Function at 0x42f400
Capabilities:
Check mutex on windows
Check processdebugflags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3ec
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x3e8], eax
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x42f42e
mov ecx, dword [ecx + 4]
jmp 0x42f433
mov ecx, 0x5cab58
mov eax, dword [ebx + 0x58]
mov dword [esp + 0x11c], eax
lea eax, [esp + 0x118]
push eax
push 0
push 0x104c
push dword [ebx]
mov dword [esp + 0x128], 1
mov dword [esp + 0x130], 1
mov dword [esp + 0x13c], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x42f482
mov ecx, dword ds:[ecx + 4]
jmp 0x42f487
mov ecx, 0x5cab58
mov eax, dword ds:[ebx + 0x5c]
mov dword [esp + 0x11c], eax
lea eax, [esp + 0x118]
push eax
push 0
push 0x104c
push dword [ebx]
mov dword [esp + 0x128], 1
mov dword [esp + 0x130], 1
mov dword [esp + 0x13c], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x42f533
push 0x10
lea ecx, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push ecx
push eax
call fcn.00582a2a
mov eax, dword [ebx + 0x60]
add esp, 0xc
mov dword [esp + 0x11c], eax
lea eax, [esp + 0x180]
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x118]
mov dword [esp + 0x118], 1
push eax
push 0
push 0x104c
push dword [ebx]
mov dword [esp + 0x130], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x42f542
mov eax, dword [eax + 4]
jmp 0x42f547
mov eax, 0x5cab58
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x44]
push ecx
push eax
call sym.SystemInformer.exe_PhGetAccessEntries
mov ecx, dword ds:[ebx + 0xc]
test al, al
je 0x42f648
push dword [esp + 0x28]
mov esi, dword [esp + 0x44]
push esi
push dword [ecx + 0x14]
call sym.SystemInformer.exe_PhGetAccessString
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
cmp dword [eax], 0
je 0x42f5d9
push dword [eax + 4]
mov eax, dword [ebx + 0xc]
push dword [eax + 0x14]
push str.0x_x___s_
call sym.SystemInformer.exe_PhFormatString
add esp, 0xc
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov dword [esp + 0x118], 1
mov dword [esp + 0x11c], 3
mov dword [esp + 0x120], 1
mov eax, dword [eax + 4]
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x118]
jmp 0x42f624
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x184]
push 0x10
push ecx
mov eax, dword [eax + 0x14]
push eax
mov dword [esp + 0x18c], 0x780030
call fcn.00582a2a
lea eax, [esp + 0x18c]
mov dword [esp + 0x64], 1
mov dword [esp + 0x78], eax
add esp, 0xc
mov dword [esp + 0x5c], 3
lea eax, [esp + 0x58]
mov dword [esp + 0x60], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x42f6af
mov eax, dword [ecx + 0x14]
lea ecx, [esp + 0x184]
push 0x10
push ecx
push eax
mov dword [esp + 0x18c], 0x780030
call fcn.00582a2a
add esp, 0xc
mov dword [esp + 0x118], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x11c], 3
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x118]
mov dword [esp + 0x120], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x635f50], 3
mov ecx, 0x1000
push dword [ebx + 8]
mov eax, 0x40
cmovge eax, ecx
push eax
lea eax, [esp + 0x1c]
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x42f866
mov eax, dword ds:[ebx + 0xc]
lea ecx, [esp + 0x118]
push 0
push 0
push 0
push 0
push ecx
lea ecx, [esp + 0x3c]
push ecx
push 0
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x38]
call sym.SystemInformer.exe_PhGetHandleInformationEx
test eax, eax
js 0x42f859
mov eax, dword [esp + 0x28]
test eax, eax
js 0x42f859
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x12c]
call fcn.00582a2a
add esp, 0xc
mov dword [esp + 0x58], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x5c], 4
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x60], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x128]
call fcn.00582a2a
add esp, 0xc
mov dword [esp + 0x58], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x5c], 5
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x60], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x130]
call fcn.00582a2a
add esp, 0xc
mov dword [esp + 0x58], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x5c], 6
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x60], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x134]
call fcn.00582a2a
add esp, 0xc
mov dword [esp + 0x58], 1
lea eax, [esp + 0x180]
mov dword [esp + 0x5c], 7
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x60], 1
push eax
push 0
push 0x104c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword ds:[esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x43220e
cmp dword [eax], 0
je 0x43220e
push 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x12
push ecx
push eax
mov dword [esp + 0x28], str.ALPC_Port
call sym.SystemInformer.exe_PhEqualStringRef
lea ebx, [ebx]
test al, al
je 0x4309ae
cmp dword [0x635f50], 3
mov dword [esp + 0x40], 0
jl 0x43220e
push dword [ebx + 8]
lea eax, [esp + 0x44]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43220e
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x58]
mov ecx, dword [esp + 0x40]
push 0
push 0x14
mov edx, dword [edx + 8]
push eax
push 0
call fcn.005240c0
test eax, eax
js 0x42ff54
mov edi, dword ds:[esp + 0x5c]
lea eax, [esp + 0x18]
push 0
push 0
mov esi, 0x100
mov dword [esp + 0x40], edi
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], esi
call sym.SystemInformer.exe_PhCreateString3
mov edx, eax
xor eax, eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], edx
mov dword [edx], 0
mov ecx, dword [edx + 4]
mov word [ecx], ax
test dword [esp + 0x5c], 0x1000
je 0x42f9b9
mov eax, dword [edx]
add eax, 0x14
cmp eax, esi
jbe 0x42f971
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x28]
add edx, 0x14
call fcn.004ff5f0
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x30], edx
mov ecx, dword [edx + 4]
xor edi, edi
add ecx, dword [edx]
mov eax, dword [str.LPC_mode_]
mov dword [ecx], eax
mov eax, dword [0x5fd2d0]
mov dword [ecx + 4], eax
mov eax, dword [0x5fd2d4]
mov dword [ecx + 8], eax
mov eax, dword [0x5fd2d8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5fd2dc]
mov dword [ecx + 0x10], eax
add dword [edx], 0x14
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], di
mov edi, dword [esp + 0x38]
and edi, 0xffffefff
mov dword [esp + 0x38], edi
test dword [esp + 0x5c], 0x10000
je 0x42fa14
mov eax, dword [edx]
add eax, 0x2a
cmp esi, eax
jae 0x42f9e5
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x28]
add edx, 0x2a
call fcn.004ff5f0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
mov edi, dword [edx + 4]
mov ecx, 0xa
add edi, dword [edx]
mov esi, str.Allow_impersonation_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x2a
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xfffeffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x5c], 0x20000
je 0x42fa6f
mov eax, dword [edx]
add eax, 0x28
cmp dword [esp + 0x28], eax
jae 0x42fa42
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x28]
add edx, 0x28
call fcn.004ff5f0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
mov edi, dword [edx + 4]
mov ecx, 0xa
add edi, dword [edx]
mov esi, str.Allow_LPC_requests_
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x28
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xfffdffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x5c], 0x40000
je 0x42fae3
mov eax, dword ds:[edx]
add eax, 0x14
cmp dword [esp + 0x28], eax
jae 0x42fa9f
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x28]
add edx, 0x14
call fcn.004ff5f0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
mov ecx, dword [edx + 4]
xor esi, esi
add ecx, dword [edx]
mov eax, dword [str.Waitable_]
mov dword [ecx], eax
mov eax, dword [0x5fd340]
mov dword [ecx + 4], eax
mov eax, dword [0x5fd344]
mov dword [ecx + 8], eax
mov eax, dword [0x5fd348]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5fd34c]
mov dword [ecx + 0x10], eax
add dword [edx], 0x14
and edi, 0xfffbffff
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x5c], 0x80000
je 0x42fb3e
mov eax, dword [edx]
add eax, 0x34
cmp dword [esp + 0x28], eax
jae 0x42fb11
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x28]
add edx, 0x34
call fcn.004ff5f0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
mov edi, dword [edx + 4]
mov ecx, 0xd
add edi, dword [edx]
mov esi, str.Allow_object_duplication_
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x34
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xfff7ffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x5c], 0x100000
je 0x42fb9c
mov eax, dword [edx]
add eax, 0x2a
cmp dword [esp + 0x28], eax
jae 0x42fb6d
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x28]
add edx, 0x2a
call fcn.004ff5f0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
mov edi, dword [edx + 4]
mov ecx, 0xa
add edi, dword [edx]
mov esi, str.System_process_only_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x2a
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xffefffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x5c], 0x200000
je 0x42fbfc
mov eax, dword [edx]
add eax, 0x22
cmp dword [esp + 0x28], eax
jae 0x42fbcd
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x28]
add edx, 0x22
call fcn.004ff5f0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
mov edi, dword [edx + 4]
mov ecx, 8
add edi, dword [edx]
mov esi, str.Wake_policy__1__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xffdfffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x5c], 0x400000
je 0x42fc5c
mov eax, dword [edx]
add eax, 0x22
cmp dword [esp + 0x28], eax
jae 0x42fc2d
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x28]
add edx, 0x22
call fcn.004ff5f0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
mov edi, dword [edx + 4]
mov ecx, 8
add edi, dword [edx]
mov esi, str.Wake_policy__2__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xffbfffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x5c], 0x800000
je 0x42fcbc
mov eax, dword [edx]
add eax, 0x22
cmp dword [esp + 0x28], eax
jae 0x42fc8d
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x28]
add edx, 0x22
call fcn.004ff5f0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
mov edi, dword [edx + 4]
mov ecx, 8
add edi, dword [edx]
mov esi, str.Wake_policy__3__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xff7fffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x5c], 0x1000000
je 0x42fd1a
mov eax, dword [edx]
add eax, 0x38
cmp dword [esp + 0x28], eax
jae 0x42fced
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x28]
add edx, 0x38
call fcn.004ff5f0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
mov edi, dword [edx + 4]
mov ecx, 0xe
add edi, dword [edx]
mov esi, str.No_shared_section__direct__
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x38
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xfeffffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x5c], 0x2000000
je 0x42fd78
mov eax, dword [edx]
add eax, 0x3e
cmp dword [esp + 0x28], eax
jae 0x42fd4d
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x28]
add edx, 0x3e
call fcn.004ff5f0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
mov edi, dword [edx + 4]
mov ecx, 0xf
add edi, dword [edx]
mov esi, str.Allow_multi_handle_attributes_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x3e
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xfdffffff
mov word [ecx + eax], si
mov ecx, dword [edx]
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], 0x5cffb8
cmp ecx, 4
jb 0x42fe00
mov eax, dword [edx + 4]
add ecx, 0xfffffffc
add eax, ecx
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x18]
push 0
push eax
lea eax, [esp + 0x40]
push eax
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x42fdfc
mov ecx, dword ds:[esp + 0x30]
mov esi, dword [ecx]
mov eax, esi
mov ecx, dword [ecx + 4]
shr eax, 1
lea edx, [eax*2 - 4]
sub esi, edx
lea eax, [ecx + eax*2]
sub esi, 4
push esi
push eax
lea eax, [ecx + edx]
push eax
call fcn.00580c90
mov edx, dword [esp + 0x3c]
add esp, 0xc
add dword [edx], 0xfffffffc
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], si
jmp 0x42fe00
mov edx, dword [esp + 0x30]
cmp dword [esp + 0x5c], 0
jne 0x42fe57
mov eax, dword [edx]
add eax, 0xa
cmp dword [esp + 0x28], eax
jae 0x42fe29
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x28]
add edx, 0xa
call fcn.004ff5f0
mov edx, dword [esp + 0x2c]
mov ecx, dword [edx + 4]
add ecx, dword [edx]
mov eax, dword [0x5fd4a0]
mov dword [ecx], eax
mov eax, dword [0x5fd4a4]
mov dword [ecx + 4], eax
mov ax, word [0x5fd4a8]
mov word [ecx + 8], ax
add dword [edx], 0xa
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], si
jmp 0x42fe96
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push dword [esp + 0x64]
call fcn.00582a2a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x2c]
push str.___s_
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov edx, dword [esp + 0x38]
add esp, 0xc
test edi, edi
je 0x42fed6
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push edi
call fcn.00582a2a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x2c]
push str.__UNKNOWN:__s_
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov edx, dword [esp + 0x38]
add esp, 0xc
push dword [edx + 4]
push 1
push dword [ebx + 0x78]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea eax, [esp + 0x28]
push eax
call sym.SystemInformer.exe_PhDeleteBytesBuilder
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x68]
call fcn.00582a2a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 1
push dword [ebx + 0x7c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push dword [esp + 0x6c]
call fcn.00582a2a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 1
push dword [ebx + 0x80]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x40]
push eax
mov edx, dword [edx + 8]
call fcn.005241a0
mov edx, dword [ebx + 0xc]
xor ecx, ecx
mov edi, dword [esp + 0x28]
test eax, eax
push ecx
push 0x3c
mov edx, dword [edx + 8]
lea eax, [esp + 0x120]
push eax
cmovs edi, ecx
mov ecx, dword [esp + 0x4c]
push 1
call fcn.005240c0
test eax, eax
js 0x43025b
mov eax, dword ds:[esp + 0x118]
test eax, eax
je 0x43006f
xor edx, edx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0
call fcn.0052c100
mov esi, eax
mov dword [esp + 0x28], esi
test edi, edi
je 0x430057
movzx ecx, word [edi]
mov edx, ecx
test cx, cx
je 0x430057
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xb0], eax
mov eax, edx
mov dword [esp + 0xe0], eax
mov dword [esp + 0xa0], 1
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], 1
mov dword [esp + 0xc8], 6
mov dword [esp + 0xcc], 0x5fd4cc
mov dword [esp + 0xd0], 1
mov eax, dword [edi + 4]
push 0x104
mov dword [esp + 0xe8], eax
lea eax, [esp + 0xa4]
push 3
push eax
call sym.SystemInformer.exe_PhFormat
push dword [esp + 0x28]
mov esi, eax
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esi + 4]
push 1
push dword [ebx + 0xb8]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
mov eax, dword [esp + 0x12c]
test eax, eax
je 0x43014b
xor edx, edx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0
call fcn.0052c100
mov esi, eax
mov dword [esp + 0x28], esi
test edi, edi
je 0x430133
movzx ecx, word [edi + 8]
mov edx, ecx
test cx, cx
je 0x430133
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xb0], eax
mov eax, edx
mov dword [esp + 0xe0], eax
mov dword [esp + 0xa0], 1
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], 1
mov dword [esp + 0xc8], 6
mov dword [esp + 0xcc], 0x5fd4cc
mov dword [esp + 0xd0], 1
mov eax, dword [edi + 0xc]
push 0x104
mov dword [esp + 0xe8], eax
lea eax, [esp + 0xa4]
push 3
push eax
call sym.SystemInformer.exe_PhFormat
push dword [esp + 0x28]
mov esi, eax
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esi + 4]
push 1
push dword [ebx + 0xbc]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
mov eax, dword [esp + 0x140]
test eax, eax
je 0x430225
xor edx, edx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0
call fcn.0052c100
mov esi, eax
mov dword [esp + 0x28], esi
test edi, edi
je 0x43020a
movzx ecx, word [edi + 0x10]
mov edx, ecx
test cx, cx
je 0x43020a
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xb0], eax
mov eax, edx
mov dword [esp + 0xe0], eax
mov dword [esp + 0xa0], 1
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], 1
mov dword [esp + 0xc8], 6
mov dword [esp + 0xcc], 0x5fd4cc
mov dword [esp + 0xd0], 1
mov eax, dword [edi + 0x14]
push 0x104
mov dword [esp + 0xe8], eax
lea eax, [esp + 0xa4]
push 3
push eax
call sym.SystemInformer.exe_PhFormat
push dword [esp + 0x28]
mov esi, eax
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esi + 4]
push 1
push dword [ebx + 0xc0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
test edi, edi
je 0x430238
push edi
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword ds:[esp + 0x40]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push dword [ebx + 8]
lea eax, [esp + 0x44]
mov dword [esp + 0x2c], 0
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43220e
push 0
push 0
push 0x20000
lea eax, [esp + 0x34]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x58]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x40]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x43220e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x43220e
push 0
push 0xc
lea ecx, [esp + 0x50]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x43096b
mov edi, dword [esp + 0x48]
lea eax, [esp + 0x30]
push 0
push 0
mov esi, 0x100
mov dword [esp + 0x40], edi
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], esi
call sym.SystemInformer.exe_PhCreateString3
mov edx, eax
xor eax, eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x1c], edx
mov dword [edx], 0
mov ecx, dword [edx + 4]
mov word [ecx], ax
test dword [esp + 0x48], 0x1000
je 0x430399
mov eax, dword [edx]
add eax, 0x14
cmp eax, esi
jbe 0x430351
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x18]
add edx, 0x14
call fcn.004ff5f0
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x30], edx
mov ecx, dword [edx]
xor edi, edi
add ecx, dword [edx + 4]
mov eax, dword [str.LPC_mode_]
mov dword [ecx], eax
mov eax, dword [0x5fd2d0]
mov dword [ecx + 4], eax
mov eax, dword [0x5fd2d4]
mov dword [ecx + 8], eax
mov eax, dword [0x5fd2d8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5fd2dc]
mov dword [ecx + 0x10], eax
add dword [edx], 0x14
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], di
mov edi, dword [esp + 0x38]
and edi, 0xffffefff
mov dword [esp + 0x38], edi
test dword [esp + 0x48], 0x10000
je 0x4303fc
mov eax, dword [edx]
add eax, 0x2a
cmp esi, eax
jae 0x4303cd
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x18]
add edx, 0x2a
call fcn.004ff5f0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov edi, dword [edx]
mov ecx, 0xa
add edi, dword [edx + 4]
mov esi, str.Allow_impersonation_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x2a
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xfffeffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x48], 0x20000
je 0x43045b
mov eax, dword [edx]
add eax, 0x28
cmp dword [esp + 0x18], eax
jae 0x43042e
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x18]
add edx, 0x28
call fcn.004ff5f0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov edi, dword [edx]
mov ecx, 0xa
add edi, dword [edx + 4]
mov esi, str.Allow_LPC_requests_
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x28
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xfffdffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x48], 0x40000
je 0x4304d1
mov eax, dword [edx]
add eax, 0x14
cmp dword [esp + 0x18], eax
jae 0x43048d
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x18]
add edx, 0x14
call fcn.004ff5f0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov ecx, dword [edx]
xor esi, esi
add ecx, dword [edx + 4]
mov eax, dword [str.Waitable_]
mov dword [ecx], eax
mov eax, dword [0x5fd340]
mov dword [ecx + 4], eax
mov eax, dword [0x5fd344]
mov dword [ecx + 8], eax
mov eax, dword [0x5fd348]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5fd34c]
mov dword [ecx + 0x10], eax
add dword [edx], 0x14
and edi, 0xfffbffff
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x48], 0x80000
je 0x430530
mov eax, dword [edx]
add eax, 0x34
cmp dword [esp + 0x18], eax
jae 0x430503
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x18]
add edx, 0x34
call fcn.004ff5f0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov edi, dword [edx]
mov ecx, 0xd
add edi, dword [edx + 4]
mov esi, str.Allow_object_duplication_
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x34
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xfff7ffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x48], 0x100000
je 0x430591
mov eax, dword [edx]
add eax, 0x2a
cmp dword [esp + 0x18], eax
jae 0x430562
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x18]
add edx, 0x2a
call fcn.004ff5f0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov edi, dword [edx]
mov ecx, 0xa
add edi, dword [edx + 4]
mov esi, str.System_process_only_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x2a
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xffefffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x48], 0x200000
je 0x4305f2
mov eax, dword [edx]
add eax, 0x22
cmp dword [esp + 0x18], eax
jae 0x4305c3
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x18]
add edx, 0x22
call fcn.004ff5f0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov edi, dword [edx]
mov ecx, 8
add edi, dword [edx + 4]
mov esi, str.Wake_policy__1__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xffdfffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword ds:[esp + 0x48], 0x400000
je 0x43065c
mov eax, dword [edx]
add eax, 0x22
cmp dword [esp + 0x18], eax
jae 0x43062d
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x18]
add edx, 0x22
call fcn.004ff5f0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov edi, dword [edx]
mov ecx, 8
add edi, dword [edx + 4]
mov esi, str.Wake_policy__2__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xffbfffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x48], 0x800000
je 0x4306bd
mov eax, dword [edx]
add eax, 0x22
cmp dword [esp + 0x18], eax
jae 0x43068e
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x18]
add edx, 0x22
call fcn.004ff5f0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov edi, dword [edx]
mov ecx, 8
add edi, dword [edx + 4]
mov esi, str.Wake_policy__3__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x22
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xff7fffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x48], 0x1000000
je 0x43071c
mov eax, dword [edx]
add eax, 0x38
cmp dword [esp + 0x18], eax
jae 0x4306ef
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x18]
add edx, 0x38
call fcn.004ff5f0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov edi, dword [edx]
mov ecx, 0xe
add edi, dword [edx + 4]
mov esi, str.No_shared_section__direct__
rep movsd dword es:[edi], dword [esi]
add dword [edx], 0x38
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xfeffffff
mov dword [esp + 0x38], edi
mov word [ecx + eax], si
test dword [esp + 0x48], 0x2000000
je 0x430779
mov eax, dword [edx]
add eax, 0x3e
cmp dword [esp + 0x18], eax
jae 0x43074e
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x18]
add edx, 0x3e
call fcn.004ff5f0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov edi, dword [edx]
mov ecx, 0xf
add edi, dword [edx + 4]
mov esi, str.Allow_multi_handle_attributes_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add dword [edx], 0x3e
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edi, dword [esp + 0x38]
and edi, 0xfdffffff
mov word [ecx + eax], si
mov ecx, dword [edx]
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], 0x5cffb8
cmp ecx, 4
jb 0x43080a
mov eax, dword [edx + 4]
add ecx, 0xfffffffc
add eax, ecx
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], eax
lea eax, [esp + 0x38]
push 0
push eax
lea eax, [esp + 0x28]
push eax
call sym.SystemInformer.exe_PhEqualStringRef
lea esp, [esp]
test al, al
je 0x430806
mov ecx, dword [esp + 0x30]
mov esi, dword [ecx]
mov eax, esi
mov ecx, dword [ecx + 4]
shr eax, 1
lea edx, [eax*2 - 4]
sub esi, edx
lea eax, [ecx + eax*2]
sub esi, 4
push esi
push eax
lea eax, [ecx + edx]
push eax
call fcn.00580c90
mov edx, dword [esp + 0x3c]
add esp, 0xc
add dword [edx], 0xfffffffc
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], si
jmp 0x43080a
mov edx, dword [esp + 0x30]
cmp dword [esp + 0x48], 0
jne 0x43086c
mov eax, dword ds:[edx]
add eax, 0xa
cmp dword [esp + 0x18], eax
jae 0x43083b
lfence
mov edx, dword [edx]
lea ecx, [esp + 0x18]
add edx, 0xa
call fcn.004ff5f0
mov edx, dword [esp + 0x1c]
mov ecx, dword [edx]
add ecx, dword [edx + 4]
mov eax, dword [0x5fd4a0]
mov dword [ecx], eax
mov eax, dword [0x5fd4a4]
mov dword [ecx + 4], eax
mov ax, word [0x5fd4a8]
mov word [ecx + 8], ax
add dword [edx], 0xa
xor esi, esi
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov word [ecx + eax], si
jmp 0x4308ac
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push dword [esp + 0x50]
call fcn.00582a2a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x1c]
push str.___s_
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov edx, dword [esp + 0x28]
add esp, 0xc
test edi, edi
je 0x4308f0
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push edi
call fcn.00582a2a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x1c]
push str.__UNKNOWN:__s_
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
mov edx, dword [esp + 0x28]
add esp, 0xc
push dword [edx + 4]
push 1
push dword [ebx + 0x78]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
lea eax, [esp + 0x18]
push eax
call sym.SystemInformer.exe_PhDeleteBytesBuilder
push 0xa
lea eax, [esp + 0x184]
push eax
push dword [esp + 0x54]
call fcn.00582a2a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 1
push dword [ebx + 0x7c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 0x10
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x780030
push eax
push dword [esp + 0x58]
call fcn.00582a2a
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 1
push dword [ebx + 0x80]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp dword [0x62dbb0], 0x6c
jb 0x431a0b
push 0
push 8
lea eax, [esp + 0x20]
push eax
push 0xc
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtAlpcQueryInformation]
test eax, eax
js 0x431a0b
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
jmp 0x4319ea
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0x1e
push dword [eax + 0x20]
mov dword [esp + 0x30], str.EtwRegistration
call sym.SystemInformer.exe_PhEqualStringRef
mov ecx, dword [ebx + 0xc]
test al, al
je 0x4309ff
mov eax, dword [ecx + 0x24]
test eax, eax
je 0x4309ef
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xd4]
jmp 0x432207
xor eax, eax
push eax
push 1
push dword [ebx + 0xd4]
jmp 0x432207
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 8
push eax
push dword [ecx + 0x20]
mov dword [esp + 0x30], 0x5fb708
call sym.SystemInformer.exe_PhEqualStringRef
mov edi, edi
test al, al
je 0x43151b
cmp dword [0x635f50], 3
jl 0x430fef
push dword [ebx + 8]
lea eax, [esp + 0x18]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x430fef
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x48]
push eax
push ecx
lea eax, [esp + 0x40]
mov byte [esp + 0x1b], 0
mov edx, dword [edx + 8]
push eax
push ecx
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x22], 0
call fcn.005242e0
test eax, eax
js 0x430ad8
mov eax, dword [esp + 0x38]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x430a93.9
movzx eax, byte [eax + 0x432238]
jmp dword [eax*4 + 0x432224]
push str.Pipe
nop
jmp 0x430ac9
push str.Network
jmp 0x430ac9
mov byte [esp + 0x13], 1
push str.File_or_directory
jmp 0x430ac9
mov byte [esp + 0x12], 1
push str.Console
jmp 0x430ac9
push 0x5fd524
push 1
push dword [ebx + 0x84]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 4
lea eax, [esp + 0x34]
push eax
mov eax, dword [ebx + 0xc]
push 0x10
push dword [eax + 8]
push dword [esp + 0x24]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
test eax, eax
js 0x430c05
mov eax, dword [esp + 0x30]
mov edx, eax
mov ecx, eax
and edx, 0xfeffffff
or ecx, 0x1000000
test al, 0x30
push 6
cmovne ecx, edx
push 0x5d2978
push ecx
call sym.SystemInformer.exe_PhGetAccessString
mov ecx, dword [esp + 0x30]
mov esi, eax
push 0
mov dword [esp + 0xa4], 1
mov dword [esp + 0xb4], 4
mov dword [esp + 0xb8], 0x5f5c30
mov dword [esp + 0xbc], 0x108
mov dword [esp + 0xcc], ecx
mov byte [esp + 0xc6], 0x10
mov dword [esp + 0xd4], 1
mov dword [esp + 0xe4], 4
mov dword [esp + 0xe8], 0x5c98ec
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xfc], eax
lea eax, [esp + 0x1ec]
push 0x208
push eax
push 5
lea eax, [esp + 0xb0]
mov dword [esp + 0xf8], 1
push eax
mov dword [esp + 0x110], ecx
mov dword [esp + 0x114], 1
mov dword [esp + 0x124], 2
mov dword [esp + 0x128], 0x5fd530
call sym.SystemInformer.exe_PhFormatToBuffer
lea ecx, [ecx]
test al, al
je 0x430bfb
lea eax, [esp + 0x1e8]
push eax
push 1
push dword [ebx + 0x88]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
cmp byte [esp + 0x12], 0
jne 0x430e05
push 0x18
lea eax, [esp + 0x5c]
push eax
mov eax, dword [ebx + 0xc]
push 5
push dword [eax + 8]
push dword [esp + 0x24]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
test eax, eax
js 0x430cb0
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
push 0
mov dword [esp + 0x12c], eax
lea eax, [esp + 0xa4]
push 0x64
push eax
push 1
lea eax, [esp + 0x128]
mov dword [esp + 0x128], 0xc
push eax
mov dword [esp + 0x140], ecx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x430c87
lea eax, [esp + 0xa0]
push eax
push 1
push dword [ebx + 0x90]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [esp + 0x13], 0
je 0x430cb0
cmp byte [esp + 0x6d], 0
mov ecx, 0x5fb708
mov eax, 0x5fd534
cmove eax, ecx
push eax
push 1
push dword [ebx + 0x84]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 8
lea eax, [esp + 0x1c]
push eax
mov eax, dword [ebx + 0xc]
push 0xe
push dword [eax + 8]
push dword [esp + 0x24]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
test eax, eax
js 0x430e05
mov ecx, dword ds:[esp + 0x18]
mov eax, ecx
mov edx, dword [esp + 0x1c]
or eax, edx
je 0x430e05
mov eax, dword [esp + 0x60]
or eax, dword [esp + 0x64]
push 0
push 0x64
je 0x430db9
fild qword ds:[esp + 0x20]
mov dword [esp + 0xa8], 0x10009
mov eax, 1
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbc], edx
mov dword [esp + 0xc0], 1
mov dword [esp + 0xd0], 4
mov dword [esp + 0xd4], 0x5c98ec
mov dword [esp + 0xd8], 0x4b
fstp qword [esp + 0x28]
fld qword [esp + 0x28]
fild qword [esp + 0x68]
fstp qword [esp + 0x28]
fdiv qword [esp + 0x28]
mov word [esp + 0xdc], ax
mov dword [esp + 0xf0], eax
lea eax, [esp + 0x120]
push eax
push 4
lea eax, [esp + 0xb0]
mov dword [esp + 0x108], 4
push eax
mov dword [esp + 0x110], 0x5fd548
fmul qword [0x61c8e0]
fstp qword [esp + 0xf4]
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x430e05
lea eax, [esp + 0x118]
jmp 0x430df4
lea eax, [esp + 0xa8]
mov dword [esp + 0x120], 0x10009
push eax
push 1
lea eax, [esp + 0x128]
mov dword [esp + 0x138], ecx
push eax
mov dword [esp + 0x140], edx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x430e05
lea eax, [esp + 0xa0]
push eax
push 1
push dword [ebx + 0x8c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 8
lea eax, [esp + 0x9c]
push eax
mov eax, dword [ebx + 0xc]
push 0x2b
push dword [eax + 8]
push dword [esp + 0x24]
call sym.SystemInformer.exe_PhCallKphQueryFileInformationWithTimeout
test eax, eax
js case.default.0x430e40
mov eax, dword [esp + 0x98]
cmp eax, 4
ja case.default.0x430e40
lea ecx, [ecx]
jmp dword [eax*4 + 0x432288]
push str.Very_Low
jmp 0x430e68
push 0x5fd564
jmp 0x430e68
push 0x5cf2e8
jmp 0x430e68
push 0x5cf2f8
jmp 0x430e68
push 0x5fd56c
push 1
push dword [ebx + 0x94]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0x14]
push 0
push 4
mov edx, dword [edx + 8]
push eax
push 8
call fcn.00523b00
test eax, eax
js 0x430fd0
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x28]
call fcn.005151e0
test eax, eax
js 0x430ed3
mov esi, dword [esp + 0x28]
test esi, esi
je 0x430ebb
mov eax, dword [esi + 4]
jmp 0x430ebd
xor eax, eax
push eax
push 1
push dword [ebx + 0x98]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x28]
push eax
push 0
push 0
mov edx, 3
mov dword [esp + 0x34], 0
mov ecx, esi
call fcn.00523ca0
push dword [esp + 0x28]
push 4
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov edx, 3
lea eax, [esp + 0x28]
mov ecx, esi
push eax
push dword [esp + 0x2c]
push edi
call fcn.00523ca0
lfence
test eax, eax
js 0x430fb4
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x430f3a
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x430f55
mov eax, dword [edi + 4]
mov dword [esp + 0x24], eax
mov eax, ecx
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push 0
push eax
call sym.SystemInformer.exe_PhCreateString3
push edi
push 0
push dword [0x633f94]
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
je 0x430f6f
mov eax, dword [esi + 4]
jmp 0x430f71
xor eax, eax
push eax
push 1
push dword [ebx + 0x9c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esp + 0x40]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push edi
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x40]
call dword [sym.imp.ntdll.dll_NtClose]
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
push dword [ebx + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0x34], 0
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43220e
push 0
push 0
push 0x100001
lea eax, [esp + 0x3c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x43109e
push 0
push 0
push 0x100080
lea eax, [esp + 0x3c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x43109e
push 2
push 0
push 0
lea eax, [esp + 0x3c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x28]
push 0
push 0
push 0x100001
mov esi, eax
call fcn.0051a8a0
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x43220e
mov eax, dword [esp + 0x30]
test eax, eax
je 0x43220e
push 4
push 8
lea ecx, [esp + 0xa0]
mov byte [esp + 0x1a], 0
push ecx
lea ecx, [esp + 0x54]
mov byte [esp + 0x1f], 0
push ecx
push eax
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov edi, edi
test eax, eax
js 0x43114c
mov eax, dword [esp + 0x98]
add eax, 0xfffffffe
cmp eax, 0x4e
ja case.0x431102.9
movzx eax, byte [eax + 0x4322b0]
jmp dword [eax*4 + 0x43229c]
push str.Pipe
jmp 0x43113d
push str.Network
jmp 0x43113d
mov byte [esp + 0x12], 1
push str.File_or_directory
jmp 0x43113d
mov byte [esp + 0x13], 1
push str.Console
jmp 0x43113d
push 0x5fd524
push 1
push dword [ebx + 0x84]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov ecx, dword ds:[esp + 0x30]
lea eax, [esp + 0x28]
push 4
push eax
mov edx, 0x10
call fcn.0052e680
test eax, eax
js 0x431277
mov eax, dword [esp + 0x28]
mov edx, eax
mov ecx, eax
and edx, 0xfeffffff
or ecx, 0x1000000
test al, 0x30
push 6
cmovne ecx, edx
push 0x5d2978
push ecx
call sym.SystemInformer.exe_PhGetAccessString
mov ecx, dword [esp + 0x28]
mov esi, eax
push 0
mov dword [esp + 0xa4], 1
mov dword [esp + 0xb4], 4
mov dword [esp + 0xb8], 0x5f5c30
mov dword [esp + 0xbc], 0x108
mov dword [esp + 0xcc], ecx
mov byte [esp + 0xc6], 0x10
mov dword [esp + 0xd4], 1
mov dword [esp + 0xe4], 4
mov dword [esp + 0xe8], 0x5c98ec
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0xfc], eax
lea eax, [esp + 0x1ec]
push 0x208
push eax
push 5
lea eax, [esp + 0xb0]
mov dword [esp + 0xf8], 1
push eax
mov dword [esp + 0x110], ecx
mov dword [esp + 0x114], 1
mov dword [esp + 0x124], 2
mov dword [esp + 0x128], 0x5fd530
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x431271
lea eax, [esp + 0x1e8]
push eax
push 1
push dword [ebx + 0x88]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
cmp byte ds:[esp + 0x13], 0
jne 0x431488
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x58]
push 0x18
push eax
mov edx, 5
call fcn.0052e680
jmp 0x4312a0
test eax, eax
js 0x431332
mov eax, dword ds:[esp + 0x60]
mov ecx, dword [esp + 0x64]
push 0
mov dword [esp + 0x12c], eax
lea eax, [esp + 0xa4]
push 0x64
push eax
push 1
lea eax, [esp + 0x128]
mov dword [esp + 0x128], 0xc
push eax
mov dword [esp + 0x140], ecx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x431305
lea eax, ds:[esp + 0xa0]
push eax
push 1
push dword [ebx + 0x90]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [esp + 0x12], 0
je 0x431332
cmp byte [esp + 0x6d], 0
mov ecx, 0x5fb708
mov eax, 0x5fd534
cmove eax, ecx
push eax
push 1
push dword [ebx + 0x84]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x18]
push 8
push eax
mov edx, 0xe
call fcn.0052e680
test eax, eax
js 0x431488
mov ecx, dword ds:[esp + 0x18]
mov eax, ecx
mov edx, dword [esp + 0x1c]
or eax, edx
je 0x431488
mov eax, dword [esp + 0x60]
or eax, dword [esp + 0x64]
push 0
push 0x64
je 0x431439
fild qword ds:[esp + 0x20]
mov dword [esp + 0xa8], 0x10009
mov eax, 1
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbc], edx
mov dword [esp + 0xc0], 1
mov dword [esp + 0xd0], 4
mov dword [esp + 0xd4], 0x5c98ec
mov dword [esp + 0xd8], 0x4b
fstp qword [esp + 0x28]
fld qword [esp + 0x28]
fild qword [esp + 0x68]
fstp qword [esp + 0x28]
fdiv qword [esp + 0x28]
mov word [esp + 0xdc], ax
mov dword [esp + 0xf0], eax
lea eax, [esp + 0x120]
push eax
push 4
lea eax, [esp + 0xb0]
mov dword [esp + 0x108], 4
push eax
mov dword [esp + 0x110], 0x5fd548
fmul qword [0x61c8e0]
fstp qword [esp + 0xf4]
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x431488
lea eax, [esp + 0x118]
jmp 0x431478
lea eax, [esp + 0xa8]
mov dword [esp + 0x120], 0x10009
push eax
push 1
lea eax, [esp + 0x128]
mov dword [esp + 0x138], ecx
push eax
mov dword [esp + 0x140], edx
call sym.SystemInformer.exe_PhFormatToBuffer
test al, al
je 0x431488
lea eax, [esp + 0xa0]
push eax
push 1
push dword [ebx + 0x8c]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x40]
push 8
push eax
mov edx, 0x2b
call fcn.0052e680
lea ecx, [ecx]
test eax, eax
js case.default.0x4314b5
mov eax, dword [esp + 0x40]
cmp eax, 4
ja case.default.0x4314b5
jmp dword [eax*4 + 0x432300]
push str.Very_Low
jmp 0x4314ea
push 0x5fd564
jmp 0x4314ea
push 0x5cf2e8
jmp 0x4314ea
push 0x5cf2f8
nop
jmp 0x4314ea
push 0x5fd56c
push 1
push dword [ebx + 0x94]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push dword ds:[esp + 0x30]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xe
push dword [eax + 0x20]
mov dword [esp + 0x30], 0x5fc9b4
call sym.SystemInformer.exe_PhEqualStringRef
lea ecx, [ecx]
test al, al
je 0x4318ac
xor edi, edi
cmp dword [0x635f50], 3
mov dword [esp + 0x28], edi
jl 0x43167f
push dword [ebx + 8]
lea eax, [esp + 0x18]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43167f
push 0x100
push 4
push dword [0x633f94]
mov dword [esp + 0x34], edi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov esi, eax
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x48]
push edi
push 0x10
mov edx, dword [edx + 8]
push eax
push 0xe
call fcn.00523b00
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
mov edx, dword [edx + 8]
push 0x100
push esi
push 0xf
call fcn.00523b00
cmp eax, 0x80000005
jne 0x43161d
cmp dword [esp + 0x28], edi
jbe 0x431667
push esi
push edi
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x28]
push esi
push 4
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x28]
push eax
mov edx, dword [edx + 8]
push esi
mov esi, dword [esp + 0x48]
push esi
push 0xf
call fcn.00523b00
lea ecx, [ecx]
test eax, eax
js 0x431667
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x431645
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x431640
jmp 0x431665
mov eax, dword ds:[esi + 4]
mov dword [esp + 0x24], eax
mov eax, ecx
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push 0
push eax
call sym.SystemInformer.exe_PhCreateString3
mov edi, eax
push esi
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x14]
jmp 0x43173a
push dword [ebx + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0x44], edi
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43220e
