je 0x4ab332
push str.FIRSTNTAINIT_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab332
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab30e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.FIRSTNTAINIT_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x40000
je 0x4ab392
push str.APTIN_Itializing_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab392
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab36e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.APTIN_Itializing_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x80000
je 0x4ab3f2
push str.UIMSGS_IN_MODAL_LOOP_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab3f2
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab3ce
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.UIMSGS_IN_MODAL_LOOP_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x100000
je 0x4ab452
push str.Marshaling_error_object_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab452
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab42e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.Marshaling_error_object_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x200000
je 0x4ab4b2
push str.WinRT_initialized_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab4b2
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab48e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.WinRT_initialized_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x400000
je 0x4ab512
push str.ApplicationSTA_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab512
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab4ee
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.ApplicationSTA_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x800000
je 0x4ab572
push str.IN_SHUTDOWN_CALLBACKS_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab572
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab54e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.IN_SHUTDOWN_CALLBACKS_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x1000000
je 0x4ab5d2
push str.POINTER_INPUT_BLOCKED_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab5d2
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab5ae
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.POINTER_INPUT_BLOCKED_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x2000000
je 0x4ab632
push str.IN_ACTIVATION_FILTER_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab632
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab60e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.IN_ACTIVATION_FILTER_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x4000000
je 0x4ab692
push str.ASTATOASTAEXEMPT_QUIRK_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab692
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab66e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.ASTATOASTAEXEMPT_QUIRK_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x8000000
je 0x4ab6f2
push str.ASTATOASTAEXEMPT_PROXY_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab6f2
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab6ce
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.ASTATOASTAEXEMPT_PROXY_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x10000000
je 0x4ab752
push str.ASTATOASTAEXEMPT_INDOUBT_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab752
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab72e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.ASTATOASTAEXEMPT_INDOUBT_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x20000000
je 0x4ab7b2
push str.DETECTED_USER_INITIALIZED_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab7b2
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab78e
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.DETECTED_USER_INITIALIZED_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, 0x40000000
je 0x4ab812
push str.BRIDGE_STA_
nop
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab812
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab7ee
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.BRIDGE_STA_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
test ebx, ebx
jns 0x4ab86f
push str.NAINITIALIZING_
jmp 0x4ab820
call sym.ProcessHacker.exe_PhCountStringZ
add eax, eax
mov dword [ebp - 0x3c], eax
je 0x4ab86f
mov ecx, dword [edi]
add ecx, eax
cmp esi, ecx
jae 0x4ab84b
lfence
mov edx, dword [edi]
lea ecx, [ebp - 0x48]
add edx, eax
call fcn.004c5440
mov edi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [edi + 4]
add eax, dword [edi]
push str.NAINITIALIZING_
push eax
call fcn.00537fe0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
add dword [edi], eax
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
mov ecx, dword ds:[edi]
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x3c], 0x584228
cmp ecx, 4
jb 0x4ab8de
mov eax, dword [edi + 4]
add ecx, 0xfffffffc
add eax, ecx
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x40]
push 0
push eax
lea eax, [ebp - 0x50]
push eax
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4ab8de
mov esi, dword [edi]
mov eax, esi
mov ecx, dword [edi + 4]
shr eax, 1
lea edx, [eax*2 - 4]
sub esi, edx
lea eax, [ecx + eax*2]
sub esi, 4
push esi
push eax
lea eax, [ecx + edx]
push eax
call fcn.00537fe0
add dword [edi], 0xfffffffc
add esp, 0xc
mov ecx, dword [edi]
xor edx, edx
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
push 0x10
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], 0x780030
push eax
push ebx
call fcn.005388ed
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x48]
push str.___s_
push eax
call sym.ProcessHacker.exe_PhAppendFormatStringBuilder
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp - 0x44]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret