Function at 0x4d1840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword [0x5ac004]
xor eax, esp
mov dword [esp + 0xf8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x30], eax
mov ecx, dword [ebp + 0x10]
mov ebx, edx
mov eax, dword [ebp + 0xc]
push edi
mov dword [esp + 0x3c], ecx
xor edi, edi
mov ecx, dword [sym.ProcessHacker.exe_PhStdGetClientIdName]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x18]
push 1
push ecx
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x1e
mov dword [esp + 0x28], str.EtwRegistration
call sym.ProcessHacker.exe_PhEqualStringRef
nop
test al, al
je 0x4d1911
mov eax, dword [0x5b1f3c]
test eax, eax
je 0x4d253e
push edi
push edi
push 0x18
lea ecx, [esp + 0x98]
mov dword [esp + 0x4c], esi
mov dword [esp + 0x58], ecx
lea ecx, [esp + 0x4c]
push ecx
push 0x9999225f
lea ecx, [esp + 0x34]
mov dword [esp + 0x58], ebx
push ecx
push edi
push edi
push edi
push eax
mov dword [esp + 0x70], 6
mov dword [esp + 0x78], 0x14
mov dword [esp + 0x7c], edi
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x4d253e
lea eax, [esp + 0x8c]
push eax
call sym.ProcessHacker.exe_PhGetEtwPublisherName
mov edi, eax
jmp 0x4d2536
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 8
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x28], 0x56c740
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4d1a65
push dword ds:[esp + 0x34]
call sym.ProcessHacker.exe_PhResolveDevicePrefix
mov edi, eax
test edi, edi
jne 0x4d1959
mov eax, dword [esp + 0x34]
mov edi, eax
test eax, eax
je 0x4d1966
lock inc dword [eax - 4]
cmp dword ds:[edi], 0
jne 0x4d1a57
cmp dword [0x5b1f3c], 0
je 0x4d2536
push 0
push 4
lea eax, [esp + 0x14]
mov edx, ebx
push eax
push 8
mov ecx, esi
call fcn.004cc270
test eax, eax
js 0x4d2536
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4d2536
lea eax, [esp + 0x10]
mov edx, 1
push eax
call fcn.004c5c00
test eax, eax
js 0x4d252c
mov ebx, dword ds:[esp + 0x10]
movzx eax, word [ebx]
mov dword [esp + 0x10], eax
test ax, ax
jne 0x4d19ce
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
jmp 0x4d1a13
push dword [0x5b1d70]
mov ecx, dword [ebx + 4]
movzx eax, ax
add eax, 0xa
mov dword [esp + 0x3c], ecx
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor edx, edx
mov eax, dword [esp + 0x10]
movzx ecx, ax
lea eax, [esi + 8]
mov dword [esi + 4], eax
mov dword [esi], ecx
mov word [eax + ecx], dx
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4d1a13
push ecx
push eax
push dword [esi + 4]
call fcn.00521a30
add esp, 0xc
push ebx
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push esi
push 0x5b0104
call sym.ProcessHacker.exe_PhConcatStringRef2
mov ecx, edi
mov edi, eax
test ecx, ecx
je 0x4d1a4c
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4d1a4c
call fcn.004b3960
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
jmp 0x4d252c
mov eax, dword ds:[esp + 0x3c]
mov dword [eax], edi
jmp 0x4d2550
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 6
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x28], 0x56e03c
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4d1c56
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4d1a9d
cmp dword [eax], edi
jne 0x4d253e
push 0
push 0
push 4
lea eax, [esp + 0x1c]
push eax
push 0xffffffffffffffff
push ebx
push esi
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4d253e
mov esi, dword ds:[esp + 0xc]
test esi, esi
je 0x4d1c4d
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x14]
call sym.ProcessHacker.exe_PhGetJobProcessIdList
test eax, eax
js 0x4d1c4d
push dword [0x5b1d70]
mov dword [esp + 0x1c], 0x28
push 0x32
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [esp + 0x1c], edi
xor ebx, ebx
mov dword [edi + 4], eax
mov word [eax + 0x28], cx
mov dword [edi], ecx
mov eax, dword [edi + 4]
mov word [eax], cx
mov eax, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x38], eax
cmp dword [eax + 4], ecx
jbe 0x4d1beb
add eax, 8
mov dword [esp + 0x14], eax
mov eax, dword ds:[eax]
mov ecx, esi
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
call dword [0x5404bc]
call esi
mov dword [esp + 0x78], eax
test eax, eax
je 0x4d1bd0
push eax
lea eax, [esp + 0x1c]
push eax
call sym.ProcessHacker.exe_PhAppendStringBuilder
push 0x579ee8
call sym.ProcessHacker.exe_PhCountStringZ
mov edi, dword [esp + 0x1c]
mov esi, eax
add esi, esi
je 0x4d1bb5
mov ecx, dword [edi]
add ecx, esi
cmp dword [esp + 0x18], ecx
jae 0x4d1b91
lfence
mov edx, dword [edi]
lea ecx, [esp + 0x18]
add edx, esi
call fcn.004b6ea0
mov edi, dword [esp + 0x1c]
mov eax, dword ds:[edi]
add eax, dword [edi + 4]
push esi
push 0x579ee8
push eax
call fcn.00521a30
add dword [edi], esi
add esp, 0xc
mov ecx, dword [edi]
xor edx, edx
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
mov ecx, dword [esp + 0x78]
or eax, 0xffffffff
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4d1bcc
call fcn.004b3960
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
inc ebx
mov eax, dword [esp + 0x14]
add eax, 4
mov dword [esp + 0x14], eax
cmp ebx, dword [ecx + 4]
jb 0x4d1b30
mov eax, ecx
push eax
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword ds:[edi]
test esi, esi
je 0x4d1c3a
mov ecx, dword [edi + 4]
mov eax, esi
shr eax, 1
lea edx, [eax*2 - 4]
sub esi, edx
lea eax, [ecx + eax*2]
sub esi, 4
push esi
push eax
lea eax, [edx + ecx]
push eax
call fcn.005214b0
add dword [edi], 0xfffffffc
xor edx, edx
mov ecx, dword [edi]
add esp, 0xc
mov eax, dword [edi + 4]
mov word [ecx + eax], dx
cmp dword [edi], edx
jne 0x4d1c4d
push str._No_processes_
lea eax, [esp + 0x1c]
push eax
call sym.ProcessHacker.exe_PhAppendStringBuilder2
mov edi, dword [esp + 0x1c]
push dword [esp + 0x10]
jmp 0x4d2530
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 6
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x30], 0x56da04
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4d1c8c
push dword ds:[esp + 0x34]
call sym.ProcessHacker.exe_PhFormatNativeKeyName
mov edi, eax
jmp 0x4d2536
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0xe
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x30], 0x56c684
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4d1d50
mov dword ds:[esp + 0x1c], edi
push 0
cmp dword [0x5b1f3c], edi
je 0x4d1cde
push 0x18
lea eax, [esp + 0x48]
mov edx, ebx
push eax
push 4
mov ecx, esi
call fcn.004cc270
test eax, eax
jmp 0x4d1d1f
push 0
push 0x1000
lea eax, [esp + 0x1c]
push eax
push 0xffffffffffffffff
push ebx
push esi
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4d253e
push 0
push 0x18
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
nop
js 0x4d253e
mov ebx, dword [esp + 0xc]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x4d253e
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call dword [0x5404bc]
call ebx
mov edi, eax
jmp 0x4d2536
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0xe
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x30], 0x56da48
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4d1ede
mov eax, dword ds:[esp + 0x34]
test eax, eax
je 0x4d1d8c
cmp dword [eax], edi
jne 0x4d253e
push 0
push 0
push 5
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
push ebx
push esi
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4d253e
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x78]
call fcn.004d1560
test eax, eax
js 0x4d1dd6
mov esi, dword [esp + 0x78]
push esi
call sym.ProcessHacker.exe_PhResolveDevicePrefix
push esi
mov edi, eax
call sym.ProcessHacker.exe_PhDereferenceObject
jmp 0x4d252c
push 0
push 0x10
lea eax, [esp + 0x28]
push eax
push 0
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtQuerySection]
test eax, eax
js 0x4d252c
mov eax, dword ds:[esp + 0x24]
mov ecx, 0x56d084
test eax, 0x8000000
je 0x4d1e0e
mov edx, 0x56e3a8
jmp 0x4d1e3b
test eax, 0x800000
je 0x4d1e1c
mov edx, 0x56c740
jmp 0x4d1e3b
lea esp, [esp]
test eax, 0x1000000
je 0x4d1e2e
mov edx, 0x56e3b8
jmp 0x4d1e3b
test eax, 0x4000000
mov edx, str.Reserve
cmove edx, ecx
mov ecx, edx
mov dword [esp + 0xa0], 1
lea esi, [ecx + 2]
jmp 0x4d1e50
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d1e50
sub ecx, esi
mov dword [esp + 0xb4], edx
sar ecx, 1
push 0x14
push 4
mov dword [esp + 0xc0], 1
lea eax, [ecx + ecx]
mov dword [esp + 0xd0], 4
mov ecx, dword [esp + 0x34]
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xe8], eax
mov eax, 0x29
mov word [esp + 0x100], ax
lea eax, [esp + 0xa8]
push eax
mov dword [esp + 0xd8], 0x56d1bc
mov dword [esp + 0xdc], 0xc
mov dword [esp + 0xf0], ecx
mov dword [esp + 0xf4], edi
call sym.ProcessHacker.exe_PhFormat
mov edi, eax
jmp 0x4d252c
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0xc
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x30], str.Thread
call sym.ProcessHacker.exe_PhEqualStringRef
mov edi, edi
test al, al
je 0x4d1fa5
push 0
cmp dword [0x5b1f3c], edi
je 0x4d1f29
push 0x1c
lea eax, [esp + 0x48]
mov edx, ebx
push eax
push 5
mov ecx, esi
call fcn.004cc270
test eax, eax
jmp 0x4d1f6b
push 0
push 0x800
lea eax, [esp + 0x1c]
push eax
push 0xffffffffffffffff
push ebx
push esi
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
nop
test eax, eax
js 0x4d253e
push 0
push 0x1c
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x4d253e
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x4d253e
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call dword [0x5404bc]
call ebx
mov edi, eax
jmp 0x4d2536
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x30], str.TmEn
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4d2045
push 0
push 0
push 1
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
push ebx
push esi
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4d253e
mov esi, dword [esp + 0xc]
call fcn.004f2e20
test eax, eax
je 0x4d20a4
push 0
push 0x30
lea eax, [esp + 0x48]
push eax
push 0
push esi
call fcn.004f2e20
mov esi, eax
mov ecx, eax
call dword [0x5404bc]
call esi
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x4d253e
lea eax, [esp + 0x40]
push eax
call sym.ProcessHacker.exe_PhFormatGuid
mov edi, eax
jmp 0x4d2536
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x30], str.TmRm
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4d216a
push 0
push 0
push 1
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
push ebx
push esi
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4d253e
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x78]
push eax
call fcn.004c57c0
lea esp, [esp]
test eax, eax
jns 0x4d20b3
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x4d253e
mov edi, dword ds:[esp + 0x78]
mov eax, dword [edi]
mov dword [esp + 0x7c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x80], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x84], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x88], eax
mov ebx, dword [edi + 0x10]
test ebx, ebx
jne 0x4d20ed
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
jmp 0x4d2120
push dword [0x5b1d70]
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], eax
mov dword [esi], ebx
mov word [eax + ebx], cx
lea eax, [edi + 0x14]
test eax, eax
je 0x4d2120
push ebx
push eax
push dword [esi + 4]
call fcn.00521a30
add esp, 0xc
push edi
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x4d2149
cmp dword [esi], 0
je 0x4d2149
mov edi, esi
jmp 0x4d2536
lea eax, [esp + 0x7c]
push eax
call sym.ProcessHacker.exe_PhFormatGuid
mov edi, eax
test esi, esi
je 0x4d2536
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
jmp 0x4d2536
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x30], str.TmTm
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4d2299
push 0
push 0
push 1
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
push ebx
push esi
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
test eax, eax
js 0x4d253e
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
call fcn.004c52c0
lea ecx, [ecx]
test eax, eax
js 0x4d224a
mov eax, dword [esp + 0x10]
mov ebx, dword [eax]
test ebx, ebx
jne 0x4d21db
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
jmp 0x4d2216
push dword [0x5b1d70]
add eax, 4
mov dword [esp + 0x7c], eax
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], eax
mov dword [esi], ebx
mov word [eax + ebx], cx
mov eax, dword [esp + 0x78]
test eax, eax
je 0x4d2216
push ebx
push eax
push dword [esi + 4]
call fcn.00521a30
add esp, 0xc
push dword [esp + 0x10]
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
je 0x4d224a
push esi
cmp dword [esi], edi
je 0x4d2245
call sym.ProcessHacker.exe_PhGetFileName
push esi
mov edi, eax
call sym.ProcessHacker.exe_PhDereferenceObject
mov edi, edi
jmp 0x4d252c
call sym.ProcessHacker.exe_PhDereferenceObject
mov esi, dword [esp + 0xc]
call fcn.004f31e0
test eax, eax
je 0x4d252c
push 0
push 0x18
lea eax, [esp + 0x48]
push eax
push 0
push esi
call fcn.004f31e0
mov esi, eax
mov ecx, eax
call dword [0x5404bc]
call esi
jmp 0x4d2280
test eax, eax
js 0x4d252c
lea eax, [esp + 0x40]
push eax
call sym.ProcessHacker.exe_PhFormatGuid
mov edi, eax
jmp 0x4d252c
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x30], str.TmTx
call sym.ProcessHacker.exe_PhEqualStringRef
lea esp, [esp]
test al, al
je 0x4d23ac
push 0
push 0
push 1
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
push ebx
push esi
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
lea ecx, [ecx]
test eax, eax
js 0x4d253e
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
call fcn.004c5540
test eax, eax
js 0x4d2365
mov eax, dword [esp + 0x10]
push dword [0x5b1d70]
mov ebx, dword [eax + 0x14]
add eax, 0x18
mov dword [esp + 0x7c], eax
lea eax, [ebx + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor eax, eax
lea ecx, [esi + 8]
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov word [ecx + ebx], ax
mov eax, dword [esp + 0x78]
test eax, eax
je 0x4d2340
push ebx
push eax
push dword [esi + 4]
call fcn.00521a30
add esp, 0xc
push dword [esp + 0x10]
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [esi], edi
je 0x4d235d
mov edi, esi
jmp 0x4d252c
push esi
call sym.ProcessHacker.exe_PhDereferenceObject
mov esi, dword [esp + 0xc]
call fcn.004f30a0
test eax, eax
je 0x4d252c
push 0
push 0x18
lea eax, [esp + 0x48]
push eax
push 0
push esi
call fcn.004f30a0
mov esi, eax
mov ecx, eax
call dword [0x5404bc]
call esi
test eax, eax
js 0x4d252c
lea eax, [esp + 0x40]
push eax
call sym.ProcessHacker.exe_PhFormatGuid
mov edi, eax
jmp 0x4d252c
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0xa
push eax
push dword [esp + 0x1c]
mov dword [esp + 0x30], 0x56e064
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
je 0x4d253e
push 0x38
lea eax, [esp + 0x44]
mov dword [esp + 0x14], edi
push 0
push eax
call fcn.0051fd40
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push 0
push 8
push eax
push 0xffffffffffffffff
push ebx
push esi
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov edi, edi
test eax, eax
js 0x4d253e
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov edx, 1
call fcn.004c4b80
mov esi, eax
lea eax, [esp + 0x78]
push eax
push 0x38
lea eax, [esp + 0x48]
push eax
push 0xa
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
test esi, esi
js 0x4d252c
mov ebx, dword [esp + 0x10]
push 0
push 1
push dword [ebx]
call sym.ProcessHacker.exe_PhGetSidFullName
mov esi, eax
test esi, esi
je 0x4d251d
mov eax, dword [esp + 0x48]
mov edx, str.__Primary_
cmp dword [esp + 0x58], 1
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov dword [esp + 0xe0], eax
mov eax, str.__Impersonation_
cmovne edx, eax
mov dword [esp + 0xb4], ecx
mov ecx, edx
mov dword [esp + 0xa0], 1
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb8], 1
mov dword [esp + 0xc8], 8
lea eax, [ecx + 2]
mov dword [esp + 0xcc], str.:_0x
mov dword [esp + 0xd0], 0x108
mov byte [esp + 0xda], 0x10
mov dword [esp + 0xe8], 1
mov dword [esp + 0x78], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d24e0
sub ecx, dword [esp + 0x78]
sar ecx, 1
mov dword [esp + 0xfc], edx
lea eax, [ecx + ecx]
mov dword [esp + 0xf8], eax
lea eax, [edi + 0x28]
push eax
push 4
lea eax, [esp + 0xa8]
push eax
call sym.ProcessHacker.exe_PhFormat
push esi
mov edi, eax
call sym.ProcessHacker.exe_PhDereferenceObject
push ebx
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
jne 0x4d1a57
mov ebx, dword [esp + 0x34]
test ebx, ebx
je 0x4d254a
lock inc dword [ebx - 4]
mov eax, dword [esp + 0x3c]
mov dword [eax], ebx
mov ecx, dword ds:[esp + 0x104]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 0xc