push 0
push 0
push 5
lea eax, [esp + 0x4c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test esi, esi
jns 0x4316e8
push 0
push 0
push 1
lea eax, [esp + 0x4c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x43220e
mov eax, dword ds:[esp + 0x40]
test eax, eax
je 0x431751
push 0
push 0x10
lea ecx, [esp + 0x50]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQuerySection]
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x28]
mov dword [esp + 0x30], eax
call fcn.0052c060
mov edi, dword [esp + 0x28]
xor ecx, ecx
push dword [esp + 0x40]
test eax, eax
cmovs edi, ecx
lea ebx, [ebx]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [esp + 0x30], 0
jl 0x43220e
mov eax, dword ds:[esp + 0x4c]
mov ecx, 0x5cf2cc
test eax, 0x8000000
je 0x431775
mov esi, 0x5fd580
jmp 0x4317c2
jmp 0x431780
test eax, 0x800000
je 0x431795
mov esi, 0x5fb708
jmp 0x4317c2
jmp 0x4317a0
test eax, 0x1000000
je 0x4317b5
mov esi, 0x5fd590
jmp 0x4317c2
test eax, 0x4000000
mov esi, str.Reserve
cmove esi, ecx
mov al, byte [0x631998]
mov ecx, dword [esp + 0x54]
mov byte [esp + 0x62], al
mov eax, dword [esp + 0x50]
push 0
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x5c]
push 1
push eax
mov dword [esp + 0x64], 0x10c
mov dword [esp + 0x78], ecx
call sym.SystemInformer.exe_PhFormat
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov dword ds:[esp + 0x28], eax
test edi, edi
je 0x431850
push edi
call sym.SystemInformer.exe_PhResolveDevicePrefix
test eax, eax
je 0x43183f
mov ecx, edi
mov edi, eax
test ecx, ecx
je 0x43183f
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x43183f
call fcn.004fbd80
nop
test edi, edi
je 0x431850
mov eax, dword [edi + 4]
jmp 0x431855
mov eax, 0x5fd5ac
push eax
push 1
push dword [ebx + 0xa4]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
push 1
push dword [ebx + 0xa0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov eax, dword ds:[esp + 0x28]
test eax, eax
je 0x431899
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xa8]
jmp 0x432207
mov eax, 0x5cf2cc
push eax
push 1
push dword [ebx + 0xa8]
jmp 0x432207
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xc
push dword [eax + 0x20]
mov dword [esp + 0x30], 0x5fd1d8
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x431a2a
push dword [ebx + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], 0
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43220e
push 0
push 0
push 1
lea eax, [esp + 0x34]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov edi, edi
test esi, esi
js 0x43220e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x43220e
push 0
push 8
lea ecx, [esp + 0x28]
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x4319ba
mov eax, dword [esp + 0x20]
cdq
push 0
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x11c]
push 1
push eax
mov dword [esp + 0x124], 0x10009
mov dword [esp + 0x138], edx
call sym.SystemInformer.exe_PhFormat
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xac]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [esp + 0x25], 0
mov ecx, str.False
mov eax, str.True
cmove eax, ecx
push eax
push 1
push dword [ebx + 0xb0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push 0
push 8
lea eax, [esp + 0x20]
push eax
push 1
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtQueryMutant]
test eax, eax
js 0x431a0b
cmp dword ds:[esp + 0x18], 0
je 0x431a0b
lea eax, [esp + 0x18]
push eax
call sym.SystemInformer.exe__PhGetClientIdName_4
mov esi, eax
push dword [esi + 4]
push 1
push dword [ebx + 0xb4]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xe
push dword [eax + 0x20]
mov dword [esp + 0x30], 0x5fb61c
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x431e01
xor esi, esi
mov edi, 0x103
cmp dword [0x635f50], 3
mov dword [esp + 0x28], esi
jl 0x431bd8
push dword [ebx + 8]
lea eax, [esp + 0x18]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
mov edi, edi
test eax, eax
js 0x431bd8
push 0x100
push 4
push dword [0x633f94]
mov dword [esp + 0x34], esi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x14]
push esi
mov dword [esp + 0x44], eax
lea eax, [esp + 0x11c]
mov edx, dword [edx + 8]
push 0x18
push eax
push 4
call fcn.00523b00
mov edx, dword ds:[ebx + 0xc]
test eax, eax
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x58]
cmovns edi, dword [esp + 0x118]
push esi
mov edx, dword [edx + 8]
push 0x20
push eax
push 9
call fcn.00523b00
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x14]
shr eax, 0x1f
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
mov edx, dword [edx + 8]
push eax
push 0x100
push dword [esp + 0x48]
push 0xb
call fcn.00523b00
cmp eax, 0xc0000023
jne 0x431b6c
jmp 0x431b20
cmp dword [esp + 0x28], esi
jbe 0x431bc5
push dword [esp + 0x40]
push esi
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x28]
push esi
push 4
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push esi
mov edx, dword [edx + 8]
push eax
push 0xb
mov dword [esp + 0x50], eax
call fcn.00523b00
xor esi, esi
test eax, eax
js 0x431bc5
mov edx, dword ds:[esp + 0x40]
movzx eax, word [edx]
mov ecx, eax
test ax, ax
jne 0x431b93
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x431bac
mov eax, dword [edx + 4]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x2c], ecx
call sym.SystemInformer.exe_PhCreateString3
push eax
mov dword [esp + 0x44], eax
call sym.SystemInformer.exe_PhGetFileName
push dword ds:[esp + 0x40]
mov esi, eax
call sym.SystemInformer.exe_PhDereferenceObject
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0x30]
jmp 0x431cad
push dword [ebx + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0x44], esi
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x43220e
push 0
push 0
push 0x1000
lea eax, [esp + 0x4c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
nop
test esi, esi
js 0x43220e
mov eax, dword [esp + 0x40]
test eax, eax
je 0x43220e
lea ecx, [esp + 0x28]
push ecx
push eax
call sym.SystemInformer.exe_PhGetProcessImageFileName
mov esi, dword [esp + 0x28]
test eax, eax
js 0x431c5f
push esi
call sym.SystemInformer.exe_PhGetFileName
push esi
mov dword [esp + 0x2c], eax
call sym.SystemInformer.exe_PhDereferenceObject
mov esi, dword [esp + 0x28]
push 0
push 0x18
lea eax, [esp + 0x120]
push eax
push 0
push dword [esp + 0x50]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push 0
test eax, eax
lea eax, [esp + 0x5c]
push 0x20
cmovns edi, dword [esp + 0x120]
push eax
push 4
push dword [esp + 0x50]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
push dword ds:[esp + 0x40]
mov dword [esp + 0x34], eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0x30]
shr eax, 0x1f
xor al, 1
mov dword [esp + 0x30], eax
test esi, esi
je 0x431cd7
push dword [esi + 4]
push 1
push dword [ebx + 0xc4]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
mov eax, dword [esp + 0x30]
test al, al
je 0x431d54
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x4c]
push eax
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea eax, [esp + 0x48]
push eax
call sym.SystemInformer.exe_PhFormatDateTime
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xc8]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp edi, 0x103
je 0x43220e
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x4c]
push eax
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea eax, [esp + 0x48]
push eax
call sym.SystemInformer.exe_PhFormatDateTime
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xcc]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
jmp 0x431d6c
jmp 0x431d60
cmp edi, 0x103
je 0x43220e
push 0
push edi
call sym.SystemInformer.exe_PhGetStatusMessage
mov esi, eax
test esi, esi
je 0x431d86
mov eax, dword [esi + 4]
jmp 0x431d8b
mov eax, 0x5cf2cc
push eax
push edi
push str.0x_x___s_
call sym.SystemInformer.exe_PhFormatString
mov edi, eax
add esp, 0xc
test edi, edi
je 0x431db0
mov eax, dword [edi + 4]
jmp 0x431db5
mov eax, 0x5cab58
push eax
push 1
push dword [ebx + 0xd0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push edi
call sym.SystemInformer.exe_PhDereferenceObject
test esi, esi
je 0x43220e
lea ecx, ds:[esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x43220e
call fcn.004fbd80
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret
mov eax, dword ds:[ebx + 0xc]
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xc
push dword [eax + 0x20]
mov dword [esp + 0x30], str.Thread
call sym.SystemInformer.exe_PhEqualStringRef
test al, al
je 0x43220e
xor eax, eax
mov byte [esp + 0x12], 0
cmp dword [0x635f50], 3
mov edi, 0x103
mov dword [esp + 0x40], eax
mov dword [esp + 0x28], eax
jl 0x431fe5
push dword ds:[ebx + 8]
lea eax, [esp + 0x18]
push 0x1000
push eax
call sym.SystemInformer.exe_PhOpenProcess
test eax, eax
js 0x431fe5
push 0x100
push 4
push dword [0x633f94]
mov dword [esp + 0x34], 0
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov esi, eax
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
push 0x100
mov edx, dword [edx + 8]
push esi
push 0xc
call fcn.00523b00
cmp eax, 0xc0000023
jne 0x431efe
cmp dword [esp + 0x28], 0
jbe 0x431f42
push esi
push 0
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x28]
push esi
push 4
push dword [0x633f94]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
mov edx, dword [edx + 8]
push esi
mov esi, dword [esp + 0x38]
push esi
push 0xc
call fcn.00523b00
mov edi, edi
test eax, eax
js 0x431f42
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x431f25
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x431f20
jmp 0x431f3e
mov eax, dword [esi + 4]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x2c], ecx
call sym.SystemInformer.exe_PhCreateString3
mov dword [esp + 0x40], eax
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x14]
push 0
push 4
mov edx, dword [edx + 8]
push eax
push 0xd
call fcn.00523b00
lea esp, [esp]
test eax, eax
js 0x431fa2
mov eax, dword [esp + 0x38]
test eax, eax
setne byte [esp + 0x12]
test eax, eax
je 0x431fa2
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x118]
mov ecx, dword [esp + 0x14]
push 0
push 0x1c
mov edx, dword [edx + 8]
push eax
push 5
call fcn.00523b00
test eax, eax
cmovns edi, dword [esp + 0x118]
mov edx, dword [ebx + 0xc]
lea eax, [esp + 0x58]
mov ecx, dword [esp + 0x14]
push 0
push 0x20
mov edx, dword [edx + 8]
push eax
push 0xa
call fcn.00523b00
push esi
push 0
push dword [0x633f94]
mov dword [esp + 0x3c], eax
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword ds:[esp + 0x40]
jmp 0x4320e6
push dword [ebx + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0x44], 0
push 0x40
push eax
call sym.SystemInformer.exe_PhOpenProcess
lea esp, [esp]
test eax, eax
js 0x43220e
push 0
push 0
push 0x800
lea eax, [esp + 0x4c]
push eax
mov eax, dword [ebx + 0xc]
push 0xffffffffffffffff
push dword [eax + 8]
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x43220e
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x43219f
lea edx, [esp + 0x28]
call fcn.0051c800
mov esi, dword [esp + 0x28]
test eax, eax
js 0x432065
push esi
call sym.SystemInformer.exe_PhDereferenceObject
push 0
push 4
lea eax, [esp + 0x30]
push eax
push 0x14
push dword [esp + 0x50]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
lea ebx, [ebx]
test eax, eax
js 0x4320bd
mov eax, dword [esp + 0x28]
test eax, eax
setne byte [esp + 0x12]
test eax, eax
je 0x4320bd
push 0
push 0x1c
lea eax, [esp + 0x120]
push eax
push 0
push dword [esp + 0x50]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
cmovns edi, dword [esp + 0x118]
push 0
push 0x20
lea eax, [esp + 0x60]
push eax
push 1
push dword [esp + 0x50]
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
push dword ds:[esp + 0x40]
mov dword [esp + 0x34], eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x43210b
push dword ds:[esi + 4]
push 1
push dword [ebx + 0xc4]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push esi
call sym.SystemInformer.exe_PhDereferenceObject
cmp byte [esp + 0x12], 0
je 0x432194
push 0
push edi
call sym.SystemInformer.exe_PhGetStatusMessage
mov esi, eax
test esi, esi
je 0x432130
mov eax, dword [esi + 4]
jmp 0x432135
mov eax, 0x5cf2cc
push eax
push edi
push str.0x_x___s_
call sym.SystemInformer.exe_PhFormatString
mov edi, eax
add esp, 0xc
test edi, edi
je 0x43215a
mov eax, dword [edi + 4]
jmp 0x43215f
mov eax, 0x5cab58
push eax
push 1
push dword [ebx + 0xd0]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
push edi
call sym.SystemInformer.exe_PhDereferenceObject
test esi, esi
je 0x432194
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x432194
call fcn.004fbd80
cmp dword [esp + 0x30], 0
jl 0x43220e
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x4c]
push eax
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea eax, [esp + 0x48]
push eax
call sym.SystemInformer.exe_PhFormatDateTime
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xc8]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
cmp byte [esp + 0x12], 0
je 0x43220e
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x4c]
push eax
call sym.SystemInformer.exe_PhLargeIntegerToLocalSystemTime
lea eax, [esp + 0x48]
push eax
call sym.SystemInformer.exe_PhFormatDateTime
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov eax, dword [eax + 4]
push eax
push 1
push dword [ebx + 0xcc]
push dword [ebx]
call sym.SystemInformer.exe_PhSetListViewSubItem
mov ecx, dword [esp + 0x3f4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret